CN105516117A - Cloud computing-based electric power data secure storage method - Google Patents

Cloud computing-based electric power data secure storage method Download PDF

Info

Publication number
CN105516117A
CN105516117A CN201510874603.9A CN201510874603A CN105516117A CN 105516117 A CN105516117 A CN 105516117A CN 201510874603 A CN201510874603 A CN 201510874603A CN 105516117 A CN105516117 A CN 105516117A
Authority
CN
China
Prior art keywords
data
user
key
encryption
cloud
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN201510874603.9A
Other languages
Chinese (zh)
Inventor
关泽武
蒋屹新
郭晓斌
许爱东
陈华军
蒙家晓
陈富汉
陈立明
黄建理
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
China South Power Grid International Co ltd
Power Grid Technology Research Center of China Southern Power Grid Co Ltd
Original Assignee
China South Power Grid International Co ltd
Power Grid Technology Research Center of China Southern Power Grid Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by China South Power Grid International Co ltd, Power Grid Technology Research Center of China Southern Power Grid Co Ltd filed Critical China South Power Grid International Co ltd
Priority to CN201510874603.9A priority Critical patent/CN105516117A/en
Publication of CN105516117A publication Critical patent/CN105516117A/en
Pending legal-status Critical Current

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/08Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083Network architectures or network communication protocols for network security for authentication of entities using passwords
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/04Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00Network arrangements or protocols for supporting network services or applications
    • H04L67/01Protocols
    • H04L67/10Protocols in which an application is distributed across nodes in the network
    • H04L67/1097Protocols in which an application is distributed across nodes in the network for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Storage Device Security (AREA)

Abstract

The invention discloses a cloud computing-based electric power data safe storage method, which comprises the following steps: (1) a user applies for a cloud storage space through a service interface, accesses the cloud storage space into a cloud computing architecture to access data, and simultaneously selects whether the data needs to be encrypted; (2) distributing a cloud storage space to a user, if data needs to be encrypted, distributing a key according to an algorithm, and storing a mapping relation between the storage space and the key; (3) after the cloud storage space is distributed, informing a user to start the cloud storage resources; (4) the user accesses the cloud storage according to the applied service mode, and encrypted ciphertext data are landed in the storage system through encryption processing when the user writes data; (5) and when a legal user allowed by the service reads the cloud storage space data, the encrypted data block is decrypted and restored to be a plaintext and returned to the user interface.

Description

A kind of electric power data method for secure storing based on cloud computing
Technical field
The present invention relates to the data processing of electric power system, more particularly, relate to a kind of electric power data method for secure storing based on cloud computing.
Background technology
Cloud computing is a kind of large-scale distributed computation schema, inherits existing distributed security problem and technology.But, the virtualized environment had due to cloud computing application model, data high polymeric and mobility, Data Control store and the feature such as use is separated, under making power cloud calculation environment, data security creates problem new in a large number, challenges to existing information safe practice and management mode.
No matter electrical network is sharing or the mutual use of resource and service of architecture, all meet essence and the intension of cloud, the construction of electric power cloud computing will be made overall planning to electric power resource to greatest extent and configure, and makes great efforts to improve the level of resources utilization, strives making enterprise's O&M cost minimum.
In the storage platform based on electric power cloud computing, user is linked into visit data cloud computing framework from each operation system by specific application program or existing stores service interface layer (such as samba).Stores service interface layer provides multiplex roles support, process the load balancing logic of access service simultaneously, after interface layer, system roughly can be divided into four pieces of logical constructions again: (1) system configuration administration module, there is provided friendly management interactive entrance, the behavior of control and management total system; (2) store data encrypting and deciphering module, be responsible for the fail safe of data content in process storage platform; (3) storage pool administration module, manages the running (node state, memory space, cluster state, user's quota etc.) of overall clustered node; (4) system monitoring administration module, is responsible for service condition and the behavior of monitor audit platform and integrally.Under this storage environment, transfer of data operates on establishing network, and transmission path is no longer security threat, on the contrary the storage of data, and shared security requirement is higher,
Summary of the invention
The object of the invention is to: the electric power data method for secure storing based on cloud computing is provided, from framework, data security is separated with control strategy under cloud computing environment, thus ensure the safety of data.
To achieve these goals, the invention provides the electric power data method for secure storing based on cloud computing, it comprises the steps: (1) user is by service interface application cloud memory space and be linked into visit data in cloud computing framework, selects data the need of encryption simultaneously; (2) distribute cloud memory space to user, if data need encryption, then according to algorithm assigns key, and deposit the mapping relations of this memory space and key; (3), after cloud memory allocation completes, notify that user enables cloud storage resources; (4) user stores according to the trafficwise access cloud of application, when user writes data, the encrypt data after encryption will be landed within the storage system by encryption; (5), when the validated user that business allows reads described cloud memory space data, decrypted being reduced into of the data block of encryption expressly returns to user interface.
As a modification of the present invention, the deciphering in the encryption in step (4) and step (5) is the safe encryption and decryption done based on memory space and content, and completes when the write of data reads, and safety and service interface is done decoupling zero simultaneously.
As a modification of the present invention, in step (1), also comprise: (101) each service interface controls the access of user by the access control mechanisms of self, for each user distributes addressing space, and do access limit control; (102), when user is by service interface access respective path, if validated user, then the file system interface that can be stored by secure cloud has access to correct content; If disabled user, then at MAC layer authentification failure, be then encrypted content under the cloud store path that this user browses, real business datum cannot be obtained.
As a modification of the present invention, in step (2), also comprise the management process of key: (201) provide key management entrance, support generation and the amendment of key; (202) when secret generating or amendment, perform backup operation, by secret key encryption backup in safety zone, be separated with data storage; (203) by the key that escape way periodic synchronization memory space is corresponding, key distribution is completed; (204) when user writes data, encrypting module writes storage medium by corresponding path key by after data encryption process; (205) when user reads data, deciphering module by after data deciphering process, returns to user by respective path.
As a modification of the present invention, also comprise: the initial owner of store path is set as key owners, key owners possesses the administration authority to key; Other are to the sharer in memory space path, and key only can be used to do encryption and decryption data.
As a modification of the present invention, described service interface is samba service data visitation interface, and after the data that samba service data visitation interface transmits are done encryption and decryption by a data security encryption/decryption module, write stores or returns to application layer after deciphering.
Compared with prior art, data security can be separated with control strategy by the present invention in the storage platform of electric power cloud computing from framework, thus ensures the safety of data.
Accompanying drawing explanation
Below in conjunction with the drawings and specific embodiments, structure of the present invention and Advantageous Effects thereof are described in detail.
Fig. 1 is the security strategy schematic diagram that the present invention is based on access interface.
Fig. 2 is for the present invention is based on cloud storage key management architecture figure.
Fig. 3 is cloud storage key of the present invention and memory space graph of a relation.
Fig. 4 is the safe encryption and decryption flow chart of VFS that the present invention is based on samba.
Embodiment
In order to make goal of the invention of the present invention, technical scheme and Advantageous Effects thereof more clear, below in conjunction with the drawings and specific embodiments, the present invention is further elaborated.Should be understood that, the embodiment described in this specification is only used to explain the present invention, is not intended to limit the present invention.
The electric power data method for secure storing that the present invention is based on cloud computing is implemented in the storage platform based on electric power cloud computing, access user/business that it comprises the steps: (1) applies for memory space to keeper's (storage platform system), access mode (samba, nfs, ftp, S3 etc.) and data the need of encryption (depending on safe class determine); (2) keeper distributes cloud memory space, if data need encryption, then choosing configuration needs cryptographic storage, and system according to algorithm assigns key, and deposits the mapping relations of this memory space and key; (3), after keeper is assigned, notify that user/operation system enables cloud storage resources; (4) user stores according to the trafficwise access cloud oneself applied for, when user writes data, platform IO layer will, by encryption, land the encrypt data after encryption in the storage system of this platform; (5), when the validated user that business allows reads these memory space data, encrypted data chunk is deciphered to be reduced into and is expressly returned to user/business interface by system again.
Refer to Fig. 1, the data encrypting and deciphering of core completes when the write of data reads, and is the safe encryption and decryption done based on memory space and content, and automatically safety and interface layer done decoupling zero.At business interface layer, only need to keep present situation, certification is carried out to access user, control user well (access control mechanisms of each existing interface to user has different supports to the access limit in given space simultaneously, such as samba, S3 just has different access control mechanisms), the secure access of data is just effectively guaranteed.The access of user controls reduction to the user security access control mechanisms of each access service interface self, if operation system authorizes the access limit that certain user possesses current path, so this user just correct reading and writing data of energy, otherwise user can only have access to the data of encryption.Each business controls the access of user by the access control mechanisms of self, and samba, NFS, FTP, S3 and other services distribute addressing space for each user, and does access limit control; When user is by amba, NFS, FTP, S3 and other service interfaces access respective path, if validated user, the file system interface that will be stored by secure cloud, has access to correct content; If a disabled user, at MAC layer authentification failure, be then also all encrypted content under the cloud store path that this user browses, real business datum cannot be obtained.
Refer to Fig. 2, data encrypting and deciphering realizes on data storage layer, is transparent to upper layer application and user's encryption and decryption functions, and therefore in encryption and decryption, most important key is also relevant with the memory space position of correspondence.Each memory location is by correspondence key.For application or the user of storage system, each store path must be used by certain application or user, therefore key management system can intuitively by the initial user of memory space, as the owner of the key in this space, pass through key owners, memory space, the key management functions closed loop of whole encryption and decryption system is got up by key.Management platform provides key management entrance, supports generation and the amendment of key; When secret generating or amendment, system performs backup operation simultaneously, by secret key encryption backup in safety zone, is separated with data storage; In secure cloud storage cluster, by the key that escape way periodic synchronization memory space is corresponding, complete key distribution; When user or application system are by storage cluster write data, encrypting module writes storage medium by corresponding path key by after data encryption process; When user or application system read data by storage cluster, deciphering module by after data deciphering process, returns to user or application system by respective path.
Refer to Fig. 3, in the method for the invention, key is different with traditional key management based on user, the encryption and decryption proposed occurs in data storage layer, concerning upper layer application or user, encryption and decryption data is transparent, and therefore the owner of key is based on memory space path.The initial owner of store path is set as key owners, and key owners possesses the administration authority to key, makes to be convenient to dock with traditional system based on user in key management; Other are to the sharer in memory space path, only support the use to key (using key to do encryption and decryption data).
Refer to Fig. 4, method of the present invention is the storage based on ceph, provides samba service data visitation interface.But the samba service of routine is the safe encryption and decryption not supporting to store data.This verification platform after the analysis samba communication protocol, based on the VFS Development of Module safe encryption/decryption module of data of samba.After the data that samba application interface transmits are done encryption and decryption by this VFS module, write stores or returns to application layer after deciphering.During samba reading and writing data, intermediate data is rewritten by VFS module, and the encryption and decryption of data operated to (the vfs source code of Samba is generally deposited below the moudes of source code path by writing VFS module to realize, the code name form of VFS module is as vfs_<module_name>.c, wherein module_name is the name of module, is also writing a Chinese character in simplified form of functions of modules; The header file that the code function structure of a VFS module mainly comprises the initialization of VFS module, VFS function pointer organization definition, needs comprise, VFS realize the function of specific function); Based on the improvement of VFS code structure above and encryption and decryption function, vfs encryption/decryption module core function is mainly as shown in table 1:
Table 1 core encryption function table
Generate VFS dynamic link library my_encrypt.so after this code compilation and leave the position at VFS module place in, after restarting samba service, can load and come into force.
The announcement of book and instruction according to the above description, those skilled in the art in the invention can also carry out suitable change and amendment to above-mentioned execution mode.Therefore, the present invention is not limited to embodiment disclosed and described above, also should fall in the protection range of claim of the present invention modifications and changes more of the present invention.In addition, although employ some specific terms in this specification, these terms just for convenience of description, do not form any restriction to the present invention.

Claims (6)

1., based on an electric power data method for secure storing for cloud computing, it is characterized in that, it comprises the steps:
(1) user is linked into visit data in cloud computing framework by service interface application cloud memory space, selects data the need of encryption simultaneously;
(2) distribute cloud memory space to user, if data need encryption, then according to algorithm assigns key, and deposit the mapping relations of this memory space and key;
(3), after cloud memory allocation completes, notify that user enables cloud storage resources;
(4) user stores according to the trafficwise access cloud of application, when user writes data, the encrypt data after encryption will be landed within the storage system by encryption;
(5), when the validated user that business allows reads described cloud memory space data, decrypted being reduced into of the data block of encryption expressly returns to user interface.
2. according to the electric power data method for secure storing of claim 1 based on cloud computing, it is characterized in that, deciphering in encryption in step (4) and step (5) is the safe encryption and decryption done based on memory space and content, and complete when the write of data reads, safety and service interface are done decoupling zero simultaneously.
3. according to the electric power data method for secure storing of claim 1 based on cloud computing, it is characterized in that, in step (1), also comprise:
(101) each service interface controls the access of user by the access control mechanisms of self, for each user distributes addressing space, and does access limit control;
(102), when user is by service interface access respective path, if validated user, then the file system interface that can be stored by secure cloud has access to correct content; If disabled user, then at MAC layer authentification failure, be then encrypted content under the cloud store path that this user browses, real business datum cannot be obtained.
4. according to the electric power data method for secure storing of claim 1 based on cloud computing, it is characterized in that, in step (2), also comprise the management process of key:
(201) key management entrance is provided, supports generation and the amendment of key;
(202) when secret generating or amendment, perform backup operation, by secret key encryption backup in safety zone, be separated with data storage;
(203) by the key that escape way periodic synchronization memory space is corresponding, key distribution is completed;
(204) when user writes data, encrypting module writes storage medium by corresponding path key by after data encryption process;
(205) when user reads data, deciphering module by after data deciphering process, returns to user by respective path.
5., according to the electric power data method for secure storing of claim 4 based on cloud computing, it is characterized in that, also comprise: the initial owner of store path is set as key owners, key owners possesses the administration authority to key; Other are to the sharer in memory space path, and key only can be used to do encryption and decryption data.
6. according to the electric power data method for secure storing of claim 1 based on cloud computing, it is characterized in that, described service interface is samba service data visitation interface, and after the data that samba service data visitation interface transmits are done encryption and decryption by a data security encryption/decryption module, write stores or returns to application layer after deciphering.
CN201510874603.9A 2015-12-02 2015-12-02 Cloud computing-based electric power data secure storage method Pending CN105516117A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201510874603.9A CN105516117A (en) 2015-12-02 2015-12-02 Cloud computing-based electric power data secure storage method

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201510874603.9A CN105516117A (en) 2015-12-02 2015-12-02 Cloud computing-based electric power data secure storage method

Publications (1)

Publication Number Publication Date
CN105516117A true CN105516117A (en) 2016-04-20

Family

ID=55723754

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201510874603.9A Pending CN105516117A (en) 2015-12-02 2015-12-02 Cloud computing-based electric power data secure storage method

Country Status (1)

Country Link
CN (1) CN105516117A (en)

Cited By (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106330869A (en) * 2016-08-15 2017-01-11 江苏敏捷科技股份有限公司 Data security protection system and method based on cloud application
CN106385454A (en) * 2016-09-18 2017-02-08 安徽爱她有果电子商务有限公司 Network computing storage system based on cloud storage
CN107682329A (en) * 2017-09-26 2018-02-09 国网上海市电力公司 A kind of electric power data transmission storage method and device
CN108322451A (en) * 2018-01-12 2018-07-24 深圳壹账通智能科技有限公司 Data processing method, device, computer equipment and storage medium
CN109543415A (en) * 2018-11-20 2019-03-29 南方电网科学研究院有限责任公司 Safe operating system architecture
CN109586924A (en) * 2019-01-02 2019-04-05 大连理工大学 A kind of intelligent distribution network data safe transmission method based on cloud computing
CN109784079A (en) * 2019-01-28 2019-05-21 广州供电局有限公司 A kind of user data protection method for power industry
CN110880986A (en) * 2019-10-30 2020-03-13 烽火通信科技股份有限公司 High-availability NAS storage system based on Ceph
CN112134943A (en) * 2020-09-21 2020-12-25 李波 Internet of things cloud storage system and method
CN112579549A (en) * 2020-12-14 2021-03-30 浪潮云信息技术股份公司 CephFS file protocol sharing system, construction method and implementation method
CN114257606A (en) * 2021-12-13 2022-03-29 阿里巴巴(中国)有限公司 Data processing method, file management system, storage medium, and program product
CN115171279A (en) * 2022-07-07 2022-10-11 杭州正华电子科技有限公司 Remote electricity meter card payment management method, system and readable medium

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102611711A (en) * 2012-04-09 2012-07-25 中山爱科数字科技股份有限公司 Cloud data safe storing method
CN103107995A (en) * 2013-02-06 2013-05-15 中电长城网际系统应用有限公司 Cloud computing environmental data secure storage system and method
CN104767745A (en) * 2015-03-26 2015-07-08 浪潮集团有限公司 Cloud data security protection method
CN105100248A (en) * 2015-07-30 2015-11-25 国家电网公司 Cloud storage security realization method based on data encryption and access control

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102611711A (en) * 2012-04-09 2012-07-25 中山爱科数字科技股份有限公司 Cloud data safe storing method
CN103107995A (en) * 2013-02-06 2013-05-15 中电长城网际系统应用有限公司 Cloud computing environmental data secure storage system and method
CN104767745A (en) * 2015-03-26 2015-07-08 浪潮集团有限公司 Cloud data security protection method
CN105100248A (en) * 2015-07-30 2015-11-25 国家电网公司 Cloud storage security realization method based on data encryption and access control

Cited By (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106330869A (en) * 2016-08-15 2017-01-11 江苏敏捷科技股份有限公司 Data security protection system and method based on cloud application
CN106385454A (en) * 2016-09-18 2017-02-08 安徽爱她有果电子商务有限公司 Network computing storage system based on cloud storage
CN107682329A (en) * 2017-09-26 2018-02-09 国网上海市电力公司 A kind of electric power data transmission storage method and device
CN108322451B (en) * 2018-01-12 2020-09-22 深圳壹账通智能科技有限公司 Data processing method, data processing device, computer equipment and storage medium
CN108322451A (en) * 2018-01-12 2018-07-24 深圳壹账通智能科技有限公司 Data processing method, device, computer equipment and storage medium
CN109543415A (en) * 2018-11-20 2019-03-29 南方电网科学研究院有限责任公司 Safe operating system architecture
CN109586924A (en) * 2019-01-02 2019-04-05 大连理工大学 A kind of intelligent distribution network data safe transmission method based on cloud computing
CN109784079A (en) * 2019-01-28 2019-05-21 广州供电局有限公司 A kind of user data protection method for power industry
CN110880986A (en) * 2019-10-30 2020-03-13 烽火通信科技股份有限公司 High-availability NAS storage system based on Ceph
CN112134943A (en) * 2020-09-21 2020-12-25 李波 Internet of things cloud storage system and method
CN112134943B (en) * 2020-09-21 2023-08-22 李波 Internet of things cloud storage system and method
CN112579549A (en) * 2020-12-14 2021-03-30 浪潮云信息技术股份公司 CephFS file protocol sharing system, construction method and implementation method
CN114257606A (en) * 2021-12-13 2022-03-29 阿里巴巴(中国)有限公司 Data processing method, file management system, storage medium, and program product
CN114257606B (en) * 2021-12-13 2024-03-29 阿里巴巴(中国)有限公司 Data processing method, file management system, storage medium, and program product
CN115171279A (en) * 2022-07-07 2022-10-11 杭州正华电子科技有限公司 Remote electricity meter card payment management method, system and readable medium

Similar Documents

Publication Publication Date Title
CN105516117A (en) Cloud computing-based electric power data secure storage method
CN102394894B (en) Network virtual disk file safety management method based on cloud computing
CN113961535A (en) Data trusted storage sharing system and method based on block chain
CN110268691A (en) Alliance&#39;s block chain network with verified block chain and common recognition agreement
CN111709056A (en) Data sharing method and system based on block chain
CN105718794B (en) The method and system of safeguard protection are carried out to virtual machine based on VTPM
CN106055993A (en) Encryption storage system for block chains and method for applying encryption storage system
CN113132103A (en) Data cross-domain security sharing system and method
CN112835977B (en) Database management method and system based on block chain
CN104102483A (en) Method and system for securely using public services for private or enterprise purposes
CN103366135A (en) Tenant driven security system and method in a storage cloud
CN102546788A (en) Cloud platform management method and cloud platform
CN102427447A (en) Method of sharing identity authentication information among tax cloud computing systems
CN104092743B (en) The guard method of user data and system under cloud environment
CN106716968A (en) Account management method, device and account management system
CN106131225A (en) The security system accessed for medical treatment case information
CN103209189A (en) Distributed file system-based mobile cloud storage safety access control method
CN105100248A (en) Cloud storage security realization method based on data encryption and access control
CN107302524A (en) A kind of ciphertext data-sharing systems under cloud computing environment
WO2023011140A1 (en) Forest resource one-graph quality inspection logic rule update method, system and cloud platform
GB2599043A (en) Encrypted knowledge graph
CN113127927B (en) Attribute reconstruction encryption method and system for license chain data sharing and supervision
CN113407626B (en) Planning management and control method based on blockchain, storage medium and terminal equipment
CN106161654A (en) A kind of cloud educational system
CN106254510A (en) The Internet financial resources integrates shared system

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
RJ01 Rejection of invention patent application after publication

Application publication date: 20160420

RJ01 Rejection of invention patent application after publication