JP4515860B2 - Data falsification prevention method in write-once storage means - Google Patents

Description

  The present invention relates to a technique for preventing data tampering in write-once storage such as a write-once type magnetic disk, magnetic tape, and optical disk.

  Security issues in computer systems include data falsification and information leakage, and various countermeasures have been implemented in OSs, applications, and networks. In the field of data storage, write-once type magnetic disks, magnetic tapes, and optical disks have come into the world as a final barrier in system security to deal with these risks.

  Write once is a data storage method in which data once written cannot be updated or deleted again. When considering the storage implementation method, write once on a physical raw device and write on a file system. There is once.

  In the case of magnetic tapes and optical disks, data writing is generally a write-once method at the raw device level, and an already written area cannot be overwritten. When a write-once is implemented in the file system, the file level is updated at the driver level. And a method for controlling deletion.

  In the case of a magnetic disk, when write once is implemented in the file system, the update and deletion of the file unit is controlled at the driver level in the same manner as the magnetic tape or optical disk, but when write once is implemented at the raw device level. The volume write-once method is adopted in which after a certain amount of data has been written, update and deletion of the written area are explicitly prohibited.

In write-once storage, the file write-once method provides a high level of security at the file system level, but the physical low device level is vulnerable to external attacks, while the volume write-once method provides a physical low device level of security. Although it is expensive, until the update or delete is prohibited, each file in the unlocked area is vulnerable to external attacks. In addition, there exists a technique of the following patent document 1 as a prior art relevant to this invention.
JP 2002-207623 A

  When the volume write-once method is used for write-once storage of a magnetic disk, the volume is generally prohibited from being updated or deleted when the data reaches a certain size. If updating and deleting are prohibited in units of files, updating is prohibited even in an area where data has not been written yet, so the storage capacity cannot be used effectively. Therefore, until the volume is full and deletion and update are prohibited, the attack from the outside becomes defenseless.

  If the file write-once method is used, the security of only the file being written may be considered, but the volume write-once method increases the amount of data and time exposed to external attacks compared to the file write-once method. The issue is how to secure the security until the deletion is prohibited.

  In view of the above-described problems in the prior art, the present invention has a high security level and high-speed search without exposing data to volume write-once magnetic disks until the volume is updated or deleted. The purpose is to realize storage.

  In order to achieve the above object, according to the present invention, a volume write-once storage means (for example, a magnetic disk) is exclusively used for retrieval, data is stored, and is not disclosed to the public until update and deletion are prohibited. To do.

  Confirmed data managed by a general server is backed up in a write-once type storage means (for example, magnetic tape), and at that time, a hash value is stored in units of files (for example, an optical disk). Save to. When reading the file, the hash value is used to check the tampering of the read data. Here, when tampering is detected, data is recovered from the write-once storage means that has been backed up. When the data reaches a certain size, the data is restored from the backup write-once storage unit to the volume write-once storage unit, the update and deletion are prohibited, and the volume is made available for retrieval.

  According to the present invention, it is possible to realize a high-speed search storage with a high security level without exposing the data until the volume update / deletion is prohibited to the volume write-once storage means. In particular, when a magnetic disk device or the like is used as a volume write-once type storage means, since one volume is large in the volume write-once type magnetic disk device, the volume becomes full until update and deletion are prohibited. Security during the period will be a problem. According to the present invention, since the file is backed up once in a write-once type magnetic tape device or the like and the tampering check is performed based on the hash value when there is a read request, the security of the period can be maintained.

  Hereinafter, an embodiment for carrying out the present invention will be specifically described with reference to the drawings.

  FIG. 1 shows the basic configuration of the system of this embodiment. In the server 1, data is stored in the volume 101 under the document management software 102. The server 1 is connected with the tape drive 2 via the SCSI or Fiber channel 105, the write once array disk 3 as volume write-once storage via the SCSI or Fiber channel 104, and the single optical disk drive 4 via the SCSI or Fiber channel 106, respectively. Yes. In the tape drive 2, write-once (file write-once) magnetic tapes 121, 122, and 123 are sequentially loaded, and the backup software 103 collects a backup of the volume 101. The write-once disk 3 is composed of volumes 131, 132, 133. The write-once tapes 121, 122,... And the write-once array disk 3 volumes 131, 132,. In the following, that case is assumed. In addition, a write-once optical disc 140 is mounted on the optical disc unit drive 4 as a hash value storage medium.

  FIGS. 2 and 3 are a block diagram and a flowchart showing an operation procedure when a data registration request is received in the system of FIG. When the data registration request 201 is received, the data is written into the volume 101 by the document management software 102 (202 in FIG. 2, step 301). When the file to which the data is written is determined, the data is backed up to the write-once tape 121 by the backup software 103 for each file (203 in FIG. 2, step 302). At that time, a hash value is created for each file and added to the write-once optical disc 401 (204 in FIG. 2).

  In the course of this processing, the document management software 102 writes the file ID for each file, the access path on the volume 101, the device ID of the backed-up write-once tape, and the calculated hash value in the file management table. The file name on the once optical disc 140 is stored. FIG. 4 shows details of each item of the file management table managed by the document management software 102.

  When it is detected that the write-once tape 121 is full (step 303), the document management software 102 temporarily waits for I / O from the host (step 304) and uses the backup software 103. Thus, data is restored from the write-once tape 121 to the volume 131 of the write-once array disk 3 (205 in FIG. 2, step 305). Here, the hash value calculated for each file is compared with the hash value stored in the write-once optical disc 140, and if there is no problem, update and deletion of the restored volume 131 is prohibited (step 306). Therefore, each backed up file on the volume 101 is deleted once, and a link file indicating the path on the restored volume 131 is recreated with the same name as the original file name (step 307). At this time, the file management table of FIG. 4 also stores the actual file name on the volume 131 for each file, and sets a migrated flag. When this process is completed, the I / O waiting state from the host is released, thereby releasing the volume 131 (step 308).

  When the waiting time due to the above processing becomes long, the processing for restoring data from the write-once tape 121 to the volume 131 is run asynchronously, and only the processing for creating the link file from the volume 101 to the volume 131 is executed from the upper level. It is possible to shorten the waiting time by locking the I / O of the file and the link file creation process by locking in units of files.

  Next, a case where there is a READ request will be described with reference to FIGS. If there is a READ request 501, the document management software 102 confirms the migrated flag in the file management table of FIG. 4 (step 601), and determines whether the data has been migrated to the write-once array disk 3. (Step 602). If the flag is not set, it means that the file exists in the volume 101, so the data is read from the volume 101 and the hash value is calculated (503 in FIG. 5, step 603). The calculated hash value is compared with the hash value of the write-once optical disc 401 (502 in FIG. 5, step 604). If there is no problem (Yes in step 605), the data is returned to the READ request source (step 609). ). However, when tampering is detected (No in step 605), data is returned from the write-once tape 121 using the backup software 103 (505 in FIG. 5, step 606), and returned to the READ request source (step 607). ). When tampering is detected, the fact is notified to the READ requester or system administrator by e-mail and the log is also kept. Regarding log storage, a method of using the write-once optical disc 401 is also conceivable.

  If the flag is set in step 602, it means that the data has been transferred to the write-once array disk 3, so the data read from the write-once array disk 3 is returned to the READ request source as it is (arrows 504 to 503 in FIG. 5, step 608). .

  The file name on the write-once optical disk 140 storing the hash value and the device ID of the write-once tape that has been backed up can be acquired from the file management table in FIG. The access path name in the file management table is used for recovery processing when the link file of the volume 101 is broken.

  Here, even if the file entity has been transferred to the volume 131, the volume 101 can be transparently accessed from the volume 101 to the secure and safe volume 131, and the data that has not been tampered with can be returned to the host at high speed. Further, by storing not only the substance of the volume 101 but also the path name on the volume 131, recovery processing when the file management table shown in FIG.

  Similarly, data registration and processing for a READ request can be continued. FIG. 7 shows the flow when switching to the next write-once tape or volume. As shown in FIG. 7, in response to the data registration request 701, the data is continuously written to the volume 101 on the server 1 (703), and the confirmed data is backed up to the write-once tape 122 in units of files (704). ). When the write-once tape 122 becomes full, data is restored from the write-once tape 202 to the volume 132 of the write-once array disk 3 (705), and updating and deletion are prohibited. Similarly, the access path of the file backed up in the volume 101 is left as it is, and the volume 132 is released by changing the entity from the volume 101 to the volume 132.

  By moving the real area of the file from the volume 101 to the write-once array disk 3 without changing the access path, the need for the document management software 102 to consider the full error of the volume 101 is also eliminated.

  In the above embodiment, the write-once optical disk 140 on a single drive has a capacity of about 23 GB, for example, and if only a hash value is stored, there is no capacity problem in the case of a normal file server. If it exceeds 23 GB, a new single drive is connected or the optical disk library is used to store the hash value on the next write-once optical disk.

1 is a schematic configuration diagram showing an entire system according to an embodiment of the present invention. Data flow diagram when there is a data registration request Flow chart when there is a data registration request The figure which shows the file management table which the document management software 102 manages Data flow diagram when there is a data READ request Flow chart when there is a data READ request Data flow diagram for data registration and READ requests

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... Server, 101 ... Volume on server 1, 102 ... Document management software on server 1, 103 ... Backup software on server 1, 104 ... SCSI or Fiber interface for connecting server 1 and tape drive device 2, 105 ... SCSI or Fiber interface for connecting the server 1 and the write-once array disk 3, 106... SCSI or Fiber interface for connecting the server 1 and the single optical disk drive 4, 2... Tape drive device, 121 to 123. Once array disk, 131 to 133: Volume of write once array disk, 4: Single optical disk drive, 140: Write once optical disk.

Claims (7)

A method for preventing data tampering in a write-once storage means,
Backup means provided in the computer, backup the data stored in a normal rewritable storage to a write-once backup storage means;
Detecting means provided in the computer, detecting that a predetermined amount of data has been backed up in the backup storage means;
When a predetermined amount of data is backed up in the backup storage unit, a transfer unit included in the computer copies the predetermined amount of data backed up in the backup storage unit to a predetermined volume write-once storage unit When,
A method for preventing data falsification in the write-once storage unit, comprising: a step of disabling update of the volume write-once storage unit after the copying, and disclosing the volume write-once storage unit for search. In the data tampering prevention method in the write-once storage means according to claim 1,
The backup storage means is a file write-once storage means, and a data alteration prevention method in the write-once storage means. In the data tampering prevention method in the write-once storage means according to claim 1,
When the data stored in the rewritable storage is backed up to the backup storage means, the hash value calculation means provided in the computer calculates the hash value of the data to be backed up and stores the predetermined write-once hash value storage A method for preventing data tampering in a write-once storage unit, further comprising the step of saving to a medium. In the data tampering prevention method in the write-once storage means according to claim 3,
When the data is read, if the data is stored in the rewritable storage, the hash value of the stored data is calculated, and the hash value of the data stored in the hash value storage medium A data tampering prevention method in a write-once storage unit, wherein tampering is checked by confirming that they match. In the data tampering prevention method in the write-once storage means according to claim 4,
A data falsification preventing method in a write-once storage unit, wherein the data is restored from the write-once backup storage unit when it is determined in the falsification check that the data has been falsified. In the data tampering prevention method in the write-once storage means according to claim 1,
The backup storage means is a file write-once magnetic tape device,
The volume write-once type storage means is a volume write-once type magnetic disk device, and the data alteration prevention method in the write-once storage means. In the data tampering prevention method in the write-once storage means according to claim 6,
One storage capacity of the magnetic tape device and the storage capacity of one volume of the volume write-once magnetic disk device are substantially the same size, and when data is backed up for one of the magnetic tape devices, A data falsification preventing method in a write-once storage means, wherein one piece of data is copied to one volume of the volume write-once type magnetic disk device.

Images