KR101225903B1 - User terminal device based on client hypervisor and method for encoding/decoding file on virtual machine, and system comprising the device - Google Patents

Abstract

A client hypervisor-based user terminal device and a file encryption / decryption method on a virtual machine thereof, and a file encryption / decryption system on a virtual machine including the same are disclosed. The user terminal device according to an embodiment of the present invention, in the user terminal device having a virtual machine, by using a key corresponding to the location of the user terminal device, at least one encrypted file operating on the virtual machine It includes a decoding unit for decoding. Thereby, it is possible to provide a virtual desktop model that can maintain confidential information.

Description

User terminal device based on client hypervisor and method for encoding / decoding file on virtual machine, and system configuring the device}

The present invention relates to a client hypervisor-based user terminal device and a file encryption / decryption method on a virtual machine, and a file encryption / decryption system on a virtual machine, including the same. The present invention relates to a client hypervisor-based user terminal device and a file encryption / decryption method on a virtual machine thereof, and a file encryption / decryption system on a virtual machine including the same.

As virtualization technology has evolved, a client can download and use a plurality of logical virtual machines from a central server on a single physical terminal by using a client hypervisor technology that introduces a hypervisor technology used in a server to a client. Desktop models are in the spotlight. In such a virtual desktop model, since the virtual machine can be used anytime and anywhere, there is a concern that confidential information may leak from a virtual machine having confidential information.

As the virtual desktop model has such fatal problems, a method of encrypting a file on a virtual machine has been proposed. For example, there is a Diffie-Hellman key exchange (hereinafter referred to as "DH technology") that provides a file / disk encryption function based on user authentication. DH technology is for sharing secrets or exchanging symmetric keys between two different users A and B. User A generates a symmetric key using A's private key and public B's public key, which only he knows. User B generates a symmetric key using only B's private key and public A's public key. The symmetric keys generated by A and B coincide with each other. This symmetric key is used to encrypt communication and files. At this time, a user other than A and B does not know the secret keys of A and B, and thus cannot generate a symmetric key.

However, there are some problems in applying the DH technology to the client hypervisor. First, unlike a server-based computing environment where all encryption and decryption keys are managed inside a secure data center, the client hypervisor is a virtual machine that exists in the user terminal, so the encryption and decryption key must be downloaded to the user terminal. . There is a risk of confidential information leaking during the download process. Secondly, if the network connection between the user terminal device and the server is smooth, this is not a problem. However, when the network is disconnected between the user terminal device and the server, there is a problem in that both databases are not synchronized. Therefore, while solving the above problems, a technique for effectively encrypting and decrypting files on a virtual machine is required.

The present invention provides a client hypervisor-based user terminal device and a client hyper-based device, which encrypts and decrypts a file on a virtual machine using a key according to the location of the user terminal device, thereby allowing the authorized user to use the file on the virtual machine only at an authorized place. An object of the present invention is to provide a file encryption / decryption method on a virtual machine and a file encryption / decryption system on a virtual machine including the same.

According to an embodiment of the present invention, in a user terminal device having a virtual machine, a decryption unit for decrypting at least one encrypted file operating on the virtual machine by using a key corresponding to the location of the user terminal device It provides a user terminal device comprising a.

The decryption unit may decrypt the file using a key corresponding to the changed position when the position of the user terminal apparatus changes.

The user terminal device according to an embodiment of the present invention further includes a terminal-side key management database storing the encrypted key corresponding to each position, wherein the decryption unit is configured to store the encrypted key from the terminal-side key management database. The file can be extracted and decrypted.

The encrypted key may be encrypted by a local secret key and a user public key corresponding to the location of the user terminal device.

The decryption unit may decrypt the extracted encrypted key using a user secret key and a local public key, and decrypt the file using the decrypted key.

If there is no encrypted key corresponding to the location of the user terminal device in the terminal-side key management database, the decryption unit requests a key transmission to a management server connected to the user terminal device through a network. The file may be decrypted using an encrypted key received from the management server.

The decryption unit may decrypt the encrypted key received from the management server using at least one key corresponding to the location of the user terminal device, and decrypt the file with the decrypted key.

The at least one key may include a user private key and a local public key.

A user terminal device according to an embodiment of the present invention, the network detecting unit for detecting a network connection state; And a virtual machine manager requesting a location tracking of the user terminal device to a management server connected to the network and receiving the requested location information from the management server when the network connection state is online.

The user terminal device according to an embodiment of the present invention may further include a terminal-side synchronization unit for synchronizing the server-side key management database and the terminal-side key management database of the management server.

The user terminal device according to an embodiment of the present invention may further include a recording unit for recording the usage history of the file in a usage history database.

The user terminal device according to an embodiment of the present invention may further include a violation detection unit detecting a violation of a management policy stored in the terminal-side key management database among the usage records recorded in the usage history database.

The violation detection unit may transmit the detected violation to the management server when the violation is detected in the usage history while the network connection state is offline.

According to an embodiment of the present invention, a method for decrypting a file operating on a virtual machine, the method comprising: extracting a key corresponding to a location of a terminal apparatus on which the virtual machine is installed; And decrypting an encrypted file operating on the virtual machine by using the extracted key.

File decoding method on a virtual machine according to an embodiment of the present invention, the step of detecting the location of the terminal device is installed; The extracting may further include extracting a logical region to which the detected location of the terminal device belongs, and extracting a key corresponding to the extracted logical region.

The file decryption method on the virtual machine according to an embodiment of the present invention further comprises the steps of: extracting a key corresponding to the changed position when a change in the position of the terminal apparatus occurs; The file can be decrypted using a key.

The method for decrypting a file on a virtual machine according to an embodiment of the present invention may further include storing at least one encrypted key corresponding to each location, wherein the decrypting comprises the terminal device among the stored encrypted keys. An encrypted key corresponding to the position of may be extracted, and the file may be decrypted using the extracted key.

The encrypted key may be encrypted by at least one key including a local secret key corresponding to the location of the user terminal device.

In the decrypting, the extracted encrypted key may be decrypted using a local public key, and the file may be decrypted using the decrypted key.

The encrypted key is encrypted by at least a local secret key and a user public key corresponding to the location of the user terminal device, and the step of decrypting

The extracted encrypted key can be decrypted using a local public key and a user secret key, and the file can be decrypted using the decrypted key.

In the file decryption method on a virtual machine according to an embodiment of the present invention, when the key corresponding to the location of the terminal device does not exist in the terminal device, the location of the terminal device from a management server connected to the terminal device through a network. The method may further include receiving a key corresponding to the.

The key received from the management server may be encrypted by at least one key.

The at least one key may include a user public key and a local secret key.

The file decryption method on the virtual machine according to an embodiment of the present invention may further include recording the usage history of the file in a usage history database.

In the file decryption method on a virtual machine according to an embodiment of the present invention, when the key corresponding to the location of the terminal device does not exist in the terminal device, the location of the terminal device from a management server connected to the terminal device through a network. Receiving an encrypted key corresponding to the, and the step of decrypting the encrypted key received from the management server using at least one key, and using the decrypted key on the virtual machine You can decrypt a working file.

The at least one key may include a user private key and a local public key.

According to an embodiment of the present invention, a user terminal device having a virtual machine, comprising a decryption unit for decrypting at least one encrypted file operating on the virtual machine using a key corresponding to the location of the user terminal device. The user terminal device; And a management server which holds a key corresponding to the location and encrypts the key corresponding to the reserved location when the request is received from the user terminal device. Provided is a file decryption system on a virtual machine including a user terminal device comprising a.

When the user terminal device does not have a key corresponding to the location of the user terminal device, the user terminal requests a key transmission to the management server, and the management server stores the key corresponding to the location of the user terminal device as a local secret key and Encrypted with the user public key can be transmitted to the user terminal device.

According to an embodiment of the present invention, a method for encrypting a file operating on a virtual machine, the method comprising: generating a key corresponding to a location of a terminal apparatus on which the virtual machine is installed; And encrypting a file operating on the virtual machine using the extracted key.

A client hypervisor-based user terminal device and a file encryption / decryption method on a virtual machine according to an embodiment of the present invention, and a file encryption / decryption system on a virtual machine including the same, can be used at any time and anywhere in a virtual desktop model. Therefore, by decrypting the file using a region-specific key according to the current location of the user terminal device in which the virtual machine is installed, only the authorized user can use the virtual machine in the authorized place. Therefore, there is an effect that can prevent leakage of confidential information by the file on the virtual machine.

In addition, a client hypervisor-based user terminal device and a file encryption / decryption method on a virtual machine, and a file encryption / decryption system on a virtual machine including the same, the encryption / decryption process for a key and a file may be performed. As it happens inside the client hypervisor, the file can be decrypted regardless of the type of guest operating system on the virtual machine, and the convenience is increased from the user's point of view because it does not go through a separate process for file security. There is.

1 is a block diagram of a file encryption / decryption system on a virtual machine according to an embodiment of the present invention;
2 is a flowchart illustrating a file encryption / decryption method on a virtual machine according to an embodiment of the present invention;
3 is a flowchart illustrating a file encryption / decryption method on a virtual machine according to an embodiment of the present invention; and
4 is a diagram illustrating an encryption and decryption process according to an embodiment of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The above and other objects, features, and advantages of the present invention will become more readily apparent from the following description of preferred embodiments with reference to the accompanying drawings. However, the present invention is not limited to the embodiments described herein but may be embodied in other forms. Rather, the embodiments disclosed herein are provided so that the disclosure can be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. In this specification, when an element is referred to as being on another element, it may be directly formed on another element, or a third element may be interposed therebetween.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. In the present specification, the singular form includes plural forms unless otherwise specified in the specification. The terms "comprises" and / or "comprising" used in the specification do not exclude the presence or addition of one or more other elements.

Hereinafter, the present invention will be described in detail with reference to the drawings. In describing the specific embodiments below, various specific details have been set forth in order to explain the invention in greater detail and to assist in understanding it. However, those skilled in the art can understand that the present invention can be used without these various specific details. In some cases, it is mentioned in advance that parts of the invention which are commonly known in the description of the invention and which are not highly related to the invention are not described in order to prevent confusion in explaining the invention without cause.

1 is a block diagram of a file encryption / decryption system on a virtual machine according to an embodiment of the present invention.

Referring to FIG. 1, a file encryption / decryption system on a virtual machine according to an embodiment of the present invention may include a user terminal device 100 and a management server 200 that communicate with each other through a network. Here, the network connecting the user terminal device 100 and the management server 200 collectively is a wired or wireless communication network, and is not limited to the type of communication network.

The user terminal 100 may be a device using an operating system (OS), that is, a device capable of simultaneously or simultaneously operating at least one operating system, and any device capable of guaranteeing resource distribution and independent operation among several operating systems. Applicable For example, a typical computer device and a smartphone may be applied to the user terminal device 100.

The user terminal device 100 may include a hardware platform 110, a client hypervisor unit 120, and a user module 130.

The hardware platform 110 may include actual hardware devices including storage devices such as hard disks, input devices such as keyboards and mice, output devices such as speakers and displays, and the like. In the present embodiment, the hardware platform 110 may include a terminal-side key management database (DB) 112, a terminal-side location information DB 113, and a usage history DB 114.

The terminal-side key management DB 112 is a database that stores keys used for file decryption, and stores each key for each logical region (or 'logical location') stored in the terminal-side location information DB 113. It may be.

Specifically, the terminal-side key management DB 112 according to an embodiment of the present invention includes a secret key of the user of the terminal device, at least one local public key and its list, and a symmetric key downloaded from the management server 200. You can save the list. Here, the symmetric key downloaded from the management server 200 may be a symmetric key encrypted by at least one key including a local secret key. For example, it may be a symmetric key encrypted by a local secret key and a user public key.

The terminal-side key management DB 112 may store a list of local public keys and a symmetric key list, but the terminal-side key management DB 112 does not necessarily need to store the list because it is for convenience of searching.

In the terminal-side key management DB 112 according to an embodiment of the present invention, local public keys may be stored corresponding to respective logical regions. Alternatively, local public keys may be stored corresponding to respective physical locations (or regions). In this case, the physical location would not need to be converted to a logical area.

The symmetric key (or encrypted symmetric key) stored in the terminal-side key management DB 112 according to an embodiment of the present invention may be stored corresponding to each logical region.

In addition, the terminal-side key management DB 112 may be updated at any time by the interworking of the terminal-side synchronization unit 124 and the server-side synchronization unit 210 to be described later, for example, to the terminal-side key management DB 112. The local public key and the list stored therein and the local secret key and the list stored in the management server 200 may be synchronized with each other and updated from time to time.

The key (for example, a key used for encrypting or decrypting a file) stored in the terminal-side key management DB 112 may be an encrypted key. According to an embodiment of the present invention, the encrypted key may be encrypted by at least one key including a local secret key. For example, it may be encrypted with a local secret key and a user public key.

 The terminal-side key management DB 112 may also store a management policy transmitted from the management server 200. Here, although the terminal-side key management DB 112 has been described as storing both the encrypted key and the management policy, this is merely illustrative and stores both of them, such as a DB storing the encrypted key and a DB storing the management policy. Configuration may also be possible.

The terminal-side location information DB 113 is a database that stores cross-mapping information of physical locations and logical areas, and is used when the location determining unit 111 detects a location to extract a logical area (ie, a logical location). In addition, the terminal side location information DB 113 may be updated at any time by the interworking of the terminal side synchronization unit 124 and the server side synchronization unit 210.

The usage history DB 114 is a database that stores usage history when the network between the user terminal 100 and the management server 200 is disconnected and is offline. The usage history of the key used for file encryption and decryption during offline operation is used. , A time using a key, a location of the user terminal device 100 when a key is used, an operation type for a file, for example, reading or writing, a path name of a target file, and an encrypted value of a used key may be stored. . Here, the usage history that can be stored in the usage history DB 114 is merely an example, and is not necessarily limited thereto. That is, in addition to the above-described details, more usage history may be stored. The usage history stored in the usage DB 114 may be used when the violation detection unit 126 detects a violation later.

The client hypervisor 120 may operate the user virtual machine 131. The term 'actuating' herein may be used as the same meaning as 'allocating resources', 'activating' or 'activating'.

In the present exemplary embodiment, one user virtual machine 131 is illustrated on the client hypervisor 120 for convenience of description, but a plurality of user virtual machines 131 may be actually installed. When the plurality of user virtual machines 131 are installed on the client hypervisor unit 120, the client hypervisor unit 120 may be installed in at least one user virtual machine 131 to operate among the plurality of user virtual machines 131. You can allocate resources. Therefore, when a plurality of user virtual machines are installed, the present invention can be applied to files operating on each virtual machine. Meanwhile, the present invention is not necessarily applied to all of the plurality of virtual machines, and the present invention may be applied only to files operating on specific virtual machine (s) according to the security policy.

The client hypervisor unit 120 includes a location determiner 111, a virtual machine manager 121, a network detector 122, a decoder 123, a terminal side synchronizer 124, a recorder 125, and a violation. The item detection unit 126 may be included.

The location determiner 111 extracts (ie, determines) a logical area based on the physical location of the user terminal device 100. The location determining unit 111 uses a physical location obtained from a location information acquisition device such as a GPS receiver (not shown). Specifically, the location determining unit 111 uses a location information stored in the terminal location information DB 113 to provide a logical location. Can determine the local area. Here, the logical area may be a concept of dividing logical spaces such as an office, a lobby, and a conference room.

As a method of determining the physical position by the position determining unit 111, various known techniques may be used. For example, you can selectively apply one of the following methods: network management tools that can be located via IP, Wi-Fi (Wireless Fidelity), ZigBee, and Global Positioning System (GPS). Can be. However, this is only an example, and any method not described herein may be applied to anything that can detect the physical location of the user terminal device 100.

According to an embodiment of the present invention, if the position change of the user terminal device 100 occurs, the position determiner 111 may transmit information about the changed position to the decoder 123. According to another embodiment of the present invention, the location determiner 111 may transmit information about the location of the terminal device 100 to the decoder 123 when a request is received from the decoder 123. According to another exemplary embodiment, the location determiner 111 may periodically transmit information about the location of the terminal device 100 to the decoder 123. Here, the information on the location may be for a logical area, but in some embodiments, may be information about a physical location. In the case of information about the physical location, the physical location and the local key (local public key and local secret key) should correspond to each other.

The virtual machine manager 121 monitors the state of the user virtual machine and controls the state, thereby controlling the overall functions of the user virtual machine 131. In addition, the virtual machine manager 121 may request location tracking to the location determiner 111 or request network confirmation to the network detector 122 when a user request for a specific file is input from the user. . Here, the user's request for using the file may mean requesting an operation such as creating, reading, or modifying the file.

The network detector 122 continuously monitors a connection state of a network connecting the user terminal device 100 and the management server 200 to detect whether the network connection state is offline or online.

The decryption unit 123 decrypts a file operating on a virtual machine. Here, the decryption unit 123 may decrypt the file using a key corresponding to the current position of the user terminal device 100 (or according to the current position).

According to an embodiment of the present invention, the position corresponding to the key may be a "physical position" or a "logical position". And, "location information" means any information indicating the location of the user terminal device 100, for example, information about the physical location or information about the logical location or used to mean all of them. Can be.

According to an embodiment of the present invention, keys may correspond to "logical locations". However, it is not excluded that the key is configured to correspond to the "physical position" as described above.

 The "key" corresponding to the position may be the "symmetric key" and the "local key" referred to in the present invention. Here, the 'symmetric key' is a key used when encrypting or decrypting a file operating on a virtual machine, and the 'local key' can be used when encrypting or decrypting a 'symmetric key'. The 'local key' may include, for example, a 'local public key' and a 'local secret key'. The 'symmetric key' is encrypted using the 'local secret key', and the symmetric key thus encrypted is referred to as the 'local public key'. Can be decrypted using '.

When the local key corresponds to each of the "logical locations" described above, mapping data (or information) corresponding to "physical location" and "logical location" is required, and the mapping data is the terminal side location information DB 113. ) Can be stored.

4 is a diagram illustrating an encryption and decryption process according to an embodiment of the present invention. Hereinafter, with reference to Figure 4 will be described in detail.

 Referring to FIG. 4, the operation of the management server 200 will first be described. A symmetric key is generated by inputting a local secret key and a user public key into the DH algorithm.

The generated symmetric key can be encrypted using a user public key and an asymmetric encryption algorithm, and the encrypted one can be encrypted again using a local secret key and an asymmetric encryption algorithm.

The symmetric key double encrypted by the management server 200 is transmitted to the user terminal device 100, and the client hypervisor of the user terminal device 100 decrypts the symmetric key by using the local public key and the user secret key. Create By using the generated symmetric key, the file operating on the virtual machine can be decrypted.

The user terminal device 100 stores the decrypted symmetric key in an encrypted state. Thus, when the location of the user terminal device 100 changes, the local public key corresponding to the location is changed, and the pre-stored encrypted symmetric key cannot be used.

The decryption unit 123 may decrypt the file by using a symmetric key corresponding to the current position of the user terminal device 100.

In addition, when the change of the local information occurs due to the change of the current position of the user terminal device 100, the decoder 123 abolishes the symmetric key currently used and replaces the symmetric key corresponding to the changed local information. Can be used to decrypt the file.

In addition, when the power of the user terminal apparatus 100 is turned on or the current position of the user terminal apparatus 100 is changed, the decryption unit 123 receives local information (eg, a logical position) from the position determining unit 111. ) Can be provided. In this case, the decryption unit 123 may determine whether an encrypted symmetric key corresponding to the region information exists in the terminal-side key management DB 112 using the region information. Here, if the corresponding key exists in the terminal-side key management DB 112, the decryption unit 123 extracts the corresponding key, decrypts it using the user secret key and the local public key, and then virtualizes the decrypted key. Decrypt encrypted files running on the machine.

On the other hand, if the corresponding key does not exist in the terminal-side key management DB 112, the decryption unit 123 can not decrypt the file requested to use, it can request the key transmission to the management server 200. At this time, the decryption unit 123 requests the network detection unit 122 to check the network connection state before requesting the key transmission to the management server 200, and when the network connection state is detected as online, the management server ( Request a key transfer. In this case, the decryption unit 123 may decrypt the file requested to be used by using the key received in response to the key transmission request from the management server 200. In addition, when the decryption unit 123 receives an encrypted key from the management server 200, the decryption unit 123 may store the encrypted key in the terminal-side key management DB 112 so that it can be used later.

The key extracted from the terminal-side key management DB 112 or the key received from the management server 200 may be an encrypted key. In this case, the decryption unit 123 may decrypt the encrypted key using a local public key and a user secret key corresponding to the local information. That is, the decryption unit 123 may perform the first decryption of the encrypted key using the local public key corresponding to the region information, and may perform the second decryption of the first decrypted key again using the user secret key. have.

In this embodiment, it is assumed that the management server 200 encrypts the first time using the user public key and secondly encrypts the second time using the local secret key.

Unlike the above embodiment, it is also possible to configure the management server 200 to primary encryption using the local secret key, and secondary encryption using the user public key in the second, in this case, the decryption unit 123 is a user The primary key may be decrypted using the secret key, and the second decryption may be performed using the local public key.

The terminal side synchronization unit 124 manages the terminal side key management DB 112 and the terminal side location information DB 113 of the user terminal device 100 through interworking with the server side synchronization unit 210 described later. The server side key management DB 240 and the server side location information DB 250 of 200 are respectively synchronized. Since the method of synchronizing two DBs corresponds to a known matter, a detailed description of the synchronization is omitted.

Synchronization between the DBs corresponding to each other between the user terminal device 100 and the management server 200 may be performed at any time when the network connection state between the user terminal device 100 and the management server 200 is online. Alternatively, the operation may be performed when a change occurs in the information in the server-side key management DB 240 and the server-side location information DB 250.

The recording unit 125 records the usage history when the network between the user terminal apparatus 100 and the management server 200 is disconnected and is offline, in the usage history DB 114. The recording unit 125 may include a history of use of a key used for file encryption and decryption while offline, a time of using a key, a location of the user terminal device 100 when a key is used, an operation type for a file, for example, reading or writing. The path name of the target file and the encrypted value of the used key may be recorded in the usage history DB 114. Since the usage history described here is an example, more various types of usage history can be recorded as needed.

The violation detection unit 126 detects a violation of the usage history of the file used while offline when the network connection state between the user terminal device 100 and the management server 200 is switched from offline to online. More specifically, when the network connection state is switched from offline to online, the terminal side key management DB 112 is synchronized by the terminal side synchronization unit 124. At this time, the violation detection unit 126 may detect a violation of the management policy stored in the terminal-side key management DB 112 from the offline usage history recorded in the usage history DB 114.

The violation detection unit 126 checks the validity of the change history and the key usage history of the server-side key management DB 240 only for the details changed before the time of use of the key while the network connection state is offline. By determining whether the policy is violated, violations can be detected. If the violation detection unit 126 detects a violation, the violation detection unit 126 transmits the detected violation to the management server 200.

The user module 130 is installed on the client hypervisor unit 120 and may include a user virtual machine 131, a user operating system unit 132, and a user application unit 133.

Here, the user virtual machine 131 operates on the client hypervisor unit 120, the user operating system unit 132 operates on the user virtual machine 131, and the user application unit 133 is the user operating system unit 132. It works on

In the present embodiment, for convenience of description, one user module 130, that is, one user virtual machine 131, one user operating system unit 132, and one user application unit 133 are illustrated. However, a plurality of user modules 130 may be installed on the client hypervisor unit 120. In addition, a plurality of user application units 133 may be installed on one user operating system unit 132.

Meanwhile, in the present specification, the term 'file' operating on a virtual machine refers to a file configuring or using a user operating system unit, a file used to configure or using a user application unit, or a user application unit operating on a virtual machine. It will be used to include the generated file.

The management server 200 is connected to the user terminal 100 through a network, the server-side synchronization unit 210, key management unit 220, location tracking unit 230, server-side key management DB 240, server The side location information DB 250 and the violation history DB 260 may be included.

When the server-side synchronization unit 210 changes with information in the server-side key management DB 240 and the server-side location information DB 250 through interworking with the terminal-side synchronization unit 124, the changed information Synchronize the DB corresponding to each other so that the two keys can be reflected in the terminal-side key management DB 112 and the terminal-side location information DB 113.

When a key transmission request is received from the decryption unit 123 of the user terminal device 100, the key manager 220 generates a key and transmits the key to the user terminal device 100 in response thereto. In this case, the key transmission request transmitted from the decryption unit 123 may include information on the current location of the user terminal device 100.

The key manager 220 encrypts the key to be transmitted by using information about the location included in the key transmission request of the decryptor 123. For example, when the information on the location is the current logical location of the user terminal device 100, the key manager 220 encrypts the primary by using a local secret key corresponding to the logical location, and then again uses the user public key. After the second encryption, it can be transmitted to the user terminal device (100).

According to an embodiment of the present invention, the key manager 220 may use a known key exchange method for data encryption and decryption. For example, a Diffie-Hellman key exchange method may be applied. Diffie-Hellman key exchange is used to share a secret key or a symmetric key between two different users A and B. Both sides generate the same symmetric key by using their private key and the other party's shared key. Use the basic principle.

In this embodiment, a local public key and a local private key pair are assigned for each logical region, and each user has a user public key and a user private key pair. At this time, the local public key and the user public key are open to each other, but the local private key and the user private key correspond to a key known only by the user. Therefore, the key manager 220 may be in a state of knowing a local public key, a local secret key, and a user public key. The key manager 220 may generate a symmetric key by substituting a local secret key and a user public key into a symmetric key generation algorithm. In this case, the Diffie-Hellman key exchange technique may be applied as a symmetric key generation algorithm. Here, the local secret key may be a key corresponding to a logical region (ie, a logical position) of the user terminal device 100.

After generating the symmetric key, the key manager 220 first encrypts the symmetric key using the user's public key, and then encrypts the second symmetric key using the local secret key. It is also possible to encrypt again with the user's public key). Thereafter, the key manager 220 transmits the double encrypted key to the decryption unit 123 of the user terminal device 100.

When the user terminal device 100 and the management server 200 are normally connected through a network, the location tracking unit 230 detects a current location of the user terminal device 100 and extracts local information according to the current location. Can be. The method of detecting the location of the user terminal device 100 by the location tracking unit 230 may be one of the methods for determining the location by the location determination unit 111 mentioned above.

The server-side key management DB 240 may be a database in which a key necessary for symmetric key generation and symmetric key encryption is stored. When information in the server-side key management DB 240 is changed, the server-side key management DB 240 may be synchronized with the terminal-side key management DB 112 by the server-side synchronization unit 210. In addition, the server-side key management DB 240 may further store a management policy for managing the use of the user virtual machine 131 in the user terminal device 100 in the management server 200. The management policy may be changed from time to time, and may be stored and managed in the server-side key management DB 240 and the terminal-side key management DB 112 by the operation of the server-side synchronization unit 210.

The server-side location information DB 250 stores the mapping information for mapping the physical location and the logical area when the location tracking unit 230 detects the current location of the user terminal device 100.

The violation history DB 260 is a database that stores the violation history transmitted from the violation detection unit 126 of the user terminal device 100. That is, when a violation of the usage history of the key and file is detected because the changed management policy is not reflected in the user terminal device 100 while the network is disconnected, the violation detection unit (if the network is switched from offline to online) The violation may be transmitted from 126). At this time, the transmitted violation history is stored in the violation history DB 260. Violations stored in the violation history DB 260 may take any action according to a predetermined management policy.

In the above-described embodiment of FIG. 1, although a plurality of components are illustrated as being included in one functional block, this is for convenience of description and does not necessarily mean that they are implemented in one apparatus. For example, at least one or more of these components may be implemented as separate functional blocks. Here, the term "separate" means to include a location or a different software or hardware.

2 is a flowchart illustrating a file encryption / decryption method on a virtual machine according to an embodiment of the present invention.

When the virtual machine manager 121 receives a use request for a specific file from the user (S301), the virtual machine manager 121 requests the location tracking unit 111 to track the location (S303). Here, the use request for a file collectively refers to operations such as modifying, viewing, and creating a file.

When the location determination unit 111 receives a location tracking request from the virtual machine manager 121, the location determiner 111 obtains a current physical location of the user terminal device 100 and based on the obtained current physical location, the terminal side location information DB ( Local information is extracted by using 113) (S305). Here, the location determiner 111 may obtain a physical location from information received from a GPS receiver (not shown).

After determining the location information, the location determining unit 111 provides the extracted area information to the decoding unit 123 (S307). The decryption unit 123 determines whether a key corresponding to the area information exists in the terminal-side key management DB 112 using the area information provided from the location determining unit 111 (S309). Here, the key corresponding to the local information may be, for example, the above-mentioned 'symmetric key' and is encrypted.

In step S309, if there is a key corresponding to the area information (S309-Y), the decryption unit 123 extracts and decrypts the key corresponding to the area information from the terminal-side key management DB 112, and then decrypts it. The file requested to be used is decrypted using the key (S311).

In operation S309, when the key corresponding to the local information does not exist (S309-N), the decryption unit 123 may not decrypt the file requested to be used, and thus the key to the management server 200. In order to request a request for confirmation of the network connection state to the network detection unit 122 (S313).

The network detector 122 detects a network connecting the user terminal device 100 and the management server 200 and checks a network connection state (S315). The network connection state may be either offline or online.

As a result of checking the network connection state of the network detection unit 122, if the network connection state is online (315-Y), the network detection unit 122 notifies online to the decryption unit 123 (S319), and the decoding unit 123 ) Requests the key transmission to the key management unit 220 to the management server 200 (S321).

When the key transmission unit 220 of the management server 200 is requested to transmit a key from the user terminal device 100, the key management unit 220 generates a symmetric key according to the aforementioned method, and converts the generated symmetric key into a user public key and a local secret key. Encrypt using (S323). In this case, the key manager 220 may store the encrypted key in the server-side key management DB 240.

The key manager 220 transmits the encrypted key to the decryption unit 123 of the user terminal device 100 (S325). Accordingly, the decryption unit 123 stores the encrypted key in the terminal-side key management DB 112 (S327), decrypts the encrypted key using the local public key and the user secret key (S329), and decrypts the encrypted key. The file requested to be used is decrypted using the key (S331). Here, the procedure of storing the encrypted key in step S327 in the terminal-side key management DB 112 is to enable the encrypted key later, but may be omitted.

In step S317, when it is confirmed offline when the network connection state of the network detector 122 is checked (S317 -N), the network detector 122 notifies the decoder 123 of offline (S333). As a result, since the decryption unit 123 does not have a key corresponding to the area information to which the location of the user terminal device 100 belongs, it cannot be transmitted from the management server 200, and thus the file cannot be used. Notify (S335). The virtual machine manager 121 may notify the user that the file is not available (S337).

In the present embodiment, when a use request for a file in the user virtual machine 131 is received, the location of the user terminal device 100 is determined through the location determination unit 111 provided in the user terminal device 100. In this case, we will explain how to decrypt files. In determining the location of the user terminal device 100, as described in the present embodiment, when the location determining unit 111 is used, the location of the user terminal device 100 may be determined regardless of a network connection state. have.

3 is a flowchart illustrating a file encryption / decryption method on a virtual machine according to an embodiment of the present invention.

A request for using a specific file on the user virtual machine 131 is input to the virtual machine manager 121 (S401). The virtual machine manager 121 requests the network detector 122 to check the network connection state (S403).

The network detection unit 122, which has been requested to check the network connection state from the virtual machine manager 121, checks whether the network connection state is online or offline (S405).

If it is confirmed that the network connection state is online (S407-Y), the network detector 122 notifies the virtual machine manager 121 that the network connection state is online (S409). As a result, the virtual machine manager 121 requests the location tracking to the location tracking unit 230 of the management server 200 (S411).

The location tracking unit 230 tracks the location of the user terminal device 100 and extracts local information to which the user terminal device 100 belongs by using the server-side location information DB 250 according to the tracked location ( S413). The location tracking unit 230 provides local information to the decoding unit 123 of the user terminal device 100 (S415).

The decryption unit 123 determines whether a key corresponding to the area information exists in the terminal-side key management DB 112 using the area information received from the location tracking unit 230 of the management server 200 (S417). The key corresponding to the local information here may be the above-mentioned 'symmetric key'.

In step S417, if there is a key corresponding to local information (S417-Y), the decryption unit 123 extracts a key corresponding to the local information from the terminal-side key management DB 112 and uses the decrypted key. The file requested to be used is decrypted (S419).

If, in step S417, the decryption unit 123 does not exist a key corresponding to the local information (S417-N), the decryption unit 123 requests a key transmission to the key management unit 220 of the management server 200. (S421). At this time, when the key transmission request, the local information to which the user terminal device 100 belongs may be transmitted together.

When the key transmission is requested from the decryption unit 123, the key management unit 220 generates a symmetric key corresponding to the area information to which the user terminal device 100 belongs, and encrypts the generated key (S423). This step is the same procedure as described in step S323 of FIG.

The key manager 220 transmits the encrypted key to the decryptor 123 (S425). Accordingly, the decryption unit 123 stores the encrypted key received from the key management unit 220 in the terminal-side key management DB 112 (S427), decrypts the encrypted key (S429), and decrypts the decrypted key. The file requested to be used is decrypted by using (S431).

In the present embodiment, file encryption / decryption when the location tracking unit 230 included in the management server 200 connected to the user terminal device 100 via a network is used to determine the location of the user terminal device 100. The method is explained. As such, the method of using the management server 200 when determining the location of the user terminal device 100 is possible only when the network is online. Therefore, as a result of confirming the network connection state in the network detection unit 122 in step S407, the process is terminated because it is impossible to track the location of the user terminal 100 through the management server 200 or Alternatively, if the location determination unit 111 in the user terminal device 100 is used by performing the procedure after S303 of FIG. 2, the location tracking of the user terminal device 100 may be performed.

Although not illustrated in FIGS. 2 and 3, the file may be used even when the network detection unit 122 checks the network connection state and is offline. That is, when the location determining unit 111 detects the location of the user terminal device 100, a key corresponding to the area information to which the user terminal device 100 belongs currently exists in the terminal key management DB 112. There is no need to receive the key from the management server 200.

However, even if the management policy of the management server 200 is changed while the network connection state is offline, the user terminal device 100 is not reflected, and thus, the file and key are used in the state in which the changed management policy is not reflected. Therefore, the recording unit 125 records the usage history of the key and file in the usage history DB 114 while the network connection state is offline. As a result, when the network connection state is switched from offline to online, the terminal-side key management DB 112 and the server-side key management DB 240 are synchronized by the terminal-side synchronization unit 124 and the server-side synchronization unit 210. Is made, and if there is a change in the synchronization result management policy, the violation detection unit 126 detects the violation. By this procedure, even when the network connection is offline, the use of files and keys can detect when the management policy is violated.

Although the above-described embodiments mainly describe a method of encrypting, the present invention is of course applied to a method of decrypting.

According to an embodiment of the present invention, the file operating on the virtual machine may be encrypted and stored to operate based on the location of the user terminal in which the virtual machine is installed.

For example, the file operating on the virtual machine of the user terminal device may be encrypted and downloaded from the management server 200. In this case, the management server 200 encrypts the file using a predetermined key and transmits the encrypted file to the user terminal device. The transmitted encrypted file can be used after the decryption process as described above. The predetermined key may be the 'symmetric key' described above. That is, it may be a 'key' generated by inputting a user public key and a local secret key into a predetermined encryption algorithm.

While the present invention has been described with reference to the particular embodiments and drawings, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims. This is possible. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined by the equivalents of the claims, as well as the claims.

100: user terminal 110: hardware platform
111: position determination unit 112: terminal side key management DB
113: terminal location information DB 114: use history DB
120: client hypervisor unit 121: virtual machine management unit
122: network detection unit 123: decryption unit
124: terminal side synchronization unit 125: recording unit
126: violation detection unit 130: user module
131: user virtual machine 132: user operating system unit
133: user application unit

Claims (29)

In the user terminal device having a virtual machine,
A terminal-side key management database for storing keys corresponding to positions;
Among the keys stored in the key management database, using a key corresponding to the location of the user terminal device, a decryption unit for decrypting at least one encrypted file operating on the virtual machine;
Keys corresponding to locations stored in the terminal-side key management database are encrypted keys, respectively.
Wherein the decoding unit comprises:
Extracting an encrypted key corresponding to a location of the user terminal device from among encrypted keys corresponding to each location stored in the terminal-side key management database, and decrypting the file; and
If there is no encrypted key corresponding to the location of the user terminal device in the terminal-side key management database, the decryption unit requests a key transmission to a management server connected to the user terminal device through a network. And decrypting the file by using an encrypted key received from the management server. The method of claim 1,
And the decryption unit decrypts the file using a key corresponding to the changed position when the position of the user terminal apparatus changes. delete The method of claim 1,
The encrypted keys are each encrypted by a local secret key and a user public key corresponding to the location of the user terminal device. The method of claim 1,
And the decryption unit decrypts the extracted encrypted key using a user secret key and a local public key, and decrypts the file using the decrypted key. delete The method of claim 1,
The decryption unit decrypts the encrypted key received from the management server using at least one key corresponding to the location of the user terminal device, and decrypts the file with the decrypted key. . The method of claim 7, wherein
The at least one key is
And a user secret key and a local public key. The method of claim 1,
A network detector detecting a network connection state between the management server and the user terminal device; And
If the network connection state is online, the virtual machine management unit for requesting the location tracking of the user terminal device to the management server connected to the network, and receives the requested location information from the management server; User terminal device. The method of claim 9,
And a terminal side synchronization unit for synchronizing the server side key management database and the terminal side key management database of the management server. 11. The method of claim 10,
And a recording unit for recording the usage history of the file in a usage history database. The method of claim 11,
And a violation detection unit detecting a violation of a management policy stored in the terminal-side key management database among the usage records recorded in the usage history database. 13. The method of claim 12,
The violation detection unit detects a violation in the usage history of a file used in the user terminal device while the network connection state is offline, and transmits the detected violation to the management server. Device. In the method for decrypting a file running on a virtual machine,
Storing, by the key management database, keys corresponding to locations;
Extracting, by the decryption unit, a key corresponding to a location of a terminal apparatus in which the virtual machine is installed, from among keys corresponding to each location; And
And decrypting, by the decryption unit, an encrypted file operating on the virtual machine using the key extracted in the extracting step.
The key management database is included in the terminal device on which the virtual machine is installed,
If the key corresponding to the location of the terminal device does not exist in the key management database, a file corresponding to the location of the terminal device is received from a management server connected through the network with the terminal device. Decryption method. 15. The method of claim 14,
Detecting, by a location determining unit, a physical location of a terminal device in which the virtual machine is installed; And
And storing, by the terminal-side location information DB, mutual mapping information of a physical location and a logical area.
Keys stored in the key management database are stored corresponding to the logical region,
The extracting may include extracting a logical region to which the physical location of the terminal device belongs from the cross mapping information, and extracting a key corresponding to the extracted logical region. The method of claim 15,
Extracting a key corresponding to the changed position when a change of the position of the terminal occurs;
And the decryption unit decrypts the file using a key corresponding to the changed position. 15. The method of claim 14,
Keys corresponding to locations stored in the key management database are encrypted keys, respectively.
The decrypting may include extracting an encrypted key corresponding to a location of the terminal device from among keys corresponding to each location stored in the key management database, and decrypting the file using the extracted encrypted key. File decryption on the fly. The method of claim 17,
And the encrypted key is encrypted by at least one key including a local secret key corresponding to the location of the terminal device. The method of claim 17,
The decoding step
And decrypting the extracted encrypted key by using a local public key and decrypting the file by using the decrypted key. The method of claim 17,
The encrypted key is encrypted by at least the local secret key and the user public key corresponding to the location of the terminal device,
The decoding step
And decrypting the extracted encrypted key by using a local public key and a user private key, and decrypting the file by using the decrypted key. delete 15. The method of claim 14,
And a key received from the management server is encrypted by at least one key. 23. The method of claim 22,
And said at least one key comprises a user public key and a local secret key. 15. The method of claim 14,
And recording the usage history of the file in a usage history database. 15. The method of claim 14,
The key management database is included in the terminal device on which the virtual machine is installed,
If the key corresponding to the location of the terminal device is not present in the key management database, receiving an encrypted key corresponding to the location of the terminal device from a management server connected through the network with the terminal device;
The decrypting may include decrypting an encrypted key received from the management server using at least one key, and decrypting a file operating on the virtual machine using the decrypted key. Way. The method of claim 25,
And said at least one key comprises a user private key and a local public key. A user terminal device, comprising: a terminal-side key management database for storing keys corresponding to each location, among keys stored in the key management database, using at least one of the keys corresponding to the location of the user terminal device and operating at the user terminal device; The user terminal device including a decryption unit for decrypting one encrypted file; And
A management server which holds a key corresponding to a location and encrypts the key corresponding to the reserved location when the request is received from the user terminal device; File decryption system on a virtual machine comprising a user terminal device comprising a. The method of claim 27,
If the user terminal device does not have a key corresponding to the location of the user terminal device requests a key transmission to the management server,
And the management server encrypts a key corresponding to the location of the user terminal device using a local secret key and a user public key and transmits the encrypted key to the user terminal device. 28. The method of claim 27,
The user terminal device may include a network detector configured to detect a connection state of a network connecting the user terminal device and the management server, and a usage history of a file used while offline when the connection state of the network is changed from offline to online. File decryption system on a virtual machine, characterized in that it further comprises a violation detection unit for detecting.

Images