KR102474210B1 - System and Method for Storing Data Location Artificial Intelligence Learning for Internet of Things - Google Patents

Abstract

In the IoT environment, the artificial intelligence data location storage system and method includes an industrial Internet of Things system composed of four layers: a device layer, a network layer, a service layer, and an application layer, and the application layer provides a user interface for various heterogeneous devices, An IIoT environment by deploying two types of agents: a gateway agent that collects data from clients and stores them in a designated cloud service provider, and performs communication between clients and servers, and a service agent that is used for data integrity and provides geolocation guarantees. can achieve geolocation assurance of outsourced data.

Description

Artificial intelligence data location storage system and method in the IT environment {System and Method for Storing Data Location Artificial Intelligence Learning for Internet of Things}

The present invention relates to an artificial intelligence data location storage system, and more particularly, includes an industrial Internet of Things (IoT) system composed of four layers: a device layer, a network layer, a service layer, and an application layer, and the application layer is for users of various heterogeneous devices. There are two types of agents: gateway agents, which provide interfaces, collect data from clients and store it in designated cloud service providers, and perform communication between clients and servers, and service agents, which are used for data integrity and provide geolocation guarantees. It relates to an artificial intelligence data location storage system and method in an IoT environment that achieves geolocation assurance of outsourced data in an IIoT environment by deploying a.

The Internet of Things (IoT) enables interrelated computing devices, objects, and people to connect and transmit data through computer networks without human-to-human or human-to-machine communication.

How IoT is perceived has evolved over the years due to the convergence of several technologies such as real-time data analytics, machine learning, commodity sensors and embedded systems.

Existing fields such as cloud computing, wireless sensor networks, control systems, and automation all contribute to IoT implementation. This has resulted in fascinating paradigms such as smart cities, smart buildings, smart homes, smart grids, and more. Unlike the IoT, the Industrial Internet of Things (IIoT) connects machines and devices in industries such as oil, gas and food.

Most IIoT adopt cloud computing-based mechanisms to solve storage and computing problems.

The Industrial Internet of Things (IIoT) has the potential to transform many industries.

However, reliable data collection, processing and analysis cannot be performed if the underlying cloud storage is unreliable. Current IIoT architectures tend to adopt cloud computing as the backbone for implementation and further deployment. Therefore, the reliability of cloud storage is paramount for efficient and reliable IIoT design.

When data storage is outsourced to third parties, many problems can arise, such as non-compliance with service level agreements, data theft, and privacy issues.

Korean Registered Patent No. 10-2017408

In order to solve this problem, the present invention includes an industrial Internet of Things system composed of four layers of a device layer, a network layer, a service layer, and an application layer, the application layer provides a user interface for various heterogeneous devices, and the client In an IIoT environment by deploying two types of agents: a gateway agent that collects data from and stores it in a designated cloud service provider and performs communication between clients and servers, and a service agent that is used for data integrity and provides geolocation guarantees. Its purpose is to provide an artificial intelligence data location storage system and method in an IoT environment that achieves geolocation assurance of outsourced data.

In order to achieve the above object, the artificial intelligence data location storage system in the IoT environment according to the features of the present invention,

It consists of a device layer composed of hardware components including sensors and machines, a network layer composed of communication protocols, a service layer composed of application programs to store and process data, and an application layer providing user interfaces for various heterogeneous devices. Including the configured industrial Internet of Things system,

It further includes two types of agents: a gateway agent that is connected to the network and performs communication between a client and a server, and a service agent that is connected to the service layer and is used for data integrity and provides geographic location assurance.

The artificial intelligence data location storage method in the IoT environment according to the features of the present invention,

It consists of a device layer composed of hardware components including sensors and machines, a network layer composed of communication protocols, a service layer composed of application programs to store and process data, and an application layer providing user interfaces for various heterogeneous devices. Including the configured industrial Internet of Things system,

a gateway agent that is connected to the network layer and performs communication between a client and a server, fetching data, meta data, and tags from the client and transmitting them to the service agent;

the service agent being connected to the service layer and storing the received data, meta data, and tags in a cloud service provider (CSP) that is the server; and

The service agent queries the CSP to generate a response signal related to guaranteeing the geographical location of data, and transmits the response signal to the client through the gateway agent.

With the foregoing configuration, the present invention proposes a multi-agent-based approach to solve the problem of ensuring the geolocation of outsourced data in the context of IIoT, and thus a cost-effective geolocation that can be managed without a trusted third party. There is an effect that guarantees can be achieved.

The present invention has an effect of protecting an agent in a malicious environment by combining a protocol capable of combining data collected in the IIoT with a specific geographic location.

1 is a diagram showing the configuration of an artificial intelligence data location storage system in an IoT environment according to an embodiment of the present invention.
2 is a more simplified block diagram of an artificial intelligence data location storage system in an IoT environment according to an embodiment of the present invention.
3 is a diagram for explaining a method for storing artificial intelligence data locations according to an embodiment of the present invention in the form of a protocol.
4 is a diagram illustrating a data outsourcing step according to an embodiment of the present invention.
5 is a diagram illustrating a geographic location assurance step according to an embodiment of the present invention.
6 is a diagram showing a result of comparing communication costs according to an embodiment of the present invention.
7 is a diagram showing a result of comparing tag verification times according to an embodiment of the present invention.
8 is a diagram showing a result of comparing RTT values in different regions according to an embodiment of the present invention.
9 to 13 are diagrams illustrating results of comparing RTT values in regions 1 to 5 according to embodiments of the present invention.

Throughout the specification, when a certain component is said to "include", it means that it may further include other components without excluding other components unless otherwise stated.

1 is a diagram showing the configuration of an artificial intelligence data location storage system in an IoT environment according to an embodiment of the present invention, and FIG. 2 is a more simplified view of an artificial intelligence data location storage system in an IoT environment according to an embodiment of the present invention. It is a block diagram.

In the IoT environment according to an embodiment of the present invention, the artificial intelligence data location storage system 100 is an industrial object composed of four layers: a device layer 110, a network layer 120, a service layer 130, and an application layer 140. Including the Industrial Internet of Things (IIoT), the application layer 140 provides a user interface for various heterogeneous devices, and collects data from the client 170 to provide a designated Cloud Service Provider (hereinafter referred to as Cloud Service Provider). Referred to as 'CSP') and a gateway agent (Gateway Agent, hereinafter referred to as 'GWA') 150 that performs communication between the client 170 and the server, and is used for data integrity and provides geographic location assurance It is a technology that achieves geolocation assurance of outsourced data in an IIoT environment by deploying two types of agents, Service Agent (hereinafter referred to as 'SA') 160. CSP stands for a type of server.

Device layer 110 consists of the hardware components of the IIoT, including sensors, machines, and other Cyber Physical Systems (CPS).

The network layer 120 is composed of communication protocols required for IIoT tasks such as WiFi, edge computing, and cloud computing, aggregates data, and is composed of communication protocols for transmission to the service layer 130.

The service layer 130 is composed of application programs so that the IIoT can run various applications to store and process client data and convert it into useful information to be used for analysis purposes.

The application layer 140 provides user interfaces for various heterogeneous devices.

The GWA 150 is connected to the network layer 120, collects data from the client 170, stores it in a designated server, CSP, and serves as a gateway agent 150.

Communication between the client 170 and the CSP server is performed through the GWA 150.

The SA 160 is connected to the service layer 130 and is used for data integrity and, as shown in FIG. 1 , may provide geographic location assurance.

CSPs can eavesdrop on the actions performed by agents and are passive attackers.

CSPs can change the location of their data, host the data of various clients 170, are in different geographic locations, and can distinguish them from one another.

The artificial intelligence data location storage system performs protocol steps in two steps: data outsourcing step and geolocation assurance step.

In the data outsourcing step, the client 170 generates metadata and tags for the outsourced data using a Provable Data Possession (PDP) scheme.

For each block of data, client 170 creates a message authentication tag that is sent to the CSP along with the outsourced data.

As shown in FIG. 2, the client 170 and the server (not shown) communicate through the GWA 150, and the GWA 150 retrieves data, meta data, and tags from the client 170 and sends the SA 160 ) is sent to

The SA 160 stores the data, meta data, and tags received by the client 170 from the GWA 150 in the server CSP.

The geolocation assurance step verifies the geolocation and integrity of the outsourced data.

Client 170 randomly selects a block to prove the integrity of the outsourced data, and generates a challenge containing a tag for the randomly selected block of the file. This randomly selected information is transmitted to the server through the GWA (150).

SA 160 then takes action on any challenge and responds to client 170 .

Client 170 compares the response received from SA 160 through GWA 150 with locally stored tags and determines whether the outsourced data has been modified.

The next step is geolocation assurance, where round-trip time and log tracking are used.

RTT is the time difference between when the CSP is queried and when the response is received. SA 160 is responsible for log trace collection.

Based on the log tracking and the observed RTT, it can determine whether the CSP has moved the outsourced data to another geographic location.

SA 160 and GWA 150 communicate with each other to determine actual and observed RTTs as there may be network delays.

3 is a diagram for explaining a method for storing artificial intelligence data locations according to an embodiment of the present invention in the form of a protocol.

The artificial intelligence data position storage method of the present invention is described in the form of a protocol as follows.

The client 170 divides the file into various blocks and pre-processes them.

The client 170 generates a metadata tag for each data block using a Message Authentication Code (MAC). The block size remains fixed at 4KB.

If the block size is kept small, the overhead of the number of tags increases and high communication and computation costs occur.

The client 170 transmits the generated tags and data to the GWA 150, and the GWA 150 transmits the generated tags, data, and meta data to the SA 160 (S100). SA 160 stores tags, data, and meta data in CSP.

Client 170 performs data integrity and geolocation guarantees, and selects an arbitrary set of blocks to query the CSP.

The client 170 transmits the randomly generated block index to the GWA 150, and the GWA 150 transmits the block index to the SA 160. SA 160 queries integrity and geolocation guarantees of the outsourced data.

The client 170 randomly selects a block in order to prove the integrity of the outsourced data, and generates a challenge including a tag for the block of the randomly selected file (S101).

SA 160 receives the randomly generated challenge and queries the CSP for its tag for the randomly queried outsourced data block.

The SA 160 transmits the challenge entity Ci composed of the data block Bi in the storage index i and the corresponding tag Ti to the client 170 through the GWA 150 (S102).

The SA 160 accesses the block stored in the CSP and the corresponding tag to generate a response signal including a value of RTT (Round Trip Time) related to guaranteeing the geographic location of data and a log file, and sends the client 170 through the GWA 150. It is transmitted to (S103).

The GWA 150 transmits the RTT (Round Trip Time) value and the trace of the log file to the client 170 capable of determining the result of the protocol. RTT and log tracking provide strong guarantees to the client 170 regarding the geolocation guarantee of the outsourced data.

The value of RTT indicates the time spent by the CSP, and the log trace provides the work done by the CSP.

The logs are collected by SA 160 and finally transmitted to GWA 150 and provided to client 170 .

Client 170 may receive a response signal from SA 160 and determine whether the CSP has moved the outsourced data to another geographic location based on the value of the log file and RTT to determine geolocation guarantee.

,

,

는 클라이언트(170)에서 수행되는 알고리즘이고,

는 SA(160)에서 수행되는 알고리즘이다.

,

,

is an algorithm performed by the client 170,

Is an algorithm performed in SA 160.

은 확률적 다항식 시간 알고리즘으로 보안 파라미터 k를 사용하고, 공개키 및 개인키의 임의의 키 쌍

을 반환한다.

is a stochastic polynomial time algorithm using a security parameter k, and a random key pair of public and private keys

returns

알고리즘은 주어진 파일 F에 대한 메타 데이터 태그를 생성하는데 사용된다. 이러한 알고리즘은 파일 F를 블록 세트(

)로 나누고, 메타 데이터 태그의 세트 T를 생성한다.

An algorithm is used to generate a metadata tag for a given file F. This algorithm converts file F into a set of blocks (

), and generate a set T of metadata tags.

)로 구성된다.A set T is the tags for each block of data (

) is composed of

The storage of tags is stored on the client side.

Data and metadata are outsourced to a cloud service provider (CSP) through the GWA 150.

The service agent (SA) 160 receives data and T from the gateway agent (GWA) 150 and stores these values in the CSP.

A small block size value affects the processing overhead of the client 170 and can transmit a large number of tags, so the block size should be chosen carefully. GWA 150, in cooperation with SA 160, also calculates the round-trip time for this entire process.

은 데이터 무결성 및 지리적 위치 보장을 위한 무작위 알고리즘이다. 이 알고리즘은 데이터 무결성을 달성하기 위해 클라이언트

가 챌린지 응답 프로토콜을 쿼리할 무작위로 선택된 태그 인덱스로 구성된 챌린지

를 생성한다.

is a random algorithm for ensuring data integrity and geolocation. This algorithm is used by the client to achieve data integrity

A challenge consisting of randomly selected tag indices to query the challenge response protocol for.

generate

는 GWA(150)를 통해 SA(160)에 제공된다. SA(160)는 CSP에 쿼리하고 CSP에 저장된 블록 및 해당 태그를 액세스하여 소유 증명을 생성한다.challenge object

is provided to SA 160 via GWA 150. SA 160 queries the CSP and accesses the blocks and corresponding tags stored in the CSP to generate proof of possession.

로 구성된 응답 개체

를 생성한다.Therefore, the SA 160 retrieves the tag and client ID from the CSP.

Response object composed of

generate

에서 FileF 및 Ti를 가져와 CSP 측에서 아웃소싱한다. 이러한 통신은 클라이언트

의 요청에 따라 서버에서 실행된다.Algorithm 1 describes the preprocessing and data outsourcing steps of the proposed approach. It takes an input file that is a collection of blocks of size 4KB. Each block Bi is known by its index (i), while Ti represents the corresponding tag created using the method in pre-processing. After that, the GWA 150 is

Take FileF and Ti from and outsource them on the CSP side. This communication is

runs on the server upon request.

The pre-processing and data outsourcing of Algorithm 1 are as follows.

는 SA(160)가 생성한 응답을 확인하는데 사용된다. 클라이언트(170)는 SA(160)가 제공한 증명을 확인한다. 증명 검증이 성공하면 데이터 무결성 및 지리적 위치 보증이 위반되지 않았음을 의미한다.

is used to confirm the response generated by SA 160. Client 170 verifies the attestation provided by SA 160. If attestation verification succeeds, it means that data integrity and geolocation guarantees have not been violated.

RTT and log trace Li are used to infer the malicious CSP's behavior. Algorithm 2 describes attestation verification consisting of tag verification and data geolocation with the help of SA 160.

The challenge object Ci consists of a data block (Bi) at index (i) in storage and a corresponding tag (Ti). This information is used by SA 160 to generate proofs.

When the challenge is confirmed, SA 160, with the help of GWA 150, notifies the customer. If no challenge is confirmed, it is inferred that no geolocation guarantee has been achieved for the particular file entity F.

The proof verification of Algorithm 2 is as follows.

Experiment evaluation

We provided an analysis using a high level Petri net (HLPN) to show accuracy. We drew two HLPNs, one for modeling the outsourcing phase and one for the geolocation assurance phase.

4 and 5 show HLPNs for two stages of the method proposed in the present invention.

The system configuration was Ubuntu 18.04 with 12GB RAM, 1TB HDD on Core i7 processor with Java.

To implement the agent, JADE, which supports programming agents, was used. For cryptographic primitives, we used the Java Cryptographic Extensions (JCE). The experiment of the present invention was performed 5 times, and the average value is shown in the graph of FIG. 6 below.

To evaluate the performance, various file sizes from 100 MB to 1 GB were considered. Five different virtual machines with identical settings were used to run the mobile agent code. These virtual machines represent different geographic locations used for simulation of different industrial environments. Analyze data, metadata transfer cost, metadata tag verification cost, round trip time (RTT), LAN and Internet latency.

6 is a diagram showing a result of comparing communication costs according to an embodiment of the present invention.

A. Communication cost

This is the cost incurred during communication and includes the cost of transmitting data and metadata via the cloud. Metadata consists of tags that are later used for verification. The approach proposed in the present invention uses GWA to transmit file F and meta data T to the server. As shown in FIG. 6, since the meta data of the tag is transmitted in an uncompressed form, the [9] method takes more time to transmit data and meta data than [8]. The present invention and Faheem et al. [8] Transmission of data and meta data is also the same. However, the method of the present invention is unique in that it incurs very little overhead by using an agent such as GWA that is responsible for transmitting data and meta data.

7 is a diagram showing a result of comparing tag verification times according to an embodiment of the present invention, FIG. 8 is a diagram showing a result of comparing RTT values in different regions according to an embodiment of the present invention, and FIG. 13 are diagrams illustrating results of comparing RTT values in regions 1 to 5 according to embodiments of the present invention.

B. Tag Verification Fee

Tag verification is required for data integrity of data outsourced from CSP. To this end, Ateniese et al. [9] and Faheem et al. [8]. was used, and GWA and SA participated in the tag verification process. GWA sends a series of challenge blocks C to SA. The SA may query the CSP for response and tag verification. Due to the fixed block size of [8], the tag verification cost is less than that of [9], as shown in Fig. 7.

C. Round Trip Time (RTT)

RTT is an important measure that can be used to study the time spent in the challenge response phase of a protocol.

To measure RTT, five regions were studied in the experiment as shown in FIG. 8 . Region 1 in this scenario is a user-defined region that you trust, and you know the RTT values of these regions. Regions 2 through 5 are regions where malicious CSPs are trying to relocate outsourced data to cut costs.

For region 1, which is a known region, the RTT does not change during the challenge-response phase. However, if the CSP relocates the client's data to another region, such as region 2 or region 5, the RTT value will change, indicating malicious behavior of the CSP.

We compared our approach with the scheme presented by Gondree et al. [17]. Gondree et al. Regions transmit messages between themselves that are not practical in any real sense. Therefore, this scheme is costly for communication.

The artificial intelligence data storage method of the present invention reduces communication costs because agents can encapsulate all protocols and achieve desired goals without increasing communication overhead on behalf of end users. As shown in Figures 9-13, RTT was studied in five different regions. The X-axis shows files of different sizes, and the Y-axis shows the time taken in milliseconds.

D. delay

We measured two types of latency: LAN and Internet. LAN latency depends on the hardware infrastructure used, such as wiring media and switching equipment. Experiments to measure LAN latency are conducted inside a university campus with fiber optics using different areas each marked by a virtual machine. For distance estimation, the present invention uses Equation 1 as used by the authors in [16].

where a is the given RTT value, T is the speed of digital information traveling in the fiber and S is the speed of light. The function f(a) uses the values of S, T and a needed to calculate the distance in kilometers (KM).

For LAN latency, T is assumed to be 0.66. Also, a comparison with [11] is provided as shown in Table 1. To calculate the internet latency we use the same Equation 1 with T equal to 0.44. In general, internet latency varies based on peak and normal hours of usage, geographic distance, weather, and other natural heuristic mechanisms that can affect internet speed. Table 1 compares Internet latency with [11].

Internet latency is less than 3 ms in all cases shown in Table 1. Compared to the scheme [11] in which a manager of one region queries another region, the scheme of the present invention uses an agent.

[8] A. K. Faheem, Zafar and A. Mansoor, “A scalable data integrity mechanism based on provable data possession and jars,” KSII Transactions on Internet and Information Systems, vol. 10, p. 2851-2873, 2016.

[9] G. Ateniese, R. Burns, R. Curtmola, J. Herring, L. Kissner, Z. Peterson, and D. Song, “Provable data possession at untrusted stores,” in Proceedings of the 14th ACM conference on Computer and communications security. Acm, 2007, pp. 598-609.

[11] A. Albeshri, C. Boyd, and J. G. Nieto, “Geoproof: proofs of geographic location for cloud computing environment,” in Distributed Computing Systems Workshops (ICDCSW), 2012 32nd International Conference on. IEEE, 2012, pp. 506-514.

[17] M. Gondree and Z. N. Peterson, “Geolocation of data in the cloud,” “in Proceedings of the third ACM conference on Data and application security and privacy. ACM, 2013, pp. 25-36.

As described above, the embodiments of the present invention are not implemented only through devices and/or methods, and may be implemented through programs for realizing functions corresponding to the configurations of the embodiments of the present invention, recording media on which the programs are recorded, and the like. And, such an implementation can be easily implemented by an expert in the technical field to which the present invention belongs from the description of the above-described embodiment.

Although the embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements made by those skilled in the art using the basic concept of the present invention defined in the following claims are also included in the scope of the present invention. that fall within the scope of the right.

100: AI data location storage system
110: device layer
120: network layer
130: service layer
140: application layer
150: GWA, gateway agent
160: SA, service agent
170: client

Claims (9)

It consists of a device layer composed of hardware components including sensors and machines, a network layer composed of communication protocols, a service layer composed of application programs to store and process data, and an application layer providing user interfaces for various heterogeneous devices. Including the configured industrial Internet of Things system,
further comprising two types of agents: a gateway agent connected to the network and performing communication between a client and a server, and a service agent connected to the service layer and used for data integrity and providing geographic location assurance;
The gateway agent retrieves data, meta data, and tags from the client and transmits them to the service agent;
The service agent stores data, metadata, and tags received from the gateway agent in a cloud service provider (CSP), which is the server,
The client divides and pre-processes the file into various blocks, randomly selects blocks to perform data integrity and geolocation guarantees, and generates a challenge containing a tag for the randomly selected blocks of the file so that the gateway to the service agent via an agent;
the service agent receives the randomly generated challenge and queries the CSP for corresponding tags for randomly queried outsourced data blocks;
The service agent accesses the block stored in the CSP and the corresponding tag, generates a response signal including a round trip time (RTT) value related to guaranteeing the geographic location of data and a log file, and transmits the response signal to the client through the gateway agent; ,
The client receives the response signal from the service agent, and based on the log file and the value of the RTT, artificial intelligence determining whether the CSP has moved the outsourced data to another geographical location to determine geographical location assurance. Data location storage system. delete delete delete delete It consists of a device layer composed of hardware components including sensors and machines, a network layer composed of communication protocols, a service layer composed of application programs to store and process data, and an application layer providing user interfaces for various heterogeneous devices. Including the configured industrial Internet of Things system,
a gateway agent that is connected to the network layer and performs communication between a client and a server, fetching data, meta data, and tags from the client and transmitting them to a service agent;
the service agent being connected to the service layer and storing data, meta data, and tags received from the gateway agent in a cloud service provider (CSP) that is the server; and
The service agent queries the CSP to generate a response signal related to guaranteeing the geographical location of data and transmits the response signal to the client through the gateway agent;
The client divides and pre-processes the file into various blocks, randomly selects blocks to perform data integrity and geolocation guarantees, and generates a challenge containing a tag for the randomly selected blocks of the file so that the gateway transmitting to the service agent through an agent; and
the service agent receiving the randomly generated challenge and querying the CSP for a corresponding tag for the randomly queried outsourced data block;
The service agent accesses the block stored in the CSP and the corresponding tag to generate a response signal including a round trip time (RTT) value and a log file related to guaranteeing the geographic location of data, and transmits the response signal to the client through the gateway agent. contains steps,
The client receives the response signal from the service agent, and determines whether the CSP has moved the outsourced data to another geographical location based on the log file and the value of the RTT to determine geographical location assurance. A method for storing artificial intelligence data locations, including delete delete delete

Images