KR101319586B1 - Cloud computing network system and method for authenticating client - Google Patents

Abstract

PURPOSE: A cloud computing system and a client authentication method are provided to implement safe and effective access authentication for a client in a cloud computing environment. CONSTITUTION: A cloud computing system implementing the access authentication of a client (110) using a hash chain includes a name node (120) and a data node (130). The name node receives the block access request of the client and configures the hash chain to provide a block access token to the client. The name node uses a random number or a hash function applied number for configuring the hash chain. The data node verifies a block access token as the value of the hash function according to the hash chain for authenticating the block access of the client. [Reference numerals] (110) Client; (120) Name node; (130) Data node

Description

CLOUD COMPUTING NETWORK SYSTEM AND METHOD FOR AUTHENTICATING CLIENT}

The present invention relates to a cloud computing system and a client authentication method.

Recently, as information is transmitted through various communication networks such as the Internet, security measures to prevent infiltration into the system and measures to protect the 'transmitted information' itself have been required. Encryption techniques such as secret key encryption and public key encryption have been developed.

In addition, the encryption algorithm can be classified into a secret key encryption algorithm and a public key encryption algorithm. The secret key encryption algorithm uses the encryption key and the decryption key as the same one, and the public key encryption algorithm uses the different one.

Conventionally, the actual information is encrypted and decrypted by a secret key cryptographic algorithm, and the session key for this is exchanged and shared with each other by a public key cryptographic algorithm. At this time, the session key is shared by sending and receiving messages in both directions between the communicating systems using the key sharing protocol. However, when sharing the session key, the session key may be stolen or copied by a malicious attacker. A malicious attacker who has obtained a session key can interfere with the operation of the system by launching a retransmission attack on the system using the session key. Therefore, for the operational stability of the system, even if a session key is stolen or copied, an access authentication method that cannot be retransmitted is required.

Korea Patent Registration No. 10-0444199

In order to solve the above problems of the prior art, the present invention provides a cloud computing system and a client authentication method for authenticating a client to access data.

In addition, the present invention provides a cloud computing system and a client authentication method for managing a client's access authentication using a hash chain to enhance security.

The objects of the present invention are not limited to the above-mentioned objects, and other objects not mentioned can be clearly understood from the following description.

In order to achieve the above object, a cloud computing system according to an aspect of the present invention receives a block access request of a client and sets a hash chain to provide a block access token to the client, and a hash function value according to the hash chain. At least one data node for authenticating the block access of the client by verifying the block access token.

In order to achieve the above object, a client authentication method according to another aspect of the present invention comprises the steps of receiving a block access request from a client, retrieving a data node storing a block according to the block access request, a hash for block access authentication Establishing a chain, storing the hash function value of the hash chain for the block access authentication of the client in the data node storing the block, generating a block access token in response to the block access request, and providing the block access token to the client And receiving a block request using the block access token, and performing a block access authentication of the client using the block access token.

BRIEF DESCRIPTION OF THE DRAWINGS The above and other objects, features and advantages of the present invention will be more apparent from the following detailed description taken in conjunction with the accompanying drawings, in which: FIG.

The present invention may, however, be embodied in many different forms and should not be construed as being limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. It is provided to fully inform the owner of the scope of the invention.

According to the above-described problem solving means of the present invention, the cloud computing system and the client authentication method according to an embodiment of the present invention to perform secure and efficient access authentication for the client in the cloud computing environment through hash chain-based authentication Can be. In addition, the cloud computing system and the client authentication method according to an embodiment of the present invention can protect the attacker's retransmission attack and enhance the security of the cloud system by using the one-way of the hash chain. In addition, the cloud computing system and the client authentication method according to an embodiment of the present invention can prevent the leakage of data by the attacker attack and increase the reliability of the cloud computing system.

1 is a block diagram showing the configuration of a cloud computing system according to an embodiment of the present invention.
2 is a diagram illustrating authenticating block access at a data node according to an embodiment of the present invention.
3 is a flowchart illustrating a client authentication method according to an embodiment of the present invention.

While the present invention has been described in connection with certain exemplary embodiments, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, is intended to cover various modifications and similarities.

It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like parts throughout the specification.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram showing the configuration of a cloud computing system according to an embodiment of the present invention.

Referring to FIG. 1, a cloud computing system according to an exemplary embodiment of the present invention uses a hash chain to manage a block access of a client 110 and a data node authenticating a connection of the client 110. 130.

The name node 120 manages block access of the client 110 using a hash chain. First, the name node 120 may receive a block access request from the client 110. The name node 120 may search for the data node 130 that stores the block according to the block access request. For example, the name node 120 may search for block storage information and location information of the data node 130 using meta information stored in the storage. Through this, the name node 120 may check the data node 130 storing the block requested by the client 110.

을 설정할 수 있다. 네임 노드(120)는 설정한 해쉬 체인의 제n 해쉬 함수값

와 해쉬함수 적용횟수

를 데이터 노드 x에 송신할 수 있다.The name node 120 may establish a hash chain to manage block access of the client 110. For example, the name node 120 uses the random number R and the number of hash function applications n, where n is a natural number, to the nth hash function value of the hash chain for the data node x.

Can be set. The name node 120 sets the value of the nth hash function of the set hash chain.

And Hash Functions

Can be sent to the data node x.

로 나타내며,

에 대해

관계가 성립한다. 여기서 H는 암호학적 해쉬 함수(Cryptographic Hash Function)이고,

는 체인의 루트(root)라 한다. 해쉬 함수의 일방향성(one-way) 때문에

를 알아도 루트를 아는 사람을 제외하고는

를 만들 수 없다.On the other hand, a hash chain is a list of values obtained by applying a value to a hash function and repeating the hash operation several times. For example, a hash chain of length L

Represented by

About

The relationship is established. Where H is the Cryptographic Hash Function,

Is called the root of the chain. Because of the one-way of the hash function

Except for those who know the root

Can't make

The name node 120 may provide a block access token to the client 110 in response to the block access request of the client 110. The name node 120 may manage the independent hash chain for each data node 130 and include the hash chain based one-time token in one block access token and transmit the same to the client 110.

Here, the block access token may be configured in a format as shown in Table 1 below.

designation format TokenID expirationDate, keyID, One Time Token, blockID, accessModes One Time Token

TokenAuthenticator HMAC-SHA1 (key, TokenID) Block Access Token TokenID, TokenAuthenticator

일 수 있다. 즉, 일회용 토큰은 데이터 노드(130)에서 해쉬 함수의 적용을 통해 인증받을 수 있도록 해쉬 함수가

회 적용된 제n-1 해쉬 함수값

일 수 있다.Referring to Table 1, the block access token may include a one time token in the token ID. Here, the one-time token indicates that the name node 120 has the n-1 hash function value of the hash chain for the corresponding data node 130.

Lt; / RTI > That is, the one-time token has a hash function so that the data node 130 can be authenticated by applying the hash function.

N-1 hash function values applied times

Lt; / RTI >

과 해쉬함수 적용횟수

을 수신할 수 있다. 예를 들면, 데이터 노드(130)는 네임 노드(120)로부터 난수 R에 임의의 횟수 n번만큼 해쉬 함수를 적용한 제n 해쉬 함수값

을 접속 인증값으로 수신할 수 있다. 여기서 데이터 노드(130)는 클라이언트(110)의 접속 인증시 블록 접근 토큰의 인가 검증을 확인하기 위해 네임 노드(120)로부터 수신한 제n 해쉬 함수값

를 저장하여 유지할 수 있다.The data node 130 stores blocks and block IDs that constitute the file. Herein, the data node 130 receives the nth hash function value from the name node 120.

And hash functions

Lt; / RTI > For example, the data node 130 applies a hash function n times a random number n times to the random number R from the name node 120.

Can be received as a connection authentication value. Herein, the data node 130 receives the n-th hash function value received from the name node 120 to confirm authorization verification of the block access token when authenticating the connection of the client 110.

You can save it and keep it.

와 블록 접근 토큰의 토큰 아이디를 비교하여 클라이언트(110)의 접속을 인증할 수 있다.In addition, the data node 130 may receive a block access token from the client 110 as shown in FIG. 2. At this time, the data node 130 is the n-th hash function value

It is possible to authenticate the access of the client 110 by comparing the token ID of the block access token with.

에 해쉬 함수를 적용하여 토큰 인증자

를 생성한 후 자신이 유지하고 있는 접속 인증값인 제n 해쉬 함수값

와 비교할 수 있다.The data node 130 may verify the token ID of the block access token when authenticating the connection of the client 110. In this case, the data node 130 may generate a token authenticator by applying a hash function to the token ID, and compare the data node 130 with the access authentication value received from the client 110. For example, the data node 130 is the n-1 hash function value that is a one-time token of the token ID.

Token authenticator by applying hash function to

The hash control value of the connection authentication value maintained by the user after generating

Can be compared with

과 접속 인증값

이 동일하면, 데이터 노드(130)는 클라이언트(110)의 접근을 승인하여 해당 블록을 클라이언트(110)에게 송신할 수 있다. 또는, 토큰 인증자

과 접속 인증값

이 동일하지 않으면, 데이터 노드(130)는 클라이언트(110)의 블록 접근을 거부하여 클라이언트(110)에게 인가 에러 메시지를 송신할 수 있다.As a result of the comparison, if the token authenticator and the access authentication value are the same, the data node 130 may grant access of the client 110. As a result of the comparison, if the token authenticator and the connection authentication value are not the same, the data node 130 may deny access of the client 110. For example, token authenticator

And connection authentication value

If the same, the data node 130 may grant the client 110 access and transmit the corresponding block to the client 110. Or token authenticator

And connection authentication value

If not the same, the data node 130 may transmit an authorization error message to the client 110 by denying block access by the client 110.

및 제n-1 해쉬 함수값

을 수신할 수 있다. 여기서 해쉬함수 적용횟수

After approval, the data node 130 may request the name node 120 to update the access authentication value for authentication of the next block access token. For example, the data node 130 notifies the name node 120 of the approval result and applies the hash function of the hash chain set from the name node 120.

And n-1 hash function values

Lt; / RTI > Hash function number applied here

은 해쉬 체인에 의해 블록접근 인증횟수가 1회 차감되는 것을 의미할 수 있다. 또한, 데이터 노드(130)는 수신한 제n-1 해쉬 함수값

을 업데이트된 접속 인증값으로 유지할 수 있다.And n-1 hash function values

May mean that the number of times of block access authentication is deducted once by the hash chain. In addition, the data node 130 receives the received n-th hash function value.

Can be maintained as an updated connection authentication value.

Meanwhile, the name node 120 may re-configure the hash chain when the number of times of authentication of the data node 130 exceeds a preset number. That is, when the number of times of authentication of the block access token is exhausted, the name node 120 may initialize the number of times of authentication to provide a hash function value of the hash chain set in the data node 130.

3 is a flowchart illustrating a client authentication method according to an embodiment of the present invention. Here, a client authentication method according to an embodiment of the present invention will be described with reference to the cloud computing system illustrated in FIG. 1.

Referring to FIG. 3, the client authentication method according to an embodiment of the present invention includes receiving a block access request from a client (S110), searching for a data node storing a block (S120), and for block access authentication. Setting a hash chain (S130), storing the hash function value of the hash chain for the client's access authentication in the data node storing the block (S140), generates a block access token in response to the block access request and generates a client Providing a block access token at step S150, receiving a block request using a block access token at step S160, performing block access authentication on a client using a block access token at step S170. Notifying the client of block access permission or denial (S180) and updating a hash function value of the hash chain for block access authentication (S19). 0).

In step S110, the name node of the cloud computing system receives a block access request. The name node receives a request from the client for access to the blocks that make up the file. In this case, the name node may perform verification on the client.

In step S120, the name node of the cloud computing system searches for a data node that stores the block using meta information. The name node may retrieve block storage information and location information of the data node using meta information stored in the storage. This allows the Namenode to identify the data node that stores the block requested by the client.

을 설정할 수 있다.In step S130, the name node of the cloud computing system establishes a hash chain for block access authentication. The name node is the value of the nth hash function of the hash chain for the data node x using a random number R and the number of hash functions applied n.

Can be set.

Here, the name node may store a random number R and a hash function application number n for each data node.

와 접속 인증값인 해쉬 체인의 제n 해쉬 함수값

를 수신한다.In step S140, the data node of the cloud computing system applies the hash function from the name node.

Hash function value of the hash chain

.

In step S150, the name node of the cloud computing system provides a block access token to the client in response to the block access request. The name node may provide the block access token to the client in the format shown in Table 2 above. In this case, the name node may add the hash function value of the hash chain that can be authenticated by applying the hash function as a one-time token to the token ID of the block access token.

In step S160, the data node of the cloud computing system receives a block request using a block access token from a client.

에 해쉬 함수를 적용하여 토큰 인증자

를 생성한 후 자신이 유지하고 있는 접속 인증값인 제n 해쉬 함수값

와 비교할 수 있다.In step S170, the data node of the cloud computing system authenticates the block access token. The data node may verify the token ID of the block access token. Here, the data node may generate a token authenticator by applying a hash function to the one-time token included in the token ID of the block access token, and then compare the hash function value of the hash chain which is the access authentication value. For example, the data node may be an n-1 hash function value that is a one-time token of the token ID.

Token authenticator by applying hash function to

The hash control value of the connection authentication value maintained by the user after generating

Can be compared with

In step S180, the data node of the cloud computing system notifies the client of block access permission or denial through a result of performing block access authentication.

As a result of the comparison, if the token authenticator and the connection authentication value are the same, the data node grants the client access and sends the requested block to the client. As a result of the comparison, if the token authenticator and the connection authentication value are not the same, the data node rejects the client's access and sends an authorization error message to the client.

및 해쉬 체인의 제n-1 해쉬 함수값

을 수신할 수 있다.In step S190, the data node of the cloud computing system requests an update of the access authentication value to the name node for the next access authentication. After the request, the data node notifies the name node of its approval and the number of hash functions applied from the name node.

And the n-1 hash function value of the hash chain

Lt; / RTI >

및 제n-1 해쉬 함수값

은 해쉬 체인에 의해 블록접근 인증횟수가 1회 차감되는 것을 의미할 수 있다. 또한, 데이터 노드는 수신한 제n-1 해쉬 함수값

을 업데이트된 접속 인증값으로 유지할 수 있다.Hash function number applied here

And n-1 hash function values

May mean that the number of times of block access authentication is deducted once by the hash chain. In addition, the data node receives the value of n-th hash function received.

Can be maintained as an updated connection authentication value.

을 블록 접근 토큰의 토큰 아이디에 일회용 토큰으로 추가할 수 있다.When generating the next block access token, the name node is the value of the n-2 hash function.

Can be added as a one-time token to the token ID of the block access token.

Cloud computing system and client authentication method according to an embodiment of the present invention can perform a secure and efficient access authentication for the client in a cloud computing environment through a hash chain-based authentication. In addition, the cloud computing system and the client authentication method according to an embodiment of the present invention can protect the attacker's retransmission attack and enhance the security of the cloud system by using the one-way of the hash chain. In addition, the cloud computing system and the client authentication method according to an embodiment of the present invention can prevent the leakage of data by the attacker attack and increase the reliability of the cloud computing system.

The foregoing description is merely illustrative of the technical idea of the present invention, and various changes and modifications may be made by those skilled in the art without departing from the essential characteristics of the present invention.

Therefore, the embodiments disclosed in the present invention are intended to illustrate rather than limit the scope of the present invention, and the scope of the technical idea of the present invention is not limited by these embodiments.

The scope of protection of the present invention should be construed according to the following claims, and all technical ideas falling within the scope of the same shall be construed as falling within the scope of the present invention.

110: Client
120: Name node
130: data nodes

Claims (12)

In a cloud computing system that performs a connection authentication of a client using a hash chain,
A name node that receives a block access request from a client and establishes a hash chain to provide a block access token to the client; And
And at least one data node that verifies the block access token with a hash function value according to the hash chain to authenticate block access of the client.
The method according to claim 1,
The name node is a cloud computing system, characterized in that for setting the hash chain using a random number and the number of hash function application.
The method of claim 2,
The name node provides the data node with the nth hash function value (where n is a natural number) of the hash chain for the client's block access authentication and uses the block access token as the n-1 hash function value of the hash chain. Cloud computing system, characterized in that for generating.
The method of claim 3,
The name node adds the n-th hash function value to the token ID of the block access token as a one-time token.
The method of claim 3,
The data node generates a token authenticator by applying a hash function to the n-1 hash function value of the block access token, and performs the block access authentication of the client by comparing the token authenticator with an access authentication value. Cloud computing system.
6. The method of claim 5,
The data node requests the name node to update the access authentication value after the block access authentication.
And the name node provides the n-th hash function value to the data node as the access authentication value. In the method of authenticating a block access of a client using a hash chain,
Receiving a block access request from a client;
Retrieving a data node storing a block according to the block access request;
Establishing a hash chain for block access authentication;
Storing a hash function value of the hash chain for a block access authentication of a client at a data node storing a block;
Generating a block access token in response to the block access request and providing the block access token to the client;
Receiving a block request using the block access token; And
A client authentication method comprising performing block access authentication for a client using a block access token.
The method of claim 7, wherein
In the step of establishing a hash chain for the block access authentication,
And a name node managing a block access of the client establishes the hash chain by using a random number and a hash function application frequency.
The method of claim 8,
Before storing the hash function value of the hash chain,
And the name node provides the data node with an nth hash function value (where n is a natural number) of the hash chain for the block access authentication of the client.
10. The method of claim 9,
And the name node generates the block access token with the n-1 hash function value of the hash chain.
The method of claim 10,
In the step of performing block access authentication for the client,
The data node generates a token authenticator by applying a hash function to the n−1 th hash function value of the block access token, and performs the block access authentication of the client by comparing the token authenticator with an access authentication value. Client authentication method.
The method of claim 7, wherein
After performing block access authentication for the client,
Updating a hash function value of the hash chain for block access authentication.

Images