KR20230045267A - Dynamic update method for encrypted contents in cloud environment and cloud server - Google Patents

Abstract

A disclosed technology relates to a dynamic update method for encrypted content in a cloud environment and a cloud server. The method comprises the steps of: dividing, by a cloud server, input content into a plurality of blocks; generating, by the cloud server, a plurality of types of link information connecting adjacent blocks among the plurality of blocks; encrypting, by the cloud server, each of the plurality of blocks using data included in a corresponding block and a portion of link information on both sides connected to the corresponding block; and when the cloud server receives an update request for partial blocks among the plurality of blocks, updating only the partial blocks using the updated partial blocks and the link information connecting the partial blocks.

Description

Dynamic update method of encrypted contents in cloud environment and cloud server {DYNAMIC UPDATE METHOD FOR ENCRYPTED CONTENTS IN CLOUD ENVIRONMENT AND CLOUD SERVER}

The disclosed technology relates to a method for updating content in a cloud environment in an encrypted state and a cloud server for dynamically updating an encrypted document.

A cloud service is a technology that provides various additional services by allowing users to store data in a remote storage and use it anywhere. Since COVID-19, as face-to-face activities have been converted to non-face-to-face methods, the demand for technology suitable for the new environment is increasing, and cloud computing is one of these demands.

These cloud services are technologies specialized for non-face-to-face environments, enabling data sharing and collaboration between users who are physically separated. However, as convenient as it is, there are inevitably issues related to data security, and many studies have been conducted for the security of cloud-based services. For safe collaboration, many cloud services use a method of encrypting data using a secret key shared only between internal users, decrypting it, updating it, and then encrypting it again when updating the data. However, this method has a problem in that the load of the server increases excessively in a cloud environment where a large number of users work on documents at the same time.

Korean Patent Registration No. 10-1979267

The disclosed technology provides a method and a cloud server for dynamically updating encrypted content in a cloud environment without decryption.

A first aspect of the technology disclosed to achieve the above technical problem is the step of dividing input content into a plurality of blocks by a cloud server, and a plurality of link information for connecting adjacent blocks among the plurality of blocks by the cloud server. generating, by the cloud server, encrypting each of the plurality of blocks by using some of the data included in the corresponding block and link information on both sides connected to the corresponding block, and the cloud server encrypting some of the plurality of blocks When an update request for a block of is received, updating only the partial blocks using the updated partial blocks and link information connecting the partial blocks is provided. .

A second aspect of the technology disclosed to achieve the above technical problem is a storage device for storing content, a communication device for receiving an update request for the content, and dividing the content into a plurality of blocks, and each of the plurality of blocks A plurality of link information linking adjacent blocks is generated, and each of the plurality of blocks is stored in the storage device in an encrypted state using some of data included in the block and link information on both sides connected to the block, A cloud server for dynamically updating an encrypted document including a processor that updates only some of the blocks by using some of the blocks updated according to an update request and link information connecting the some of the blocks.

Embodiments of the disclosed technology may have effects including the following advantages. However, this does not mean that the embodiments of the disclosed technology must include all of them, so the scope of rights of the disclosed technology should not be understood as being limited thereby.

A method for dynamically updating encrypted content in a cloud environment and a cloud server according to an embodiment of the disclosed technology update data in an encrypted state, thereby preventing data exposure.

In addition, since dynamic update is performed in an encrypted state, there is an effect of reducing server load compared to the prior art in which frequent decryption is performed.

In addition, even if data is leaked through block unit encryption, it has an effect of preventing plain text from being discovered.

1 is a diagram illustrating a process of dynamically updating an encrypted document in a cloud environment according to an embodiment of the disclosed technology.
2 is a flowchart of a method of dynamically updating encrypted content in a cloud environment according to an embodiment of the disclosed technology.
3 is a block diagram of a cloud server for dynamically updating encrypted content in a cloud environment according to an embodiment of the disclosed technology.
4 is a diagram illustrating an example of modifying, deleting, and adding encrypted content.
5 is a diagram illustrating a step of encrypting a plurality of blocks and link information.

Since the present invention can make various changes and have various embodiments, specific embodiments will be illustrated in the drawings and described in detail in the detailed description. However, this is not intended to limit the present invention to specific embodiments, and should be understood to include all modifications, equivalents, and substitutes included in the spirit and scope of the present invention.

Terms such as first, second, A, B, etc. may be used to describe various components, but the components are not limited by the above terms, and are only used for the purpose of distinguishing one component from another. used only as For example, a first element may be termed a second element, and similarly, a second element may be termed a first element, without departing from the scope of the present invention. The terms and/or include any combination of a plurality of related recited items or any of a plurality of related recited items.

In the terms used herein, singular expressions should be understood to include plural expressions unless the context clearly dictates otherwise. And the term "includes" means that there is an embodied feature, number, step, operation, component, part, or combination thereof, but one or more other features or number, step, operation component, or part. or the possibility of the presence or addition of combinations thereof.

Prior to a detailed description of the drawings, it is to be clarified that the classification of components in the present specification is merely a classification for each main function in charge of each component. That is, two or more components to be described below may be combined into one component, or one component may be divided into two or more for each more subdivided function.

In addition, each component to be described below may additionally perform some or all of the functions of other components in addition to its main function, and some of the main functions of each component may be performed by other components. Of course, it may be dedicated and performed by . Therefore, the existence or nonexistence of each component described through this specification should be interpreted functionally.

1 is a diagram illustrating a process of dynamically updating an encrypted document in a cloud environment according to an embodiment of the disclosed technology. Referring to FIG. 1 , a cloud server may establish a cloud environment with a plurality of collaborator terminals. A plurality of collaborators can use their respective terminals to transmit written data through a secure channel established with the cloud server. The cloud server may collect data transmitted from each collaborator terminal into contents and store them in storage. Here, the content may be various types of data such as documents, images, and videos created by collaborators. The cloud server may periodically or non-periodically update data transmitted from each collaborator terminal to contents thereafter. The cloud server stores the contents in an encrypted state to prevent data leakage to the outside when updating documents, and updates can be performed in an encrypted state when updating.

On the other hand, the cloud server can dynamically update the content in an encrypted state when updating the stored content. As an embodiment, when the cloud server receives a request to update the content from one of the plurality of collaborator terminals, the encrypted content may be applied without decrypting and updating the encrypted content as it is. For this operation, the cloud server may store the contents in advance in a block-by-block encrypted state as shown below.

First, the cloud server may divide content into a plurality of blocks. Each block corresponds to content in a plain text state and can be divided in the same ratio as plain text. For example, each of a plurality of lines within a paragraph may be divided into a plurality of blocks. The cloud server can divide plain text content of an arbitrary length into blocks of a fixed length, as in the conventional DES and AES schemes. The meaning of division here may itself be a kind of encryption process.

Meanwhile, when the cloud server divides a plurality of blocks, it generates a plurality of link information between each block. The cloud server may generate a plurality of pieces of link information connecting blocks adjacent to each other among a plurality of blocks. Here, the link information refers to information that stores a part of information included in a previous block and a part of information included in a next block in a redundant manner. For example, first link information for connecting a specific block among a plurality of blocks to an adjacent block on one side of the corresponding block and second link information for connecting to an adjacent block on the other side of the corresponding block may be generated. The link information may be used to confirm where a document to be updated is to be applied when content in an encrypted state is updated in real time. That is, the position to which the document to be updated is applied can be identified based on some information stored in the link information without decoding the information divided into blocks and returning them to a plain text state.

Meanwhile, the cloud server may encrypt a plurality of blocks in block units using a plurality of pieces of link information. For example, the cloud server uses data included in a specific block among a plurality of blocks, link information of half of the first link information close to the specific block, and link information of half of the second link information close to the specific block. The block can be encrypted. By applying this process to each block, the content can be encrypted into a plurality of block data.

Meanwhile, the cloud server may share a secret key with a plurality of collaborator terminals in advance. The secret key is for accessing the encrypted content and can be shared over a secure channel. The secret key is not shared only with a specific terminal, but can be shared with all terminals in the cloud environment through a secure channel.

Meanwhile, the cloud server may receive an update request for updating a part of the content from one of a plurality of collaborator terminals after storing the content in an encrypted state according to the above-described process. The update request may be transmitted through a secure channel by one of the plurality of cooperator terminals. According to the update request, the cloud server may update only some of the blocks while maintaining the remaining blocks by using some of the blocks to be updated among the plurality of blocks and link information connecting the blocks. The cloud server may check where a specific block corresponding to data to be updated is located among a plurality of blocks by using a plurality of pieces of link information. That is, the cloud server may update content based on information stored in link information without decoding blocks into plain text. Since the cloud server encrypts the contents in block units, the collaborator can check which part of the contents to modify by using the link information included in each encrypted block.

Meanwhile, the update process of the cloud server can be basically divided into modification, deletion, and addition. First, when modifying a specific block among a plurality of blocks, the cloud server may modify data included in the specific block to data according to an update request. In addition, among the link information connected to the left side of the specific modified block, half link information close to the specific modified block and half link information close to the specific modified block among link information connected to the right side of the specific modified block Information can be modified with the data included in the specific block being modified. As described above, link information connected to both sides of a specific block stores part of the data included in the specific block redundantly, so when a specific block is modified, the modified data can be stored in half redundantly.

Meanwhile, When deleting a specific block among a plurality of blocks, the cloud server provides link information of half of the specific block and link information connected to the left side of the specific block and link information connected to the right side of the specific block. Half of link information close to a specific block can be deleted. In addition, among link information connected to the left side of a specific block, half of the link information far from the specific block and link information of the half far from the specific block among link information connected to the right side of the specific block can be combined into one link information. can That is, since the data of the specific block stored in the link information on both sides is deleted as the specific block is deleted, the remaining data stored in the link information on both sides can be combined into one piece of link information.

Meanwhile, when a specific block is inserted between a plurality of blocks, the cloud server may generate data according to an update request as a specific block. Naturally, a specific block that is created is a new block that is not included in a plurality of existing blocks. The cloud server may insert the generated block into a specific position among a plurality of blocks. In this process, the cloud server separates the link information at the location where the specific block is inserted, and adds the data included in the specific block to the link information on the left of the separated link information and the link information on the right among the separated link information. there is. In contrast to combining the remaining link information into one in the previous deletion process, newly added data may be stored in the link information. According to this process, the cloud server can perform dynamic update without decoding the content into plain text.

2 is a flowchart of a method of dynamically updating encrypted content in a cloud environment according to an embodiment of the disclosed technology. Referring to FIG. 2 , the method of dynamically updating an encrypted document includes steps 210 to 240 and may be sequentially performed through a cloud server.

In step 210, the cloud server divides the content into a plurality of blocks. The cloud server may encode plain text content into a plurality of blocks in order to prevent the original content from being exposed to the outside.

In step 220, the cloud server generates a plurality of link information linking blocks adjacent to each other among a plurality of blocks. Link information refers to information for connecting each block by dividing and storing a part of information included in a block. For example, part of the information of the previous block and part of the information of the next block may be stored. The cloud server can divide content into a chain structure in which a plurality of blocks and link information are repeated.

In step 230, the cloud server encrypts each of the plurality of blocks block by block using data included in the corresponding block and a part of both link information connected to the corresponding block. As described with reference to FIG. 1, it is possible to encrypt duplicate values stored in a block of a specific sequence, link information of a previous sequence, and link information of a next sequence, respectively. The cloud server encrypts and stores the content in block units according to steps 210 to 230.

In step 240, when the cloud server receives an update request for some blocks among the plurality of blocks, using some of the blocks to be updated and link information connecting some of the blocks, only some of the blocks remain while maintaining the remaining blocks. update The cloud server receives an update request for updating a part of content from one of a plurality of collaborator terminals belonging to the cloud environment. Step 240 corresponds to a step of updating content after steps 210 to 230 precede. The update request received by the cloud server may be data to be reflected in content. The cloud server may modify, delete, or add some blocks upon receiving data for updating content. When a specific block is modified, deleted or added, link information on both sides of the corresponding block can also be updated.

3 is a block diagram of a cloud server for dynamically updating encrypted content in a cloud environment according to an embodiment of the disclosed technology. Referring to FIG. 3 , the cloud server 300 includes a storage device 310 , a communication device 320 and a processor 330 . The cloud server 300 may be implemented as a device capable of serving as a server in a cloud environment. For example, it may be a PC, tablet or smartphone.

The storage device 310 stores encrypted content through a processor. The storage device may be implemented as a storage provided in a space different from the location of each collaborator terminal in order to apply to a cloud environment. The storage device may store only content for one cloud environment or separately store content for each of a plurality of cloud environments.

The communication device 320 communicates with one of the plurality of collaborator terminals and receives a request for updating content. The communication device receives data according to the update request through a secure channel. The communication device 320 may be implemented as a communication module or modem of the device 300 for dynamic updating of encrypted documents. The communication device may receive a document by communicating with a plurality of cooperator terminals through wired/wireless Internet.

The processor 330 divides the content into a plurality of blocks, generates a plurality of link information linking adjacent blocks among the plurality of blocks, and divides each of the plurality of blocks into data included in the corresponding block and both sides connected to the corresponding block. Some of the link information is used and stored in a storage device in an encrypted state. Then, when an update request is received through the communication device, only some of the blocks are updated by using some of the blocks to be updated and link information connecting the some of the blocks. The processor 330 may be a CPU or an AP of the apparatus 300 for dynamically updating encrypted documents. The processor may dynamically update content stored in an encrypted state in the manner described with reference to FIGS. 1 and 2 .

Meanwhile, the aforementioned cloud server 300 may be implemented as a program (or application) including an executable algorithm that can be executed on a computer. The program may be stored and provided in a temporary or non-transitory computer readable medium.

A non-transitory readable medium is not a medium that stores data for a short moment, such as a register, cache, or memory, but a medium that stores data semi-permanently and can be read by a device. Specifically, the various applications or programs described above are CD, DVD, hard disk, Blu-ray disk, USB, memory card, ROM (read-only memory), PROM (programmable read only memory), EPROM (Erasable PROM, EPROM) Alternatively, it may be stored and provided in a non-transitory readable medium such as EEPROM (Electrically EPROM) or flash memory.

Temporary readable media include static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), and enhanced SDRAM (Enhanced SDRAM). SDRAM, ESDRAM), Synchronous DRAM (Synclink DRAM, SLDRAM) and Direct Rambus RAM (DRRAM).

4 is a diagram illustrating an example of modifying, deleting, and adding encrypted content. As shown in FIG. 4 , the cloud server may update content created by multiple collaborators in real time. The cloud server can modify, delete, and add content encrypted in block units without decryption.

A of FIG. 4 shows content converted into a chain form composed of a plurality of blocks and link information. Each block is data divided into a certain length of plain text. Although data 1 to data 6 are illustratively shown in FIG. 4, the number of blocks may be changed. And the link information is data that stores the information of the previous block and the next block redundantly. Since the cloud server performs an update based on the information stored in the link information, the process of decoding the block into plain text is omitted.

Meanwhile, B-1 of FIG. 4 shows data 3 being modified to data 7. When data 3 corresponding to the third block is modified to be data 7, link 2 and link 3 connected to both sides of data 3 may be modified to link 6 and link 7, respectively. That is, part of data 3 stored in link 2 is modified as part of data 7 and updated as link 6, and part of data 3 stored in link 3 is modified as part of data 7 and updated as link 7. .

Meanwhile, B-2 of FIG. 4 shows data 4 being deleted. When data 4 corresponding to the fourth block is deleted, some information of data 4 stored in link 7 and link 4 connected to both sides of data 4 may also be deleted. As link 7 and link 4 are deleted along with data 4, link 8 may be created between data 7 and data 5 to store information of data 7 and data 5 in a partially redundant manner.

Meanwhile, B-3 of FIG. 4 shows adding data 8 between data 2 and data 7. As data 8 is added, link 9 that stores some of the information of both blocks redundantly is created between data 2 and data 8, and link 10 that stores some of the information of both blocks redundantly can be created between data 8 and data 7. there is.

5 is a diagram illustrating a step of encrypting a plurality of blocks and link information. According to the steps shown in FIG. 5, the cloud server may encrypt content in a plain text state. First, content in a plain text state is divided into a plurality of blocks (m1 to m6). The length or ratio of each block may be the same. Then, link information is generated between the blocks. The link information is a redundant value that stores part of the information of the previous block and the next block redundantly. Referring to FIG. 5, for example, link information r1 stores part of the information of blocks m1 and m2 redundantly. For example, information corresponding to the right half of block m1 and information corresponding to the left half of block m2 may be stored in link information r1.

Meanwhile, the classified data can be expressed as in Equation 1 below.

은 평문

을 구분한 것을 의미하고,

는 맨 처음 블록의 좌측 링크정보 및 맨 마지막 블록의 우측 링크정보를 의미한다. 맨 처음 블록의 좌측 링크정보에는 처음 블록의 정보 일부만 저장된다. 마찬가지로 마지막 블록의 우측 링크정보에는 마지막 블록의 정보 일부만 저장된다. 구분된 콘텐츠

는 순차적으로 가장 좌측의 링크정보

부터 가장 우측의 링크정보

사이에 있는 복수의 블록들 및 복수의 링크정보들을 포함한다.From here

silver plain text

means to separate

Means the left link information of the first block and the right link information of the last block. In the left link information of the first block, only part of the information of the first block is stored. Similarly, only part of the information of the last block is stored in the right link information of the last block. Separated content

is the leftmost link information sequentially

Rightmost link information from

It includes a plurality of blocks and a plurality of link information in between.

부터

까지를

(

는 1~6)으로 표현하고

에 암호화 함수

를 적용하면 아래 수학식 2의 형태로 정의할 수 있다.On the other hand, block

from

until

(

is expressed as 1 to 6)

to the encryption function

When applied, it can be defined in the form of Equation 2 below.

는 구분된 블록

와

의 왼쪽 링크정보 중 우측에 중복 저장된 값

및 오른쪽 링크정보 중 좌측에 중복 저장된 값

를 포함한다.i.e. the encrypted block

is a delimited block

and

Redundantly stored value on the right side of the left link information of

and redundantly stored value on the left side of right link information

includes

는 1~6까지 이므로 첫 번째 암호화 된 블록 및 마지막 암호화 된 블록은 아래 수학식 3으로 표현할 수 있다.As mentioned above, in the example of FIG. 5

is from 1 to 6, so the first encrypted block and the last encrypted block can be expressed by Equation 3 below.

는

에 맨 처음 좌측에 위치하는 링크정보의 우측에 중복 저장된 값

및 우측에 위치하는 링크정보 중 좌측에 중복 저장된 값

를 포함한다. 그리고 마지막 암호화 된 블록

는

에 좌측에 위치하는 링크정보 중 우측에 중복 저장된 값

와 마지막에 위치하는 링크정보 중 좌측에 중복 저장된 값

을 포함한다. 물론 사이에 나머지 블록들 또한 동일하게 암호화될 수 있다. 클라우드 서버는 이러한 과정에 따라 평문 상태의 콘텐츠를 암호화 된 블록 상태로 변환할 수 있다.first encrypted block

Is

The value stored redundantly on the right side of the link information located on the first left side in

and the redundantly stored value on the left side of the link information located on the right side.

includes And the last encrypted block

Is

Among the link information located on the left side of the value stored redundantly on the right side

and the redundantly stored value on the left side of the link information located at the end

includes Of course, the rest of the blocks can also be encrypted in the same way. The cloud server can convert plaintext content into an encrypted block state according to this process.

A method for dynamically updating content encrypted in a cloud environment and a cloud server according to an embodiment of the disclosed technology have been described with reference to the embodiment shown in the drawings for better understanding, but this is merely an example and is common knowledge in the art. Those who have will understand that various modifications and equivalent other embodiments are possible from this. Therefore, the true technical scope of protection of the disclosed technology should be defined by the appended claims.

Claims (12)

Dividing, by the cloud server, input content into a plurality of blocks;
generating, by the cloud server, a plurality of pieces of link information connecting blocks adjacent to each other among the plurality of blocks;
encrypting, by the cloud server, each of the plurality of blocks by using some of data included in the corresponding block and link information on both sides connected to the corresponding block; and
and updating, by the cloud server, only the partial blocks by using the updated partial blocks and link information connecting the partial blocks when the cloud server receives an update request for some blocks among the plurality of blocks. How to dynamically update encrypted documents that do. According to claim 1,
The corresponding block is connected to first link information connected to an adjacent block on one side of the corresponding block and second link information connected to an adjacent block on the other side of the corresponding block,
The cloud server uses half of the data included in the corresponding block, link information of half of the first link information close to the corresponding block, and half of the link information of the second link information close to the corresponding block, A dynamic update method for an encrypted document that encrypts that block. According to claim 1,
The link information is a method of dynamically updating an encrypted document in which part of the data included in the blocks adjacent to each other is redundantly stored. According to claim 1,
When modifying a specific block among the plurality of blocks, the cloud server modifies data included in the specific block to data according to the update request, and among the link information connected to the left of the modified specific block Half of link information close to the modified specific block and half link information connected to the right of the modified specific block are included in the modified specific block. A dynamic update method for encrypted documents that you modify with data. According to claim 1,
When the cloud server deletes a specific block from among the plurality of blocks, link information of half of the specific block and link information connected to the left side of the specific block close to the specific block and the specific block Among the link information connected to the right of, delete link information of half close to the specific block,
Among the link information connected to the left side of the specific block, half of the link information far from the specific block and the link information of the half far from the specific block among the link information connected to the right side of the specific block are one link information. A dynamic update method for encrypted documents that combines with . According to claim 1,
When inserting a specific block between the plurality of blocks, the cloud server generates data according to the update request as the specific block, inserts it into a specific position among the plurality of blocks, and inserts the specific block. A method of dynamically updating an encrypted document by separating link information at the separated location and adding data included in the specific block to link information on the left of the separated link information and link information on the right of the separated link information. a storage device for storing content;
a communication device receiving an update request for the content; and
Divides the content into a plurality of blocks, generates a plurality of link information linking adjacent blocks among the plurality of blocks, and divides each of the plurality of blocks into data included in the block and link information on both sides connected to the block. A processor for storing some of the blocks in an encrypted state in the storage device and updating only the partial blocks using link information connecting the partial blocks and the partial blocks updated according to the update request; A cloud server that dynamically updates encrypted documents that According to claim 7,
The corresponding block is connected to first link information connected to an adjacent block on one side of the corresponding block and second link information connected to an adjacent block on the other side of the corresponding block,
The processor uses data included in the corresponding block, link information of half of the first link information close to the corresponding block, and half of the link information of the second link information close to the corresponding block to determine the corresponding block. A cloud server that dynamically updates encrypted documents encrypting blocks. According to claim 7,
The link information is a cloud server for dynamically updating an encrypted document that redundantly stores some of the data included in the blocks adjacent to each other. According to claim 7,
When modifying a specific block among the plurality of blocks, the processor modifies data included in the specific block to data according to the update request, and among the link information linked to the left of the modified specific block Among the half link information close to the modified specific block and link information connected to the right of the modified specific block, the half link information close to the modified specific block is data included in the modified specific block. A cloud server that dynamically updates encrypted documents that you modify with . According to claim 7,
When the processor deletes a specific block from among the plurality of blocks, the link information of half of the specific block and link information connected to the left side of the specific block and half of the link information close to the specific block and the specific block Among the link information connected to the right, half of the link information close to the specific block is deleted,
Among the link information connected to the left side of the specific block, half of the link information far from the specific block and the link information of the half far from the specific block among the link information connected to the right side of the specific block are one link information. A cloud server that dynamically updates encrypted documents that you combine into. According to claim 7,
When inserting a specific block between the plurality of blocks, the processor generates data according to the update request as the specific block, inserts it into a specific position among the plurality of blocks, and inserts the specific block into the inserted block. A cloud dynamically updating an encrypted document that separates link information of a location and adds the data included in the specific block to the link information on the left of the separated link information and the link information on the right of the separated link information, respectively. server.

Images