[go: up one dir, main page]

CN106850819A - A kind of method and system for improving object storage security - Google Patents

A kind of method and system for improving object storage security Download PDF

Info

Publication number
CN106850819A
CN106850819A CN201710087511.5A CN201710087511A CN106850819A CN 106850819 A CN106850819 A CN 106850819A CN 201710087511 A CN201710087511 A CN 201710087511A CN 106850819 A CN106850819 A CN 106850819A
Authority
CN
China
Prior art keywords
agent
object storage
program
service end
key
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN201710087511.5A
Other languages
Chinese (zh)
Inventor
李进
李发明
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Beijing Toyou Feiji Electronics Co., Ltd.
Original Assignee
Shenzhen City Rui Bo Deposit Information Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Shenzhen City Rui Bo Deposit Information Technology Co Ltd filed Critical Shenzhen City Rui Bo Deposit Information Technology Co Ltd
Priority to CN201710087511.5A priority Critical patent/CN106850819A/en
Publication of CN106850819A publication Critical patent/CN106850819A/en
Pending legal-status Critical Current

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00Network arrangements or protocols for supporting network services or applications
    • H04L67/01Protocols
    • H04L67/10Protocols in which an application is distributed across nodes in the network
    • H04L67/1097Protocols in which an application is distributed across nodes in the network for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/04Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00Network arrangements or protocols for supporting network services or applications
    • H04L67/50Network services
    • H04L67/56Provisioning of proxy services
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00Network arrangements or protocols for supporting network services or applications
    • H04L67/50Network services
    • H04L67/56Provisioning of proxy services
    • H04L67/565Conversion or adaptation of application format or content

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Storage Device Security (AREA)
  • Computer And Data Communications (AREA)

Abstract

The invention discloses a kind of method and system for improving object storage security, shown method includes A:An Agent is respectively installed on the main frame and object storage server stored using object, is communicated by Agent;B:Strategy according to configuration is encrypted to carrying out the communication data between Client Agent program and service end Agent, operational order enters line translation, key enters line translation.It includes the main frame and the object storage server that use object to store, and it also includes client agent and service end Agent.Communication one side data between the main frame and object storage server that are stored using object are encrypted, and on the other hand same operation is specified and can sent in different forms under different conditions, so that the safety of the guarantee data of maximum likelihood.The present invention is widely used in Computer Storage field as a kind of method and system for improving object storage security.

Description

A kind of method and system for improving object storage security
Technical field
The present invention relates to Computer Storage field, more particularly to a kind of method and system for improving object storage security.
Background technology
More and more attracted attention in the storage of cloud era object, and obtained rapid development.Object storage system System needs less metadata to store and access file compared to file system, and they are also reduced because of storage metadata The expense of the management file metadata of generation.This means object storage can be extended to almost limitless system by increasing node Scale.
Object storage is different from tradition SAN and NAS file storages, and flat data organizational structure is used in object storage Traditional nested file is abandoned, it is to avoid safeguard huge directory tree.Number of files in cloud era, a system can be non- Chang Ju great, and when accessing these files, not only visit capacity is huge, requirement of the user to speed is also very high.
The bigger factor that object storage service obtains great development is to achieve the favor of mobile Internet, in mobile terminal In APP, object stores simple HTTP interface and simplifies the development process of developer, and also can provide the user magnanimity Memory space.
Current object storage generally uses HTTP or HTTPS modes and carries out the transmission of data manipulation instruction and data. Object storage no longer provides POSIX compatible interfaces, and can be easily by HTTP Restful api interfaces and Object is interacted:Upload download is carried out by PUT and GET, is deleted by DELETE.No matter which kind of mode object is used All there is certain potential safety hazard in storage server, caused the characteristics of this is mainly due to http protocol itself.
The mode for improving object storage security at present is a kind of by using special private instruction collection, and this mode does not have Standby versatility, makes application program needs modification in this way increased the cost for using.Another kind is exactly to use HTTPS, this When external attack is subjected to, attacker can send mass data upload, download request to the mode of kind to storage server, after causing End cluster can't bear the heavy load, or even the situation that service cannot be provided for normal user occur, that is, occur in that the situation of refusal service.
The content of the invention
In order to solve the above-mentioned technical problem, it is an object of the invention to provide it is a kind of improve object storage security method and System.
The technical solution adopted in the present invention is:A kind of method for improving object storage security, it is comprised the following steps: A:An Agent is respectively installed on the main frame and object storage server stored using object, is carried out by Agent Communication;B:Strategy according to configuration is added to carrying out the communication data between Client Agent program and service end Agent Close, operational order enters line translation, key and enters line translation.
Further, the step A includes sub-step:A1:Client Agent program is by being locally configured program connecting object Storage server;A2:The IP address of place main frame, CPU sequence numbers, mainboard sequence number information are sent to service by Client Agent End Agent;A3:3 information that service end Agent sends client as seed obtain one group of communication key, with And an instruction dictionary, and it is sent to Client Agent program;A4:The information that Client Agent program will be received is solved It is close, and be saved in local.
Further, the step B includes sub-step:B1:Client Agent program randomly selects one group of instruction dictionary, will refer to Order is converted to alias, randomly selects a communication key and it is encrypted, and will instruct dictionary numbering, communication key numbering and add Data is activation after close gives service end Agent;B2:Service end Agent obtains key according to communication key numbering, and will Data deciphering, order and alias corresponding relation are obtained according to instruction dictionary numbering, obtain actual command, are sent to object storage clothes Result is sent to Client Agent program by business device treatment, service end Agent using same way;B3:Client Agent journey Sequence is sent to the main frame stored using object after result is decrypted.
A kind of system for improving object storage security, it includes the main frame and the object storage service that use object to store Device, it also includes client agent and service end Agent, the Client Agent program and service end Agent:With Communicated between the main frame and object storage server stored using object, and according to the strategy of configuration to, communication data It is encrypted, operational order enters line translation, key enters line translation.
Further, the Client Agent program includes also including:Program and collecting unit is locally configured, it is described locally to match somebody with somebody The program of putting is used for:Client Agent program is by being locally configured program connecting object storage server;Collecting unit:For by institute IP address, CPU sequence numbers in main frame, mainboard sequence number information are sent to service end Agent;
Further, the service end Agent includes:Key production unit, the Key generating unit:For servicing 3 information that end Agent sends client obtain one group of communication key and an instruction dictionary as seed, concurrently Give Client Agent program.
Further, the client agent and service end Agent include:Accidental enciphering unit:For randomly selecting One group of instruction dictionary, alias is converted to by instruction, randomly selects a communication key and it is encrypted;Decryption unit:For basis Communication key numbering obtains key, and by data deciphering, order and alias corresponding relation is obtained according to instruction dictionary numbering, obtains Actual command.
The beneficial effects of the invention are as follows:By the present invention in that being stored in the main frame and object stored using object with one One Agent is respectively installed, the communication between the main frame and object storage server of all use object storages is complete on server Portion is completed by the Agent.Client Agent program and service end Agent can carry out adding for data according to the strategy of configuration Close, operational order conversion, the conversion of key, the communication between the main frame for so being stored using object and object storage server One side data are encrypted, and on the other hand same operation is specified and can sent in different forms under different conditions, So as to the security of the guarantee data of maximum likelihood.
Brief description of the drawings
Specific embodiment of the invention is described further below in conjunction with the accompanying drawings:
Fig. 1 is a kind of flow chart of the method for improving object storage security of the present invention;
Fig. 2 is the flow chart connected between Agent in a kind of method for improving object storage security of the present invention;
Fig. 3 is the schematic diagram of instruction dictionary in a kind of method for improving object storage security of the present invention;
Fig. 4 is the communication flow figure between Agent in a kind of method for improving object storage security of the present invention;
Fig. 5 is a kind of raising object storage security system structure diagram of the invention.
Specific embodiment
It should be noted that in the case where not conflicting, the feature in embodiment and embodiment in the application can phase Mutually combination.
As shown in figure 1, a kind of method for improving object storage security, it is comprised the following steps:A:Deposited using object One Agent is respectively installed on the main frame and object storage server of storage, is communicated by Agent;B:According to matching somebody with somebody To carrying out, the communication data between Client Agent program and service end Agent is encrypted the strategy put, operational order enters Line translation, key enter line translation.
The use of the method user is that need not need not change code to the application program that original use object is stored, can protect Hold original access mode it is constant while improve security.This method can be by using one in the main frame stored using object And an Agent, the main frame and object storage server of all use object storages are respectively installed in object storage server Between communication all completed by the Agent.Client Agent program and service end Agent can be according to the strategies of configuration Carry out encryption, the conversion of operational order, the conversion of key of data, the main frame for so being stored using object and object storage service Communication one side data between device are encrypted, and on the other hand same operation is specified under different conditions can be with difference Form send so that the security of the guarantee data of maximum likelihood.
As shown in Fig. 2 the step A includes sub-step:A1:Client Agent program connects right by the way that program is locally configured As storage server;A2:The IP address of place main frame, CPU sequence numbers, mainboard sequence number information are sent to clothes by Client Agent Business end Agent;A3:3 information that service end Agent sends client as seed obtain one group of communication key, And an instruction dictionary (producing hash values by 3 permutation and combination), and it is sent to Client Agent program;A4:Client The information that Agent will be received is decrypted, and is saved in local.
As shown in figure 3, the corresponding alias of instruction that the storage of each object is had in instruction dictionary (is acted on behalf of in service end later Program and Client Agent program can all use such group name when communicating, wherein in service in the specified numbering of true operation The suite number in some groups provided in advance in end Agent and Client Agent program).
As shown in figure 4, the step B includes sub-step:B1:Client Agent program randomly selects one group of instruction dictionary, Instruction is converted into alias, a communication key is randomly selected and it is encrypted, and will instruction dictionary numbering, communication key numbering with And the data is activation after encryption gives service end Agent;B2:Service end Agent obtains key according to communication key numbering, And by data deciphering, order and alias corresponding relation are obtained according to instruction dictionary numbering, and actual command is obtained, it is sent to object and deposits Result is sent to Client Agent program by storage server process, service end Agent using same way;B3:Client generation Reason program is sent to the main frame stored using object after result is decrypted.After Agent starts successfully, reception can be started and used The operation requests of object storage service client, and convert the request into it is specific specify, be sent to storage server, storage clothes After business device treatment request, make to return result to Agent in a like fashion, last Agent is returned result to should Use program.
As shown in figure 5, a kind of system for improving object storage security, it includes the main frame and object that use object to store Storage server, it also includes client agent and service end Agent, the Client Agent program and service end generation Reason program:For being communicated between the main frame and object storage server that are stored using object, and according to the strategy of configuration to, Communication data is encrypted, operational order enters line translation, key enters line translation.
It is further used as preferred embodiment, the Client Agent program includes also including:Be locally configured program and Collecting unit, the program that is locally configured is used for:Client Agent program is by being locally configured program connecting object storage service Device;Collecting unit:Journey is acted on behalf of for the IP address of place main frame, CPU sequence numbers, mainboard sequence number information to be sent into service end Sequence;
It is further used as preferred embodiment, the service end Agent includes:Key production unit, the key Generation unit:3 information client sent for service end Agent as seed obtain one group of communication key and One instruction dictionary, and it is sent to Client Agent program.
It is further used as preferred embodiment, the client agent and service end Agent include:It is random to add Close unit:For randomly selecting one group of instruction dictionary, instruction is converted into alias, randomly selects a communication key and it is added It is close;Decryption unit:For obtaining key according to communication key numbering, and by data deciphering, ordered according to instruction dictionary numbering Order and alias corresponding relation, obtain actual command.
Application program need not change the present invention to routine interface when in use, it is only necessary to by the right of original access The port of Agent is changed to as the IP of storage server and port.When in use, it might even be possible to not public to application program Open the IP address of object storage server.
Above is preferable implementation of the invention is illustrated, but the invention is not limited to the implementation Example, those of ordinary skill in the art can also make a variety of equivalent variations or replace on the premise of without prejudice to spirit of the invention Change, these equivalent deformations or replacement are all contained in the application claim limited range.

Claims (7)

1. it is a kind of improve object storage security method, it is characterised in that:It is comprised the following steps:
A:An Agent is respectively installed on the main frame and object storage server stored using object, by Agent Communicated;
B:Strategy according to configuration is added to carrying out the communication data between Client Agent program and service end Agent Close, operational order enters line translation, key and enters line translation.
2. it is according to claim 1 improve object storage security method, it is characterised in that the step A include son Step:
A1:Client Agent program is by being locally configured program connecting object storage server;
A2:The IP address of place main frame, CPU sequence numbers, mainboard sequence number information are sent to service end agency by Client Agent Program;
A3:3 information that service end Agent sends client obtain one group of communication key and a finger as seed Dictionary is made, and is sent to Client Agent program;
A4:The information that Client Agent program will be received is decrypted, and is saved in local.
3. it is according to claim 1 improve object storage security method, it is characterised in that the step B include son Step:
B1:Client Agent program randomly selects one group of instruction dictionary, and instruction is converted into alias, randomly selects a communication close Key is encrypted to it, and the data is activation after dictionary numbering, communication key numbering and encryption will be instructed to give service end Agent;
B2:Service end Agent obtains key according to communication key numbering, and by data deciphering, is numbered according to instruction dictionary To order and alias corresponding relation, actual command is obtained, be sent to object storage server process, service end Agent will be tied Fruit is sent to Client Agent program using same way;
B3:Client Agent program is sent to the main frame stored using object after result is decrypted.
4. it is a kind of improve object storage security system, it include use object store main frame and object storage server, It is characterized in that:It also includes client agent and service end Agent,
The Client Agent program and service end Agent:For the main frame and object storage server that are stored using object Between communicated, and according to configuration strategy to, communication data is encrypted, operational order enters line translation, key becomes Change.
5. it is according to claim 4 improve object storage security system, it is characterised in that the Client Agent journey Sequence includes also including:Program and collecting unit is locally configured,
The program that is locally configured is used for:Client Agent program is by being locally configured program connecting object storage server;
Collecting unit:For the IP address of place main frame, CPU sequence numbers, mainboard sequence number information to be sent into service end agency Program.
6. it is according to claim 5 improve object storage security system, it is characterised in that the service end acts on behalf of journey Sequence includes:Key production unit,
The Key generating unit:For 3 information that service end Agent sends client one group is obtained as seed Communication key and an instruction dictionary, and it is sent to Client Agent program.
7. it is according to claim 6 improve object storage security system, it is characterised in that the client agent Include with service end Agent:
Accidental enciphering unit:For randomly selecting one group of instruction dictionary, instruction is converted into alias, randomly selects a communication close Key is encrypted to it;
Decryption unit:For obtaining key according to communication key numbering, and by data deciphering, ordered according to instruction dictionary numbering Order and alias corresponding relation, obtain actual command.
CN201710087511.5A 2017-02-17 2017-02-17 A kind of method and system for improving object storage security Pending CN106850819A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201710087511.5A CN106850819A (en) 2017-02-17 2017-02-17 A kind of method and system for improving object storage security

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201710087511.5A CN106850819A (en) 2017-02-17 2017-02-17 A kind of method and system for improving object storage security

Publications (1)

Publication Number Publication Date
CN106850819A true CN106850819A (en) 2017-06-13

Family

ID=59128829

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201710087511.5A Pending CN106850819A (en) 2017-02-17 2017-02-17 A kind of method and system for improving object storage security

Country Status (1)

Country Link
CN (1) CN106850819A (en)

Citations (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1669035A (en) * 2002-05-15 2005-09-14 耐威系统公司 Methods and apparatus for a title transaction network
CN101013459A (en) * 2007-02-07 2007-08-08 北京飞天诚信科技有限公司 Method and apparatus for improving security of software protection
CN101034424A (en) * 2007-01-12 2007-09-12 深圳兆日技术有限公司 Date safety storing system, device and method
CN101484904A (en) * 2006-07-07 2009-07-15 桑迪士克股份有限公司 Content control system and method using versatile control structure
CN101641702A (en) * 2007-03-23 2010-02-03 微软公司 Secure data storage and retrieval incorporating human participation
CN102075532A (en) * 2010-12-30 2011-05-25 中国民航信息网络股份有限公司 Method for penetrating through firewall
CN102136052A (en) * 2011-04-29 2011-07-27 北京深思洛克软件技术股份有限公司 Software protecting method
CN102857507A (en) * 2012-09-10 2013-01-02 福建伊时代信息科技股份有限公司 Disk mapping method and disk mapping system
CN103888499A (en) * 2012-12-21 2014-06-25 中国科学院深圳先进技术研究院 Method and system for distributed object processing
CN103927489A (en) * 2014-04-22 2014-07-16 陈幼雷 System and method for trusted storage of data
CN104468422A (en) * 2014-10-21 2015-03-25 华为技术有限公司 Data transmission method, controller and forwarding equipment
CN104796412A (en) * 2014-04-06 2015-07-22 惠州Tcl移动通信有限公司 End-to-end cloud service system and method for accessing sensitive data thereof
CN105872102A (en) * 2016-06-06 2016-08-17 武汉理工大学 File uploading and downloading method
CN106453442A (en) * 2016-12-28 2017-02-22 安徽云软信息科技有限公司 Cloud computing-based massive big data secure cloud storage system

Patent Citations (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1669035A (en) * 2002-05-15 2005-09-14 耐威系统公司 Methods and apparatus for a title transaction network
CN101484904A (en) * 2006-07-07 2009-07-15 桑迪士克股份有限公司 Content control system and method using versatile control structure
CN101034424A (en) * 2007-01-12 2007-09-12 深圳兆日技术有限公司 Date safety storing system, device and method
CN101013459A (en) * 2007-02-07 2007-08-08 北京飞天诚信科技有限公司 Method and apparatus for improving security of software protection
CN101641702A (en) * 2007-03-23 2010-02-03 微软公司 Secure data storage and retrieval incorporating human participation
CN102075532A (en) * 2010-12-30 2011-05-25 中国民航信息网络股份有限公司 Method for penetrating through firewall
CN102136052A (en) * 2011-04-29 2011-07-27 北京深思洛克软件技术股份有限公司 Software protecting method
CN102857507A (en) * 2012-09-10 2013-01-02 福建伊时代信息科技股份有限公司 Disk mapping method and disk mapping system
CN103888499A (en) * 2012-12-21 2014-06-25 中国科学院深圳先进技术研究院 Method and system for distributed object processing
CN104796412A (en) * 2014-04-06 2015-07-22 惠州Tcl移动通信有限公司 End-to-end cloud service system and method for accessing sensitive data thereof
CN103927489A (en) * 2014-04-22 2014-07-16 陈幼雷 System and method for trusted storage of data
CN104468422A (en) * 2014-10-21 2015-03-25 华为技术有限公司 Data transmission method, controller and forwarding equipment
CN105872102A (en) * 2016-06-06 2016-08-17 武汉理工大学 File uploading and downloading method
CN106453442A (en) * 2016-12-28 2017-02-22 安徽云软信息科技有限公司 Cloud computing-based massive big data secure cloud storage system

Similar Documents

Publication Publication Date Title
US12099721B2 (en) Methods to configure and access scalable object stores using KV-SSDs and hybrid backend storage tiers of KV-SSDs, NVMe-SSDs and other flash devices
CN103595730B (en) A ciphertext cloud storage method and system
CN106156359B (en) A kind of data synchronization updating method under cloud computing platform
US20220188275A1 (en) Flexible Permission Management Framework For Cloud Attached File Systems
US12537799B2 (en) Data stream replication using staggered encryption
US8300823B2 (en) Encryption and compression of data for storage
US11775569B2 (en) Object-backed block-based distributed storage
JP6644960B1 (en) Method and system for restoring archived data containers on object-based storage
EP2951731B1 (en) Accessing objects in hosted storage
US10893032B2 (en) Encryption key management system for cloud services
US10783121B2 (en) Techniques for optimizing data flows in hybrid cloud storage systems
EP2631805A1 (en) Storage-service-provision device, system, service-provision method, and service-provision program
CN106657267A (en) Cloud storage system based on edge server
CN108182367B (en) A client-side deduplication method for encrypted data blocks supporting data update
CN104754055A (en) Safety cloud storage method for use in multi-cloud environment
US10534667B2 (en) Segmented cloud storage
CN104992124A (en) Document safety access method for cloud storage environment
CN103731489A (en) Data storage method, system and equipment
EP3716580A1 (en) Cloud file transfers using cloud file descriptors
CN108011888A (en) A kind of method, apparatus and storage medium, program product for realizing certificate reconstruct
CN105591959A (en) A system and method for load balancing using SSL session reuse
CN105978944A (en) Object storage method and device
US20180198862A1 (en) Link-server caching
CN116015767A (en) A data processing method, device, equipment and medium
CN106850819A (en) A kind of method and system for improving object storage security

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
TA01 Transfer of patent application right
TA01 Transfer of patent application right

Effective date of registration: 20190823

Address after: Floors 1 to 4, Building 2, Courtyard 9, Dijin Road, Haidian District, Beijing

Applicant after: Beijing Toyou Feiji Electronics Co., Ltd.

Address before: 518000 Room 1402, Feiyada Science and Technology Building, Nanshan District, Shenzhen City, Guangdong Province

Applicant before: Shenzhen City Rui Bo deposit information technology Co. Ltd.

RJ01 Rejection of invention patent application after publication
RJ01 Rejection of invention patent application after publication

Application publication date: 20170613