TWI474189B - Automatic file encryption and decryption system - Google Patents

Description

Cloud file automatic encryption and decryption system

The invention relates to a cloud file automatic encryption and decryption system, in particular to a data access encryption and decryption system applied to a cloud platform virtualization host service. The information security module is directly added to the cloud service platform system, and the method of intercepting system instructions is used to verify the operation behavior of the virtualization host and to encrypt and decrypt the access data. Another key management server is used to protect key storage security.

The continuous improvement of the information industry, network infrastructure and network technology has contributed to the advent of the era of cloud services, making cloud services the hottest topic in recent times. The cloud service uses the network to communicate with multiple hosts for computing work, or allows users to use a variety of connection devices, such as personal computers, notebook computers, and smart phones, to connect via the Internet. Access and use the integrated information services and resources provided by cloud service providers.

The cloud service uses a large number of virtualization technologies and architectures. The information security management problem is different from the traditional information security field. The host device and data of the cloud virtualization host service are built and stored in the service provider's computer room. , not in the user-controllable range, this feature allows large enterprises to have great doubts when using cloud services. In order to enhance the trust of users, in addition to the development of cloud service information security management, it is necessary to provide data storage. Security protection is provided to enhance user acceptance of virtualization hosting services.

In practice, the protection against data storage security can be achieved by means of data encryption. The protection can be divided into two types according to the protection aspect. One is built on the user's virtual host. This method requires additional installation. And the data encryption may need to change the user's habits, resulting in low user acceptance; another way is to build on the cloud service platform system, so that the data encryption behavior does not affect the users. The existing data storage protection methods built on the cloud service platform are to encrypt and access the storage devices through additional hardware modules, and the construction cost is high.

In view of the shortcomings derived from the above-mentioned conventional methods, the inventor of the present invention has improved and innovated, and after painstaking research, finally successfully developed and completed this invention to solve the cloud virtualization host data storage protection problem.

The object of the present invention is to provide a cloud file automatic encryption and decryption system, which utilizes an information security module to verify the operation behavior of the system, and performs instant encryption and decryption on the access of the host data to improve the information security of the cloud platform virtualization host service. The purpose of protection; by intercepting the system I\O, the data encryption process does not need to change the system operation process, so as not to affect the user's operating habits. By using the information security module on the cloud service platform system, the cloud platform system can be reduced. The purpose of this.

A cloud file automatic encryption and decryption system for achieving the above object is applied to a data access encryption and decryption system of a cloud platform virtualization host service, and an information security module is added in the system data processing flow, which includes a cloud virtual host management security mode. The group, the key management module, the cloud virtual host system I\O interception module, the encryption and decryption module, and the key management server protect the key storage security. The information security module uses the method of intercepting system commands. When the virtual host performs operations such as opening, transferring, backing up, and shutting down the system data, the information security module verifies the operation behavior of the system and is reading. Instant data encryption and decryption during the process of writing a storage device or file.

Please refer to FIG. 1 , which is a schematic diagram of an implementation structure of a cloud file automatic encryption and decryption system according to the present invention, which includes a data security protection module 1 of a cloud service platform, and an information security module built on a cloud service platform system. The software system security module does not need to install another hardware module, and the cloud service platform system can be a cloud service virtualization platform system such as Xen or KVM.

The cloud service platform data security protection module 1 includes a cloud virtual host management security module 11 embedded in the cloud virtual host management system, and uses an interception point in the cloud virtual host management module to intercept cloud virtual host management commands, such as : virtual host open, transfer, backup, off After the interception of the management command, the cloud virtual host management security module 11 in the data security protection module 1 of the cloud service platform is called, and the data processing flow is directed from the cloud virtual host management module to the cloud virtual host management security module. After the security module performs the information verification processing, the data processing flow is returned to the cloud virtual host management module to complete the normal data processing process.

The cloud virtual host management security module 11 requests the key management module 12 to perform virtual host information and key information comparison to verify whether the virtual host management command is from an authorized person's operation, after completing the information comparison. The key management module 12 will return the verification result to the cloud virtual host management security module 11. When the verification information result is correct, the cloud virtual host management security module 11 will release the intercepted cloud virtual host management command, so that the cloud virtual host management module 11 The management process correctly performs the actions of opening, moving, backing up, and closing the virtual host; if the verification result is incorrect, the execution of the cloud virtual host management instruction will be blocked.

When receiving the verification request of the cloud virtual host management security module 11, the key management module 12 compares the existing key information in the key management module 12 first, if there is no corresponding key information, The key information is requested from the key management server 13 by using the virtual host information, and the information is compared after the key information is returned. When the information is verified correctly, the key management module 12 temporarily stores the key information in the mode. In the group, in order to facilitate the next verification use, in order to improve the efficiency of the authority verification, the key information temporary storage will start from the virtual The host is turned on, and the virtual host is closed.

The key management server 13 is responsible for receiving the key information request sent by the key management module 12, and transmitting the corresponding key information to the key management module 12 according to the virtual host information parameter. The key management server 13 uses a standard Key Management Interoperability Protocol (KMIP), and the communication protocol with the key management module 12 uses a secure transport protocol SSL (Secure Sockets Layer) to protect The security of the key information.

The cloud virtual host system I\O interception module 14 is embedded in the cloud virtual host I\O module, and uses the intercept point in the cloud virtual host I\O module to intercept the cloud virtual host I\O information to obtain The data of the storage device is read or written in the data processing flow. After intercepting the I\O information, the cloud virtual host system I\O interception module 14 in the data security protection module 1 of the cloud service platform is called, and the data processing flow is guided by the cloud virtual host I\O module to the cloud virtual The host system I\O interception module, after the security module performs data encryption and decryption processing, returns the data processing flow back to the cloud virtual host I\O module to complete the normal data processing flow.

The cloud virtual host system I\O intercepting module 14 transmits the obtained data to the data encryption and decryption module 15, decrypts the read data and encrypts the written data, and after the data is encrypted and decrypted, the cloud virtual The host system I\O interception module 14 will release the intercepted cloud virtual host I\O action, so that the data processing flow continues to proceed correctly. Due to virtual host The data of the read storage device has been decrypted in the cloud virtual host system, so the virtual host can correctly identify the data content without data errors or unrecognizable conditions; and the data written by the virtual host to the storage device is also virtual in the cloud. Encryption processing is performed in the host system, so the data stored in the device is encrypted.

The data encryption and decryption module 15 is responsible for encrypting and decrypting the read or write storage device data sent by the cloud virtual host system I\O intercepting module 14, and the encryption and decryption algorithm of the data encryption and decryption module 15 uses the disk encryption algorithm. The method can support encryption algorithms such as CBC, LRW, XEX, XTS, CMC and EME or ESSIV, and encrypt and decrypt data with 128 bits or 256 bits. The encryption and decryption key pair is generated by the data encryption/decryption module 15 according to the information of the storage device to the information of the key management module 12, and the information includes derivative information of the virtual host key pair.

The cloud file automatic encryption and decryption system provided by the invention has the following advantages when compared with other conventional technologies:

1. The system provided by the present invention is a data access protection method built on the cloud service platform, and an information security module is added in the data processing flow, and the virtual host can be verified to be turned on, off, and operated by means of intercepting system instructions. Whether the action of changing the data comes from the operation of the authorized personnel, and enhances the information security protection of the cloud platform virtualization host service.

2. The system provided by the present invention is a data access protection method built on the cloud service platform, and an information security module is added in the data processing flow. The purpose of data encryption is achieved by means of intercepting the system I\O. And achieve the purpose of not changing the user's operating habits.

3. The system provided by the invention is a software information security module, and the data encryption can be achieved without additional hardware modules, which can reduce the construction of the cloud service platform system.

4. The data encryption and decryption module provided by the present invention uses a disk encryption algorithm to support encryption algorithms such as CBC, LRW, XEX, XTS, CMC and EME or ESSIV, and can be paired with 128-bit or 256-bit key pairs. Encryption and decryption of data.

5. The key management module and key management server provided by the present invention adopts a standard Key Management Interoperability Protocol (KMIP), and the key information transmission protocol uses a secure transmission protocol SSL (Secure). Sockets Layer) protects the security of key information.

6. The present invention can be used with any relevant cloud service platform system.

The detailed description of the present invention is intended to be illustrative of a preferred embodiment of the invention, and is not intended to limit the scope of the invention. The patent scope of this case.

In summary, this case is not only innovative in terms of technical thinking, but also has many of the above-mentioned functions that are not in the conventional system of conventional use. It has fully complied with the statutory invention patent requirements of novelty and progressiveness, and applied for it according to law. You have approved this invention patent application, in order to invent the invention, to Chengde.

1‧‧‧Cloud Service Platform Data Security Protection Module

11‧‧‧Cloud Virtual Host Management Security Module

12‧‧‧Key Management Module

13‧‧‧Key Management Server

14‧‧‧Cloud virtual host system I\O interception module

15‧‧‧ Data encryption and decryption module

The detailed description of the present invention and the accompanying drawings will be further understood. The technical content of the present invention and its functions are as follows: FIG. 1 is a schematic diagram of an implementation structure of a cloud file automatic encryption and decryption system according to the present invention;

1‧‧‧Cloud Service Platform Data Security Protection Module

11‧‧‧Cloud Virtual Host Management Security Module

12‧‧‧Key Management Module

13‧‧‧Key Management Server

14‧‧‧Cloud virtual host system I\O interception module

15‧‧‧ Data encryption and decryption module

Claims (8)

A cloud file automatic encryption and decryption system refers to a data security protection module of a cloud service platform, which is constructed as an information security module placed on a cloud service platform system, and can achieve data encryption without additional hardware modules. The purpose of the method comprises: a cloud virtual host management security module, which intercepts the cloud virtual host management command and controls the management process; a key management module performs the virtual host information and the key information comparison to verify Whether the management instruction of the virtual host is from the operation of a authorized person, and temporarily storing the key information to improve the efficiency of the authority verification; a key management server receives the key information request from the key management module Returning the corresponding key information according to the virtual host information parameter; a cloud virtual host system I\O intercepting module intercepts the cloud virtual host I\O information to obtain reading or writing in the data processing flow Data into the storage device; and a data encryption and decryption module responsible for encrypting and decrypting the read or write sent by the cloud virtual host system I\O intercept module Data storage devices. The cloud file automatic encryption and decryption system described in claim 1, wherein the cloud service platform system can be a cloud virtualization system such as Xen or KVM. For example, the cloud file automatic encryption and decryption system described in claim 1 is characterized in that the cloud virtual host management security module is embedded in the cloud virtual host management system, and can intercept and control the cloud virtual host management command. For example, the cloud file automatic encryption and decryption system mentioned in item 1 of the patent application scope The key management interoperability protocol (KMIP) is used to protect the security of the key information. For example, the cloud file automatic encryption and decryption system described in claim 1 is characterized in that the key management server uses a secure transmission protocol SSL (Secure Sockets Layer) to protect key information transmission security. For example, the cloud file automatic encryption and decryption system described in claim 1 is wherein the cloud virtual host system I\O interception module is embedded in the cloud virtual host I\O module to intercept the cloud virtual host I\O. Information to obtain data that is read or written to the storage device during the data processing process. For example, the cloud file automatic encryption and decryption system described in claim 1 wherein the data encryption and decryption module uses a disk encryption algorithm to support encryption algorithms such as CBC, LRW, XEX, XTS, CMC and EME or ESSIV. . For example, the cloud file automatic encryption and decryption system described in claim 1 wherein the data encryption and decryption module uses a disk encryption algorithm to encrypt and decrypt data with 128 bits, 192 bits, and 256 bits.