KR101387939B1 - System for controlling backup storage - Google Patents

Abstract

The present invention relates to a storage control system for backup, comprising: a primary storage server for managing original data, a secondary backup storage for generating secondary data from the primary storage server, and a storage for controlling a token for performing user authentication By configuring the array, only a user authenticated by the token can access the storage array to recover the encrypted data, thereby providing a more secure separation authentication and key delivery structure.

Description

Storage control system for backup {SYSTEM FOR CONTROLLING BACKUP STORAGE}

The present invention relates to a storage control technology for backup, and more particularly, to a storage control system for secondary backup to prepare for damage of the primary storage server and to recover it in an emergency.

Currently, enterprises and organizations have built and used a single integrated storage server for efficient data management.In addition, for the purpose of storing and sharing information among multiple users as the application of web disks has developed along with the recent rapid development of the Internet. Storage servers are becoming larger and more network-based for ease of expansion and management.

In the case of mass storage servers, RAID-based storage servers, which are commonly used today, are commonly used for network-based access, and security technology for this is provided in the form of preventing external attackers or malicious access through the network. It provides a secure secure session between multiple clients and the storage server by configuring a RAID storage method by installing a mass storage array such as a hard disk array outside the server for data storage, and restricts access to the secure session through user authentication. This method applies encryption to data transmission.

However, these technologies do not respond to data leakage caused by physically stealing storage after acquiring an administrator password through an insider attack such as memory hacking or keyboard hacking, which has recently been issued.

On the other hand, in a small storage device such as a USB memory, there is a great possibility of theft or loss, and many suppliers introduce security and anti-theft technologies. They are similar in form to software-based security solutions applied to mass storage servers, but with reduced multiuser support and enhanced security against insider attacks through remote management servers. In other words, a dedicated security chip that supports hardware-based data encryption is installed inside the storage, or encryption and authentication is performed at the host side, but in response to insider attacks by collecting and managing authentication information in consideration of the characteristics of the storage.

However, even in the case of introducing a security technology to counter an insider attack in such a small storage device, the security system is mostly simply incapacitated by memory hacking or keyboard hacking technology linked with recent reverse engineering.

As described above, the primary storage server has the same problem as described above, but in a network-based storage server, data must be transmitted / received at the request of a user at any time, and the resource of the server is frequently used as needed. It is virtually impossible to install software in a car storage server to encrypt and use data in real time. Raw data is stored as it is, and it is exposed to insider attacks. In USB memory, user authentication key leaks and data. There is no practical use because of a decrease in the backup data transfer rate due to the encryption / decryption processing speed. Accordingly, there is a need for a secure secondary backup and management technology for a primary shared storage server and a USB memory and a security technology for enhancing data stability.

Republic of Korea Patent Publication No. 2008-0071530 (2008.08.04.) Republic of Korea Patent Publication No. 0847659 (2008.07.21.)

Accordingly, the present invention has been made to solve the above-mentioned problems of the prior art, and an object of the present invention is to use an independent hardware security token, and thereby to perform a function of encrypting and decrypting data, thereby enabling a more secure separation authentication and key delivery structure. It is to provide a storage control system for a backup having.

The storage control system for a backup of the present invention for achieving the above object, the primary storage server for managing the original data; Secondary backup storage for generating secondary data from the primary storage server; And a storage array controlling a token for performing user authentication.

In this case, the storage array includes a host controller and a security module separated from the token.

The security module generates a candidate authentication key, calculates a candidate authentication value, and transmits the candidate authentication value to the token so that only a user authenticated by the token can access the storage array.

The security token receives an encryption key and an authentication key, generates Rnd and an authentication value, and compares the candidate authentication value and the authentication value transmitted from the storage array, so that only an authenticated user can access the storage array. .

As described above, the backup storage control system according to the present invention provides the following effects.

This is different from the usual method of providing keys and authenticating users on the host platform. Only users authenticated by tokens can receive key values from the tokens to access the storage array and recover encrypted data. It is possible to provide secure separation authentication and key delivery structure.

In addition, the storage system itself, rather than the host, maintains a history of encrypted data access, thereby securing the data.

1 is a configuration diagram showing an overall overview of a storage system for backup of the present invention.
2 is a block diagram of a backup storage control system according to an embodiment of the present invention.

Hereinafter, a backup storage control system of the present invention will be described in detail with reference to the accompanying drawings.

1 is a configuration diagram showing an overall overview of a storage system for backup of the present invention.

Referring to FIG. 1, the present invention provides a backup storage system for secondaryly generating data of a primary storage server that manages user information, confidential documents, and the like of an institution and an enterprise to prepare for damage to a server and to recover it in an emergency. to be. In order to prevent the leakage of confidential information caused by the simultaneous online user authentication vulnerability attack and the physical theft of the storage array, it provides a more secure separate authentication and key delivery structure, which enables independent data encryption and decryption. Perform the function.

The present invention uses independent hardware security tokens to provide separate authentication and key delivery schemes, thereby providing key values for encrypting and decrypting data and performing user authentication. This is different from the general method of providing keys and authenticating users on the host platform. Only users authenticated by tokens can receive key values from the tokens and access the storage array to recover encrypted data. In addition, the storage system itself, not the host, maintains a history of encrypted data access, ensuring that sensitive data within the enterprise or organization is protected.

Companies and organizations are now deploying and using one unified storage server for efficient data management. Servers installed in companies and organizations are configured to store and manage various data such as revenue and distribution structure, member personal information, output information, company confidential information, and sources used during development. Such information is very important information directly related to the existence of the company or institution, so periodic backups are required, and if necessary, the backed up information should be restored to a legitimate user to a minimum extent.

In addition, the storage server is often used as a shared space for primary storage and is often composed of a network-based simple disk array. In many cases, however, companies or organizations need to periodically back up the primary stored information and evacuate it to secondary storage space, which is usually done manually. In terms of protecting stored data, it is common to utilize software solutions outside the server for access control or encryption for users. Therefore, it is necessary to perform this process according to an automated process with a more differentiated and specialized system.

Meanwhile, in the case of a mass storage server, a mass storage array such as a hard disk array is installed outside the server for data storage and configured in a RAID manner. Based on this, you can add some software to keep the data on the server by creating and backing up a second copy of the data to additional, externally connected storage arrays in parallel, but you can use all of the data by simply connecting to another computer in case of physical theft or loss. Can be. To prevent this, even if the disk is encrypted, the software for this is executed along with the software for controlling the disk. Therefore, no countermeasures are prepared against malicious internal attacker access through memory hacking or keyboard hacking, which has recently emerged as a serious hacking problem. Not. In these cases, the leakage of administrator secret information can be easily performed, and the enterprise and organization can suffer enormous losses if the large external storage array containing the primary and secondary data of the server is stolen and lost.

Therefore, in the new secure storage system for the secondary backup of the present invention, by using a hardware-based security token to block the malicious attacker's malicious access through memory hacking or keyboard hacking and secondary backup and encryption of the storage server data By doing so, companies and organizations can keep confidential information safe even in the event of physical theft and loss of backup information. In addition, a USB host controller can be included within the storage array assembly to isolate security tokens from the host, completely blocking the authentication process from the host software to address future security issues.

Next, the backup storage control system of the present invention will be described in detail.

2 is an overall configuration diagram of a backup storage control system according to an embodiment of the present invention.

As shown in FIG. 2, the backup storage control system 100 of the present invention includes a primary storage server 200, a secondary backup storage 300, a storage array 400, and a security token 500. It includes.

The primary storage server 200 is a configuration for storing and managing various original data, and performs a conventional function such as transmitting / receiving data according to a user's request. The removable storage 600 may be connected via USB, SATA, or LAN.

The secondary backup storage 300 performs a function of generating and managing secondary backup data from the primary storage server 200 and may be connected to the primary storage server 200 through a USB 3.0.

The storage array 400 includes a host controller 410 and a security module 420, is installed outside the storage servers 200 and 300, and interface hardware for secondary backup storage 300 and high-speed data transfer. Can be connected. Here, the host controller 410 is a system for controlling the security token 500. In the present invention, the host controller 410 is included in the storage array 400 aggregation structure to isolate the security token 500 from the host to separate the host from the host software. This can completely block the authentication process. Next, the security module 420 is a software for controlling the security token 500, and communicates with the security token 500, responds to the user authentication function of the security token 500, and receives a key value from the security token 500. Etc. Specifically, the security module 420 requests the user to enter a personal identification number (PIN) number, generates a candidate authentication key Ka ', and uses the same to encrypt the Rnd transmitted from the security token 500. The authentication value A 'is calculated and transmitted to the security token 500. In addition, if the user authentication is successful in the security token 500, the decryption value K transmitted from the security token 500 is decrypted to obtain a decryption key key, and the candidate authentication value Ka 'is deleted.

The security token 500 is a hardware-based configuration that encrypts data at high speed and performs user authentication and access control in order to prevent physical theft and malicious access of secondary data, and is controlled by the host controller 410 to communicate. In the present invention, by being installed independently of the host controller 410 of the storage array 400 it is possible to prevent malicious access to the secondary data.

By being separated from the host controller 410 independently installed in the storage array 400, malicious access to secondary data may be prevented. Specifically, the security token 500 receives an encryption key Key and an authentication key Ka, generates a random number (Rnd) using a security function, and specifically generates the Rnd (Random Number) using the security function. It transmits to the security module 420 of the storage array, and generates an authentication value A by encrypting Rnd using the authentication key Ka. In addition, if it is determined that the candidate authentication value A 'transmitted from the security module 420 of the storage array 400 is identical to the authentication value A generated by itself, and is determined to be the same, the decryption value K encrypted so that an unauthorized user cannot access it. And decrypts the data by transmitting it to the security module 420 of the storage array 400 to allow the user access. If it is determined that the candidate authentication value A 'and the authentication value A are different, the encryption key is completely deleted. This prevents unauthorized access by unauthorized users by decrypting the data.

As described above, the storage array 400 of the present invention includes a host controller 410 and a security module 420 that are separated from the security token 500 to differentiate from the conventional system in which key provision and user authentication are performed in the host platform. In this manner, only the user authenticated by the security token 500 can access the storage array 400, thereby protecting important data of the storage system.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, but, on the contrary, is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the invention.

100: Storage control system for backup
200: primary storage server
300: secondary backup storage
400: storage array
410: host controller
420: security module
500: Security Token

Claims (5)

A primary storage server for managing original data;
Secondary backup storage for generating secondary data from the primary storage server; And
A storage array controlling a token that performs user authentication,
The storage array includes a host controller and a security module separate from the token,
The security module generates a candidate authentication key, calculates a candidate authentication value, and transmits the candidate authentication value to the token, so that only a user authenticated by the token has access to the storage array.
delete delete The method of claim 1,
The token receives an encryption key and an authentication key, generates a random number (Rnd) and an authentication value, and compares the candidate authentication value and the authentication value transmitted from the storage array, so that only an authenticated user accesses the storage array. Storage control system for backup, characterized in that possible.
The method of claim 1,
And the storage array generates a decryption key if the authentication value and the candidate authentication value are the same, and deletes the encryption key if the authentication value and the candidate authentication value are different.

Images