KR20190041784A - System and method for controlling distribution synchronization access based on blockchain in multicloud environment - Google Patents

Abstract

The present invention relates to a system for controlling distribution synchronization access based on block chain in a multi-cloud environment, and a method thereof. According to an embodiment of the present invention, a system for controlling distribution synchronization access based on block chain in a multi-cloud environment comprises: a plurality of cloud servers for synchronizing a block chain distributed book in which data on terminal access rights of a cloud terminal is recorded; and a cloud security managing server for registering and managing server and terminal policy information for the cloud server and the cloud server, generating a block chain-based block for managing authentication and access rights of the cloud terminal by using the server and the terminal policy information, and releasing and distributing the block chain distributed book formed by the block to the cloud server.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention [0001] The present invention relates to a distributed synchronous access control system based on block chaining in a multi-cloud environment,

The present invention relates to a distributed chain synchronous access control system and method for a block chain based on a multi-cloud environment, and more particularly, to a distributed chain synchronous access control system in a multi-cloud environment in which a blockchain technique based on a distributed transaction engine In order to provide reliable cloud connection through distributed synchronization and forgery blocking for authentication and access right management of cloud terminal (or cloud node) in cloud server (or gateway), multi-cloud based distributed Synchronization access control system and method thereof.

With the development of cloud computing technology, various cloud services are emerging. In recent years, multi-cloud environment that uses multiple cloud services together is getting attention instead of using only one cloud service.

A multi-cloud environment is needed for the following reasons.

First, as the penetration rate of high-performance portable computing devices increases, the amount of data to be processed also increases rapidly, making it difficult to cope with the existing single cloud environment.

Second, due to the nature of mobile devices, it is sensitive to performance degradation such as wireless network and battery consumption. Therefore, there is a need for a technique to select a provider having the most optimal cloud resource among various cloud service providers.

However, in a multi-cloud environment, each cloud server owns personal information and authentication information of a user. This allows the user to provide more personal information than is needed for each cloud service.

In this case, it is difficult to manage the personal information distributed in various places, and since there are many cloud servers to which personal information is transmitted, personal information is highly likely to be exposed. Therefore, the confidentiality of user's personal information can not be guaranteed unless the security on the communication line is guaranteed.

In addition, the cloud server is accessed by multiple users. There is a possibility that a malicious attacker tricks his / her identity and accesses the server to tamper or tamper with the user's login information. Accordingly, the integrity of the user login information can not be guaranteed.

In the case of using different cloud services, a separate user authentication process must be performed according to the policy of the corresponding cloud service.

This process is not only troublesome to perform but also there is a possibility of causing a problem of information disclosure due to repeated input of a password.

A multi-cloud environment allows users to access multiple cloud servers. Therefore, the unauthorized user's unauthorized access to the specific cloud server becomes unauthorized access to the other third cloud server. This could lead to malicious users uploading malicious data unauthorized to multiple cloud servers as well as to a single cloud server. There is also the potential for serious security problems, such as breaching the availability of cloud servers

Therefore, as the existing multi-cloud environment changes from a centralized cloud environment to a distributed cloud environment, technologies for authentication and access rights management of cloud terminals are needed.

In addition, the existing multi-cloud environment needs to provide a reliable cloud connection through distributed synchronization and forgery-blocking of the authentication and access right management of the terminal in the existing centralized crawler.

Korean Patent Publication No. 10-2015-0137530

It is an object of the present invention to apply a blockchain technique based on a distributed transaction engine to a multi-cloud environment, thereby enabling authentication and access authority management of a cloud terminal (or a cloud node) In a multi-cloud environment, to provide a reliable cloud connection through distributed synchronization and forgery-and-fade blocking of a block-chain-based distributed synchronization access control system and method.

A block-chain-based distributed synchronization access control system in a multi-cloud environment according to an embodiment of the present invention includes: a plurality of cloud servers for synchronizing distributed servers that are data blocks of terminal access rights of cloud terminals; And registering and managing server and terminal policy information for the cloud server and the cloud terminal, and generating a block-chain-based block for authentication and access authority management of the cloud terminal using the server and terminal policy information And a cloud security management server for disclosing and distributing the block chain distributed book formed by the block to the cloud server.

The plurality of cloud servers may be servers distributed in a multi-cloud environment.

The plurality of cloud servers may be included in a distributed cloud site or a multi-cloud site, and may be grouped when included in the multi-cloud site.

Wherein the plurality of cloud servers register server policy information for authentication and access authority management for the cloud terminal in the cloud security management server, and the server policy information includes a server ID, an IP address, a MAC address , And group information.

The cloud terminal may restrict access to the cloud server according to the group information of the server policy information.

The cloud terminal may receive authentication information from the cloud security management server while registering terminal policy information for authentication and access authority management in the cloud security management server.

Each of the plurality of cloud servers may perform the process of verification and agreement on the block chain distributed server.

The block chain distribution server may include a white list of terminal access rights of the cloud terminal.

The cloud security management server may add, delete and modify blocks in the block chain distributed server.

Also, a block-chain-based distributed synchronization access control method in a multi-cloud environment according to an embodiment of the present invention includes: registering and managing server and terminal policy information for authentication and access authority management for a cloud terminal; Generating a block-chain-based block for authentication and access right management of the cloud terminal using the server and terminal policy information; Disclosing and distributing a block chain distributed book formed by the block to an adjacent cloud server; And synchronizing the block chain distributed book among all the cloud servers through the adjacent cloud servers.

The block chain distribution server may include a white list of terminal access rights of the cloud terminal, in which data on the terminal access authority of the cloud terminal is recorded.

The registration and management step registers server policy information for authentication and access authority management for the cloud terminal, and the server policy information includes a server ID, an IP address, a MAC address, and group information have.

According to an exemplary embodiment of the present invention, after the synchronization step, the cloud terminal may perform authentication and access authority management for the cloud server according to the group information of the server policy information.

According to another aspect of the present invention, there is provided a computer readable storage medium having a program recorded thereon, the program comprising: a function of registering and managing server and terminal policy information for authentication and access authority management for a cloud terminal; Generating a block-chain-based block for managing authentication and access rights of the cloud terminal using the server and terminal policy information; A function of disclosing and distributing a block chain distributed book formed by the block to an adjacent cloud server; And a function of synchronizing the block chain distributed book among all the cloud servers through an adjacent cloud server.

The present invention applies a block chain technology based on a distributed transaction engine to a multi-cloud environment, thereby preventing distributed synchronization and forgery and falsification of authentication and access authority management of a cloud terminal (or a cloud node) from a cloud server (or gateway) To provide a reliable cloud connection.

In addition, since the present invention uses block-chain technology, it is not necessary to possess user's personal information and authentication information for each cloud server in a multi-cloud environment, thereby ensuring confidentiality of user's personal information.

In addition, the present invention can guarantee the integrity of the user login information by preventing the malicious attacker from tricking his / her identity and accessing the server and tampering with / tampering with the user's login information.

In addition, according to the present invention, there is no need to perform a separate user authentication process according to the policy of the cloud service corresponding to each different cloud service. Therefore, it is troublesome to perform the procedure, The risk of exposure to hazards can be reduced.

1 is a block-chain-based distributed synchronization access control system in a multi-cloud environment according to an embodiment of the present invention;
2 is a diagram showing an example of server policy information registered by a cloud server,
FIG. 3 is a diagram illustrating a white list of terminal access rights of a block chain distributed book; FIG.
FIG. 4 is a block chain distributed book, FIG.
5 is a block chain-based distributed synchronization access control method in a multi-cloud environment according to an embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description and the accompanying drawings, detailed description of well-known functions or constructions that may obscure the subject matter of the present invention will be omitted. It should be noted that the same constituent elements are denoted by the same reference numerals as possible throughout the drawings.

The terms and words used in the present specification and claims should not be construed in an ordinary or dictionary sense, and the inventor shall properly define the terms of his invention in the best way possible It should be construed as meaning and concept consistent with the technical idea of the present invention.

Therefore, the embodiments described in the present specification and the configurations shown in the drawings are merely the most preferred embodiments of the present invention, and not all of the technical ideas of the present invention are described. Therefore, It is to be understood that equivalents and modifications are possible.

In the accompanying drawings, some of the elements are exaggerated, omitted or schematically shown, and the size of each element does not entirely reflect the actual size. The invention is not limited by the relative size or spacing depicted in the accompanying drawings.

When an element is referred to as " including " an element throughout the specification, it is to be understood that the element may include other elements as well, without departing from the spirit or scope of the present invention. Also, when a part is referred to as being "connected" to another part, it includes not only "directly connected" but also "electrically connected" with another part in between.

The singular expressions include plural expressions unless the context clearly dictates otherwise. It will be understood that terms such as " comprise " or " comprise ", when used in this specification, specify the presence of stated features, integers, , But do not preclude the presence or addition of one or more other features, elements, components, components, or combinations thereof.

Also, as used herein, the term " part " refers to a hardware component such as software, FPGA or ASIC, and " part " However, " part " is not meant to be limited to software or hardware. &Quot; Part " may be configured to reside on an addressable storage medium and may be configured to play back one or more processors. Thus, by way of example, and not limitation, " part (s) " refers to components such as software components, object oriented software components, class components and task components, and processes, Subroutines, segments of program code, drivers, firmware, microcode, circuitry, data, databases, data structures, tables, arrays and variables. The functions provided in the components and " parts " may be combined into a smaller number of components and " parts " or further separated into additional components and " parts ".

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily carry out the present invention. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In order to clearly illustrate the present invention, parts not related to the description are omitted, and similar parts are denoted by like reference characters throughout the specification.

Hereinafter, preferred embodiments of the present invention will be described with reference to the accompanying drawings.

1 is a block chain-based distributed synchronization access control system in a multi-cloud environment according to an embodiment of the present invention.

1, a block-chain-based distributed synchronous access control system (hereinafter referred to as 'access control system') 100 in a multi-cloud environment according to an embodiment of the present invention includes a distributed transaction engine (Or cloud node) in the cloud server (or gateway) by applying the blockchain technology based on the cloudchain technology based on the cloudchain technology to the cloud (or cloud node) Connection can be provided.

Here, the multi-cloud environment uses a plurality of cloud services together rather than using one cloud service, and may be a private cloud that an enterprise or the like independently constructs for an internal business system.

Such a multi-cloud environment includes a distributed-cloud site for distributing a single cloud service, and a multi-cloud site for grouping a plurality of cloud services.

Referring to FIG. 1, the distributed cloud sites correspond to the cloud sites # 1 to # 3, and the multi-cloud sites correspond to the cloud sites # 4 to # 6. In this case, the cloud site # 1 belongs to 'Group A', the cloud site # 2 belongs to 'Group B', and the cloud site # 3 belongs to 'Group C'. Cloud Sites # 4 to # 6 belong to 'Group D'.

The access control system 100 includes a cloud server 110 and a cloud security management server 120.

The cloud server 110 collectively refers to servers distributed in a multi-cloud environment, and performs cloud connection through authentication and access authority management for the cloud terminal 130 to provide a cloud service.

To this end, the cloud server 110 performs a process of establishing a trust relationship with the cloud security management server 120 in order to manage the authentication and access rights of the cloud terminal 130 in cooperation with the cloud security management server 120.

First, the cloud server 110 registers server policy information for authentication and access authority management for the cloud terminal 130 in the cloud security management server 120 (1 & cir &). Here, the server policy information includes a server ID, an IP address, a MAC address, and group information. In this case, access to the cloud server 110 is limited according to the group information of the cloud server 110. 2 is a diagram showing an example of server policy information registered by a cloud server.

Referring to FIG. 2, if the cloud terminal 130 permits access to the group information 'Group A, D' of the cloud server 110, the cloud terminal 110 can access the cloud servers 110, 0.0 > 110 < / RTI > On the other hand, if access to the group information 'Group B, C' of the cloud server 110 is not allowed, the cloud terminal 130 accesses the cloud server 110 belonging to the cloud sites # 2 and # 3 Is not allowed.

Similarly, the cloud terminal 130 registers terminal policy information for authentication and access authority management in the cloud security management server 120 (1 & cir &). In this case, the cloud terminal 130 receives the authentication information from the cloud security management server 120 while registering the device ID in the cloud security management server 120.

In this way, the cloud security management server 120 registers and manages policy information (i.e., server and terminal policy information) for managing the authentication and access rights of the cloud server 110 and the cloud terminal 130.

The cloud security management server 120 generates a block for managing the authentication and access rights of the cloud terminal 130 using the policy information for the cloud server 110 and the cloud terminal 130. That is, the cloud security management server 120 applies the block chain technology based on the distributed transaction engine to the multi-cloud environment, and stores the block as the database on which the data on the terminal access authority of the cloud server 110 is recorded. .

 These blocks are formed into block chains of sequentially connected chains in accordance with the passage of time, so that the block chain distributed book is opened and distributed to all the cloud servers 110 and managed.

In this manner, the cloud security management server 120 synchronizes the block chain distributed server to the adjacent cloud server 110 (2). At this time, the cloud security management server 120 adds, deletes, and changes blocks to the block chain distribution server.

In addition, all the cloud servers synchronize the same block chain distributed book through the adjacent cloud server 110 (3). At this time, each of the cloud servers performs mutual verification and agreement process on the block chain distributed server. FIG. 3 is a diagram illustrating a white list of terminal access rights of a block chain distributed server.

Referring to FIG. 3, since the first block TR-1 and the fourth block TR-4 have the same International Mobile Equipment Identity (IMEI) '352469076053306', the same cloud terminal 130, .

That is, the cloud security management server 120 creates (CREATED) the first block TR-1 in the cloud terminal 130 having the terminal international unique identification number (IMEI) '352469076053306' -4) is deleted (DELETED).

Similarly, the third block TR-3 and the fifth block TR-5 relate to the same cloud terminal 130 since the same terminal international unique identification number (IMEI) has '543210987654321'.

That is, the cloud security management server 120 creates (CREATED) the third block TR-3 in the cloud terminal 130 having the terminal international unique identification number (IMEI) '543210987654321' TR-5) is changed (CHANGED). As such, the cloud security management server 120 performs updates such as creating, adding, and changing blocks in a block chain distributed server, and all the cloud servers share updated distributed cloud servers.

Meanwhile, the cloud terminal 130 can access the cloud server 110 of the authorized group only when it is authenticated through the authentication process (4).

Referring to FIG. 3, the cloud terminal 130 having the terminal international unique identification number (IMEI) '543210987654321' can access only the cloud sites # 2 and # 3 belonging to the group information 'Group C and B'.

Fig. 4 is a view showing a block chain dispersing unit. Fig.

The block constituting the block chain distribution block includes a block header 10 and a transaction 20.

The block header 10 includes Previousblockhash (11) and Merklehash (12), and information such as version, time, bits, nonce, etc. may be included although not shown in the figure. Previousblockhash (11) represents the block hash of the block immediately preceding the block chain, and Merklehash (12) represents the hash located in the tree root when constructing the transaction hash of the individual transaction information into the binary tree form. The transaction information 20 includes a white list of terminal access rights.

Such a block can be easily understood by a person skilled in the art, so a detailed description will be omitted.

5 is a block chain-based distributed synchronization access control method in a multi-cloud environment according to an embodiment of the present invention.

The access control system 100 registers and manages server and terminal policy information for authentication and access authority management for the cloud terminal 130 (S201). Here, the server policy information includes group information. Accordingly, the cloud terminal 130 is limited in the cloud server 110 that is allowed to access according to the group information.

Then, the access control system 100 generates a block for authentication and access authority management of the cloud terminal 130 using the server and terminal policy information (S202). Here, a block is a book in which data on terminal access rights are recorded, and is formed into a block chain of a chain structure sequentially connected in accordance with a time flow.

Then, the access control system 100 synchronizes the block chain distributed books to all the cloud servers (S203). At this time, each of the cloud servers performs mutual verification and agreement process on the block chain distributed server.

Then, the access control system 100 permits access to the cloud server 110 belonging to the authorized group to the cloud terminal 130 (S204).

The method according to some embodiments may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape, optical media such as CDROMs, DVDs, magneto-optical media such as floptical disks, Magneto-optical media, and hardware devices specifically configured to store and perform program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like.

Although the foregoing is directed to novel features of the present invention that are applicable to various embodiments, those skilled in the art will appreciate that the apparatus and method described above, without departing from the scope of the present invention, It will be understood that various deletions, substitutions, and alterations can be made in form and detail without departing from the spirit and scope of the invention. Accordingly, the scope of the present invention is defined by the appended claims rather than the foregoing description. All variations within the scope of the appended claims are embraced within the scope of the present invention.

100: access control system 110: cloud server
120: Cloud security management server 130: Cloud terminal

Claims (15)

A plurality of cloud servers for synchronizing a distributed book that is a block in which data on terminal access rights of the cloud terminal is recorded; And
The server and the terminal policy information for the cloud server and the cloud terminal are registered and managed and blocks based on the block chain technology are generated for the authentication and access authority management of the cloud terminal using the server and terminal policy information A cloud security management server for disclosing and distributing the block chain distributed book formed by the block to the cloud server;
A block - based distributed synchronous access control system in a multi - cloud environment.
The method according to claim 1,
Wherein the plurality of cloud servers comprises:
Distributed synchronization access control system based on block chain in multi - cloud environment, servers distributed in multi - cloud environment.
The method according to claim 1,
Wherein the plurality of cloud servers comprises:
Included in distributed cloud or multi-cloud sites,
Wherein the grouping is performed in the case of being included in the multi-cloud site.
The method according to claim 1,
Wherein the plurality of cloud servers comprises:
Registering server policy information for authentication and access authority management for the cloud terminal in the cloud security management server,
Wherein the server policy information includes a server ID, an IP address, a MAC address, and group information, in a multi-cloud environment.
5. The method of claim 4,
The cloud terminal includes:
Wherein the access to the cloud server is restricted according to the group information of the server policy information.
The method according to claim 1,
The cloud terminal includes:
A block-chain-based distributed synchronization access control system in a multi-cloud environment in which terminal policy information for authentication and access authority management is registered in the cloud security management server and authentication information is issued from the cloud security management server.
The method according to claim 1,
Wherein each of the plurality of cloud servers comprises:
A distributed chain synchronization access control system based on a block chain in a multi-cloud environment performing verification and agreement processes for the block chain distributed servers.
The method according to claim 1,
The block chain dispersing unit includes:
And a white list of terminal access rights of the cloud terminal is included in the multi-cloud environment.
The method according to claim 1,
The cloud security management server includes:
A block-chain-based distributed synchronous access control system in a multi-cloud environment for adding, deleting, and changing blocks in the block chain distributed server.
Registering and managing server and terminal policy information for authentication and access authority management for a cloud terminal;
Generating a block-chain-based block for authentication and access right management of the cloud terminal using the server and terminal policy information;
Disclosing and distributing a block chain distributed book formed by the block to an adjacent cloud server; And
Synchronizing the block chain distributed book among all the cloud servers through an adjacent cloud server;
A block chain based distributed synchronization access control method in a multi-cloud environment.
11. The method of claim 10,
The block chain dispersing unit includes:
A method of controlling access based on a block chain in a multi-cloud environment, the method comprising the steps of: storing data on terminal access rights of the cloud terminal, wherein the server includes a white list of terminal access rights of the cloud terminal.
11. The method of claim 10,
Wherein the plurality of cloud servers comprises:
Distributed synchronization access control method based on block chain in multi - cloud environment, servers distributed in multi - cloud environment.
11. The method of claim 10,
Wherein the registration and management step comprises:
Registering server policy information for authentication and access authority management for the cloud terminal,
Wherein the server policy information includes a server ID, an IP address, a MAC address, and group information, in a multi-cloud environment.
14. The method of claim 13,
Performing authentication and access right management for the cloud server according to the group information of the server policy information after the synchronization step;
The method comprising the steps of: (a) providing a block-chain-based distributed synchronization access control method in a multi-cloud environment.
A computer-readable storage medium having recorded thereon a program,
A function of registering and managing server and terminal policy information for authentication and access authority management for a cloud terminal;
Generating a block-chain-based block for managing authentication and access rights of the cloud terminal using the server and terminal policy information;
A function of disclosing and distributing a block chain distributed book formed by the block to an adjacent cloud server; And
A function of synchronizing the block chain distributed book among all the cloud servers through an adjacent cloud server;
Readable storage medium having recorded thereon a program.

Images