KR20230112584A - Method for encrypting cloud data and apparatus thereof - Google Patents

Abstract

The present invention relates to a method for encrypting cloud data in a cloud system, comprising: detecting cloud data to be encrypted; identifying the type of the sensed cloud data; and encrypting the cloud data using different encryption keys according to the type of the identified cloud data.

Description

Method for encrypting cloud data and apparatus thereof {Method for encrypting cloud data and apparatus thereof}

The present invention relates to a method and device for encrypting cloud data, and more particularly, to a method and device for encrypting cloud data capable of maximally guaranteeing user control over customer data stored in a cloud.

Recently, as the capacity of media data generated by content providers and users increases, users need additional storage space in addition to their terminals. As a result, there is an increasing trend of using cloud storage services as additional storage and backup devices. As the demand for cloud services increases and security issues increase along with it, service providers are applying various security technologies to cloud systems.

Among various security technologies applied to cloud systems, database (DB) encryption refers to the process of converting data (plaintext) stored in a database into an unreadable form (ciphertext) through an encryption algorithm. Three types of encryption methods can be largely used for the DB encryption: a symmetric key (private key) method, an asymmetric key (public key) method, and a hash method. Through this DB encryption, even if an attacker passes through all security measures at the network and application level, such as a firewall, web firewall, and intrusion prevention system (IPS), and then accesses the database, secondary damage can be effectively prevented if the data stored in the database is encrypted.

On the other hand, in a cloud system environment, simple DB encryption itself cannot be said to be safe security. Safe security can be achieved only when the authority to decrypt encrypted data, that is, secure management and access control for the key is established. Accordingly, the cloud system provides systematic and safe encryption key management, auditing and access control functions through the Key Management System (KMS).

A general cloud system provides a service that stores and manages the data in a database by entrusting/entrusting the customer's data. Since the cloud system providing these services encrypts customer data and stores and manages them in a database, the customer cannot be considered to have control over the data stored in the cloud. However, from the customer's point of view, there is a requirement to ensure maximum control over their data, as in the case of using an on-premise system. In accordance with these customer requirements, a new encryption technique is needed to fully satisfy the security of the data stored in the cloud and guarantee the maximum control over the data to the customer.

An object of the present invention is to provide a cloud data encryption method and apparatus capable of adaptively adjusting a user's right to control data according to the type of cloud data.

In addition, the present invention is to provide a cloud data encryption method and apparatus capable of maximally guaranteeing a user's control over data through management of keys used for encryption and decryption.

According to an aspect of the present invention to achieve the above or other object, detecting cloud data to be encrypted; identifying the type of the sensed cloud data; and encrypting the cloud data using different encryption keys according to the type of the identified cloud data.

According to another aspect of the present invention, a data identification unit for detecting cloud data to be encrypted and identifying a type of the detected cloud data; and a data encryption unit that encrypts the cloud data using different encryption keys according to the type of cloud data determined through the data identification unit, encrypts the key used to encrypt the cloud data, and stores the key in an encryption key management system.

According to another aspect of the present invention, the process of detecting the cloud data to be encrypted; identifying the type of the sensed cloud data; and a computer program stored in a computer-readable recording medium so that a process of encrypting the cloud data using different encryption keys according to the type of the identified cloud data can be executed on a computer.

In addition, the solution to the above problem does not enumerate all the features of the present invention. Various features of the present invention and the advantages and effects thereof will be understood in more detail with reference to specific embodiments below.

Cloud data encryption methods and effects of the apparatus according to embodiments of the present invention will be described as follows.

According to at least one of the embodiments of the present invention, different encryption keys are applied according to the type of cloud data to perform encryption and decryption of the corresponding data, and the user's control over data can be guaranteed as much as possible through management of keys used for encryption and decryption.

However, the effects that can be achieved by the cloud data encryption method and apparatus according to the embodiments of the present invention are not limited to those mentioned above, and other effects not mentioned above will be clearly understood by those skilled in the art from the description below.

1 is a diagram showing the configuration of a cloud system according to an embodiment of the present invention;
2 is a configuration block diagram of a cloud data encryption device according to an embodiment of the present invention;
3 is a flowchart illustrating a cloud data encryption method according to an embodiment of the present invention;
4 is a flowchart illustrating a method of encrypting corresponding cloud data using a first data encryption key and managing the first data encryption key when the type of cloud data is a first type of customer data;
5 is a flowchart illustrating a method of encrypting corresponding cloud data using a second data encryption key and managing the second data encryption key when the type of cloud data is a second type of customer data;
6 is a flowchart illustrating a method of encrypting corresponding cloud data using a third data encryption key and managing the third data encryption key when the type of cloud data is a third type of customer data;
7 is a diagram referenced to explain a process of encrypting and decrypting corresponding cloud data using second and third data encryption keys when the type of cloud data is customer-owned data;

Hereinafter, the embodiments disclosed in this specification will be described in detail with reference to the accompanying drawings, but the same or similar elements are given the same reference numerals regardless of reference numerals, and redundant description thereof will be omitted. The suffixes "module" and "unit" for components used in the following description are given or used together in consideration of ease of writing the specification, and do not have meanings or roles that are distinct from each other by themselves. That is, the term 'unit' used in the present invention means a hardware component such as software, FPGA or ASIC, and 'unit' performs certain roles. However, 'part' is not limited to software or hardware. A 'unit' may be configured to reside in an addressable storage medium and may be configured to reproduce one or more processors. Thus, as an example, 'unit' includes components such as software components, object-oriented software components, class components and task components, processes, functions, properties, procedures, subroutines, segments of program code, drivers, firmware, microcode, circuitry, data, databases, data structures, tables, arrays and variables. The functionality provided within the components and 'parts' may be combined into a smaller number of elements and 'parts' or further separated into additional elements and 'parts'.

In addition, in describing the embodiments disclosed in this specification, if it is determined that a detailed description of a related known technology may obscure the gist of the embodiment disclosed in this specification, the detailed description thereof will be omitted. In addition, the accompanying drawings are only for easy understanding of the embodiments disclosed in this specification, and the technical idea disclosed in this specification is not limited by the accompanying drawings, and all changes included in the spirit and technical scope of the present invention It should be understood to include equivalents or substitutes.

The present invention provides a cloud data encryption method and apparatus capable of adaptively adjusting a user's right to control data according to the type of cloud data. In addition, the present invention provides a cloud data encryption method and apparatus capable of maximally guaranteeing a user's right to control data through management of keys used for encryption and decryption. Control over encrypted data stored in the cloud equals control over encryption keys. Therefore, according to the present invention, cloud data is encrypted and decrypted using different encryption keys according to the type of cloud data, and different access rights (or management rights) are set according to the types of keys used for encryption and decryption.

Hereinafter, the cloud service described in this specification refers to an on-demand outsourcing service that provides various IT resources such as servers, storages, and software (SW) to tenants. For example, a cloud service that provides storage is a service that provides tenants with various data stored in the storage of a service providing server connected to a network and downloaded through a network when necessary. The cloud service may be Infrastructure as a Service (IaaS) capable of providing a virtualized infrastructure environment to tenants or Software as a Service (SaaS) providing application software through the Internet, but is not necessarily limited thereto.

In addition, a tenant described in this specification refers to a user or a group of users using a cloud service. For example, a tenant may be an individual user or a corporate user including a plurality of users.

Hereinafter, various embodiments of the present invention will be described in detail with reference to the drawings.

1 is a diagram showing the configuration of a cloud system according to an embodiment of the present invention.

Referring to FIG. 1 , a cloud system 100 according to an embodiment of the present invention may include a cloud service providing system 110, an encryption key management system (KMS) 120, a cloud data encryption device 130, and one or more tenant terminals 140. The components shown in FIG. 1 are not essential to implement the cloud system 100, so the cloud system described in this specification may have more or fewer components than the components listed above.

The cloud service providing system 110 is a system that provides various cloud services to the tenant terminal 140 through a network. The cloud service providing system 110 may provide independent cloud services (e.g. storage, SW, etc.) for each tenant based on virtualization and distributed processing technology.

The cloud service providing system 110 receives a data encryption key (DEK) from the encryption key management system 120, and encrypts and decrypts cloud data using the data encryption key (DEK), thereby providing data confidentiality.

The cloud service providing system 110 may include one or more service providing servers (not shown). The service providing server is a server providing cloud services. More specifically, the service providing server may create at least one virtualized virtual machine (VM) through a hypervisor. In addition, the service providing server may execute an application for a cloud service or an instance of an application through a virtual machine. An instance of the service providing server may encrypt cloud data using a data encryption key (DEK). When cloud data is provided in response to a request from the tenant terminal 140, the service providing server may receive a data encryption key (DEK) from the encryption key management system 120, and use the data encryption key (DEK) to decrypt and provide cloud data. The service providing server may transmit/receive data with the encryption key management system 120 using a security protocol such as Secure Sockets Layer (SSL) and/or Transport Layer Security Protocol (TLS).

The encryption key management system 120 may manage a data encryption key (DEK) for ensuring the confidentiality of data stored in the cloud service providing system 110 and a key encryption key (Key Encryption Key, KEK) for ensuring the confidentiality of the data encryption key (DEK). To this end, the encryption key management system 120 may include a key store for storing the data encryption key (DEK) and key encryption key (KEK).

The encryption key management system 120 may encrypt a data encryption key (DEK) using a key encryption key (KEK), and store and manage the envelope-encrypted data encryption key in a key storage. The encryption key management system 120 may decrypt the envelope encrypted data encryption key stored in the key storage using the key encryption key (KEK), and provide the decrypted data encryption key (DEK) to the cloud service providing system 110.

Hereinafter, the data encryption key (DEK) used in this embodiment may include a service key used for encryption/decryption of customer data of the first type, a resource key used for encryption/decryption of customer data of the second type, and a product key used for encryption/decryption of customer data of the third type. In addition, the key encryption key (KEK) used in this embodiment may include a master key to ensure the confidentiality of the service key, a customer key to ensure the confidentiality of the resource key, and a customer account key to ensure the confidentiality of the product key.

More specifically, the encryption key management system 120 may manage a service key ensuring confidentiality of data stored in the cloud service providing system 110 and a master key ensuring confidentiality of the service key. The encryption key management system 120 may encrypt and manage a service key using a master key, and provide the service key to the cloud service providing system 110 . Here, the master key and the service key are keys that cannot be managed by a customer, that is, a service user. The data encryption/decryption method using the master key and service key is controlled by the service providing server 110 without customer intervention.

The encryption key management system 120 may manage a resource key ensuring confidentiality of data stored in the cloud service providing system 110 and a customer key ensuring confidentiality of the resource key. The encryption key management system 120 may encrypt and manage a resource key using a customer key, and provide the resource key to the cloud service providing system 110 . Here, the customer key and the resource key are keys that can be managed by a customer, that is, a service user. The data encryption/decryption method using the customer key and resource key is controlled by the customer.

The encryption key management system 120 may manage a product key that ensures the confidentiality of data stored in the cloud service providing system 110 and a customer account key that secures the confidentiality of the product key. The encryption key management system 120 may encrypt and manage the product key using the customer account key, and provide the product key to the cloud service providing system 110 . Here, the customer account key and product key are keys that cannot be managed by the customer, that is, the service user. The data encryption/decryption method using the customer account key and product key is a method controlled by the service providing server 110 under the consent or delegation of the customer.

The cloud data encryption device 130 performs a function of identifying the type of cloud data and encrypting and decrypting the corresponding data using different encryption keys according to the type of the identified data. Data stored in the cloud can be largely divided into two types: 'customer-owned data' and 'customer-related data'. Here, customer-owned data refers to data (e.g., photos, videos, documents, etc.) created by the customer, and customer-related data refers to data related to the personal information of customers using cloud services (e.g., name, address, phone number, etc.).

Customer-owned data can be further divided into two types: 'completely controlled data' in which the customer has complete control, and 'partially controlled data' in which the customer has partial control. The type of data owned by the customer may be classified according to a user's setting. Hereinafter, in this embodiment, customer-related data is referred to as a first type of customer data, fully controlled data among customer data is referred to as a second type of customer data, and partially controlled data among customer data is referred to as a third type of customer data.

The tenant terminal 140 is a computing device using various cloud services provided by the cloud service providing system 110 . Here, the computing device may be a laptop, desktop, laptop, smart phone, etc., but is not necessarily limited thereto, and may include all types of devices equipped with calculation means and communication means.

The tenant terminal 140 can use the cloud service anytime, anywhere through a network. For example, the tenant terminal 140 may upload or download a file to storage provided by the cloud service providing system 110 through a network. At this time, the file uploaded to the storage may be encrypted by a data encryption key (DEK) and stored.

In such a cloud system environment, the cloud service providing system 110, the encryption key management system 120, the cloud data encryption device 130, and the tenant terminal 140 may communicate through a network. Here, the network may be implemented as all types of wired/wireless networks such as a local area network (LAN), a wide area network (WAN), and a mobile radio communication network.

Meanwhile, in this embodiment, the cloud data encryption device 130 is exemplified as being installed outside the cloud service providing system 110 or the encryption key management system 120, but is not necessarily limited thereto.

2 is a configuration block diagram of a cloud data encryption device according to an embodiment of the present invention.

Referring to FIG. 2 , cloud data encryption devices 130 and 200 according to an embodiment of the present invention may include a data identification unit 210 , a data encryption unit 220 and a data decryption unit. The components shown in FIG. 2 are not essential to implement the cloud data encryption device 130, so the cloud data encryption device described herein may have more or less components than the components listed above.

The data identification unit 210 may perform a function of identifying the type of cloud data to be encrypted or decrypted. The types of cloud data can be largely divided into two types, that is, 'customer-owned data' and 'customer-related data'. The data owned by the customer can be further classified into two types, that is, 'completely controlled data' in which the customer has complete control rights and 'partially controlled data' in which the customer has partial control rights.

The data encryption unit 220 may perform a function of encrypting corresponding data using different encryption keys according to the type of cloud data determined through the data identification unit 210 . Here, the reason why different encryption keys are used according to the type of cloud data is to adjust the user's control over the corresponding cloud data by adjusting the control over the encryption key.

More specifically, when the type of cloud data is customer-related data, the data encryption unit 220 may encrypt the corresponding data using a service key stored in the encryption key management system 120 . Here, the service key is encrypted and managed by the master key, and is a key that cannot be managed by the customer. The data encryption method using the service key is a method controlled by the service providing server 110 without customer intervention.

When the type of cloud data is completely controlled data among customer-owned data, the data encryption unit 220 may encrypt the corresponding data using a resource key stored in the encryption key management system 120 . Here, the resource key is encrypted and managed by the customer key, and is a key that can be managed by the customer. The data encryption method using the resource key is a method controlled by the customer.

When the type of cloud data is partially controlled data among customer-owned data, the data encryption unit 220 may encrypt the corresponding data using a product key stored in the encryption key management system 120 . Here, the product key is encrypted and managed by the customer's account key, and is a key that cannot be managed by the customer. The data encryption method using the product key is a method controlled by the service providing server 110 under the customer's consent or entrustment.

The data decryption unit 220 may perform a function of decrypting corresponding data using different encryption keys according to the type of cloud data determined through the data identification unit 210 .

More specifically, when the type of cloud data is customer-related data, the data decryption unit 220 may decrypt the corresponding data using a service key stored in the encryption key management system 120 . Similarly, the service key is encrypted and managed by the master key, and is a key that cannot be managed by the customer. The data decryption method using the service key is controlled by the service providing server 110 without customer intervention.

When the type of cloud data is fully controlled data among customer-owned data, the data encryption unit 220 may decrypt the corresponding data using a resource key stored in the encryption key management system 120 . Similarly, the resource key is encrypted and managed by the customer key, and is a key that can be managed by the customer. The data decryption method using the resource key is a method controlled by the customer.

When the type of cloud data is partial control data among customer-owned data, the data encryption unit 220 may decrypt the corresponding data using a product key stored in the encryption key management system 120 . Similarly, the product key is encrypted and managed by the customer's account key, and is a key that cannot be managed by the customer. The data decryption method using the product key is a method controlled by the service providing server 110 under the consent or entrustment of the customer.

As described above, the cloud data encryption device according to an embodiment of the present invention applies different encryption keys according to the type of cloud data to encrypt and decrypt corresponding data, and manages the keys used for encryption and decryption to maximize the user's control over data.

3 is a flowchart illustrating a cloud data encryption method according to an embodiment of the present invention.

Referring to FIG. 3 , the cloud data encryption apparatus 200 according to an embodiment of the present invention may detect cloud data to be encrypted or decrypted (S310).

The cloud data encryption device 200 may identify the type of cloud data to be encrypted or decrypted (S320). The types of cloud data can be largely divided into two types, that is, 'customer-owned data' and 'customer-related data'. The data owned by the customer can be further classified into two types, that is, 'completely controlled data' in which the customer has complete control rights and 'partially controlled data' in which the customer has partial control rights.

The cloud data encryption device 200 may check whether the type of the identified cloud data is customer-owned data or customer-related data (S330).

As a result of checking in step 330, if the type of cloud data is customer-related data, the cloud data encryption device 200 may encrypt/decrypt the corresponding data using the first key encryption key (ie, master key) and the first data encryption key (ie, service key) stored in the encryption key management system 120 (S350). The data encryption/decryption method using the first key encryption key and the first data encryption key is controlled by the service providing server 110 without customer intervention.

Meanwhile, as a result of checking in step 330, if the type of cloud data is customer-owned data, the cloud data encryption device 200 may check whether the type of cloud data is completely controlled data or partially controlled data (S340).

As a result of checking in step 340, if the type of cloud data is fully controlled data, the cloud data encryption device 200 may encrypt/decrypt corresponding data using the second key encryption key (ie, customer key) and the second data encryption key (ie, resource key) stored in the encryption key management system 120 (S360). The data encryption/decryption method using the second key encryption key and the second data encryption key is controlled by the customer.

Meanwhile, as a result of checking in step 340, if the type of cloud data is partial control data, the cloud data encryption device 200 may encrypt/decrypt the corresponding data using the third key encryption key (ie, customer account key) and the third data encryption key (ie, product key) stored in the encryption key management system 120 (S370). The data encryption/decryption method using the third key encryption key and the third data encryption key is controlled by the service providing server 110 under the consent or delegation of the customer.

As described above, the cloud data encryption method according to an embodiment of the present invention applies different encryption keys according to the type of cloud data to encrypt and decrypt corresponding data, and manages the keys used for encryption and decryption to maximize the user's control over data.

4 is a flowchart illustrating a method of encrypting corresponding cloud data using a first data encryption key and managing the first data encryption key when the type of cloud data is a first type of customer data.

Referring to FIG. 4 , the tenant terminal 140 may access the service providing server 110 and generate cloud data (S410).

The cloud data encryption device 130 may identify the type of the generated cloud data (S420).

If the type of cloud data is the first type of customer data (ie, customer-related data), the cloud data encryption device 130 may transmit a message requesting data encryption using a service key to the service providing server 110 (S430).

The service providing server 110 may request a service key for encrypting cloud data from the encryption key management system 120 in response to the message received from the cloud data encryption device 130 (S440).

The encryption key management system 120 may generate a service key for encrypting cloud data in response to a request of the service providing server 110 (S450). The encryption key management system 120 may provide the generated service key to the service providing server 110 (S460).

The service providing server 110 may encrypt cloud data using the service key received from the encryption key management system 120 (S470). The service providing server 110 may store encrypted data in a database.

The encryption key management system 120 may generate a master key for encrypting the service key (S480). The encryption key management system 120 may encrypt the service key using the master key and store the envelope-encrypted service key in a key storage (S490).

Subsequently, when decrypting encrypted data stored in the database, the encryption key management system 120 may decrypt the envelope encrypted service key using the master key and provide the decrypted service key to the service providing server 110.

As described above, when the type of cloud data is the first type of customer data, the cloud data encryption device 110 controls the service providing server 110 to encrypt corresponding cloud data using the service key provided from the encryption key management system 120. Since the user cannot access and manage the service key stored in the encryption key management system 120, he or she cannot have control over the corresponding data.

5 is a flowchart illustrating a method of encrypting corresponding cloud data using a second data encryption key and managing the second data encryption key when the type of cloud data is customer data of the second type, and FIG. 7 is a diagram referenced to explain a process of encrypting and decrypting cloud data using a second data encryption key stored in an encryption key management system.

Referring to FIGS. 5 and 7 , the tenant terminal 140 may access the service providing server 110 and generate cloud data (S505).

The cloud data encryption device 130 may identify the type of the generated cloud data (S510).

If the type of cloud data is customer-owned data, the cloud data encryption device 130 may transmit a message requesting selection of a range of user control over the corresponding data to the tenant terminal 140 (S515).

In response to the user's selection command, the tenant terminal 140 may transmit a message indicating that the corresponding user has selected complete data control right to the cloud data encryption device 130 (S520). In addition, the tenant terminal 140 may transmit a message requesting generation of a customer key to the cloud data encryption device 130 in response to a user's command.

The cloud data encryption device 130 may transmit a message requesting customer key generation to the encryption key management system 120 in response to the message received from the tenant terminal 140 (S525).

The cloud data encryption device 130 may transmit a message requesting a customer key subscription to the service providing server 110 in response to the message received from the tenant terminal 140 (S530).

The encryption key management system 120 may generate a customer key in response to the message received from the cloud data encryption device 130 (S535). The customer key is a key manageable by a user.

The service providing server 110 may transmit a subscription key including a customer authentication value to the encryption key management system 120 in response to the message received from the cloud data encryption device 130 (S540).

The encryption key management system 120 may perform user authentication for cloud data based on a customer authentication value included in the subscription key received from the service providing server 110 . If the user authentication is successful, the encryption key management system 120 may generate a resource key for encrypting cloud data by linking the customer key and the subscription key (S545). The encryption key management system 120 may provide the generated resource key to the service providing server 110 (S550).

The service providing server 110 may encrypt cloud data using the resource key received from the encryption key management system 120 (S555). The service providing server 110 may store encrypted data in a database.

The encryption key management system 120 may encrypt the resource key using the customer key and store the envelope-encrypted resource key in a key storage (S560). Subsequently, when decrypting encrypted data stored in the database, the encryption key management system 120 decrypts the envelope encrypted resource key using the customer key, and provides the decrypted resource key to the service providing server 110.

As described above, when the type of cloud data is the second type of customer data, the cloud data encryption device 130 uses the resource key provided from the encryption key management system 120 in the service providing server 110. Control to encrypt corresponding cloud data. Since the user can access and manage the customer key and resource key stored in the encryption key management system 120, the user can have control over the corresponding data. That is, the resource key may be provided to the service providing server 110 only when there is consent or approval of the user.

6 is a flowchart illustrating a method of encrypting corresponding cloud data using a third data encryption key and managing the third data encryption key when the type of cloud data is a third type of customer data, and FIG. 7 is a diagram referenced to explain a process of encrypting and decrypting cloud data using a third data encryption key stored in an encryption key management system.

Referring to FIGS. 6 and 7 , the tenant terminal 140 may access the service providing server 110 and generate cloud data (S605).

The cloud data encryption device 130 may identify the type of the generated cloud data (S610).

If the type of cloud data is customer-owned data, the cloud data encryption device 130 may transmit a message requesting selection of a range of user control over the corresponding data to the tenant terminal 140 (S615).

The tenant terminal 140 may transmit a message indicating that the corresponding user has selected partial data control right to the cloud data encryption device 130 in response to the user's selection command (S620). In addition, the tenant terminal 140 may transmit a message requesting generation of a customer account key to the cloud data encryption device 130 in response to a user's command.

The cloud data encryption device 130 may transmit a message requesting generation of a customer account key to the encryption key management system 120 in response to the message received from the tenant terminal 140 (S625).

The cloud data encryption device 130 may transmit a message requesting subscription of a customer account key to the service providing server 110 in response to the message received from the tenant terminal 140 (S630).

The encryption key management system 120 may generate a customer account key in response to the message received from the cloud data encryption device 130 (S635). The customer account key is a key that cannot be managed by a user. However, the customer account key may be generated under the user's consent or delegation.

The service providing server 110 may transmit a subscription account key including a customer authentication value to the encryption key management system 120 in response to the message received from the cloud data encryption device 130 (S640).

The encryption key management system 120 may perform user authentication for cloud data based on a customer authentication value included in the subscription account key received from the service providing server 110 . If the user authentication is successful, the encryption key management system 120 may generate a product key for encrypting cloud data by linking the customer account key and the subscription account key (S645). The encryption key management system 120 may provide the generated product key to the service providing server 110 (S650).

The service providing server 110 may encrypt cloud data using the product key received from the encryption key management system 120 (S655). The service providing server 110 may store encrypted data in a database.

The encryption key management system 120 may encrypt the product key using the customer account key and store the encrypted product key in the key storage (S660). Subsequently, when decrypting encrypted data stored in the database, the encryption key management system 120 decrypts the envelope encrypted product key using the customer account key, and provides the decrypted product key to the service providing server 110.

As described above, when the type of cloud data is the third type of customer data, the cloud data encryption device 130 uses the product key provided from the encryption key management system 120 in the service providing server 110. It can be controlled to encrypt corresponding cloud data. Since the user cannot access and manage the customer account key and product key stored in the encryption key management system 120, the user cannot have control over the corresponding data.

The above-described present invention can be implemented as computer readable code on a medium on which a program is recorded. The computer-readable medium may continuously store programs executable by the computer or temporarily store them for execution or download. In addition, the medium may be various recording means or storage means in the form of a single or combined hardware, but is not limited to a medium directly connected to a certain computer system, and may be distributed on a network. Examples of media may include magnetic media such as hard disks, floppy disks and magnetic tapes, optical recording media such as CD-ROMs and DVDs, magneto-optical media such as floptical disks, and those configured to store program instructions, including ROM, RAM, flash memory, and the like. In addition, examples of other media include recording media or storage media managed by an app store that distributes applications, a site that supplies or distributes various other software, and a server. Accordingly, the above detailed description should not be construed as limiting in all respects and should be considered illustrative. The scope of the present invention should be determined by reasonable interpretation of the appended claims, and all changes within the equivalent scope of the present invention are included in the scope of the present invention.

The present invention is not limited by the foregoing embodiments and accompanying drawings. It will be clear to those skilled in the art that the components according to the present invention can be substituted, modified, and changed without departing from the technical spirit of the present invention.

100: cloud system 110: cloud service providing system
120: encryption key management system 130/200: cloud data encryption device
140: Tenant terminal 210: Data identification unit
220: data encryption unit 230: data decryption unit

Claims (10)

In the cloud data encryption method in the cloud system,
detecting cloud data to be encrypted;
identifying the type of the sensed cloud data; and
Encrypting the cloud data using different encryption keys according to the type of the identified cloud data,
Wherein the encrypting step comprises encrypting the corresponding cloud data using a first data encryption key that is uncontrollable by a user when the type of the identified cloud data is a first type of customer data. According to claim 1,
The first type of customer data includes data related to personal information of a customer using a cloud service. In the cloud data encryption method in the cloud system,
detecting cloud data to be encrypted;
identifying the type of the sensed cloud data; and
Encrypting the cloud data using different encryption keys according to the type of the identified cloud data,
Wherein the encrypting step comprises encrypting the corresponding cloud data using a second data encryption key controllable by a user when the type of the identified cloud data is the second type of customer data. According to claim 3,
The second type of customer data includes data set to have complete user control among customer-owned data. In the cloud data encryption method in the cloud system,
detecting cloud data to be encrypted;
identifying the type of the sensed cloud data; and
Encrypting the cloud data using different encryption keys according to the type of the identified cloud data,
Wherein the encrypting step comprises encrypting the corresponding cloud data using a third data encryption key having a limited user control when the type of the identified cloud data is a third type of customer data. According to claim 5,
The third type of customer data includes data set to have partial user control among customer-owned data. According to any one of claims 1 to 6,
The cloud data encryption method further comprising enveloping a key used for encrypting the cloud data and storing it in an encryption key management system, and setting different access rights according to the type of the stored key. In the cloud data encryption device in the cloud system,
a data identification unit that detects cloud data to be encrypted and identifies a type of the detected cloud data; and
A data encryption unit encrypting the cloud data using different encryption keys according to the type of cloud data determined through the data identification unit;
Wherein the data encryption unit encrypts the corresponding cloud data using a first data encryption key that is uncontrollable by a user when the type of the identified cloud data is the first type of customer data. In the cloud data encryption device in the cloud system,
a data identification unit that detects cloud data to be encrypted and identifies a type of the detected cloud data; and
A data encryption unit encrypting the cloud data using different encryption keys according to the type of cloud data determined through the data identification unit;
Wherein the data encryption unit encrypts the corresponding cloud data using a second data encryption key controllable by a user when the type of the identified cloud data is the second type of customer data. In the cloud data encryption device in the cloud system,
a data identification unit that detects cloud data to be encrypted and identifies a type of the detected cloud data; and
A data encryption unit encrypting the cloud data using different encryption keys according to the type of cloud data determined through the data identification unit;
Wherein the data encryption unit encrypts the corresponding cloud data using a third data encryption key having limited user control when the type of the identified cloud data is a third type of customer data.

Images