KR101595056B1 - System and method for data sharing of intercloud enviroment - Google Patents

Abstract

The data sharing system in the inter-cloud environment according to the present invention generates a first key chain based on the received security information, and divides and encrypts the user data through the generated first key chain Generating a second key chain based on the received security information, and merging and decrypting the divided encrypted data received from the first service provider into the generated second key chain (step < RTI ID = 0.0 > And an integrated key management device for providing security information to the first service provider and the second service provider.

Description

SYSTEM AND METHOD FOR SHARING OF INTERCLOUD ENVIRONMENT IN INTERCLUDE ENVIRONMENT [0002]

The present invention relates to security of a cloud service, and more particularly, to a security key management method of a cloud service.

As cloud computing services become more diverse and service quality improves, more and more services such as Inter-Cloud, which interoperate and collaborate with cloud services rather than single cloud services, are increasing. However, intercloud services based on different cloud service providers have some problems.

If all cloud services generate a private key for the user to provide data encryption services and share the encrypted data with other cloud services, the data must be encrypted and transmitted to the other cloud service provider for secure data sharing. However, in such a case, since the private keys provided by the respective cloud services are different, it is impossible to decrypt them. Therefore, each cloud service must generate and manage keys that can be encrypted and decrypted with the other cloud service for data sharing and private key management for encrypting the user's data. In such a case, key management may become difficult because the number of encryption keys increases according to various cloud services.

And, in order to share encrypted data between cloud service providers, a decryptable key is needed. However, key propagation is more frequent and repetitive can expose keys and, if exposed, could pose a threat to personal data and all cloud services related to it. In addition, although data transmission of pain-text is possible through an encrypted communication session between cloud service providers, if the communication session is disabled, plain text data can be exposed. For example, when using an encrypted communication protocol such as HTTPS, a message containing sensitive information (data) may be exposed by a Man In The Middle attack (MITM) using packet sniffing such as SSL Strip.

Korean Patent Laid-Open No. 10-2014-0009708 discloses a user terminal device and an encryption method for encryption in a cloud computing environment. Korean Patent Laid-Open Publication No. 10-2014-0009708 only includes contents for monitoring security data using a hooking module in encryption between a server and a terminal, and does not improve management efficiency of a complicated encryption key.

Korean Patent Publication No. 10-2014-0009708

A problem to be solved by the present invention is to provide a secure data sharing system and a sharing method that can provide integrated key management to enable safe data sharing among different cloud service providers and securely provide services even when keys are exposed .

The data sharing system in the inter-cloud environment according to the present invention generates a first key chain based on the received security information, and divides and encrypts the user data through the generated first key chain Generating a second key chain based on the received security information, and merging and decrypting the divided encrypted data received from the first service provider into the generated second key chain (step < RTI ID = 0.0 > And an integrated key management device for providing security information to the first service provider and the second service provider.

The integrated key management device may perform authentication between the first service provider and the second service provider. The first service provider encrypts the user data uploaded from the user using the private key and stores the encrypted user data. When the sharing request of the stored user data is received from the second service provider, the stored user data is decrypted using the private key And then re-encrypts the user data using the first chain key. In this process, the integrated key management apparatus determines the key chain algorithm and the starting point, and generates security information including information on the determined key chain algorithm and the starting point. The integrated key management apparatus can select any one of key chain algorithms such as a hash chain function algorithm and a TESLA algorithm to determine a key chain algorithm to be used for data encryption. The first service provider divides the data to be transmitted into data blocks of a predetermined size, and generates keychain information from the generated keychain algorithm information and information on the starting point of using the generated keychain, The data block is encrypted with one encryption key per data block using the keychain. The second service provider generates a key chain according to the selected key chain algorithm, which is the received security information, and the key chain start point, and performs decoding and data merge using the decryption key of the start point. Then, the first service provider and the second service provider delete the first keychain and the second keychain after the second service provider decrypts the divided encrypted data.

In the data sharing method in the inter-cloud environment according to the present invention, security information (key chain algorithm information and key chain usage starting point information) is generated in the integrated key management device. The first service provider generates the first key chain based on the generated security information, and divides and encrypts the user data through the first key chain to generate the divided encrypted data. Then, the second service provider generates the second key chain based on the generated security information, and decrypts the divided encrypted data received from the first service provider through the second key chain.

The data sharing system and the sharing method in the intercloud environment according to the present invention can reduce the development cost by preventing the development of the redundant key management system by secure data sharing and encryption key integration management among the cloud service providers. In addition, even if the key is exposed, the use of a one-time encryption key that deletes the key after communication is completed can reduce the threat to the system and data even if the key is exposed.

1 is a configuration diagram illustrating an embodiment of a data sharing system in an inter-cloud environment according to the present invention.
2 is a view for explaining a key chain of a data sharing system in an inter-cloud environment according to an embodiment of the present invention.
3 is a flowchart illustrating a data processing process of a data sharing system in an inter-cloud environment according to an embodiment of the present invention.
4 is a flowchart illustrating a data sharing method in an intercloud environment according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. The terms and words used in the present specification are selected in consideration of the functions in the embodiments, and the meaning of the terms may vary depending on the intention or custom of the invention. Therefore, the terms used in the following embodiments are defined according to their definitions when they are specifically defined in this specification, and unless otherwise specified, they should be construed in a sense generally recognized by those skilled in the art.

1 is a configuration diagram illustrating an embodiment of a data sharing system in an inter-cloud environment according to the present invention.

Referring to FIG. 1, a data sharing system in an inter-cloud environment according to the present invention may include an integrated key management apparatus 110, a first service provider 120, and a second service provider 130.

The integrated key management apparatus 110 may send a request to the first service provider 120 and the second service provider 130 when a request to share the user data with the second service provider 130 is received from the first service provider 120 . The integrated key management apparatus 110 transmits security information including key chain algorithm information and starting point information to the first service provider 120 and the second service provider 130.

The first service provider 120 and the second service provider 130 represent a cloud service provider providing cloud services to the user. The first service provider 120 and the second service provider 130 generate a private key for securely storing and managing the user's data. The first service provider 120 and the second service provider 130 encrypt the data uploaded from the user using the generated private key using a private key and store the encrypted data. The private key generated by the first service provider 120 and the private key generated by the second service provider 130 are different from each other. That is, the different cloud service providers encrypt and store the user's data using respective private keys.

A user may share uploaded data between different cloud service providers 110 and 120. For example, the user may share data uploaded to the first service provider 120 through the second service provider 130. [ When the first service provider 120 receives a data sharing request from the second service provider 130, the first service provider 120 approves the second service provider 130 through a predetermined authentication procedure.

When the second service provider 130 is authenticated, the first service provider 120 requests the integrated key management device 110 to communicate with the second service provider 130. When security information is transmitted from the integrated key management device 110, the first service provider 120 generates a first key chain based on the received security information. The first service user 110 subdivides the user's data into a predetermined size based on the first key chain, divides the data into two or more pieces of user data, encrypts the divided two or more pieces of user data into a key chain, 120). The security information is information for dividing and encrypting the user data according to the key chain algorithm, and will be further described in FIG. 2 to be described later.

The first service provider 120 may first perform decryption via the private key before partitioning and encrypting through the keychain if the stored user data is encrypted with the private key. When the first service provider 120 transmits the encrypted user data to the second service user 120, the first service provider 120 can double-encrypt the encrypted user data using the encrypted communication protocol.

The second service provider 130 delivers a data sharing request to the first service provider 120 to share the user data. When the first service provider 120 authenticates the second service provider 130, it receives the security information including the type of the key chain algorithm and the starting point information from the integrated key management device 110. The security information delivered to the second service provider 130 is the same as the security information delivered to the first service provider 120. The second service provider 130 generates the second key chain based on the received security information. Since the first keychain and the second keychain are generated according to the same security information, they become the same keychain.

Then, the second service provider 130 decrypts the divided encrypted data received from the first service provider 120 using the generated second key chain. The partitioned encrypted data received from the first service provider 120 is partitioned and encrypted through the keychain generated based on the security information. The second service provider 130 generates the same second key chain as the first key chain using the security information with the first service provider 120. [ Then, the second service provider 130 decrypts and merges the received divided and encrypted user data in order using the same second keychain as the first keychain.

The second keychain used to decrypt the user data at the second service provider 130 and the first keychain used to encrypt the user data at the first service provider 120 are decrypted after decrypting the user data. When data sharing between the first service provider 120 and the second service provider 130 is completed, the first service provider 120 and the second service provider 130 delete the generated key chain to minimize the key exposure do.

2 is a view for explaining a key chain of a data sharing system in an inter-cloud environment according to an embodiment of the present invention.

2, a key chain generated by the first service provider 120 and the second service provider 130 of the data sharing system in the inter-cloud environment according to an embodiment of the present invention includes a hash chain function Function) algorithm or a Tesla algorithm.

The hash chain function generates a key successively and provides a piece of data encrypted based on a hash function. In computer security, a hash chaining function is one way to generate an encryption key or password as a one-time key. Since the hash chain encrypts fragments of data continuously, it transmits the data together with the data by recording the time table (order number) for the purpose of preventing non-repudiation. Key chain encryption using a hash chain function is an encryption algorithm that continuously applies a cryptographic hash function h (x) to a character x value. The hash chain function is, for example, h (h (h (x))), and the length of the hash chain is 4 and h ⁴ (x). Can use the Tesla algorithm. The Tesla technique requires that the size of the data be known in advance because key generation is performed in the reverse direction.

The data sharing system in the inter-cloud environment according to an embodiment of the present invention generates a key chain using such a method and divides / encrypts / merges / decodes user data through the generated key chain.

The integrated key management device 110 delivers security information to the first service provider 120 and the second service provider 130. Security information transmitted from the integrated key management device 110 includes a key chain algorithm type and start point information. The first service provider 120 and the second service provider 130 generate a key chain using the key chain algorithm type, start point information, and chain length information included in the received security information. The keychain algorithm type indicates the kind of keychain algorithm that is selected among various keychain algorithms. The starting point information is information on a starting point indicating how many key ciphers the keychain will be generated from. The chain length information is the number of generated key chains and indicates the number of divided user data. The chain length information may vary depending on the file size of the user data and the preset.

2 shows an embodiment of a key chain algorithm using a hash chain function. The first service provider 120 confirms that the type of the key chain algorithm is the hash chain algorithm and the starting point is 3 through the received security information 211. Then, the first service provider 120 divides the received user data 212 and generates the key chain 213 through the received security information 211. Next, the divided user data is encrypted (214) through the keychain and transferred to the second service provider (130). The second service provider 130 generates the key chain 222 through the received security information 221 and decrypts 223 the encrypted data 214 through the generated key chain 222, ) To restore the user data.

For example, if the key chain algorithm included in the security information is a hash chain function, the starting point information is 4, and the chain length (the number of divided user data) is 10, the first service provider 120 sets the user data to 10 And carries out encryption for 10 data pieces from key chains 4 to 13 using the x value set in the hash chain function. The x value defined in the hash chain function is a value previously defined in the first service provider 120 and the second service provider 130 and used in the hash chain algorithm. Generate the first keychain using the x value, and generate the second keychain value using the first keychain value. Thus, since x is the first variable to generate the keychain, both the first service provider 120 and the second service provider 130 must know the x value in advance.

The first service provider 120 generates a total of 10 key values from h4 (x) to h13 (x) based on the starting point information 4, encrypts 10 pieces of user data and 10 keys in correspondence with each other, And generates divided encrypted data including the first encrypted data (Encrypted Data 1) to the tenth encrypted data (Encrypted Data 10). That is, the first service provider 120 encrypts 10 data pieces from Data 1 + key (h ⁴ (x)) = Encrypted Data 1 to Data 10 + key (h ¹³ (x)) = Encrypted Data 10. When divided encrypted data is generated, the first service provider 120 forwards the divided encrypted data including the ten encrypted data to the second service provider 130.

The second service provider 110 generates a second key chain based on the received security information in the same manner as the first service provider 120 and transmits the second key chain to the second service provider 120 via the generated key chain And merges and decrypts the divided encrypted data including ten encrypted data. Then, the first service provider 120 and the second service provider 130 delete the keychain generated after the end of the job, thereby minimizing the keychain exposure.

In the embodiment of FIG. 2, a hash chain algorithm is used and it is described that one of the algorithms is selected from the Tesla algorithm and the hash chain algorithm. However, the kind of the key chain algorithm is not limited to the two algorithms described above, Can be applied without restriction.

3 is a flowchart illustrating a data processing process of a data sharing system in an inter-cloud environment according to an embodiment of the present invention.

Referring to FIG. 3, in the process of data processing in a data sharing system in an inter-cloud environment according to an embodiment of the present invention, a first service provider 120 receiving user data from a user transmits (301). The first service provider 120 provides the cloud service to the user. Accordingly, the user can transmit the data owned by the user to the first service provider 120 and store the same. When data is received from the user, the first service provider 120 may encrypt and store the data through a private key generally used for security before storing the received data. When a data sharing request is received (302) from the second service provider (130), the first service provider (120) decrypts the stored user data using the private key (303). In an intercloud environment, users can share data uploaded to one cloud service through other cloud services. Thus, for such a cloud sharing service, the second service provider 130 requests the first service provider 130 to share the user data. The first service provider 130 may approve the second service provider 130 by determining whether the second service provider 130 is an authorized target for the user before data sharing. The first service provider 130 decrypts the encrypted user data using the private key in step 301 so that the user data can be shared. Then, the first service provider 120 requests the integrated key management device 110 to communicate with the second service provider 130 (304).

When a communication request from the first service provider 120 to the second service provider is received, the integrated key management device 110 determines an algorithm and a starting point for generating a key chain (305). The keychain used in the present invention may use a keychain such as a hash chain function algorithm or a Tesla algorithm. Accordingly, the integrated key management device 110 determines an algorithm for generating a key chain among a hash chain function algorithm or a Tesla algorithm. Then, the integrated key management device 110 determines a starting point according to the determined key chain algorithm. When the algorithm and the starting point are determined, the integrated key management device 110 generates security information including information about the determined algorithm and the starting point and forwards it to the first service provider 120 (306).

When security information is received from the integrated key management device 110, the first service provider 120 generates a first key chain based on the received security information (307). Security information transmitted from the integrated key management device 110 includes key chain algorithm information and starting point information. The first service provider 120 generates the first key chain using the key chain algorithm information and the starting point information included in the received security information. Then, the first service provider 120 divides and encrypts the user data through the generated first key chain (308). The first service provider 120 divides the user data and encrypts it according to the key chain algorithm included in the security information. For example, if the key chain algorithm included in the security information is a hash chain function, the start point information is 4, and the first service provider 120 divides the data into 10 pieces, the first service provider 120 transmits the start point information 10, a total of ten key values from h4 (x) to h13 (x) are generated based on the first encryption data (Encrypted Data 1) And generates divided encrypted data including the tenth encrypted data (Encrypted Data 10). When the divided encrypted data is generated, the first service provider 120 forwards the divided encrypted data to the second service provider 130 (309).

Then, the integrated key management device 110 transmits the security information including the algorithm and the starting point determined in step 305 to the second service provider 130 (310). When security information is received from the integrated key management device 110, the second service provider 130 generates a second key chain based on the received security information in step 307 (311). Since the first keychain and the second keychain are generated by the same security information, they become the same keychain. Steps 310 and 311 are not necessarily performed after step 309, and may be executed at the same time as steps 306 and 307. [

The fragmented encrypted data received from the first service provider 120 is merged and decrypted using the generated second key chain (312). The second keychain generated at the second service provider 130 is the same keychain as the first keychain used to divide and encrypt the encrypted data segmented at the first service provider 120. Accordingly, the second service provider 130 merges the divided encrypted data into one piece of data, decodes the merged data using the same second key chain as the first key chain, and restores the user data, And may share the user data with the provider 120. When the merging and decryption of the divided encrypted data is completed in the second service provider 130, the second service provider 130 deletes the generated second key chain (313). The first service provider 120 also deletes the generated first key chain (314). The first keychain and the second keychain may be encrypted and decrypted to complete data sharing and delete the keychain, thereby minimizing key exposure.

4 is a flowchart illustrating a data sharing method in an intercloud environment according to an embodiment of the present invention.

Referring to FIG. 4, in a data sharing method in an inter-cloud environment according to an embodiment of the present invention, user data uploaded from a user to a first service provider is encrypted with a private key and stored (S401). The first service provider provides the cloud service to the user. Thus, the user can transfer data owned by the user to the first service provider for storage. When the first service provider receives data from the user, the first service provider may encrypt and store the data through a private key generally used for security before storing the received data. When the data sharing request is received from the second service provider, the first service provider decrypts the stored user data using the private key (S402). In an intercloud environment, users can share data uploaded to one cloud service through other cloud services. Thus, for such a cloud sharing service, the second service provider requests sharing of user data with the first service provider. The first service provider can approve the second service provider by determining whether the second service provider is the authorized object to the user prior to data sharing. In step S401, the first service provider decrypts the encrypted user data using the private key.

The integrated key management device for sharing user data between the first service provider and the second service provider generates security information by determining an algorithm and a starting point for generating a key chain and transmits the generated security information to the first service provider and the second service provider. 2 service provider (S403). The keychain used in the present invention can use a hash chain function algorithm or a Tesla algorithm-based key chain. Accordingly, the integrated key management apparatus determines an algorithm for generating a key chain among a hash chain function algorithm or a Tesla algorithm. Then, the integrated key management apparatus determines a starting point according to the determined key chain algorithm. When the algorithm and the starting point are determined, the integrated key management device generates security information including information on the determined algorithm and the starting point, and forwards it to the first service provider and the second service provider.

When security information is received from the integrated key management device, the first service provider generates a first key chain based on the received security information (S404). The security information transmitted from the integrated key management apparatus includes key chain algorithm information and starting point information. The first service provider generates the first key chain using the key chain algorithm information and the starting point information included in the received security information. Then, the first service provider divides and encrypts the user data through the generated first key chain (S405). The first service provider divides and encrypts the user data according to the key chain algorithm included in the security information. When the divided encrypted data is generated, the first service provider transmits the divided encrypted data to the second service provider (S406).

When security information is received from the integrated key management device, the second service provider generates a second key chain based on the received security information (S407). Since the first keychain and the second keychain are generated by the same security information, they become the same keychain. Then, the divided encrypted data received from the first service provider is merged using the generated second key chain and decoded (S408). The second keychain generated at the second service provider is the same keychain as the first keychain used to divide and encrypt the encrypted data segmented at the first service provider. Accordingly, the second service provider merges the divided encrypted data into one piece of data using the same second key chain as the first key chain, decodes the merged data and restores the user data, Data can be shared. When the merging and decryption of the divided encrypted data in the second service provider is completed, the first service provider and the second service provider delete the generated first key chain and the second key chain (S409). The first keychain and the second keychain may be encrypted and decrypted to complete data sharing and delete the keychain, thereby minimizing key exposure.

The present invention including the above-described contents can be written in a computer program. And the code and code segment constituting the program can be easily deduced by a computer programmer of the field. In addition, the created program can be stored in a computer-readable recording medium or an information storage medium, and can be read and executed by a computer to implement the method of the present invention. And the recording medium includes all types of recording media readable by a computer.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, but, on the contrary, It is possible.

110: Integrated key management device
120: First service provider
130: second service provider

Claims (16)

A first service provider for generating a first key chain based on the received security information, and dividing and encrypting user data through the generated first key chain to generate divided encrypted data;
A second service provider for generating a second key chain based on the received security information, and for merging and decrypting the divided encrypted data received from the first service provider into the generated second key chain; And
An integrated key management device for providing the security information to the first service provider and the second service provider;
/ RTI >
Wherein the integrated key management apparatus determines a key chain algorithm and a starting point, and generates the security information including information on a determined key chain algorithm and a starting point. The method according to claim 1,
Wherein the integrated key management device performs authentication between the first service provider and the second service provider. The method according to claim 1,
Wherein the first service provider encrypts and stores the user data uploaded from the user using the private key and stores the stored user data in the private key when the sharing request of the stored user data is received from the second service provider And encrypts the user data using the first key chain. The data sharing system according to claim 1, delete The method according to claim 1,
The integrated key management apparatus
A hash chain function algorithm and a TESLA algorithm is determined by a keychain algorithm in a data sharing system in an intercloud environment. The method according to claim 1,
Wherein the first service provider divides the user data according to a key chain algorithm of the received security information and encrypts the user data from the starting point to generate the divided encrypted data. The method according to claim 1,
Wherein the second service provider merges the divided encrypted data according to a key chain algorithm of the received security information, and decrypts the encrypted data from the starting point to restore the user data from the divided encrypted data. Data sharing system in. The method according to claim 1,
Wherein the first service provider and the second service provider delete the first keychain and the second keychain after the second service provider decrypts the divided encrypted data. Of data sharing system. A method of sharing data between a first service provider and a second service provider,
Generating security information in an integrated key management apparatus;
Generating a first key chain by the first service provider based on the generated security information;
Dividing and encrypting user data through the first keychain to generate encrypted data segmented by the first service user;
Generating a second key chain by the second service provider based on the generated security information;
Decrypting the divided encrypted data by the second service provider based on the generated second key chain;
/ RTI >
Wherein the step of generating security information in the integrated key management apparatus comprises:
The integrated key management apparatus determining a key chain algorithm and a starting point; And
Generating the security information including information about a determined key chain algorithm and a starting point;
The method comprising the steps of: 10. The method of claim 9,
Wherein the integrated key management device performs authentication between the first service provider and the second service provider. 10. The method of claim 9,
Encrypting and storing the user data uploaded from the user by the first service provider using a private key;
Decrypting the stored user data using the private key when a sharing request of the stored user data is received from the second service provider; And
Encrypting the user data again using the first keychain;
The method of claim 1, further comprising: delete 10. The method of claim 9,
Wherein the integrated key management apparatus determines a keychain algorithm and a starting point by determining any one of a hash chain function algorithm and a tesla algorithm as a keychain algorithm, A method for sharing data in a network. 10. The method of claim 9,
Wherein the step of generating the divided encrypted data comprises:
Dividing the user data according to a key chain algorithm of the security information by the first service provider; And
Encrypting the encrypted data from the starting point to generate the divided encrypted data;
The method comprising the steps of: 10. The method of claim 9,
Wherein the step of decrypting the divided encrypted data comprises:
Merging the divided encrypted data according to a key chain algorithm of the security information; And
Decrypting the encrypted data from the start point and restoring the user data from the divided encrypted data;
The method comprising the steps of: 10. The method of claim 9,
After decrypting the divided encrypted data, deleting the first keychain and the second keychain;
The method of claim 1, further comprising:

Images