TW201616831A - Cloud storage service method in keymap access mode - Google Patents

Abstract

The invention relates to the field of computer networks, and especially relates to a cloud storage service method in a keymap access mode and provided with encryption and decryption functions, the safety of stored data can be effectively improved. The method comprises that an authentication center comprising a public key fundamental framework and an encryption and decryption key management mechanism, the authentication center serves as a source of user identity authentication and public keys, and can be supplied by a server side, a third party or a client, encryption and decryption keys are managed by a key management server and can be supplied by the server side, the third party or the client.

Description

Keymap access mode cloud storage service with encryption and decryption function

The invention relates to a keymap access mode cloud storage service with encryption and decryption function, which can effectively increase the security of storing data.

In the past, most keymap access methods did not take into account the risk of files being stored in the cloud. They did not consider whether there was encryption during storage, so that the risk of files in the cloud increased, and it could not meet the needs of different users.

Recently, some storage services have taken into account the issue of file encryption, but the inflexible design of encryption timing, encryption and decryption key management, etc., cannot meet the needs of different users.

In view of the shortcomings derived from the above-mentioned conventional methods, the inventor of the present invention has improved and innovated, and after years of painstaking research, he finally successfully developed and completed the keymap access mode cloud storage service with encryption and decryption functions.

The object of the present invention is to provide a keymap access mode cloud storage service with encryption and decryption function, which is composed of a cloud storage service, a certification center, an encryption and decryption module, and a key management server, wherein the cloud storage service is Responsible for providing external application interface (Application Programming Interface (API) for users to operate and access data; the authentication center provides the correspondence between the personal identity and its public key and the keymap access mode cloud storage service; the encryption and decryption module provides file encryption and decryption, and supports Segment processing, the specified part of the file can be downloaded or copied, and the file encryption and decryption operation and transmission of the keymap access mode cloud storage service are processed in parallel; the key management server is connected with the encryption and decryption module. And a large number of keys required for the encryption and decryption module when encrypting and managing the file.

The file encryption and decryption can be processed by the client or the server. If processed by the server, the encryption and decryption module is located at the service providing layer of the server, and can interface with different databases and file system layers, and interface with a certification center. Manage user identity authentication and retain the pairing of their identity and public key; the key management server is provided by the server, third party or by the client; the cloud storage service, and the service providing layer, provides the Restful API for providing The client side call; the file system layer is a distributed file system; and the database provides the service providing layer and the information required for storing the file system layer.

The service providing layer is divided into a RESTful API, a logical processing core, and an interface file storage layer. After the encryption and decryption module reads the user request information obtained by the RESTful API through the database, the file is encrypted and returned to the Referring to the file storage layer, the interface file storage layer stores the encrypted file to the file system layer.

The invention provides a keymap access mode cloud storage service with encryption and decryption function, which has the following advantages when compared with other conventional technologies:

1. User-uploaded files can be encrypted by the server and stored to improve the security of cloud storage.

2. The key management server used for encryption and decryption can be served by the server or a third party. Or provided by the client

3. Provide protection for identity authentication and encryption and decryption key transfer process by integrating public key infrastructure. The certification center can be provided by the server, third party or client.

100‧‧‧Cloud Storage Service

101‧‧‧ Certification Center

102‧‧‧Addition and decryption module

103‧‧‧Key Management Server

201‧‧‧personal identity and public key

202‧‧‧Safe passage

203, 304, 604‧‧ users

301‧‧‧Decrypted files

302‧‧‧Keys needed for decryption

303‧‧‧Undecrypted files

401‧‧‧Encryption Module

402‧‧‧Decryption module

403‧‧‧File segmentation processing module

404‧‧‧File Information Access Module

405‧‧‧Key Access Module

406‧‧Meta-Data Database

407‧‧‧Key Management Server

501‧‧‧ service provider

502, 603‧‧ ‧ file storage layer

503, 601‧‧ ‧ database

602‧‧‧Addition and decryption module

605‧‧‧Provide RESTFul API externally

606‧‧‧Logic Processing Core

607‧‧‧Interface file storage layer

S701~S703‧‧‧User registration and component relationship process

S801~S807‧‧‧ upload and adopt server-side encryption and relationship process between components

S901~S907‧‧‧Download and use server-side decryption and relationship process between components

S1001~S1009‧‧‧Download and use user-side decryption and relationship process between components

Please refer to the detailed description of the present invention and the accompanying drawings, which can further understand the technical content of the present invention and its function. The related drawings are: FIG. 1 is a keymap access mode cloud storage service with encryption and decryption function of the present invention. FIG. 2 is a schematic diagram of a relationship between a certificate center and a secure channel of a keymap access mode cloud storage service with encryption and decryption function; FIG. 3 is a diagram of a keymap access mode cloud storage service with encryption and decryption function according to the present invention; Schematic diagram of the decryption module and the transmission file; FIG. 4 is a schematic diagram of the encryption and decryption module of the cloud storage service of the keymap access mode with encryption and decryption function; FIG. 5 is a keymap access mode cloud storage service with encryption and decryption function according to the present invention; FIG. 6 is a schematic diagram of relationship between a service providing layer and an encryption and decryption module of a cloud storage service with a keymap access mode with encryption and decryption function; FIG. 7 is a keymap access with encryption and decryption function of the present invention. Mode cloud storage service registration and component relationship diagram; Figure 8 is a keymap access mode cloud storage with encryption and decryption function The service uploading adopts the server side encryption and the relationship diagram of each component; FIG. 9 is a downloading of the keymap access mode cloud storage service with encryption and decryption function, and the server side decryption and the relationship diagram of each component; FIG. The keymap access mode of the encryption and decryption function downloads the cloud storage service and uses the user terminal to decrypt the relationship diagram of each component.

The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

The system provides file encryption and decryption functions for the cloud storage service of the keymap (key-value mapping) access mode to provide a high-security file storage mode; when the user uploads the file to the cloud storage service space, the user can first encrypt and then encrypt Upload to the server, or upload it and then encrypt it by the server; when the user downloads the file, it is not necessary to tell the server whether the file needs to be decrypted, but the system automatically judges the server according to the record previously stored in the database. Whether the file has been encrypted.

The present invention is further described with reference to the accompanying drawings: FIG. 1 is a schematic diagram of a cloud storage service of a cloud storage service of a keymap access mode with encryption and decryption function, wherein the system is mainly composed of four parts. The cloud storage service 100, the authentication center 101, the encryption and decryption module 102, and the key management server 103 are respectively provided; wherein the cloud storage service 100 is responsible for providing an application programming interface (API) for the user to operate and access the data. The authentication center 101 provides the correspondence between the personal identity and the public key, the encryption and decryption module 102 is responsible for the encryption and decryption of the file, and the key management server 103 is responsible for the management of the key used for the encryption and decryption.

Please refer to FIG. 2 , which is a schematic diagram of a certificate center and a secure channel relationship of a keymap access mode cloud storage service with encryption and decryption function. The system integrates a public key infrastructure (Public Key). Infrastructure, PKI), the public key infrastructure links the user's personal identity with the public key 201 by a Certificate Authority (CA) 101. For each authentication center 101, the user's identity must be The only one is that the authentication center 101 can be used for system identity authentication and obtaining the user public key. The public key is mainly used to provide a secure channel 202 between the client and the server, and the server can use the confidential data to disclose the public key. The key is encrypted and transmitted to the client, and the client 203 decrypts the confidential data through the private key in the hand; the authentication center in the system can be provided by the server, the third party or the user.

Please refer to FIG. 3 , which is a schematic diagram of the encryption and decryption module and the transmission file of the cloud storage service of the keymap access mode with encryption and decryption function. When the user downloads the file, the user selects the server to decrypt the file and then return it. If the client decrypts, the encryption and decryption module can provide the decrypted file 301 by the server; if the client decrypts, the encryption and decryption module is located at the user terminal 304. The server should transmit the undecrypted file 303 to the client and the key 302 required for decryption. To protect the decrypted key, it will be transmitted through the secure channel. And the file 303 which is not decrypted by the client and the key 302 required for decryption, wherein the key 302 required for decryption is protected by the public key encryption of the user, and the client receives the undecrypted file 303 and the decryption station. After the key 302 is needed, the file is decrypted again.

Please refer to FIG. 4 , which is a schematic diagram of the encryption and decryption module of the cloud storage service of the keymap access mode with encryption and decryption function. The encryption and decryption module is the main module for realizing the encryption and decryption behavior of the file in the system. It can be divided into five sub-modules: encryption module 401, decryption module 402, file segmentation processing module 403, file information access module 404 and key access module 405, encryption module 401, decryption module 402, the file segmentation processing module 403 is responsible for the solution The secret logic processing, the file information access module 404 and the key access module 405 are responsible for the interface with the external information; wherein the encryption module 401 is responsible for encrypting the file, and the decryption module 402 is responsible for decrypting the file, and the file segmentation processing module In addition to the specified part of the download or copy file, the group 403 can also perform the parallel processing of the encryption and decryption operation and the transmission. The file information access module 404 can obtain the file information such as decryption, and if the module is located at the server end, The server Meta-Data database 406 is used to read the previous record, or if the module is located at the user end, the client Meta-Data database 406 can be interfaced to read the previous record, or specify Whether to decrypt the downloaded file, the key access module 407 interfaces with the key management server to obtain the key required for file encryption and decryption. The key access module obtains the encryption and decryption key used for decrypting the file through the user ID, the file name and the like, and the key management server can be provided by the server, the third party or the user.

Please refer to FIG. 5 , which is a schematic diagram of the cloud storage service of the cloud storage service of the keymap access mode with encryption and decryption function. The environment implemented by the encryption and decryption module is a cloud storage service providing a keymap access mode. Generally, there should be a service providing layer for providing services, a file system layer for actually storing files, and a database for storing information required for storing services (including whether files are encrypted or not). In this embodiment, there are three major parts, and the service providing layer 501 provides Restful. API (calling the state transition style call interface) for the client to call, and core logic processing, etc., the file storage layer 502 uses a distributed file system, such as MogileFS, and the database 503 mainly provides the above two layers of required information storage. local.

Please refer to FIG. 6 , which is a schematic diagram of the relationship between the service providing layer and the encryption and decryption module of the cloud storage service of the keymap access mode with encryption and decryption function, and the ability to provide encryption and decryption of the server. The encryption and decryption module is added to the layer, and the service provider layer can be subdivided into three layers according to functions: Frontend Restful Layer (L1), Core Layer (L2), Core Layer (L2) And the Backend Mogile layer (L3), the function is to provide a RESTful API interface 605, a logic processing core 606 and an interface file storage layer 607, respectively, and the system integrates the encryption and decryption module to L3. When the file is uploaded by the file storage layer 603, the file does not pass through the encryption and decryption module without being decrypted by the server without being encrypted by the server, but if the file is encrypted by the server when uploading, After receiving the request, L1 will save the relevant information to the database 601. After the encryption and decryption module 602 queries the database, the file is encrypted and then returned to the L3. If the server decrypts the file, the encryption and decryption module will first Check the database to confirm whether the file has been encrypted. If it is an encrypted file, decrypt it first and then return it to L3.

For the relationship between the cloud storage service, the authentication center, the encryption and decryption module, and the key management server, a common behavior is taken as an example: as shown in Figure 7, the user is registered with each component, and the user is using the storage service. Before the PKI architecture, the registration center S701 is registered with the certification center through the storage service, and the registration data includes the user providing its public key S702, which will be used as the encryption for transmitting the decryption key to the user in the future server; After S703, the certificate authority should retain the identity and its public key.

Please refer to FIG. 8 , which is to upload and adopt server-side encryption and relationship diagrams of various components. When uploading and adopting server-side encryption S801, the client requests and informs the server whether the data should be encrypted through the parameters. The authentication center confirms the user's legality S802. If the user is legal S803, the encryption and decryption module is required to encrypt S804. The encryption and decryption module can be identified by the user ID and file name. The information is like the encryption and decryption key S805 required by the key management server for decrypting the file, and after obtaining the encryption and decryption key S806 required for encrypting the file, the encryption and decryption module uses the encryption and decryption key to encrypt the file to complete S807. And save.

Please refer to FIG. 9 for downloading and collecting the server-side decryption and relationship diagrams of the components. When downloading and using the server to decrypt S901, the client requests the service, and the server confirms the user's legality S902 to the authentication center. Then, the encryption and decryption module is requested to decrypt, and the encryption and decryption module determines whether it is required to decrypt S904 according to the data in the database. If decryption is required, the encryption and decryption module transmits the information to the key through the user ID, file name and other information that can be identified. After the encryption and decryption key S905 required for decrypting the file is obtained, the encryption and decryption key S906 required for decrypting the file is obtained, and the encryption and decryption module decrypts the file by using the encryption and decryption key, and then returns the clear file S907.

Please refer to FIG. 10, which is a download and user terminal decryption and relationship diagram of each component, download and adopt the user side to decrypt S1001, the client requests, the server confirms the user legality S1002 to the authentication center, if the user is legal S1003 Then, the encryption and decryption module is requested to decrypt. The encryption and decryption module determines whether the data needs to be decrypted according to the data in the database. If the decryption module needs to be decrypted, the encryption and decryption module can use the user ID and the file name to identify the information. The key management server requires the encryption/decryption key S1005 required for file decryption, obtains the encryption/decryption key S1006 used for decrypting the file, and returns the server S1007, and the server requests the public key S1008 of the user from the certification center to obtain the disclosure. After the key S1009, the above-mentioned encryption and decryption key is encrypted by using the public key, and then transmitted to the user together with the undecrypted file, and the user obtains the encryption and decryption key through the private key, and then the undecrypted file is received after receiving the encryption and decryption key. Decrypt.

The detailed description above is specifically described with respect to one possible embodiment of the present invention, but the embodiment is not intended to limit the scope of the patent of the present invention. Equivalent implementations or modifications that do not depart from the spirit of the invention are intended to be included in the scope of the invention.

To sum up, this case is not only innovative in terms of technical thinking, but also has many of the above-mentioned functions that are not in the traditional methods of the past. It has fully complied with the statutory invention patent requirements of novelty and progressiveness, and applied for it according to law. Approved this invention patent application, in order to invent invention, to the sense of virtue.

100‧‧‧Cloud Storage Service

101‧‧‧ Certification Center

102‧‧‧Addition and decryption module

103‧‧‧Key Management Server

Claims (7)

A keymap access mode cloud storage service with encryption and decryption function, which includes: a cloud storage service, which is responsible for externally providing an application programming interface (API) for user operations and accessing data; a certification center is managed User identity authentication and providing personal identity to its public key; the encryption and decryption module provides server-side encryption and decryption, and supports downloading or copying the specified part of the file, and encrypting and decrypting the file storage mode cloud storage service file The operation and the transmission are processed in parallel; the key management server is connected with the encryption and decryption module, and a large number of keys required for the encryption and decryption module when the file is encrypted and decrypted. The keymap access mode cloud storage service with the encryption and decryption function described in claim 1, wherein the encryption and decryption module is located at the service providing layer of the server or at the user end, and interfaces with different databases. And the file system layer. The keymap access mode cloud storage service with encryption and decryption function as described in claim 1, wherein the encryption and decryption module is connected to the key management server, and the key management server manages the file plus The large number of keys required to encrypt and decrypt the module during decryption. The keymap access mode cloud storage service with the encryption and decryption function described in claim 1, wherein the key management server is provided by a server, a third party or by a client. The keymap storage with encryption and decryption function as described in item 1 of the patent application scope The mode cloud storage service is adopted, wherein the certificate center is provided by a server, a third party or by a client. For example, the keymap access mode cloud storage service with the encryption and decryption function described in claim 1, wherein the cloud storage service includes: a service providing layer, which provides a Restful API for the client to call; the file system layer, For the decentralized file system; and the database, the service providing layer is provided, and the information required for storing the file system layer is provided. The keymap access mode cloud storage service with encryption and decryption function as described in claim 2, wherein the service providing layer is divided into a RESTful API, a logical processing core, and an interface file storage layer, wherein the encryption and decryption After the module reads the user request information obtained by the RESTful API through the database, the file is encrypted and transmitted back to the interface file storage layer, and the file storage layer stores the encrypted file to the file system layer.