RU2660604C2 - Agent for safe cloud service provision and device of security markers for safe cloud service - Google Patents

Abstract

FIELD: calculating; counting.

SUBSTANCE: invention relates to the security of cloud services. Agent installed on a user terminal to provide a secure cloud service contains a header generator for generating headers having a random value for encrypting a file uploaded to a cloud server, upon receipt of this file from the user terminal, when the security detecting device detects the device, the session key generator is designed to generate session keys that create a session with a security token device that encrypts the generated header or decrypts the header of the file downloaded from the cloud server, and when the event detection unit determines that the security token is disabled during the specified session, automatic encryption or decryption is cancelled and files are deleted to avoid synchronization with the cloud server.

EFFECT: technical result is to improve the security of cloud services.

6 cl, 11 dwg

Description

BACKGROUND OF THE INVENTION

1. The technical field of the invention

In General, the present invention relates to an agent for providing a secure cloud service and the device security tokens for a secure cloud service. In particular, the present invention relates to a technology for increasing security, according to which user authentication and encryption-decryption of the headers are performed in files in the hardware device security tokens, which can be disconnected from the user terminal, and subsequently the files are stored on a cloud server.

2. Description of the Related Art

Currently, cloud computing environments are widely used for efficient distribution of IT resources and secure data storage. In the 1960s, computer science specialist John McCarthy proposed the concept of cloud computing. Recently, the rapid progress of the communications infrastructure and the growing need for the efficient allocation of computing resources have contributed to the rapid development of cloud computing.

In a cloud computing environment, the capital costs of IT equipment on the client side can be reduced, because users do not need high-tech terminals, and IT resources can be effectively allocated depending on the processing environments of services. However, cloud computing has some security concerns. For example, when a cloud computing server is hacked, data may be stolen or service providers may intentionally disclose sensitive user data.

In addition, since cloud services are used not only in PCs, but also in mobile environments such as smartphones, etc., security problems must be solved in order to protect the cloud server from hacking.

Accordingly, documents, including Korean Patent Application 10-1107056, disclose a method for encrypting a synchronized file before sending it from the client terminal to the cloud server and decrypting the file on the client terminal after receiving it from the cloud server.

In some products using the method described above, encryption is performed by modules of software-implemented algorithms that use encryption keys under the control of the Windows agent application, or files are encrypted in software using encryption keys stored in the hardware device.

In other words, since existing file encryption methods to increase the security of the cloud service perform encryption in the software, and the encryption keys are managed using the Windows program, the keys can be intercepted by control programs controlled by crackers. It follows that security in the prior art is a complex task.

Background Documents

(Patent Document 1) KR10-1107056

SUMMARY OF THE INVENTION

Thus, the present invention was created taking into account the above problems arising in the prior art, and the aim of the present invention is to randomly generate a header, which is a file encryption key, in a security token device connected to the user terminal, and also to encrypt file in the agent, and the security key is protected from transmission, and the amount of transmitted and received data can be reduced, since the device of security tokens encrypts and decrypts only heading.

In addition, in order to increase security, the present invention provides for the encryption and decryption of a cloud file and synchronizes it only when the security token device is connected to a user terminal.

It is also an object of the present invention to generate a session key using a random value obtained from a password key when the security token device is connected to a user terminal in order to improve security.

To achieve the above goal, according to an embodiment of the present invention, an agent installed on a user terminal for providing a secure cloud service may include: a header generator for generating headers having a random value for encrypting the file downloaded to the cloud server upon receipt of this file from the user terminal ; a session key generator for generating session keys that create a session with a security token device when it detects a security token device disconnected from the user terminal, the security token device encrypts the generated header or decrypts the header of the file downloaded from the cloud server; and a decryptor-decryptor for encrypting the file downloaded to the cloud server using the encrypted header when it is encrypted by the security token device, and to decrypt the file downloaded from the cloud server using the decrypted header when it is decrypted by the security token device.

The header generator can encrypt the generated header with a session key and transmit the encrypted header to the security token device.

The session key generator can receive a password and request a public key from the security token device when it detects it; generate authenticator data, including a random value for authentication, encrypt the data with the public key and transfer it to the device security tokens; and also generate a session key using a random value for authentication and response when receiving security tokens from the device response data, including a random value for it.

To achieve the above goal, the security token device for a secure cloud service according to an embodiment of the present invention may include: an interface unit disconnected from the user terminal to provide an interface with an agent installed on the user terminal; a storage device for storing the encrypted header, which is an encryption key generated with a random value for encrypting and decrypting the file uploaded to the cloud server; the encryption-decryption conversion support controller that encrypts the header of the file uploaded to the cloud server, upon receipt of this header, saves the encrypted header on the storage device and transfers it to the agent; and saves the encrypted header of the file downloaded from the cloud server to the storage device, upon receipt of this header decrypts it and transfers it to the agent.

In addition, the security token device may further include a secure authentication chip that transmits a public key upon agent request and receives authenticator data, including a random value for authentication; generates response data including a random value for the response, and transmits response data to the agent; and generates a session with the agent upon receipt of a session key from it, with the last agent generating it using a random value for authentication and a random value for the response.

The secure authentication chip can encrypt an encrypted or decrypted header using a session key and send it to the agent.

According to the present invention, confidential data for individuals and companies cannot be opened when a cloud server is hacked and, since the file header (and the encryption key with a random value) is encrypted and decrypted in the token key device, encryption key leaks can be avoided even if the PC is hacked. Therefore, security can be significantly improved.

Also, the session key is generated using a random value obtained from the password key when the security token device is connected to the user terminal, and the encrypted or decrypted header is transmitted after encryption by the session key, and thereby security can be improved.

BRIEF DESCRIPTION OF THE DRAWINGS

The above and other objectives, features and advantages of the present invention will be better understood on the basis of the following detailed description together with the accompanying drawings, in which:

FIG. 1 is a system configuration diagram for providing a secure cloud service according to the present invention;

FIG. 2 is a block diagram showing a detailed configuration of a user terminal agent in FIG. one;

FIG. 3 is a diagram for generating authenticator data by a session key generator in FIG. 2;

FIG. 4 is a block diagram showing a detailed configuration of a device of security tokens in FIG. one;

FIG. 5 is a diagram explaining the generation of response data by a secure authentication chip in FIG. four;

FIG. 6 is a flowchart showing a preliminary process for using a security token device in a PC environment;

FIG. 7 is a flowchart showing a process in which a file is encrypted using a security token device and then transmitted to a cloud server;

FIG. 8 is a flowchart showing a process in which a file is decrypted using a cloud service in a mobile environment;

FIG. 9 is a flowchart showing a user authentication process when connecting a security token device to a user terminal;

in FIG. 10 shows a process for encrypting a file header in a security token device when downloading a file;

in FIG. 11 shows the process of decrypting a file header in a security token device when downloading a file.

DESCRIPTION OF THE PREFERRED EMBODIMENTS OF THE INVENTION

The present invention will be described in detail based on its aspects (or variations). However, the invention can be implemented in many different forms and should not be construed as limited only by the options set forth herein, but should include modifications, analogs, or alternatives that fall within the scope and technical scope of the present invention.

Reference should be made to the drawings, where the same reference numbers are used in different drawings to refer to the same or similar components. In this description, information about well-known features and methods can be omitted to avoid unnecessarily confusing the presented options.

It is understood that although the terms are first, second, etc. can be used in this document to describe different elements, these elements should not be limited to these terms. They are used only to distinguish one element from another. For example, the first element may be called the second, and, likewise, the second element may be called the first without departing from the scope of the present invention.

In this context, the term “and / or” includes all, without exception, combinations of one or more of the related and listed elements.

It should be understood that if an element is called “connected” or “connected” to another element, it can be directly connected or connected to another element, or intermediate elements may be present. Conversely, if an element is called “directly connected” or “directly connected” to another element, there are no intermediate elements.

The terminology used in this document is intended only to describe certain embodiments of the invention and should not limit it. In this context, the singular also includes the plural, unless otherwise expressly stated by the context. It should also be understood that the terms “consisting”, “consisting”, “includes” and / or “including” in this context assume the presence of the indicated features, numbers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or several other features, numbers, steps, operations, elements, components and / or groups thereof.

Unless otherwise indicated, all terms (including technical and scientific) used in this document have a meaning mainly understood by a person skilled in the art to which the present invention relates. It is also understood that the terms defined in generally accepted dictionaries should be interpreted as having meanings matching their meanings in the context of the relevant technical field, and will not be interpreted in an idealized or too formal sense, unless expressly stated otherwise.

In FIG. 1 is a system configuration diagram for providing a secure cloud service according to the present invention; in FIG. 2 is a block diagram of a detailed configuration of a FIG agent. one; in FIG. 4 shows a block diagram of a detailed configuration of a device of security tokens in FIG. one.

As shown in FIG. 1, a system for providing a secure, cloud service according to the present invention includes a user terminal 1, a security token device 2, and a cloud server 3. A user terminal 1 is a device in which user files are stored. It includes various types of terminals capable of storing and displaying files, and has access to the Internet, such as PCs, laptops, tablets, smartphones, etc. In FIG. 1, 1A is a PC, 1B is a tablet, 1C is a smartphone.

In addition, the cloud server 3 is a device for providing a cloud service and publishing user files that stores user content in the form of documents, contacts and media files, such as movies, photos and music. When a user terminal, including a PC, a smartphone, and smart TV, requests content, the user terminal can download content stored on the server. In Korea, cloud services are provided by Naver NDrive, KT ucloud, Daum Cloud, etc., and there are also global cloud services such as Dropbox, Box, Sugarsync, Google drive, Sky Drive, etc.

As shown in FIG. 2, agent 100 is installed on user terminal 1 to provide a secure cloud service according to the present invention. Agent 100 may include an event detection unit 110, a session key generator 120, a header generator 120, and a file decryptor 140.

The event detection unit 110 may detect the occurrence of a file event. In this case, the event indicates the creation, copying, deletion and other operations with downloaded or published files.

Creating, copying and other operations with published files that require the encryption process may be the first event. Conversely, the creation, deletion and other operations with downloadable files that require a decryption process may be the second event.

Upon detection of the first event, including downloading to the server and copying the file, the header generator 130 may generate a header with a random value and transmit it to the device security tokens 2. In this case, the header is the key for encrypting or decrypting the file and can be generated with a random value with interval of the first event.

In addition, when a second event is detected, including downloading and deleting a file, the header generator 130 may transfer the header of the file downloaded from the cloud server 3 to the device of security tokens 2.

When a user uploads a file to or copies to a cloud server 3, the event detection unit 110 determines if the security token device 2 is connected. To increase security, the event detection unit 110 initiates encryption of the header of the file uploaded to the server on the security token device 2 only when it is connected.

In addition, when a user downloads an encrypted file from the cloud server and saves or deletes it, the event detection unit 110 determines whether the security token device 2 is connected and can initiate decryption of the encrypted file header on the security token device 2 when it is connected.

Upon detecting the connection of the security token device 2, the session key generator 120 may create a session to logically connect to the physically connected security token device 2 by user authentication.

When the security token device 2 is connected to the user terminal 1, the session key generator 120 creates a session key by transmitting the authenticator value to the security token device 2 and receiving a response value to the authenticator value from the security token device 2. Then, the session key generator 120 can create a session with the device security tokens 2 by passing the generated session key to it. Thus, the authenticator value is obtained by encrypting with the public key, a random authentication value obtained from the password.

In particular, upon detecting a physical connection with the security token device 2, session key generator 120 may receive a password from the user. Also, session key generator 120 may request a public key and receive it from security token device 2 when a password is entered. The generation of the authenticator value is described with reference to FIG. 3.

In FIG. 3 shows a diagram of generating authenticator data by a session key generator in FIG. 2.

Session key generator 120 may generate a random authentication value obtained from the password. A random authentication value can be generated using the Advanced Encryption Standard (AES) algorithm and encrypted in Digital Block Chain (CBC) mode.

A random authentication value (key) can be generated as a 16-byte key in SHS mode according to the following equation:

A random authentication value is obtained in the following process. First, the initialization vector (IV) is processed by the XOR by the first block of plaintext password and is encrypted. Then the next block of clear text (SNO) is processed by XOR by the previous encrypted block (SNO-1) and encrypted. The last block may be a filled block.

When a 16-byte random authentication value is generated from the password, session key generator 120 splits it into two blocks: the first 8-byte block (first random value) and the second 8-byte block (second random value), and then inserts the password string 210 at the beginning of each block to create the first and second block of authenticator data.

For example, when the password is “SZTGBPWD” and the random authentication value obtained by the above equation is 0 × 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F, the first block becomes “SZ T G B P WD 00 01 02 03 04 05 06 07 ”, and the second -“ SZ T G B P WD 08 09 0A 0B 0C 0D 0E 0F ”. That is, the first and second blocks can be encrypted using a cryptographic standard with a common key, PKCS # 5.

As shown in FIG. 3, authenticator data can be 256 bytes and consist of several blocks with a 16-byte column.

The first block may consist of 8 bytes of the password string 210 and 8 bytes of the first random value 220 obtained from the password.

The second block may consist of 8 bytes of the password string 210 and 8 bytes of the second random value 230 obtained from the password.

Also, the third block may contain 4 bytes of the verification value 240, which indicates the result of the verification of the public key received from the device of security tokens 2, and the remaining 12 bytes of the third block can be filled. In other words, 220 bytes of authenticator data can be filled with placeholder 250.

Session key generator 120 may perform RSA encryption of 256 bytes of authenticator data in FIG. 3 using the public key received from the device security tokens 2, and then can transfer them to it. In addition, in response to the encrypted authenticator data, the session key generator 120 receives response data, which is encrypted with a password from the security token device 2, and generates a session key. Then, the session key generator 120 can create a session by transferring the generated session key to the device security tokens 2.

The header generator 130 creates a header for the file in which the first event is detected, encrypts the generated header with the session key created by the session key generator 120, and can transfer it to the security token device 2.

The header for the published file is encrypted in the device of security tokens 2 and can be transferred to the file decryptor-decoder 140. Also, the header for the downloaded file is decrypted in the device of the security tokens 2 and can be transferred to the file-decoder 140.

The file decryptor 140 encrypts the file in which the first event is detected using the header encrypted in the security token device 2 and can upload the encrypted file to the cloud server 3.

In addition, the file decryptor 140 decrypts the file in which the second event is detected using the header encrypted by the security token device 2 so that the file can be launched on the user terminal 1.

The device security tokens 2 is disconnected from the user terminal 1 and works when it is connected to it. The security token device 2 receives a file header in which the event detection unit 110 detects the occurrence of any event from the header generator 130; encrypts or decrypts the header; and transfers it to the file decryptor 140.

In particular, the device of security tokens 2 encrypts the header received from the header generator 130, and transfers it to the file decryptor 140 in the process of downloading the file to the server. Conversely, during file download, the security token device 2 decrypts the header of the encrypted file, which is downloaded from the cloud server 3 upon receipt of the header from the header generator 130, and transfers the decrypted header to the file decryptor 140. Also, in the case of an event such as copying, deleting and other file operations, the device security tokens 2 can carry out the encryption-decryption process.

On the other hand, a detailed configuration of the device security tokens 2 is presented in FIG. 4. As shown in FIG. 4, the security token device 2 includes interface units 10A and 10B, an encryption-decryption conversion support controller 20, a storage device 30, and a secure authentication chip 40.

The interface units 10A and 10B are connectors that are electrically connected to the user terminal 1. As an example, a USB connector 10A and a micro USB connector 10B are shown, but various types of interface devices may be used.

The encryption-decryption conversion support controller 20 performs encryption or decryption of the header of the file in which the event occurs, using the encryption key and the encryption unit that are stored on the controller, and performs a control operation to back up data when the security token device 2 of the present invention is used as a backup memory.

When encryption or decryption is performed, the amount of data transmitted or received can be reduced, and the processing speed can be increased by encrypting or decrypting only the file header.

Also, the encryption-decryption conversion support controller 20 authenticates the user through the secure authentication chip 40 when the security token device 2 is connected to the user terminal 1, and only encrypts or decrypts when the user authentication is successful. User authentication is performed by generating a session key using the authenticator value obtained by encrypting a random value from the password that the user entered and using the response value to the authenticator value.

The storage device 30 stores an encrypted header. In addition, the memory section of the storage device 30 can be divided so that certain parts of this section are used for shared memory, and the rest for storing the encrypted header. The storage device 30 includes flash memory, such as a commonly used USB memory stick or other storage media.

The secure authentication chip 40 is a chip for providing a security function by performing user authentication when the security token device 2 is connected to the user terminal 1, and can store at least one password as a user authentication means, fingerprint information of the user, and an OTP (one-time password) generation module ) to create an OTP value.

Password information is a personal identification number that is defined by the user, and differs from the encryption key. In addition, when fingerprint information is used to authenticate the user, the fingerprint reader must be installed in the security token device or be an external device.

The OTP generation module uses a step or time and a random value as input values of the encryption algorithm to create an OTP value and passes it to the server for user authentication. Through such a complex authentication process, you can increase the security of the device security tokens. On the other hand, a complex authentication process can improve the security of the device of security tokens, but when the user loses it, he cannot open the encrypted file uploaded to the cloud server 3. This problem affects some users and employees, therefore, such complex products with the same encryption key can be sold to companies and groups that would like to use two or more security token devices to avoid losses.

At the same time, in order to manage the history of a file that is changed by several people, you can install an additional server service. That is, in complex devices of security tokens for several employees the same encryption key is used, but an identification number is assigned to each device of security tokens to distinguish them, so the history of a file that is changed by several people can be controlled, for example, by the one who last changed the file, when copying a file, etc.

On the other hand, in the process of user authentication, the secure authentication chip 40 generates response data to the authenticator data received from the session key generator 120 of the agent 100, and transmits them to the agent 100. Then, the secure authentication chip 40 can create a session with the agent 100, having received the session key generated by agent 100 using response data. The generation of response data is specifically described with reference to FIG. 5.

In FIG. 5 is a diagram for explaining the generation of response data of the secure authentication chip 40 in FIG. four.

When receiving authenticator data from the session key generator 120, the secure authentication chip 40 decrypts the authenticator data with a password and can confirm that it matches.

If the passwords match, the secure authentication chip 40 may generate a random password response value. A random response value can be generated by the same algorithm that is used to create a random authentication value. In other words, it can be generated using the algorithm of the advanced encryption standard and encrypted in the mode of a chain of digital blocks (SHS).

In this case, a random response value (key 1) can be generated as a 16-byte key in SHS mode according to the following equation:

A random response value can be obtained in the following process. First, the initialization vector (IV) is processed by the XOR by the first block of plaintext password and encrypted. Then the next block of clear text (SNO) is processed by XOR by the previous encrypted block (SNO-1) and encrypted.

When a 16-byte random value is obtained from the password, the secure authentication chip 40 splits it into two blocks: the first 8-byte block 320 (third random value) and the second 8-byte block 330 (fourth random value), and then inserts the line password 310 at the beginning of each block to create the first and second block of response data 300.

As shown in FIG. 5, the response data may be 32 bytes and consist of the first and second blocks, each of which has a 16-byte column.

The first block may consist of 8 bytes of the password string 310 and 8 bytes of the third random value 320, which is obtained from the password.

The second block may consist of 8 bytes of the password string 310 and 8 bytes of the fourth random value 330, which is obtained from the password.

The secure authentication chip 40 may encrypt 32 bytes of response data in FIG. 5 using a password and transfer them to the session key generator 120.

The secure authentication chip 40 may create a session upon receipt of the session key from the session key generator 120.

The session key can be created by the session key generator 120 using a random authentication value generated by it, as well as using a random response value that is included in the response data received by the session key generator 120 from the security token device 2.

In FIG. 6 is a flowchart showing a preliminary process for using a security token device in a PC environment.

When the security token device 2 is connected to the user PC in step S100, the agent 100 downloaded to the user PC starts at this step. Agent 100 is a program for providing a secure cloud service associated with the device of security tokens 2 and performs processes such as: sending the header of the target file created by the header generator 130 to the device of security tokens 2 for hardware encryption of the header when the target encrypted file is detected in Cloud sync time decryption of the header of the file that is downloaded from the cloud server 3, through the device security tokens 2; and performing automatic encryption and decryption operations depending on whether the security token device 2 is connected.

When the agent 100 is started, the user is redirected to the main page of the manufacturer of the security token device 2, he is invited to register on the main page and subscribe at step S120. Then, in step S130, user authentication is performed. As described above, user authentication is carried out using various means, such as password, fingerprint information, OTP, etc. In addition, security can be further improved by creating a session key using a random password-based value.

Then, the agent 100 prompts the user to specify or create a local synchronization folder in step S140, i.e. the folder that will be synchronized with cloud server 3. The local synchronization folder can be transferred to cloud server 3 after all files stored in it are encrypted using the encrypted header sent from the security tokens device 2.

Alternatively, the local synchronization folder can be divided into a shared synchronization folder, from which files are transferred to the cloud server 3 without encryption, and a safe synchronization folder, from which files are downloaded to the cloud server 3 after encryption using the header. In this case, the agent can create the safe synchronization folder as a subfolder in the local synchronization folder, and the operation for the secure cloud service can be performed only for files stored in the safe synchronization folder in step S150.

FIG. 7 is a flowchart showing a process in which a file is encrypted using a security token device, and then transmitted to a cloud server.

Agent 100, loaded on the user's PC, monitors the connection of the security token device 2 to this PC in step S201 and can generate a session key by authenticating the user in step S202 when a connection is detected. A detailed description of user authentication is provided in FIG. 9.

Agent 100 determines a first event, such as the creation or copying of a file uploaded to the cloud server 3, in step S203, and may generate a header for the corresponding file in step S204 upon detection of the first event. Here, the header is the encryption key for encrypting the file in which the first event is detected, and it can be generated by a random value.

Next, the generated header is encrypted using the session key generated in step S202, and transmitted to the security token device in step S205. Upon completion of encryption of the sent header by the security token 2 device and sending to the agent 100 in step S206, using the encrypted header, the agent 100 may encrypt the file in which the first event is detected in step S207.

When encrypting the published file, the agent 100 saves the encrypted file in a corresponding folder in step S208. The encrypted file is stored in the local synchronization folder or the secure synchronization folder, which is a subfolder of the local synchronization folder depending on the amount of encryption, and the file stored in the corresponding folder is transferred to the cloud server 3 by starting the cloud application.

If during automatic encryption in step S209, deletion or, in other words, disconnection of the device of security tokens 2 is detected, the agent 100 cancels the automatic encryption in step S210 and deletes the files in the corresponding folders to avoid synchronization with the cloud server 3.

FIG. 8 is a flowchart showing a process in which a file is decrypted using a cloud service in a mobile environment.

First, the cloud application for providing the cloud service is launched in step S301, and when the encrypted file is downloaded from the cloud server 3 to the mobile terminal, the occurrence of the second event is determined in step S302.

Upon receipt of the encrypted file, agent 100 for a secure cloud service starts up and monitors if the security token device 2 is connected.

When the security token device 2 is connected to the mobile terminal in step S303, a session key is generated by user authentication and a session with agent 100 is created in step S304. After user authentication is completed, the agent encrypts the header of the encrypted file using the session key generated in step s304 and can transmit it to the security token device 2 in step S305.

When the header is decrypted by the security token device 2 in step S306 and transmitted to the terminal, using the decrypted header, the agent 100 can decrypt the file in step S307.

The user terminal 1 can display the decrypted file on the screen, launching it.

If when downloading the file in step S308, deletion or, in other words, disconnection of the device of security tokens 2 is detected, the agent 100 cancels the automatic decryption and deletes the decrypted cache files in the corresponding folder to prevent them from starting in step S309.

FIG. 9 is a flowchart showing a process in which a security token device is connected to a user terminal. Regarding decryption by FIG. 9 cm. FIG. 2-5.

When the terminal 1, on which the agent 100 is installed, detects the physical connection of the security token device 2, the agent 100 can receive a password from the user in step S410.

When a password is entered by the user, the agent 100 may request a public key from the security token device 2 in step S420. In response to the public key request, the security token device 2 transmits it in step S430 and the agent 100 can receive and store it in step S440.

Next, the session key generator 120 of the agent 100 may generate a random authentication value based on the entered password in step S450. At this point, a random authentication value can be generated using the Advanced Encryption Standard (AES) algorithm and encrypted in Digital Block Chain (CBC) mode.

The random authentication value is 16 bytes and can be used to generate authenticator data by breaking into the first 8 bytes as the first random value and the other 8 bytes as the second.

Then, the session key generator 120 of the agent 100 generates authenticator data using the generated random authentication value, encrypts it using the public key received from the security token device 2 in step S460, and transfers it to the security token device 2.

Authentication data is 256-byte and may consist of a password, a random authentication value, a public key verification value, padding, etc. The generation of a random authentication value and authenticator data is described above in FIG. 3, therefore, in the rest of this document, a description of this will be omitted.

The security token device 2 can confirm the password by decrypting the encrypted authenticator data received from the agent 100 with the password in step S470.

Next, the security token device 2 may generate a random response value obtained from the password in step S480. A random response value can be generated using the Advanced Encryption Standard (AES) algorithm and encrypted in a Digital Block Chain (SHS) mode.

In this case, the random response value is 16 bytes and can be used to generate response data by dividing it into the first 8 bytes (third random value) and the other 8 bytes (fourth random value).

Then, the security token device 2 generates response data using a random response value generated in step S490, encrypts it with a password in step S500, and can transmit it to agent 100.

Next, in step S510, the agent 100 generates a session key using the random authentication value generated in step S450, and using the random response value included in the response data received from the security token device 2, and can transmit the generated session key to the security token device 2 .

Then, upon receipt of the session key, the security token device 2 creates a session logically connected to the agent 100 for the login procedure in step S520.

In FIG. 10 shows the process of encrypting the file header in the device of security tokens when uploading the file to the server, and to FIG. 11 is a process of decrypting a file header in a security token device when downloading a file from a server. In FIG. 10 and 11 illustrate an example in which the user terminal 1 is connected to the USB connector 10A.

First, according to FIG. 10, when a file is downloaded, the data stream from agent 100 to the security token device 2 is indicated by a dashed arrow, and data flow in the opposite direction is indicated by a dotted arrow.

When you enter a header to encrypt the published file from agent 100 in step S1, the encryption-decryption conversion support controller 20 encrypts the received header of the source file in step S2, stores it on the storage device 30 in step S3, and sends the encrypted header from the storage device 30 to agent 100 on step S4.

Agent 100 receives the encrypted header, encrypts the original published file, and can upload this file to the cloud server 3.

Subsequently, according to FIG. 11, when downloading a file, the data stream from agent 100 to the device of security tokens 2 is indicated by a dashed arrow, and the data stream in the opposite direction is indicated by a dotted arrow. When you enter the header of the file downloaded from the cloud server 3 from the agent 100 in step S11, the encryption-decryption conversion support controller 20 passes through the encrypted header and stores it on the storage device 30 in step S12, decrypts it in step S13, and sends the decrypted header to the agent 100 in step S14.

Agent 100 receives the decrypted header and decrypts the encrypted file downloaded from the cloud server to run on user terminal 1. On the other hand, in addition to creating the file by publishing or downloading it, depending on the data stream described in FIG. 10 and 11, encryption-decryption can occur when events such as copying, deleting a file, etc.

Although preferred embodiments of the present invention have been disclosed for illustrative purposes, those skilled in the art will appreciate various possible changes, additions, and substitutions without departing from the scope and spirit of the present invention, as described in the appended claims.

Claims (14)

1. An agent installed on a user terminal to provide a secure cloud service, including: a header generator for generating headers having a random value for encrypting a file uploaded to the cloud server upon receipt of this file from a user terminal; when a security token device event detection unit detects a session key generator, it is used to generate session keys that create a session with a security token device that encrypts the generated header or decrypts the file header downloaded from the cloud server, and when the event detection unit determines that the security token device is disabled during the specified session, then cancel automatic encryption or decryption and delete files to avoid syn synchronization with a cloud server, a decryptor-decryptor is designed to encrypt a file downloaded to a cloud server using an encrypted header when it is encrypted by a security token device, and to decrypt a file downloaded from a cloud server using an encrypted header when it is decrypted by a security token device; and a decryptor-decryptor for encrypting a file downloaded to a cloud server using an encrypted header when it is encrypted by a security token device, and decrypting a file downloaded from a cloud server using an encrypted header when it is decrypted by a security token device. 2. The agent according to claim 1, characterized in that the generator encrypts the header using a session key and transfers the encrypted header to the security token device. 3. The agent according to claim 1, characterized in that the session key generator receives a password and requests a public key from the security token device when it detects its connection; generates authenticator data, including a random authentication value, encrypts the data with the public key and transfers it to the device security tokens; and generates a session key using a random authentication value and a response when receiving security tokens from the device response data including a random response value. 4. The device security tokens for a secure cloud service, including: an event detection unit, designed to determine whether the security token device is connected to the user terminal when encrypting or decrypting the header of a file uploaded to the cloud server or downloaded from the cloud server, and when it detects that the security token device is disabled, cancel automatic encryption or decryption and delete files to avoid synchronization with the cloud server; an interface unit disconnected from the user terminal to provide an interface with an agent installed on the user terminal; a storage device for storing the encrypted header, which is an encryption key generated with a random value for encrypting and decrypting the file uploaded to the cloud server; and the encryption-decryption conversion support controller that encrypts the header of the file uploaded to the cloud server, upon receipt of this header, saves the encrypted header on the storage device and transfers it to the agent; and saves the encrypted header of the file downloaded from the cloud server to the storage device upon receipt of this header, decrypts it and transfers it to the agent. 5. The device security tokens according to claim 4, further comprising: a secure authentication chip that transmits the public key at the request of the agent and receives authenticator data, including a random authentication value; generates response data including a random response value, and transmits response data to the agent; and generates a session with the agent upon receipt of a session key from it, with the generation of the latter by the agent using a random authentication value and using a random response value. 6. The device of security tokens according to claim 5, characterized in that, using the session key, the secure authentication chip encrypts the encrypted or decrypted header and sends it to the agent.

Images