WO2014042512A1 - Gestion de chiffrement du stockage sur un volume de mémoire à blocs élastiques accessible en réseau - Google Patents

Gestion de chiffrement du stockage sur un volume de mémoire à blocs élastiques accessible en réseau Download PDF

Info

Publication number
WO2014042512A1
WO2014042512A1 PCT/MY2013/000156 MY2013000156W WO2014042512A1 WO 2014042512 A1 WO2014042512 A1 WO 2014042512A1 MY 2013000156 W MY2013000156 W MY 2013000156W WO 2014042512 A1 WO2014042512 A1 WO 2014042512A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
key
ebs
encrypted
volume
Prior art date
Application number
PCT/MY2013/000156
Other languages
English (en)
Inventor
Chong Seak Sea
Izyani Daud Nor
Original Assignee
Mimos Berhad
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Mimos Berhad filed Critical Mimos Berhad
Publication of WO2014042512A1 publication Critical patent/WO2014042512A1/fr

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0602—Interfaces specially adapted for storage systems specifically adapted to achieve a particular effect
    • G06F3/062—Securing storage systems
    • G06F3/0623—Securing storage systems in relation to content
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0668—Interfaces specially adapted for storage systems adopting a particular infrastructure
    • G06F3/067—Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]

Definitions

  • the present invention relates to a system and method for managing storage encryption over network-based or cloud based Elastic Block Store (EBS) Volume to provide flexibility and transparency on the encryption algorithm that can be universally acceptable to any provider and user.
  • EBS Elastic Block Store
  • Cloud computing environment has two major types of data storage.
  • the first type of storage is known as Instance Storage, which is non-persistent and data will be loss after an instance termination.
  • the other type is persistent network-based Elastic Block Store (EBS) Volume, which can be attached to any running instances or also can be used as a persistent boot medium.
  • EBS Volumes are off-instance storage that persists independently from the life of Virtual Machine (VM) instance.
  • Elastic Block Store (EBS) provides highly available and highly reliable storage volumes that can be attached to a running VM instance and exposed as a device within the VM instance.
  • EBS is particularly suited for applications that require a database, file system, or access to raw block level storage.
  • EBS also allows user to create storage volumes in any sizes that can be mounted and attached as devices by VM instances.
  • the storage volumes can be mounted on the same VM instance.
  • the storage volumes behave like raw, unformatted block devices and the user is required to supply device names and block device interface.
  • User can create a file system on top of the EBS Volumes, or use them in any other way as a block device (just like a normal hard drive).
  • data stored in cloud computing environment using EBS is not encrypted; the administrator of EBS may possibly view and/or open and/or modify the data contents. Users are not confident to keep important data in the EBS volume due to the low security level.
  • the present invention proposes a system and method to provide confidentiality as only data owner or authorized users are allowed to view the contents in a cloud computing environment.
  • the data which writes to EBS disk are encrypted transparently with the random generation of encryption key and stored in the disk.
  • the encryption key is stored in the key file and said encryption key will be protected by symmetric key provided by the user.
  • this encryption key will be used to decrypt data read from the disk.
  • the encryption data will be decrypted transparently by the system and return to user mode application.
  • the present invention provides a system (100) and a method (200) for managing storage encryption over network based Elastic-Block Store (EBS) Volume.
  • One aspect of the present invention provides a system (100) for managing storage encryption over network based Elastic-Block Store (EBS) Volume (118) with at least one user mode (102) and at least one kernel mode (104); said user mode (102) comprising of at least one application (106) and at least one block device (108); said kernel mode (104) comprising of at least one I/O Manager (110) for receiving mounting instruction and presenting decrypted data to requester; at least one crypto kernel module (112) for retrieving encryption key from key file and performing encryption and decryption on data; at least one file system (116) and at least one EBS Volume (118).
  • Another aspect of the present invention provides for a method (200) for managing storage encryption over network based Elastic-Block Store (EBS) Volume.
  • the method comprises steps of initializing and configuring EBS Volume (202); mounting encrypted EBS Volume (204); writing data on EBS Volume and encrypting data (206); reading encrypted data from EBS Volume and decrypting said encrypted data (208); and unmounting encrypted EBS Volume (210).
  • the methodology for initializing and configuring EBS Volume further comprises steps for random generation of encryption key wherein said encryption key encrypts data for writing on EBS volume and said encryption key is used to decrypt data which are decrypted by the system.
  • a further aspect of the present invention provides a further method (300) for initializing and configuring EBS Volume.
  • the said method comprises steps of selecting EBS Volume (302); selecting encryption algorithm (304); loading Encryption Kernel Module (306); generating at least one encryption key (308); storing encryption key file in Virtual Machine (VM) (310); and initializing and formatting EBS Volume (312).
  • the method for generating at least one encryption key further comprises steps of receiving password (P) through user input (402); calculating message digest (H) by hashing received password (P) (404); generating encryption key (R) randomly (406); encrypting encryption key (R ) using message digest (H) to produce encrypted key (EK) (408); and storing the encrypted key into key file (410).
  • Another aspect of the present invention provides a further method (500) for mounting encrypted EBS Volume.
  • the said method comprises steps of sending instruction to I/O Manager (502); retrieving encryption key from key file by Crypto Kernel Module (504); retrieving encryption key from key file (506); and mounting file system (508).
  • the method for retrieving encryption key from key file by Crypto Kernel Module further comprises steps of receiving password (P) through user input (602); calculating message digest (H) by hashing received password (P) (604); reading key file to retrieve encrypted key (EK) (606); retrieving encrypted key (R) using (H) as a symmetric decryption key (608); and forwarding retrieved encryption key (R) to crypto kernel module (610).
  • a further aspect of the present invention provides a further method (700) for writing data on EBS Volume and encrypting data.
  • the said method comprises steps of requesting to write data on EBS Volume (702); performing write system call to I/O Manager (704); forwarding data to crypto kernel module and encrypting data (706); forwarding encrypted data to file system (708); and storing encrypted data on EBS Volume (710).
  • the method for encrypting data forwarded to crypto kernel module further comprises steps of retrieving encryption key (EK) (802); and encrypting data to obtain encrypted data (ED) using EK as a symmetric encryption key (804).
  • Another aspect of the present invention provides a further method for reading encrypted data from EBS Volume and decrypting said encrypted data.
  • the said method comprises steps of requesting to read data from EBS Volume (902); performing read system call to I/O Manager (904); reading data from EBS Volume and decrypting data (906); forwarding decrypted data to I/O Manager (908); and presenting decrypted data to requester (910).
  • the method for decrypting data upon reading data from EBS Volume further comprises steps of retrieving encryption key (EK) (1002); and decrypting data to obtain decrypted data (DD) using EK as a symmetric decryption key (1004).
  • FIG. 1.0 illustrates the block diagram of the system of the present invention.
  • FIG. 2.0 is a flowchart illustrating the method for managing storage encryption over network based Elastic-Block Store (EBS) Volume.
  • FIG. 3.0 is a flowchart illustrating the method for initializing and configuring EBS Volume.
  • FIG. 4.0 is a flowchart illustrating the method for generating at least one encryption key.
  • FIG. 5.0 is a flowchart illustrating the method for mounting encrypted EBS Volume.
  • FIG. 6.0 is a flowchart illustrating the method for retrieving encryption key from key file by Crypto Kernel Module
  • FIG. 7.0 is a flowchart illustrating the method for writing data on EBS Volume and encrypting data.
  • FIG. 8.0 is a flowchart illustrating the method for encrypting data forwarded to crypto kernel module.
  • FIG. 9.0 is a flowchart illustrating the method for reading encrypted data from EBS Volume and decrypting said encrypted data.
  • FIG. 10.0 is a flowchart illustrating the method for decrypting data upon reading data from EBS Volume. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS
  • FIG. 1.0 illustrates the block diagram of the system of the present invention.
  • the system (100) of the present invention manages storage encryption over network based Elastic-Block Store (EBS) Volume (118) with a user mode (102) and a kernel mode (104).
  • EBS Elastic-Block Store
  • the said user mode (102) comprising of an application (106) and a block device (108) and the said kernel mode (104) comprising of Input Output (I/O) Manager (110), a crypto kernel module (112), a file system (116) and a EBS Volume (118).
  • I/O Input Output
  • crypto kernel module 112
  • file system 116
  • EBS Volume 118
  • EBS Volume (118) is an off-instance storage that persists independently from the life of Virtual Machine (VM) instance.
  • EBS provides highly available, highly reliable storage volumes that can be attach to a running VM instance and exposed as a device within the VM instance.
  • EBS is particularly suited for applications that require a database, a file system, or access to raw block level storage.
  • EBS allows user to create storage volumes in any sizes that can be mounted as devices by VM instances. Multiple volumes can be mounted to the same VM instance.
  • the storage volumes behave like raw, unformatted block devices, with user required to supplied device names and a block device interface. User can create a file system on EBS volumes, or use them in any other way as a block device (just like a normal hard drive).
  • the I/O Manager ( 10) of the present invention receives mounting instruction and presents decrypted data to requester while the crypto kernel module (112) retrieves encryption key from key file.
  • the crypto kernel module (112) retrieves encryption key from key file by the following means wherein the said system receives user input (i.e. a password (P)).
  • Key file is read by retrieving the encrypted key (EK) and the encryption key (R) is retrieved using H as a symmetric decryption key. Thereafter, the encryption key (R) is forwarded to the crypto kernel module.
  • FIG. 2.0 is a flowchart illustrating the method for managing storage encryption over network based Elastic-Block Store (EBS) Volume
  • FIG. 3.0 is a flowchart illustrating the method for initializing and configuring EBS Volume
  • FIG. 4.0 is a flowchart illustrating the method for generating at least one encryption key.
  • the methodology for managing storage encryption over network based Elastic-Block Store (EBS) Volume is initiated by first initializing and configuring EBS Volume (202) wherein initializing and configuring EBS Volume further comprises random generation of encryption key wherein said encryption key encrypts data for writing on EBS volume and said encryption key is used to decrypt data which are decrypted by the system.
  • EBS Volume is first selected (202) as a startup to initialize and configure EBS Volume. Thereafter, the encryption algorithm (304) is selected and Encryption Kernel Module is loaded (306) to generate encryption key (308).
  • the encrypted key (ER) will be stored into the key file in the Virtual Machine (310, 410). Thereafter, EBS Volume will be initialized and formatted accordingly (312).
  • FIG. 5.0 is a flowchart illustrating the method for mounting encrypted EBS Volume
  • FIG. 6.0 is a flowchart illustrating the method for retrieving encryption key from key file by Crypto Kernel Module.
  • FIG. 7.0 is a flowchart illustrating the method for writing data on EBS Volume and encrypting data and FIG.
  • 8.0 is a flowchart illustrating the method for encrypting data forwarded to crypto kernel module.
  • Request to write data on EBS Volume (702) is received and thereafter a write system call is initiated to I/O Manager (704).
  • the encrypted data is forwarded to the file system (708) and store in the EBS Volume (710).
  • FIG. 9.0 is a flowchart illustrating the method for reading encrypted data from EBS Volume and decrypting said encrypted data
  • FIG. 10.0 is a flowchart illustrating the method for decrypting data upon reading data from EBS Volume.
  • the decrypted data is forwarded to the I/O Manager (908) and said decrypted data (DD) will be presented to the requester. Subsequently, the encrypted EBS Volume (210) can be unmounted from the system if the volumes are not required.
  • the present invention provides management of storage encryption over network-based EBS Volume in which data being encrypted by encryption algorithm.
  • the present invention provides flexibility on encryption algorithm in which the said algorithm is not limited to any provider.
  • the present invention is transparent to user in which the data that is written to the EBS disk are encrypted transparently with the random generation of encryption key and stored in the disk.
  • the present invention allows and re- enforce confidentiality in the EBS Volume by encryption of the data being stored in the data storage and decryption of the encrypted data using correct symmetric key provided by the authorized user during retrieval process.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Computer Hardware Design (AREA)
  • Health & Medical Sciences (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Databases & Information Systems (AREA)
  • Storage Device Security (AREA)

Abstract

Le système et le procédé de la présente invention permettent de gérer le chiffrement du stockage sur un volume de mémoire à blocs élastiques (EBS) accessible en réseau ou en nuage de façon à fournir à n'importe quel fournisseur et utilisateur des niveaux de flexibilité et de transparence sur l'algorithme de chiffrement qui peuvent être universellement acceptables. Le système (100) de la présente invention gère le chiffrement du stockage sur un volume (118) de mémoire à blocs élastiques (EBS) accessible en réseau avec un mode utilisateur (102) et un mode noyau (104), ledit mode utilisateur (102) comprenant une application (106) et un périphérique de bloc (108) et ledit mode noyau (104) comprenant un gestionnaire d'E/S (110) destiné à recevoir une instruction de montage et à présenter à un demandeur des données déchiffrées ; un module noyau de chiffrement (112) destiné à récupérer une clé de chiffrement à partir d'un fichier de clés ; un système de fichiers (116) et un volume EBS (118). Le procédé de la présente invention commence par l'initialisation et la configuration du volume EBS (202). Puis le volume EBS chiffré (204) est monté sur le système et des données sont écrites sur le volume EBS, lesdites données étant à leur tour soumises à un chiffrement (206). Les données chiffrées sont lues à partir du volume EBS, puis lesdites données chiffrées sont déchiffrées de façon à obtenir des données déchiffrées (208). Le volume EBS chiffré (210) peut être démonté du système lorsque les volumes ne sont pas nécessaires. La présente invention est transparente pour un utilisateur en ce sens que les données qui sont écrites sur le disque EBS sont chiffrées de manière transparente grâce à la production aléatoire d'une clé de chiffrement, puis mémorisées sur le disque. La confidentialité est garantie et renforcée dans le volume EBS par le chiffrement des données stockées dans la mémoire de données et le déchiffrement des données chiffrées moyennant une clé symétrique correcte fournie par l'utilisateur autorisé lors d'un processus de récupération.
PCT/MY2013/000156 2012-09-11 2013-09-05 Gestion de chiffrement du stockage sur un volume de mémoire à blocs élastiques accessible en réseau WO2014042512A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
MYPI2012004046 2012-09-11
MYPI2012004046A MY164087A (en) 2012-09-11 2012-09-11 Management of storage encryption over network-based elastic block store volume

Publications (1)

Publication Number Publication Date
WO2014042512A1 true WO2014042512A1 (fr) 2014-03-20

Family

ID=49326825

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/MY2013/000156 WO2014042512A1 (fr) 2012-09-11 2013-09-05 Gestion de chiffrement du stockage sur un volume de mémoire à blocs élastiques accessible en réseau

Country Status (2)

Country Link
MY (1) MY164087A (fr)
WO (1) WO2014042512A1 (fr)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104836656A (zh) * 2015-05-08 2015-08-12 厦门大学 一种视频文件的存储和传输方法

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
CLEMENS FRUHWIRTH ET AL: "Secret messages, hard disk encryption with DM-Crypt, LUKS, and cryptsetup", LINUX MAGAZINE, 1 December 2005 (2005-12-01), XP055092966, Retrieved from the Internet <URL:http://www.linux-magazine.com/content/download/62715/485838/version/1/file/Hard_Disk_Encryption_DM-Crypt_LUKS_cryptsetup.pdf> [retrieved on 20131211] *
ERIK PETERSON: "Encrypting your data on Amazon EC2", 26 November 2011 (2011-11-26), pages 1 - 9, XP055066779, Retrieved from the Internet <URL:http://silvexis.com/2011/11/26/encrypting-your-data-on-amazon-ec2/> [retrieved on 20130614] *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104836656A (zh) * 2015-05-08 2015-08-12 厦门大学 一种视频文件的存储和传输方法

Also Published As

Publication number Publication date
MY164087A (en) 2017-11-30

Similar Documents

Publication Publication Date Title
US10318750B2 (en) Unlocking a storage device
US9122888B2 (en) System and method to create resilient site master-key for automated access
US10402109B2 (en) Systems and methods for storing data blocks using a set of generated logical memory identifiers
US20190149320A1 (en) Cryptographic key generation for logically sharded data stores
US8369529B1 (en) Re-keying based on pre-generated keys
US7590868B2 (en) Method and apparatus for managing encrypted data on a computer readable medium
KR101371608B1 (ko) Ｄｂｍｓ 및 데이터베이스에서 암호화 방법
US8352751B2 (en) Encryption program operation management system and program
US20080104417A1 (en) System and method for file encryption and decryption
US9774445B1 (en) Host based rekeying
US20140331061A1 (en) Drive level encryption key management in a distributed storage system
US8181028B1 (en) Method for secure system shutdown
US11494508B2 (en) Secrets as a service
US11902425B2 (en) Encrypted search with a public key
US10733306B2 (en) Write-only limited-read filesystem
AU2017440029B2 (en) Cryptographic key generation for logically sharded data stores
TWI797353B (zh) 動態密碼密鑰擴展之電路、方法及系統
TW201933169A (zh) 在一加密系統中管理密碼密鑰之一集合
US8364979B1 (en) Apparatus, system, and method to efficiently search and modify information stored on remote servers, while hiding access patterns
US9218296B2 (en) Low-latency, low-overhead hybrid encryption scheme
Halcrow eCryptfs: a stacked cryptographic filesystem
US11720717B2 (en) System memory information protection with a controller
US20210176053A1 (en) Symmetrically encrypt a master passphrase key
WO2014042512A1 (fr) Gestion de chiffrement du stockage sur un volume de mémoire à blocs élastiques accessible en réseau
CA2563144C (fr) Systeme et methode pour le cryptage et le decryptage de fichier

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 13774528

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 13774528

Country of ref document: EP

Kind code of ref document: A1