KR20100114608A - Secure data transmission for ata-based virtual storage system - Google Patents

Abstract

PURPOSE: A safe data transmitting method is provided to execute a packet-based security process by offering an iATA-based remote storage service for a mobile terminal. CONSTITUTION: A terminal encodes transmission data to a dragon stream cipher. The encoded data is authenticated to a dragon-MAC. A four-byte sized message authentication code(450) is generated. An iATA protocol data unit including the message authentication code is transmitted. A server receives the iATA protocol data unit. The server decodes the message authentication code. The server processes it according to the received command. The server drops the iATA protocol data unit by determining a hacking or attacked data when the message authentication code is not accorded.

Description

Secure Data Transmission for AT-based Virtual Storage System {Secure Data Transmission for ATA-based Virtual Storage System}

The present invention relates to the Internet Advanced Technology Attachment (iATA) protocol, and more particularly, to provide a storage space service using ATA storage over the Internet, and can safely transmit and receive data even when an external attack may occur during data transmission and reception. The present invention relates to a secure data transmission method for an ATA based virtual storage system.

As the ubiquitous computing environment grows rapidly, mobile technology plays an important role in enhancing mobility in communications and information sharing. Although the development of mobile devices has increased significantly, the demand for shortage of storage space is increasing due to the small amount of data storage space. One solution to this limitation of the storage capabilities of mobile devices is to store data in the storage space of the network.

Currently, there are two types of hard disks, SCSI and ATA. In the case of SCSI disks, remote SCSI hard disks can be recognized as local disks through the internationalized iSCSI (Internet SCSI) protocol.

Although it is possible to store data on a server using virtual storage system SCSI (Small Computer System Interface) storage device to provide mobile device users with internet storage space, SCSI storage device is expensive and requires a separate card. do.

Therefore, if the storage space on the Internet using the low-cost ATA storage does not require a separate card, it can solve the limitation of the storage space of the mobile devices (mobile devices).

Until now, however, ATA disks did not have virtual storage protocols such as iSCSI, but recently developed iATA protocol.

However, when providing storage space over the Internet using ATA storage using the Internet Advanced Technology Attachment (iATA) protocol, there is no secure processing of data, so sending and receiving data over an open ubiquitous TCP / IP network is a malicious security attack. There is a problem that can be exposed.

The above-mentioned Internet Advanced Technology Attachment (iATA) protocol is a new block-level network storage protocol. Since the ATA commands sent from the mobile device can be transmitted through the TCP / IP network, the Internet access to the server's ATA disk wirelessly using the mobile device. Data can be stored.

On the other hand, if the data is exposed to a malicious security attack by using the Internet Advanced Technology Attachment (iATA) protocol to transmit and receive data over a TCP / IP network without security, not only the loss of important data but also the modification or insertion of data and control data Since it can be attacked by various attacks such as the insertion of data, it is urgent to solve the security problem of the iATA protocol when using ATA storage to provide storage space over the Internet.

The present invention solves the above-described problems, the present invention is secure data transmission (security) and the efficiency of the Internet Advanced Technology Attachment (iATA) protocol capable of per-packet shield (packet shield) It is related to Dragon Stream Cipher and Dragon Mac (MAC) for data transmission and reception, so that data can be safely transmitted and received against attacks such as external hacking. It is an object of the present invention to provide a secure data transmission method for a storage system.

According to an aspect of the present invention, a method for transmitting and receiving data using an iATA protocol between a wired / wireless terminal and a server on the Internet includes a first step of encrypting data to be transmitted by a wired / wireless terminal with a dragon stream cipher; And authenticating the data encrypted with the Dragon Stream Cypher with the Dragon Mac and generating and adding a 4-byte message authentication code to transmit the iATA protocol data unit, and upon receiving the iATA protocol data unit from the server, a message authentication code. And decrypts, compares, compares, and matches a third step according to an instruction.

In addition, in the third step, if the message authentication code does not match, characterized in that the hacked or attacked data to drop the iATA protocol data unit from the server, characterized in that when the server receives the iATA protocol data unit Each message is received by the Dragon Mac, and the message is decrypted and compared with the message authentication code added to the iATA protocol data unit to determine whether it is normal.

The third step of the present invention is to decrypt the iATA protocol data unit with a dragon stream cipher if the message authentication code matches, and write the decrypted iATA protocol data unit to a disk of the server according to a request command, or And reading data from the server and encrypting the dragon cipher with the dragon cipher and authenticating the dragon mac to the wired / wireless terminal when there is data to be transmitted from the server to the wired / wireless terminal.

In addition, the first step encrypts the iATA common header and the iATA data portion to be transmitted from the wired / wireless terminal with Dragon Stream Cypher. The second step is a 4-byte payload that authenticates the Dragon Mac and specifies length information of the original iATA protocol data unit. The load field is added and transmitted.

In addition, the iATA protocol data unit of the present invention includes an iATA common header segment field including the payload length of a next payload having a variable size and the type information of a message included in the payload, an ATA command, an address, ATA command block or setting / query message fields containing data or containing configuration parameters and system details, data fields containing data according to the messages contained in the ATA command block message or setting / query message fields, and before encryption And a 4-byte payload field indicating the size of the original data of the message, and a 4-byte message authentication code field, wherein the iATA common header segment field and the data field are encrypted and authenticated by Dragon Stream Cypher and Dragon Mac to transmit and receive. It is characterized by.

The iATA common header segment field may also include an action message type field indicating message type information, a device identification field indicating information for identifying ATA storage and a name, a session identification field indicating session management information, and a variable size. It consists of a payload length field indicating the length of the payload, and a task tag field indicating the ATA request / response mapping information, and is encrypted and authenticated by the Dragon Stream Cypher and the Dragon Mac.

The present invention can cope with problems such as loss of important data, correction or insertion of data, insertion of control data, and the like due to external malicious attacks when sending and receiving data over a TCP / IP network using the iATA protocol. can do.

In addition, the present invention provides an iATA-based remote storage service for mobile devices, which is efficient, lightweight, fast, and has the effect of handling packet-based security such as confidentiality, data source authentication, integrity, and response protection.

In addition, the present invention solves the problem of efficiency and security when providing a remote storage service on the Internet using ATA storage that is easy to install and low-cost in a notebook, PC or server, so that the remote storage space desired for a large number of mobile device users It can provide services safely and smoothly.

Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings.

It should be noted that in the following description, only parts necessary for understanding the operation according to the present invention will be described, and descriptions of other parts will be omitted.

Recently, the company developed the Internet Advanced Technology Attachment (iATA) protocol, which can be installed on mobile devices connected wirelessly and send and receive commands and data from ATA devices over a TCP / IP network.

The present invention relates to security for the iATA protocol, and encrypts and authenticates transmitted and received data with Dragon stream cipher and Dragon Mac (Dragon-MAC) to secure data when transmitting and receiving data in a resource-restricted environment such as a mobile device. It is a secure data transmission method for ATA-based storage systems that meets the needs of security and efficiency, and is safe, efficient, lightweight, and fast, and handles packet security such as confidentiality, data source authentication, integrity, and response protection.

1 is a diagram illustrating a protocol layer structure in which a security module of the Internet Advanced Technology Attachment (iATA) protocol of the present invention is installed.

FIG. 1 illustrates a protocol hierarchy structure capable of transmitting and receiving secure data between a wired / wireless terminal, which is a client 200, and an iATA server 300. The protocol hierarchy structure of a security module of an Internet Advanced Technology Attachment (iATA) protocol is installed. It is composed of a physical layer, a data link layer, a network layer, a transport layer, and an application layer.

Meanwhile, the client 200 includes a wired / wireless terminal capable of internet such as a computer, a notebook, a PDA, a mobile communication terminal, and the like. The iATA server 300 may be implemented as an iATA computer.

Nodes in the Internet generally handle the transmission and reception of secure data between the client 100 and the iATA server 120 using a physical layer, a data link layer, and a network layer. do.

The TCP layer, which is a transport layer, provides a communication link for transmitting reliable ATA command blocks, ATA responses, and data in a parallel / serial ATA interface communication model. At this time, only one TCP connection is formed for one session.

Operation of the transport layer, network layer, data link layer, and physical layer is performed in a LAN module of the client 200 and the iATA server 300.

The block IO module 210 of the client 200 of the application layer controls an operation for making the ATA storage appear to the user as a local device.

The ATA module 220 recognizes the ATA storage as a local device, and defines and provides ATA commands and ATA responses for reading and writing data to the ATA storage mounted in the iATA server 300. That is, the ATA module of the client 200 manages ATA commands and responses for controlling the ATA module 320 of the iATA server 300.

The iATA module 230 of the client 200 generates data to be transmitted from the client 200 terminal as an iATA protocol data unit (iATA PDU), and when the iATA server 300 finishes receiving the iATA protocol data unit, the iATA server ( Command and ATA command, ATA response, and data for terminating with 300).

In addition, the iATA module 230 of the present invention, the security module 240 is installed to encrypt the data generated by the iATA protocol data unit (iATA PDU) with Dragon stream cipher (Dragon stream cipher).

The cipherhertext of the iATA protocol data unit encrypted with the Dragon stream cipher is again authenticated with Dragon-MAC to generate a 4-byte Message Authentication Code (MAC). The generated 4-byte Message Authentication Code (MAC) is inserted at the end of the newly encrypted iATA protocol data unit.

Encrypted iATA PDUs also contain an iATA header, so TCP cannot determine the beginning and end of an encrypted iATA protocol data unit, which can result in data loss. A payload length of 4 bytes is added to the beginning of the encrypted iATA protocol data unit, which specifies the length of the original iATA protocol data unit before it is encrypted.

As a result, the security module 240 of the present invention encrypts the original iATA protocol data unit with a Dragon stream cipher, and then authenticates it again with a Dragon Mac (MAC), finally encrypting the iATA protocol data unit ( A payload length of 4 bytes is added in front of the encrypted iATA PDU, and a 4 byte Message Authentication Code (MAC) is added at the end.

Meanwhile, the iATA server 300 includes an ATA storage module 310, an ATA module 320, an iATA module 330, and a security module 340 that operate in an application layer.

The ATA storage module 310 controls an operation for reading and writing data to ATA storage. The ATA module 320 manages ATA storage allocated to multiple clients, provides ATA storage to be recognized as a client's local device, and ATA storage module for ATA requests for read and write requests from clients after recognition. Control to read or write data.

It also controls parameter negotiation for recognizing ATA storage as a local device, and transmits and receives an iATA protocol data unit (Encrypted iATA PDU) including data on ATA storage recognition, ATA request, and response command by parameter negotiation control.

When the iATA server 300 receives an encrypted iATA protocol data unit (Encrypted iATA PDU) from the client 200, the security module 340 decrypts in the reverse order of the encryption process.

Whenever an iATA protocol data unit (Encrypted iATA PDU) is received to the iATA server 300, an encrypted message is received and calculated using Dragon-MAC, and the received encrypted iATA protocol data unit (Encrypted) is received. Compare with 4 bytes of Message Authentication Code (MAC) in iATA PDU), if the MAC value is matched, decrypt the iATA protocol data unit using Dragon stream cipher and if the MAC value does not match The iATA protocol data unit identifies the dropped message and drops it.

Since the present invention generates and transmits data to an encrypted iATA protocol data unit (Encrypted iATA PDU) using Dragon Stream Cypher as a cryptographic encryption algorithm and a Dragon Mac as a cryptographic authentication algorithm, It can also securely send and receive data against active or passive security threats, including message manipulation, insertion, and deletion.

2 is a diagram illustrating a dragon stream cipher of the present invention.

Dragon Stream Cypher and Dragon Mac meet security and efficiency, are safe against many known attacks, and have fast rekeying capabilities, making them ideal for mobile or wireless communications applications.

Dragon stream ciphers provide fast key stream generation, can handle gigabits per second with only 4 kilobytes of memory, and are well suited for maintaining and maintaining the confidentiality of mobile devices.

Dragon Stream Cipher is a word-based stream cipher that is synchronized with the eSTREAM, ECRYPT stream cipher project.

Dragon Stream Cypher consists of a large single word-based NLFSR, a 1024-bit nonlinear feedback shift register, a state update function represented by the F function, and a 64-bit memory represented by the M.

Referring to FIG. 2, the Dragon F function is used for key setup and keystream generation, and six 32-bits word six 32-bits word. This is a mapping that can be inversely transformed.

In Figure 2 the input words are a, b, c, d, e, f and the output words are a ', b', c ', d', e ', f'.

Six component functions are represented by G1, G2, G3, H1, H2, H3, and the F function provides a high degree of nonlinearity.

The G and H functions are configured to form a virtual 32 * 32 s-box from two 8 * 32 bit s-boxes. 32-bit input is divided into 4 bytes (x = x1 || x1 || x2 || x3), each byte goes through an 8 * 32 s-box, and four 32-bit outputs contain a binary addition. Combined using.

Dragon uses simple key tactics with 128-bit keys and initialization vectors.

The internal state of 1024 bits is initially populated with a sequence of keys and initialization vectors and those divided into eight 128-bit words W0 to W7, and eight iterations of eight 128-bit swapping and F-function processing. Use a wide range of F functions, including

An example of a Dragon's Key Initialization Function is briefly shown at the bottom of FIG. 2.

The keystream generation of the dragon stream cipher uses the same components as the initialization. The 1024-bit NLFSR is divided into 32 32-bit words and denoted by Bi, 0 ≦ i ≦ 31. In each round, six words from the internal state are used as inputs to the F function, which contains a 64-bit memory M that acts as a counter. During each round of keystream generation, the output of the 64-bit word K and the updated state B and memory M are provided.

Dragon Stream Cypher satisfies security and efficiency, is safe against known attacks, and has fast rekeying capability, making it suitable for mobile or wireless communications applications.

Note that Dragon Stream Cypher is an open cryptographic protocol that can be effectively used in virtual storage protocols such as iATA.

3 is a view for explaining an example of creating a Dragon Mac of the present invention.

Dragon Mac is also an authentication protocol, just like Dragon Stream Cypher.

Dragon Mac is a message authentication code that has F function for MAC generation and has structure of Dragon Stream Cypher.

This is a 192-bit to 192-bit invertible mapping that provides four bytes of output that operate on a MAC. The Dragon Mac utilizes a high degree of nonlinearity and a low autocorrelation effect and is provided by S boxes with F state update function structure.

The plaintext of the packet message is encrypted with the dragon stream cipher under an encryption key Ke, and generates a ciphertext Ct that is generated as a 32-bit word. Successively, the MAC encryption key Km is fed to the F function of inputs a, b, c, d. As a result, a 32-bit MAC is obtained by XORing all the outputs of the F function.

As mentioned above, the Dragon Mac, like Dragon Stream Cypher, completes its detailed description with the already published cryptographic authentication protocol.

4 is a conceptual diagram for generating an encrypted iATA protocol data unit in the security module of the present invention.

In the security module 240 installed in the client 200 of the present invention, when data to be transmitted / received is generated as an iATA protocol data unit (iATA PDU), the iATA common header 420 and the iATA data 440 portion are dragon stream ciphers. Encrypt with (Dragon stream cipher).

The cipherhertext of the iATA protocol data unit encrypted with the Dragon stream cipher is again computed by MAC computation and packet re-encapsulation with the Dragon-MAC to authenticate 4 bytes of message. Generate a code (MAC). The generated 4-byte Message Authentication Code (MAC) 450 is inserted at the end of the newly encrypted iATA protocol data unit.

In addition, a payload length 410 of 4 bytes is added to the front of the encrypted iATA protocol data unit, which specifies and transmits length information of the original iATA protocol data unit before being encrypted.

5 is a diagram illustrating a format structure of an encrypted iATA protocol data unit of the present invention.

The encrypted protocol data unit (PDU) of the present invention consists of a TCP header field, an IP header field and an Ethernet frame field, and an iATA protocol data unit (PDU) field 400. The TCP header field, the IP header field and the Ethernet frame field are configured for routing in the Internet.

The encrypted iATA protocol data unit 400 field of the present invention consists of 4 bytes of payload length 410, iATA common header segment (410), in which the size information of the original iATA PDU is recorded before being encrypted. A 4-byte MAC with an iATA Common Header Segment field (420), an ATA command block or setup / query message (430) field, a data (440) field, and a 4-byte Message Authentication Code (MAC). Consists of a field 450.

The iATA common header segment is a 16-byte variable that can specify the ATA operation message type and can also specify an ATA command block or configuration / query message. In addition, iATA common header segments are important for identification, naming, session identity, and task tag fields used in session management and ATA request response mapping. Can consist of values.

If you specify a message operation for a configuration / query message in the iATA common header segment, the message is an out-of-bank iATA I / O message such as a batch parameter or system variable. Used to exchange with.

Meanwhile, when a message operation of an ATA command block is specified in the iATA common header segment, the message is used for transmission of read / write operation data. The data field 340 inserts data according to an ATA command block message or a setting / query message.

The iATA common header segment field and the data field described above are secured by encrypting and authenticating with Dragon Stream Cypher and Dragon Mac at the time of transmission and reception.

FIG. 6 is a diagram illustrating a detailed configuration of the iATA common header segment field 420 of FIG. 5.

Referring to FIG. 6, the iATA common header segment field 420 is 16 bytes, and an operation type (Op Type) field 311, a reserved field 312, a flag field 313, and an error are generated. Field 314, session ID field 315, device ID field 316, payload length field 317, and task tag field 318.

The operation type (Op Type) field 311 represents an operation code and the reserved field 312 is an extra field to be used in the future. The flag field 313 is used to set additional functions and the error field 314 indicates a status code when an error occurs. The device identification field 315 is used to identify the iATA device, ie ATA storage and name. In contrast, session identification field 316 and task tag field 318 are used for session management and ATA request / response mapping. The payload length field 317 indicates the payload length of the next payload having a variable size.

FIG. 7 is a diagram illustrating a detailed configuration of the setting / query message field 430 of FIG. 5.

Referring to FIG. 7, the setup / query message field 430 includes a command / status field 331, a string length field 332, and a setup / query string pair field 333. The command / status field 331 indicates the command and status code and the string length field 332 indicates the length of the next set / query string pair field 333. The setup / query string pair field 333 represents a string value for setup / query.

FIG. 8 is a diagram illustrating a detailed configuration of the ATA command block field 430 of FIG. 5.

Referring to FIG. 8, a flag field 334, an error / feature field 335, a sector count field 336, a command / status field 337, and six logical block addresses ( Logical Block Address (LBA) fields 338, spare fields 339, and data fields 341.

The flag field 334 is used to set up additional functions and the error / feature field 335 indicates the status code when an error occurs and the sector count field 336 indicates the number of sectors to be accessed. Command / status field 337 represents ATA command and (some status) status information, and each LBA field 338 is eight bits, a total of 48 bits, representing the address of ATA storage. The data field 341 consists of data to be read from and written to ATA storage.

9 is a flowchart illustrating the operation of an iATA based remote storage service in the iATA module of the present invention.

The iATA-based remote storage service process according to the present invention is composed of a login phase, a discovery phase, a full feature phase, and a termination phase.

The login process is performed after the internet network is formed, and authentication of the client 200 and the iATA server 300, negotiation of session parameters, connection establishment under a single ATA session, and the like are performed.

Specifically, when the iATA-based remote storage service access command including the user identification information and the password is generated through the iATA-based remote storage service application, the client 200 performs an iATA authentication message including the user identification information and the password at step 711. iATA Authentication Message) is transmitted to the iATA server 300. The user identification information and password are included in the setup / query message of the iATA protocol data unit.

The iATA server 300 receiving the iATA authentication message performs authentication by user identification information and password included in the iATA authentication message, and transmits an iATA authentication response message according to the authentication result to the client 200 in step 713. .

If the iATA authentication response message is a successful authentication message, the client 200 transmits an iATA session parameter setting message to the iATA server 300 in step 715.

Upon receiving the iATA session parameter setting message, the iATA server 300 sets a configuration according to the included session parameters and transmits an iATA session parameter response message to the client 200 in step 717 according to the result of the setting. Session parameters include Maximum Sector Count, Maximum Burst length, and Maximum Connection.

Authentication methods of the client 200 and the iATA server 300 may include a method such as an access control list (ACL), a secure remote password (SRP), and a digital certificate.

Next, the recognition process is a process of recognizing ATA storage allocated for the client 200 and recognizing it as a local device.

In detail, the client 200 transmits an iATA device recognition message to the iATA server 300 in step 719. The device recognition message is included in the configuration / query message and transmitted.

Upon receiving the iATA device recognition message, the iATA server 300 transmits an iATA device discovery response message (iATA device discovery response) to the client 200 according to the recognition result. At this time, the client 200 recognizes the ATA storage as a local device. The iATA device recognition response message is also included in the Configuration / Query Message.

The entire operation process is a process in which the client 200 transmits and receives ATA commands and data when data to be written to or stored in the ATA storage of the iATA server 300 is generated.

In detail, in operation 723, the client 200 transmits an ATA request command message including ATA commands and data to the iATA server 300 to read or write data to the ATA storage of the iATA server 300. .

At this time, in the present invention, the iATA PDU in the security module 240 of the client 200 encrypts the iATA common header and the iATA data portion with a dragon stream cipher and then authenticates it with a Dragon Mac (Dragon-MAC) again. do.

A 4-byte payload field is added in front of the iATA protocol data unit (Encrypted iATA PDU) that encrypts the iATA header and the iATA data portion, and a 4-byte message authentication code (MAC) at the end. Is added and transmitted. However, ATA command blocks or configuration / query messages are sent without encryption.

Then, the security module 340 of the iATA server 300 passes the decryption process for the encrypted iATA protocol data unit (Encrypted iATA PDU) according to the received ATA command and passes the data to or reads from the ATA storage after writing. The result or read data is encrypted and authenticated with the Dragon stream cipher and the Dragon Mac in the manner described above by the security module 340 and transmitted to the client 200 in step 725 with an ATA response message. do.

As described above, since the present invention authenticates and transmits the iATA common header and iATA data using a dragon stream cipher and a dragon-mac, data is transmitted and received safely.

Meanwhile, the termination process is a process of removing session records from both the client 200 and the iATA server 300 before the connection of the Internet network is terminated.

In more detail, in the termination process, the client 200 transmits an iATA connection termination request message to the iATA server 300 in step 727.

Upon receiving the iATA connection request message, the iATA server 300 deletes the session record and transmits the iATA connection termination response message to the client 200 in step 729. The client 200 then deletes the session record and ends.

10 illustrates an example of transmitting and receiving secure data to a remote iATA based storage system using a mobile device according to the present invention.

The configuration of the present invention is composed of a mobile device 500, an access point (AP) 520, an internet network, an iATA server 300, and the like, which are clients. The iATA server 300 may use an iATA computer.

In addition, the mobile device 500 is a wireless Internet-enabled terminal, a personal digital assistant (PDA), a PCS, a CDMA phone, a digital camera having a wireless communication function, an MP3 player, a portable multimedia player (Portable Multimedia Player). : Any digital device such as PMP) or digital set-top box is possible.

The iATA client driver is installed in the mobile device 500, the iATA server 300 is installed with an ATA disk and iATA server driver is installed.

In the present invention, even if the mobile device 500 (Personal Data Assistant) and the operating system (OS) installed in the iATA server 300 is different, the operation is independently processed smoothly.

When the mobile device 500 accesses the iATA server 300 via the access point 520 via the Internet network and then goes through the aforementioned authentication and recognition process, the ATA storage connected to the iATA server 300 is recognized as a local device. do.

If the ATA storage is recognized as a local device and a data read or write request is required, the mobile device 500 sends an ATA command for reading or writing and an encrypted iATA protocol data unit (Encrypted iATA PDU) to the access point 520 and the Internet. Transmit to iATA server 300 through a network.

When the iATA server 300 receives an encrypted iATA PDU encrypted in the above-described manner, the iATA server 300 decrypts and authenticates using a dragon stream cipher and a dragon-MAC. Read or write the data from ATA storage.

As described above, the present invention provides a dragon stream cipher and a dragon Mac (i.e., a dragon stream cipher) to the iATA protocol during data transmission and reception to use the ATA storage of the iATA server 300 on the Internet as a local disk using the mobile device 500. It is a security module with Dragon-MAC) that encrypts and authenticates data and sends and receives data so that it can send and receive data safely and efficiently even against various known attacks.

So far, the configuration and operation of the embodiment of the present invention have been described. The present invention is not limited to the above-described embodiments, and various modifications can be made without departing from the scope of the present invention. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be defined not only by the claims but also by the equivalents of the claims.

1 is a diagram showing a protocol layer structure in which the security module of the iATA protocol of the present invention is installed.

2 illustrates a dragon stream cipher of the present invention.

3 is a view for explaining an example of dragon Mac generation of the present invention.

4 is a conceptual diagram for generating an encrypted iATA protocol data unit in the security module of the present invention.

5 shows the format structure of an encrypted iATA protocol data unit of the present invention.

FIG. 6 is a diagram illustrating a detailed configuration of an iATA common header segment field 420 of FIG. 5.

FIG. 7 is a diagram showing the detailed configuration of the setting / query message field 430 of FIG.

8 is a diagram showing the detailed configuration of the ATA command block field 430 of FIG.

9 is a flowchart illustrating the operation of an iATA based remote storage service in the iATA module of the present invention.

10 illustrates an example of transmitting and receiving secure data to a remote iATA based storage system using a mobile device according to the present invention.

<Description of the symbols for the main parts of the drawings>

200: Client 300: iATA Server

500: mobile terminal 520: access point

Claims (13)

In transmitting and receiving data using iATA protocol between a wired and wireless terminal and a server on the Internet, Encrypting data to be transmitted by the wired / wireless terminal with a dragon stream cipher; A second step of authenticating the data encrypted by the dragon stream cipher with a Dragon Mac and generating and adding a 4-byte message authentication code to transmit an iATA protocol data unit; And receiving the iATA protocol data unit from the server, decrypting the message authentication code, comparing the message authentication code, and processing the same according to the received command if the message is matched with the iATA protocol data unit. . The method of claim 1, In the third step, If the message authentication code does not match, secure data transmission method for the AI-based virtual storage system, characterized in that the hacked or attacked data and dropping the iATA protocol data unit from the server. 3. The method of claim 2, The server is Receive an encrypted message with a Dragon Mac every time the iATA protocol data unit is received, and decrypt the message to determine whether it is normal by comparing with a message authentication code added to the iATA protocol data unit. Secure data transfer method for virtual storage systems. The method of claim 1, The third step, Decrypting the iATA protocol data unit with a dragon stream cipher if the message authentication code matches; Writing the decrypted iATA protocol data unit to a disk of the server or reading data from the server according to a request command; If there is data to be transmitted from the server to the wired / wireless terminal, encrypting with the dragon cipher, authenticating with a dragon mac, and transmitting to the wired / wireless terminal, the secure data transmission method for an AT-based virtual storage system, comprising: . The method of claim 1, The first step is, And encrypting an iATA common header and an iATA data portion to be transmitted by the wired / wireless terminal with a dragon stream cipher. The method of claim 1, The second step, And a 4-byte payload field, which is authenticated with the Dragon Mac and specifies the length information of the original iATA protocol data unit, and is transmitted. The method of claim 1, The iATA protocol data unit, An iATA common header segment field including a payload length of a next payload having a variable size and type information of a message included in the payload; An ATA command block or setting / query message field containing ATA commands, addresses and data for reading or writing, or including configuration parameters and system details; A data field including data according to a message included in the ATA command block message or a setting / query message field; A 4-byte payload field representing the size of the original data before encryption; A method of secure data transmission for an AI-based virtual storage system, comprising a 4-byte message authentication code field, wherein the iATA common header segment field and the data field are encrypted and authenticated by Dragon Stream Cypher and Dragon Mac. . The method of claim 7, wherein The iATA common header segment field is An action message type field indicating type information of the message; A device identification field indicating information for identifying the ATA storage and a name; A session identification field indicating session management information and a payload length field indicating a length of a next payload having a variable size; A method of secure data transmission for an AI-based virtual storage system, comprising: a task tag field indicating ATA request / response mapping information, and encrypted and authenticated by a dragon stream cipher and a dragon mac. The method of claim 7, wherein The setting / query message field is A command / status field indicating an ATA command and status information; A string length field indicating the length of the next setting / query string pair field; A method for secure data transmission for an ATC-based virtual storage system, characterized by a configuration / query string pair field representing a string value for configuration / query. The method of claim 7, wherein The ATA command block field is, A flag field indicating information for setting an additional function; An error / feature field indicating a status code for the error if an error occurs; A sector count field indicating the number of sectors to be accessed; A command / status field indicating an ATA command and status information; A method of secure data transfer for an ATI-based virtual storage system, comprising logical block address fields indicating addresses of ATA storage. The method of claim 1, The wired / wireless terminal has an iATA client driver installed therein, and includes a terminal capable of internet communication such as a PC, a notebook computer, a mobile communication terminal, and a PDA. The method of claim 1, Wherein the server is installed iATA server driver, ATA storage, characterized in that the computer can be configured as a secure data transfer method for the AI-based virtual storage system. The method of claim 1, The iATA protocol is, A method of secure data transmission for an ATV-based virtual storage system, characterized in that the terminal is configured to use the ATA storage of the server located on the Internet as a local disk.

Images