KR101889062B1 - Server and method for generating security file - Google Patents

Abstract

A server and method for generating a security file are disclosed. The server and method for generating a security file according to an embodiment, if a file cannot be decrypted and separated due to the insertion of encrypted data into the file when the file stored in the storage of a corporation or an organization is delivered to an unauthorized user, prevent the unauthorized user from opening the file. Therefore, important data can be safely stored even in a situation where system security is low. Also, information security can be improved by restricting the access of the unauthorized user to the file as well as the security system. The method includes a step of extracting file information, a step of generating primary encryption data, a step of recording decryption key position information, a step of transmitting a security file, a step of storing secondary encryption data in a storage server, and a step of generating security data.

Description

[0001] DESCRIPTION [0002] SERVER AND METHOD FOR GENERATING SECURITY FILE [

And more particularly, to a secure file creation server and method for encrypting a file stored in various storage devices such as a web hard, a cloud, and an archive so as not to be opened by a hacked or unauthorized user.

Unless otherwise indicated herein, the contents set forth in this section are not prior art to the claims of this application and are not to be construed as prior art to be included in this section.

As personal PCs and smartphones become popular after the Internet, digital files are increasing exponentially. In addition to personal records such as photos and videos, all the media and business results in everyday life are digitized, and there is a high need for services to securely store and store important digital information. As a result, Internet file management services have emerged that can store, view, edit and share documents and files with a certain amount of storage space such as web hard and cloud. In particular, a digital archive is a repository for digitizing and storing information that may be damaged or destroyed over time, allowing for the permanent recording, preservation and use of digital information. Digital archives are a kind of database that maintains and maintains the relationship between data, keeping collections or materials as digital information.

In this way, all information of a corporation or organization is stored in a computer, thereby preventing illegal access from the outside to the inside or outside of the information communication network for information security. However, if a firewall is opened by a strong unauthorized user such as a hacker, all the information of the enterprise, organization, and individual stored in storage such as web hard, cloud, and archive is leaked to the user. To prepare for this, it is obvious that hacking technology that breaks down the security system which strengthened system security no matter how strong it is. Therefore, there is a need for a security technology that can prevent data leakage even if it does not depend on the security system.

1. Korean Patent Registration No. 10-1442489 (2014.09.15) 2. Korean Patent Registration No. 10-1409175 (June 06, 2016)

When a file is stored in the secure file creation server, encrypts the encrypted data in the file, encrypts the location information of the decryption key for decrypting the encrypted data, and stores the encrypted value of the location information of the encrypted data inserted in the file, Enhance the security of uploaded files.

      When a file is downloaded from the secure file generation server, the file can be normally opened only after the encrypted data inserted in the file is separated according to the data location information recorded in the file after the user authentication is completed, So that it can not be opened.

A method for generating a security file in a security file generation method according to an embodiment includes the steps of (A) extracting file information including a name, a path, and a size of a file from a user terminal at a secure file generation server, Extracting location information and a virtual file name; (B) generating secure file data by using the location information and the virtual file name of the server in which the file is to be stored in the secure file creation server, and generating the first encrypted data by encrypting the stored file data through an encryption algorithm; (C) generating a security file; generating a secondary encryption data by inserting a decryption key for decrypting the primary encrypted data into the primary encrypted data; and generating decryption key position information indicating a position where the decryption key is inserted in the secondary encrypted data ; (D) requesting a file transfer from the security file creation server to the user terminal and transferring the file from the user terminal to the secure file creation server; (E) While transferring a file from the user terminal to the secure file creation server, the secure file creation server changes the name of the file transmitted from the user terminal to the virtual file name, modulates the second encryption data, Inserting data into a file to be transferred; And (F) generating a security file. The server generates a file key, which is a location information encryption value of the data key, which is the encryption value of the file name, the storage path, the file size, the owner, the secondary encryption data and the decryption key position information, Generating security data including the security data; .

 In a preferred embodiment, (F) restoring the file and transmitting it to the smart terminal; (A) receiving user authentication information from a user terminal at a secure file generation server and receiving file information including a file name, a path, a size, and a user from a user terminal when the user authentication is completed; (b) retrieving security data stored in the secure file creation server based on file information transmitted from the user terminal at the secure file creation server; (c) extracting the retrieved security data, confirming the position of the secondary encrypted data in the extracted security data, and confirming the decryption key position in the secondary encrypted data; (d) separating the decryption key to convert the secondary encrypted data into primary encrypted data, decrypting the primary encrypted data with a separate decryption key, and restoring the decrypted data into stored file data; (e) confirming the location of the storage server in which the file recorded in the restored storage file data is stored, and confirming the location of the modulated secondary encrypted data in the file; And (f) separating the modulated secondary encrypted data in the file and restoring the data modulation contained in the security file; .

In the security file generation server and security file generation method as described above, even if a file stored in a storage of a corporation or an organization is delivered to an unauthenticated user, if encrypted data is inserted into a file and decrypted and can not be separated, So that important data can be safely stored even in a situation where system security is low.

It improves information security by restricting unauthorized users' access to the file itself as well as the security system.

It should be understood that the effects of the present invention are not limited to the above effects and include all effects that can be deduced from the detailed description of the present invention or the configuration of the invention described in the claims.

1 is a diagram illustrating a configuration of a security file generation system according to an embodiment;
2 is a block diagram illustrating a data processing block of a secure file generation server according to an embodiment;
3 is a diagram showing a more specific configuration of the secure file creation server according to the embodiment
FIG. 4 is a diagram illustrating a data structure
5 is a flowchart illustrating a process of encrypting a file according to an embodiment
6 is a diagram illustrating a data structure according to an embodiment;
FIG. 7 is a signal flow diagram of a security file generation system according to an embodiment. FIG. 7 is a diagram illustrating a data processing flow when a file is uploaded from a smart terminal to a secure file generation server
8 is a flowchart illustrating a data processing procedure in a case where a file is uploaded from a smart terminal to a secure file creation server according to an exemplary embodiment of the present invention.
FIG. 9 is a signal flow diagram of a security file generation system according to an embodiment. FIG. 9 is a diagram illustrating a data processing flow when a smart terminal downloads a file from a secure file generation server
10 is a flowchart illustrating a data processing procedure in a server in a case where a file is downloaded from a smart terminal to a secure file creation server according to an embodiment
11 is a diagram for explaining the encryption data according to the embodiment in more detail;

BRIEF DESCRIPTION OF THE DRAWINGS The advantages and features of the present invention, and the manner of achieving them, will be apparent from and elucidated with reference to the embodiments described hereinafter in conjunction with the accompanying drawings. The present invention may, however, be embodied in many different forms and should not be construed as being limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. Is provided to fully convey the scope of the invention to those skilled in the art, and the invention is only defined by the scope of the claims. Like numbers refer to like elements throughout.

In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear. The following terms are defined in consideration of the functions in the embodiments of the present invention, which may vary depending on the intention of the user, the intention or the custom of the operator. Therefore, the definition should be based on the contents throughout this specification.

1 is a diagram illustrating a configuration of a security file generation system according to an embodiment.

Referring to FIG. 1, the security file generation system according to the embodiment may include a security file generation server 100 and a user smart terminal 200.

When a file stored in various storage devices such as web hard, cloud, and archive is hacked or delivered to an unauthenticated user, the secure file creation server 100 permits the non-authenticated user to access the encrypted data stored in the file Generate a non-secure file. For example, the security file creation server 100 decrypts the encrypted data stored in the file even if the user smart terminal 200 completes downloading the file, and when the encrypted data is not separated from the secure file, ) So that the downloaded file does not open. When uploading a file received from the user terminal 200, the secure file generation server 100 according to the embodiment generates and stores a security file and security data in which the received file is encrypted. For example, the security data for decrypting the encrypted security file is separately stored in the database, and the security file is decrypted only when the user authentication is completed.

When the user terminal 200 downloads a file from the secure file creation server 100, when the authentication of the user terminal 200 is completed, the secure file stored in the storage server is decrypted as secure data, So that the completed file can be downloaded from the user terminal 200. Thus, even if the security file stored in the storage server is transferred to the non-authenticated user, the transferred security file is a file in which the encrypted data is not inserted, so that it is possible to safely store important files and prevent unauthorized downloading . In addition, through the embodiments, it is possible to improve information security by restricting access of non-authorized users not only in the security system of the storage server but also in the file itself.

The smart terminal 200 of the user downloads various digital files such as video, music, document, drawing, picture from the security file creation server 100 and uses them. The smart terminal 200 according to the embodiment may be a tablet PC, a laptop, a personal computer (PC), a smart phone, a personal digital assistant (PDA) A mobile communication terminal, or the like. That is, the terminal 200 refers to a terminal having a memory for storing a specific application for connecting to the server 100 via a wire / wireless communication network, a microprocessor for executing and controlling a program, and the like. That is, although the terminal 200 is a personal PC in general, any terminal can be used as long as server-client communication with the server 100 is possible, and any communication computing device such as a notebook computer, a mobile communication terminal, Is a broad concept. Meanwhile, the terminal 200 is preferably formed in a form having a touch screen, but is not limited thereto.

2 is a block diagram showing a data processing block of the security file generation server according to the embodiment.

2, the secure file generation server 100 includes a storage module 10, an extraction module 110, a secure data generation module 130, a security module 150, a data verification module 170, And a file validation module 190. [0040] The term " module ", as used herein, should be interpreted to include software, hardware, or a combination thereof, depending on the context in which the term is used. For example, the software may be machine language, firmware, embedded code, and application software. As another example, the hardware may be a circuit, a processor, a computer, an integrated circuit, an integrated circuit core, a sensor, a micro-electro-mechanical system (MEMS), a passive device, or a combination thereof.

The storage module 10 may include a storage 11 for storing security files and a database 13 for storing security data. In an embodiment, the security file may also be stored in a storage server (not shown) in communication with the secure file creation server 100.

The extraction module 110 extracts file information including a file name, a path, and a size from the file, and extracts the location information and the virtual file name of the server in which the file is to be stored in the storage server.

The security data generation module 130 generates the storage file data using the location information of the server where the file will be stored and the virtual file name. Thereafter, primary encrypted data obtained by encrypting the stored file data through an encryption algorithm is generated. The storage file data according to the embodiment may record ID, data size, hash information, file size, file name, user, file creation data, storage server, storage folder name, virtual file name,

The security data generation module 130 generates a secondary encryption data by inserting a decryption key for decrypting the primary encryption data into the primary encryption data, and outputs decryption key position information indicating the position where the decryption key is inserted in the secondary encryption data Lt; / RTI >

The security module 150 modulates the secondary encrypted data and encrypts the positional information of the modulated secondary encrypted data inserted in the file.

When the file download signal is transmitted, the secure data verification module 170 extracts the location information of the encrypted decryption key in the secure data, decrypts the secondary encrypted data inserted in the secure data using the decryption key to generate the primary encrypted data Decrypts the primary encrypted data, and restores it into the stored file data. Thereafter, the storage server, the storage folder name, and the virtual file name of the storage file data are checked to find the security file stored in the storage server

The file verification module 190 extracts the positional information of the modulated secondary encrypted data in the security file and decrypts and separates the modulated secondary encrypted data of the inserted single block or multi-block into security data. Then, the integrity of the file is verified by restoring the modulation of the file in which the secondary encrypted data is separated.

In the embodiment, the extraction module 110, the secure data generation module 13 and the security module 150 perform a function of generating a security file into which the security data and the modulated secondary encryption data are inserted, 100 to the secure file creation server 100. [

On the other hand, the data verification module 170 and the file verification module 190 perform a decryption operation and an integrity verification for separating the modulated second-order encrypted data, and are mainly used for downloading a file from the user terminal 200.

The information extraction, storage file data generation, primary encryption data generation, secondary encryption data generation, and security file generation process according to the embodiment are not processed after the transmission of the file from the user terminal but during the transmission.

3 is a diagram illustrating a more specific configuration of a secure file generation server according to an embodiment.

3, the extraction module 110 of the secure file generation server 100 according to the embodiment may include a first extraction unit 111 and a second extraction unit 113, The module 130 may include a data generation unit 131, an encryption processing unit 133, a decryption key processing unit 135 and a position recording unit 137. The security module 150 may include a data modulation unit 151, A data blocking unit 153 and a position recording unit 155. The data verification module 170 may include a position extraction unit 171, a decryption key separation unit 173, a decryption processing unit 175, The file verification module 190 may include a location extractor 191, a data separator 193, and an integrity verification unit 195. The location extractor 191, the data separator 193, In order to facilitate understanding of each data block shown in FIG. 3, FIG. 4 illustrating a data structure of a data generation process according to an embodiment and FIG. 5 illustrating a file encryption process will be described.

The first extracting unit 111 extracts basic information of a file from a file. In the embodiment, the basic information is the meta data of the file, and may include the date of the first creation, the date of the first modification, the user ID, the size, and the like. As in the embodiment shown in FIG. 4, the first extracting unit 111 may extract the file information of the terminal when the user terminal uploads the file. At this time, the extracted file information includes a hash, a file size, a filename, a user ID and an uploader user information, a file creation date, a file information 1 information 1) and file information 2 (file information 2).

The second extracting unit 113 extracts location information and a virtual file name at which a file is to be stored in the server. The location information in which the file is to be stored may include a folder name or path information, and the virtual file name may be generated using the file information extracted by the first extracting unit, such as a hash, a file size, and a file creation date.

 As in the embodiment shown in FIG. 4, the information extracted by the second extracting unit may include a storage server, a save folder name, and a virtual file name. For example, the second extracting unit 113 may extract layered folder information. Specifically, when extracting the storage location information of the building drawing file, the second extracting unit can extract the sub-category information such as the first floor, the second floor and the third floor in the 'drawing' category which is an upper category of the folder. In the embodiment, a virtual file name can be created by combining a hash, a file size, and a file creation date.

The data generation unit 131 of the secure data generation module 130 generates the storage file storage location information and the storage file location information extracted from the second extraction unit 113, And generates data. The encryption processing unit 133 generates primary encryption data to which the encryption algorithm is applied to the storage file data.

The decryption key processing unit 135 inserts a decryption key into the primary encrypted data to generate secondary encrypted data.

The location recording unit 137 encrypts the location information of the decryption key inserted into the secondary encrypted data.

The data modulator 151 of the security module 150 Thereby modulating the secondary encryption data. Since the secondary encryption data can be easily restored when a single block in the file is applied, the data modulator 151 modulates the secondary encryption data in the embodiment.

The data blocker 153 processes the modulated secondary encrypted data into a single block or multi-block and inserts the processed data into a file. As shown in FIG. 5, the single block process can insert the modulated second-order encrypted data into a single block in the file, or insert a plurality of modulated second-order encrypted data blocks in the data portion of the file.

The position recording unit 155 encrypts the positional information of the modulated secondary encrypted data inserted in the file.

The data generation unit 131 of the secure data generation module 130 may update the file name transmitted from the user terminal 200 to the security file generation server 100 during the upload of the file from the user terminal 200 to the secure file generation server 100, The secondary encrypted data is modulated, the modulated secondary encrypted data is inserted into the file transferred from the user terminal 200, and the secondary encrypted data is stored in the storage server. Then, security data including the file name, the storage path, the file size, the owner, the data key, which is the encryption value of the secondary encryption data and the decryption key position information, and the file key, which is the location information encryption value of the secondary encryption data inserted in the storage file do. In an embodiment, the data generating unit 131 may generate security data by storing a value obtained by encrypting insertion position information of the modulated secondary encryption data with the owner as a file key, and may generate a security value by encrypting the owner and the decryption key insertion location information Can be stored as a data key to generate security data.

The most important characteristic of the security file generation server according to the embodiment is that all data processing for generating a security file in the server is not performed after completion of transmission but is performed during transmission. All data transferred, such as the meta information of the embodiment, is stored in the server in the form of a memory rather than a file, and then the data is processed and the processed (used) data can be volatilized .

The position extraction unit 171 of the data verification module 170 extracts the location information of the encrypted decryption key in the secondary encrypted data of the secure data.

The decryption key separation unit 173 separates the decryption key inserted into the data.

The decryption unit 175 decrypts (decrypts) the encrypted data with a separate decryption key to recover the secondary encrypted data into the primary encrypted data.

The information confirmation unit 177 confirms the server location and the virtual file name in the restored data.

The location extracting unit 191 of the file verification module 190 extracts the location information of the encrypted data in the file.

The data separator 193 separates the secondary encrypted data decrypted by the decryption key from the security file after extracting the modulated secondary encrypted data of the inserted single block or multi-block in the file.

The integrity verification unit 195 reconstructs the data modulation of the demultiplexed secondary encrypted data and verifies that the data is identical to the data in the database.

6 is a diagram illustrating a storage file data structure according to an embodiment.

As shown in FIG. 6, the storage file data generated according to the extracted file information includes a header block for recording a chunk ID, a data size, a hash, a file size A user name and uploader user information, a file creation date, a storage server, a save folder name, a virtual file name (Virtual File Name) a first data size (InfoSize1), a first arbitrary first file information (File information1), a second arbitrary information size (InfoSize2) and an arbitrary second file information (File information2 And a variable data block for recording changeable data such as a variable data block. In particular, the storage server of the variable data block, the save folder name, and the virtual file name record the location information of the file to locate the file to be deleted.

In an embodiment, the variable data block may vary depending on the file type.

Hereinafter, the security file generation method will be described in turn. Since the function (function) of the security file generation method is essentially the same as the function on the security file generation system and the server, a description overlapping with those of FIGS. 1 to 6 will be omitted.

FIG. 7 is a signal flow diagram of a security file generation system according to an embodiment of the present invention. FIG. 7 illustrates a data processing flow for generating a security file when a file is uploaded from a smart terminal to a secure file generation server.

In step S10, user authentication information is transmitted from the user terminal 200 to the file creation server 100. [ In step S15, the file creation server 100 performs user authentication. When the authentication is successfully completed, the user authentication completion information is transmitted in step S20.

In step S25, after the authentication is completed, the terminal file information is extracted and the extracted file information is transmitted to the server 100 in step S30.

In step S35, the server information is extracted from the file creation server 100, and in step S40, the storage file data is generated using the extracted server information and file information. In step S45, primary encryption data obtained by encrypting the generated storage file data is generated. In step S50, a secondary encryption data is generated by inserting a decryption key capable of releasing the encrypted data.

The decryption key position is recorded in step S55, and the secondary encryption data is modulated in step S60. Step S60 may include a process of multiplying the data after modulation. In step S65, the location of the data that can release the file encryption in the file is recorded. In step S70, the server 100 transmits a file transfer request to the terminal 200. In step S75, the terminal 200 transmits a file to the server 100 in step S80 after waiting for a file transfer.

In step S85, the received file is stored, and the modulated secondary encrypted data is inserted into the file received from the user terminal 200. [ Thereafter, in step S90, the terminal 200 is notified of the completion of the file transfer.

FIG. 8 is a flowchart illustrating a data processing procedure in a case where a file is uploaded from a smart terminal to a secure file generation server according to an exemplary embodiment of the present invention.

The file information transmitted from the user terminal 100 is extracted in step S810.

In step S820, a virtual file name corresponding to each file is generated based on the file information. In an embodiment, the virtual file name may be created using metadata of the file, such as a hash, a file size, a file creation date, and the like. In step S821, the data extraction is performed by extracting file information (hash value, file size, file name, owner, file creation date, file information 1 and file information 2) from the terminal (primary) Save folder name and virtual file name.

In step S823, the extracted information is combined, and in step S824, the storage file data is generated from the combined data.

In step S825, the storage file data is encrypted through the encryption algorithm to generate primary encrypted data, and in step S826, a decryption key is generated.

In step S827, the secondary encryption data is generated by inserting the decryption key into the primary encryption data.

In step S828, the secondary encryption data is stored in the database of the storage module. In step S829, a value obtained by encrypting the decryption key position information embedded in the data is stored.

In step S830, the uploaded file name is changed to the virtual file name.

In step S840, the secondary encrypted data array-modulated is inserted into the variable position of the file.

In step S860, the file information and the location information of the secondary encrypted data are stored in the data ace of the storage module. In step S870, the encrypted data and the location information embedded in the file are encrypted.

FIG. 9 is a signal flow diagram of a security file generation system according to an embodiment, and shows a data flow when a file is downloaded from a security file generation server in a smart terminal.

In step S10, user authentication information is transmitted from the user terminal 200 to the file creation server 100. [ In step S12, the file creation server 100 performs user authentication. When the authentication is successfully completed, the user authentication completion information is transmitted in step S14. In step S16, the user terminal 200 confirms the file information. In step S18, the terminal 200 transmits file information such as a file name to the server 100. [

In step S20, the server 100 confirms the position of the secondary encrypted data, and in step S22, the decryption key position is confirmed. The decryption key is separated in step S24, and the primary encrypted data is decrypted in step S26. In step S28, the server position information of the file in the data is checked. In step S30, the position of the secondary encrypted data in the file is confirmed. In step S32, the secondary encrypted data is extracted. In step S34, the modulated data is restored. In step S36, integrity verification of the restored data is performed. If there is no abnormality, in step S38, the terminal 200 is notified of the file transmission wait. In step S40, the terminal 200 requests file transmission from the server 100. In step S42, the secondary encryption data modulated in the file is separated.

In step S44, the server 100 transmits a file name to the terminal 200, and in step S46, the server 100 transmits the file to the terminal 200. [

In step S48, the file transmitted from the terminal 200 is generated so that the user can access the file. In step S50, the server 100 notifies the terminal 200 of the completion of the file transfer. In step S52, the user terminal 200 completes the creation of the complete file accessible by the user.

10 is a flowchart illustrating a data processing procedure in a server in a case where a file is downloaded from a smart terminal to a secure file generation server according to an embodiment of the present invention.

In step S910, a file download request is received from the terminal.

In step S911, the control unit checks the downloaded file information. The file information may include a file name, a path, a size, an uploader, and the like.

In step S912, the position of the secondarily modulated encrypted data (encryption key and decryption key) is confirmed. In step S913, a value obtained by encrypting the decryption key position information embedded in the data is confirmed. After the decryption process, the decryption key position inserted in the data is checked in step S914.

In step S915, the decryption key of the secondarily modulated encrypted data is separated, and the primary encrypted data is obtained in step S916. Thereafter, in step S917, data is obtained through a decryption process.

S918 Checks the information of the storage file data, that is, the hash value, file size, file name, owner, file creation date, file information 1, file information 2, storage server, storage folder name and virtual file name information.

In step S919, the storage unit checks the virtual file name storage server and the storage folder location, and checks the file in step S920.

In step S921, a value obtained by encrypting the encrypted data location information inserted in the file is confirmed.

In step S922, the location of the encrypted data inserted in the file is checked. In step S923, integrity verification is performed. In the integrity verification, the file is transmitted except for the encrypted data inserted in the variable position array. The file name is transmitted in step S924, and the file is opened in step S925.

11 is a diagram for explaining a security file generated in the embodiment and a security file decryption method.

11, the storage of the secure file generation server storage module stores an encrypted file in which the modulated second-order encrypted data is stored. In the database, the location information of the decryption key for decrypting the encrypted file, Security data such as positional information of the encrypted data is stored.

Upon receipt of the file information to be downloaded from the user terminal, the security data corresponding to the inputted file information is extracted in order to restore the file containing the modulated secondary encryption data stored in the storage. When the security data is extracted, the primary encryption data is generated by separating the decryption key using the secondary encryption data recorded in the security data and the decryption key positional record recorded in the secondary encryption data, and the primary encryption data is decrypted Key, and restores the data into the storage file data. The storage file data includes a storage location of a file to be downloaded by the user, for example, a storage server, a storage folder name, and a virtual file name. The storage server, the storage folder name, and the virtual file name are searched for a file in the storage server, and the secondary encrypted data in the file is separated through the location information encryption value of the modulated secondary encrypted data recorded in the secure data. Thereafter, the data modulation included in the file is restored, the integrity verification is performed, and the file stored in the storage server is transmitted to the user terminal.

Security data stored in the database includes secondary encryption data, a data key, and a file key. In the embodiment, the data key refers to the location information encryption value of the decryption key inserted in the data, and the file key refers to the location information encryption value of the modulated secondary encrypted data inserted in the file.

The secondary encryption data is data in which the decryption key position information, the decryption key length, and the decryption key are embedded in the primary encryption data. When the decryption key is extracted and the primary encryption data is decrypted, the data can be acquired. Accordingly, in the embodiment, a file containing the secondary encryption data is provided to an illegal user who has not undergone the normal authentication process, so that the file can not be opened.

 When inserting the decryption key into the primary encrypted data in which the storage file data is encrypted, the decryption key length information is recorded in the secondary encrypted data together with a certain bit. In this embodiment, since the decryption key is the same length as the decryption key length, it is possible to grasp the decryption key position by using the decryption key length information and to extract the decryption key. Similarly, when inserting the modulated second-order encrypted data into a file, the second-order encrypted data length information modulated in the file is recorded together with the second-order encrypted data modulated with a certain bit. It is possible to grasp the position of the data in the file with the modulated secondary encrypted data length information when extracting the secondary encrypted data modulated in the file since it is secondary encrypted data of the length of the secondary encrypted data inserted in the file .

The secure file generation server and the secure file creation method according to the embodiment prevent illegal downloading or hacked data leakage by preventing the file from being opened when the encrypted data embedded in the data can not be decrypted. Also, even if the file stored in the storage of the enterprise or the organization is delivered to the unauthorized user, the file can not be opened if the location information of the data such as the decryption key is unknown, so that the important data can be safely stored even in a situation where the system security is weak. In addition, it improves information security by restricting unauthorized users' access to the file itself as well as the security system.

It is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims. It is not limited to the embodiment.

110: Extraction module
130: Security data generation module
150: Security module
170: Data validation module
190: File Validation Module

Claims (9)

In a security file generation method,
(A) Generating a security file The server extracts file information including the name, path, and size of a file from the user terminal, extracts the location information of the server on which the file is to be stored and a virtual file name step;
(B) generating storage file data by using the location information and the virtual file name of the server in which the file is to be stored in the secure file creation server, and generating the first encryption data by encrypting the stored file data through the encryption algorithm ;
(C) generating a security file by inserting a decryption key for decrypting the primary encrypted data in the primary encrypted data to generate secondary encrypted data, decrypting the secondary encrypted data by using a decryption key indicating a position where the decrypted key is inserted Recording key position information;
(D) requesting a file transfer from the security file creation server to the user terminal, and transferring the file from the user terminal to the security file creation server;
(E) During transmission of a file from the user terminal to the secure file generation server, the secure file generation server changes the name of a file transmitted from the user terminal to a virtual file name, modulates the second- Inserting encrypted data into the transferred file and storing the encrypted data in a storage server; And
(F) Generate a secure file. Includes a file key, which is the location information encryption value of the data key, which is the encryption value of the file name, the storage path, the file size, the owner, the secondary encryption data and the decryption key position information, and the secondary encryption data inserted in the file. Generating security data to be transmitted; And a security file.
The method of claim 1, further comprising: (F) generating security data; in
Wherein the file key is generated by encrypting insertion location information of the owner and the modulated secondary encryption data.
The method of claim 1, further comprising: (F) generating security data; in
Wherein the data key is generated by encrypting an owner and decryption key insertion location information.
2. The method of claim 1, further comprising: (E) modulating the secondary encrypted data, inserting the modulated secondary encrypted data into the transferred file, and storing the inserted secondary encrypted data in a storage server; The
Performing multi-block processing on the modulated secondary encrypted data; And
Inserting the multi-block processed modulated secondary encrypted data into the transferred file; And generating a security file.
The method of claim 1, further comprising the steps of: modulating the secondary encrypted data to insert the modulated secondary encrypted data into the transferred file and storing the inserted secondary encrypted data in the storage server; The
Processing the modulated secondary encryption data in a single block; And
Inserting the single block processed modulated secondary encrypted data into the transferred file; And generating a security file.
2. The method of claim 1,
(G) restoring the file and transmitting the restored file to the smart terminal when the user terminal downloads the file stored in the storage server; Further comprising the steps of:
The method of claim 6, further comprising: restoring the file (F) and transmitting the file to the smart terminal; The
(a) receiving user authentication information from a user terminal in the secure file generation server, and receiving file information including a file name, a path, a size, and a user from the user terminal when the user authentication is completed;
(b) retrieving security data stored in the secure file creation server based on file information transmitted from the user terminal in the secure file creation server;
(c) extracting the retrieved security data, checking the position of the secondary encrypted data in the extracted security data, and checking the decryption key position in the secondary encrypted data;
(d) separating the decryption key to convert the secondary encrypted data into primary encrypted data, decrypting the primary encrypted data with the decrypted decryption key, and restoring the decrypted primary key into the stored file data;
(e) checking the location of the storage server where the file recorded in the restored storage file data is stored, and checking the location of the modulated secondary encrypted data in the file; And
(f) separating the modulated secondary encrypted data in the file and restoring the data modulation included in the security file; And generating a security file.
8. The method of claim 7, further comprising: (f) separating the modulated secondary encrypted data in the file and restoring data modulation contained in the file; The
Performing integrity verification of the restored data, separating the secondary encrypted data modulated in the secure file and transferring the file to the user terminal;
And generating a security file.
The method of claim 8, further comprising: separating the secondary encrypted data modulated in the secure file and transferring the file to the user terminal; The
Wherein when the user terminal receives the file from the secure file creation server, the user terminal performs file creation and receives the file name information received from the secure file creation server to complete file creation. Generation method.

Images