KR101635005B1 - Method for managing metadata in a digital data safe system based on cloud - Google Patents

Abstract

The present invention relates to a method of managing metadata in a cloud-based digital data security system, which enables a user to download and use digital data of a user stored in the digital data safe whenever the user needs it, Information on digital data is managed in a form of metadata from a client of a user rather than the digital data safe and is encrypted and stored in the digital data safe so that high security can be provided for safely storing digital data of a user System and method therefor.

Description

{METHOD FOR MANAGING METADATA IN A DIGITAL DATA SAFE SYSTEM BASED ON CLOUD}

The present invention relates to a metadata management method in a cloud-based digital data security system, and more particularly, to a method and system for managing metadata in a cloud-based digital data security system, and more particularly, The present invention relates to a metadata management method in a cloud-based digital data security system capable of safely storing digital data of a user by encrypting and storing the metadata in a digital data safe.

Generally, the online storage means a storage space in which the user's digital data can be stored on the Internet so that the user's digital data can be used without restriction of space and time without setting the separate knowledge of the user and administrator authority.

Also, the on-line storage logically divides a large storage space so that a user can store digital data, provides a storage space for digital data to a user, stores and manages information and a list of digital data stored for each user, A physical storage space for storing digital data can be rented as much as necessary, and the storage space can be expanded in real time as needed.

Such an online repository saves the cost of having a separate storage device, such as a USB or external hard disk, for storing the digital data of the user, and can save the user's smartphone, PC, There is an advantage that digital data of a user stored in the online storage can be downloaded and used by using a notebook PC or a tablet PC.

Cloud computing technology is advancing due to the arrival of the smart age, the spread of the Internet media and the rapid development of information and communication technology, and the digital data stored individually in the user's personal PC or the server of the company is stored in the cloud- There is an environment in which the digital data stored in the same online store and downloaded through various terminals such as a user's PC or a smart phone is always downloaded anytime and anywhere and the user can perform a desired operation.

Due to such circumstances, the number of users using the above-mentioned online storage has been rapidly increasing, and thus a security problem of digital data of the users stored in the online storage has been greatly increased.

However, since the conventional on-line storage has an access right to the information of the digital data stored by users due to its characteristics, the administrator of the online storage may leak or check the digital data of the user with malicious intention There is a problem.

Also, the online storage may leak all the digital data of the user when the access right to the online storage is completely hacked by the hacker, and if the digital data of the user is very important data such as business secret, There is a disadvantage that it can be applied to the user.

In order to solve such a problem, a system for providing online storage has recently introduced a method of encrypting and storing all digital data stored by a user.

However, since the encryption key used to encrypt the digital data exists in the server managing the online storage, it is useless that the digital data of the user is encrypted when the encryption key is leaked.

Accordingly, in order to solve the above-described problems with the conventional on-line storage, the present invention manages information on digital data of a user stored in a digital data safe in a form of metadata in a client of a user, And a method and system for securely storing digital data of a user by encrypting and storing the metadata in the digital data safe.

Next, a brief description will be given of the prior arts that exist in the technical field of the present invention, and technical matters which the present invention intends to differentiate from the prior arts will be described.

Korean Patent Registration No. 0905434 (Jun. 24, 2009) discloses a file uploading method having a real-time index information extracting function and a web storage system using the same. More particularly, the present invention relates to a method for indexing data of a large number of users managed by a web storage system So that a user using the web storage apparatus can more easily and quickly retrieve a user's file stored on-line.

The prior art is somewhat similar in that the user's data is uploaded and stored on-line and the user can easily retrieve and download the data uploaded through the specific data. However, The encryption of the metadata of the data is performed, and the encrypted data is transmitted to the digital data safe and stored. By managing the encryption key for the encryption by the client of the user, stability and security of the digital data of the user are significantly The technical features of the present invention that can be improved are not described or suggested.

Korean Patent Laid-Open Publication No. 2014-0129716 (Apr. 31, 2014) discloses a storage security system and method for a cloud server in a cloud computing environment. The storage system includes a file read monitoring device and file installed in a kernel area of a file system provided in a cloud server. Monitoring access information of a user's file stored in the storage of the cloud server through a transmission monitoring device, blocking transmission of the user's file according to a preset security policy based on the access information, And a security system and method for preventing a user's file stored in the storage from being leaked to the outside.

The prior art has some similarities with the present invention in that it provides a security method for the data of the user stored in the on-line storage such as the storage of the cloud server to securely store the user's data. On the other hand, Unlike the technology, information on the user's digital data is managed in a metadata format directly from the user's client. The digital data safe only stores the digital data and metadata of the encrypted user provided by the client, The technical characteristics of the present invention, which can remarkably improve the stability and security of the user's digital data by preventing other people from reading the digital data and not even knowing what digital data is stored It does not suggest or material.

In order to solve the above-described problems, the present invention has been made to solve the above-mentioned problems, and it is an object of the present invention to provide a digital data security system, which stores metadata of a user's digital data, and an encryption key for encrypting the digital data, The client can manage the digital data so that the third party can not view the digital data uploaded by the user and can not even know what digital data is stored so that the user can access the digital data from the abnormal route in advance And to provide high security for the digital data.

The method of managing metadata in a cloud-based digital data security system according to an embodiment of the present invention includes the steps of uploading at least one piece of digital data from a user to a digital data safe and transmitting the metadata about the uploaded digital data to the digital data safe And the digital data and the metadata are encrypted.

The step of uploading may further include the steps of issuing an object ID for the encrypted digital data, storing the encrypted digital data, and generating an object management table including the object name of the encrypted digital data and the object ID The method comprising the steps of:

The updating and storing may further include transmitting the issued object ID to the client of the digital data safe, generating metadata by including the digital data and the object ID in the client, , Storing the transmitted encrypted metadata, and issuing an object ID to the encrypted metadata according to a user.

And the encryption key used for the encryption is directly managed by the client of the digital data safe.

According to another aspect of the present invention, there is provided a method of managing metadata in a cloud-based digital data security system, the method including downloading the encrypted digital data and the encrypted metadata.

The step of downloading may further include transmitting the encrypted metadata in the digital data safe to a client, extracting the object ID from the transmitted encrypted metadata, and transmitting the encrypted digital data corresponding to the object ID to the digital data safe And retrieving the encrypted digital data from the object ID and transmitting the encrypted digital data to the client.

The cloud-based digital data security system according to an embodiment of the present invention includes a client for uploading or downloading digital data and metadata of a user and a digital data safe for storing the digital data and the metadata, And the metadata is encrypted.

The digital data safe also includes an object ID issuing unit for issuing an object ID for the encrypted digital data, an object management table including the object name of the encrypted digital data and the object ID, And a first metadata management unit updating the meta data.

The client includes an encryption unit for encrypting the digital data and the metadata, and a decryption unit for decrypting the encrypted digital data and the metadata.

And the encryption key used for the encryption is directly managed by the client of the digital data safe.

The present invention relates to a metadata management method in a cloud-based digital data security system, in which a user encrypts digital data and metadata to be uploaded by a user in a client, encrypts the encryption key for encryption, The data secure client can manage the digital data so that the administrator of the digital data safe can not view the information on the digital data stored by the user other than the user himself or herself so as to prevent access to the digital data by the abnormal route in advance, The security of the stored digital data of the user can be enhanced.

1 is an exemplary view for explaining an on-line storage system according to the prior art.
FIG. 2 is a conceptual diagram for schematically explaining a cloud-based digital data security system according to an embodiment of the present invention.
3 is a diagram illustrating an example of a method for managing metadata in a cloud-based digital data security system according to an exemplary embodiment of the present invention, in which a user uploads digital data.
4 is a diagram illustrating a method of managing metadata in a cloud-based digital data security system according to an exemplary embodiment of the present invention, in which a user downloads digital data.
FIG. 5 is an exemplary diagram illustrating a concept of a logical structure of metadata according to an embodiment of the present invention. Referring to FIG.
6 is a diagram illustrating a configuration of metadata managed by a digital data security client of a user according to an exemplary embodiment of the present invention.
7 is a diagram illustrating an exemplary structure of an event map according to an embodiment of the present invention.
8 is a block diagram illustrating a configuration of a digital data security client according to an exemplary embodiment of the present invention.
9 is a block diagram illustrating a configuration of a digital data safe according to an embodiment of the present invention.
10 is a flowchart illustrating a procedure for uploading and downloading digital data of a user according to an embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. Like reference symbols in the drawings denote like elements.

1 is an exemplary view for explaining an on-line storage system according to the prior art.

FIG. 1 is a conceptual illustration of an online storage system that provides an existing online storage.

1, the conventional on-line storage system includes an on-line storage server for storing digital data of a user uploaded from a client of a user, a database for storing the received digital data, and metadata for the received digital data And a database for storing the data.

The online storage server also generates metadata for digital data uploaded from a client of the user and stores the generated metadata in the database.

In addition, the on-line storage server encrypts and stores the digital data using its own encryption key to secure the digital data uploaded from the client of the user.

Because of the characteristics of the encryption process, the online storage server may have access rights to the digital data of the user, and the administrator of the online storage may leak the digital data of the user with malicious intention or easily check the contents thereof There is a problem.

Also, since the on-line storage server itself generates and stores an encryption key for encrypting a plurality of digital data received from the user, the encryption key may be leaked through the administrator, the hacker, or the third route There is also a problem that the security of the stored digital data of the user may be weakened.

The metadata includes information on the digital data including an owner (user), size, stored position, encryption key used for encryption, and the like for the digital data.

In addition, since the metadata is stored without being encrypted, the manager or a third party can easily confirm the information on the digital data, and data of high importance is easily exposed through the stored digital data.

Accordingly, before the user transmits the digital data of the user to the digital data safe, the user's client first encrypts the digital data, the metadata of the digital data is recorded in the file or the client database, Is transmitted to the server so that a third party including the administrator can not view the digital data of the user and can not even know what digital data is being stored so that the security for the digital data can be significantly enhanced We will provide a metadata management method in a cloud-based digital data vault system.

FIG. 2 is a conceptual diagram for schematically explaining a cloud-based digital data security system according to an embodiment of the present invention.

2, the cloud-based digital data security system includes a digital data security client 200 of a user, a digital data safe 200 for receiving encrypted digital data of a user from the client 200 of the user, An object DB 300 for storing digital data of the encrypted user, and a metadata DB 300 for generating and storing a management table for the encrypted digital data.

Also, before the user transmits his / her digital data to the digital data safe 100, the user proceeds to encrypt the digital data, generates metadata in tabular form for the digital data, And then encrypts the metadata together with the encrypted digital data and transmits the encrypted metadata to the digital data safe 100. [

Meanwhile, the encryption key used for encryption is stored and managed in a database provided in the client 200 of the user.

Meanwhile, the metadata includes a file name (e.g., Text1.txt) for the digital data and an object ID (e.g., 10001) for the encrypted digital data.

Also, the encryption includes a symmetric encryption / decryption method including DES (Data Encryption Standard), 3-DES, AES (Advanced Encryption Standard), SEED, etc. or a Rivest Shamir Adleman (RSA), a Digital Signature Algorithm And can be performed using an asymmetric encryption / decryption method.

Also, the digital data security client 200 may encrypt the digital data of the user and the metadata according to different encryption methods to provide enhanced security.

Also, the digital data safe 100 defines the encrypted digital data of the user received from the digital data security client 200 as one object and stores the object DB 300, The encrypted metadata of the digital data generated by the client 200 of the user is also defined as one object and stored in the object DB 300.

This is because the metadata of the digital data generated by the client 200 of the user is also treated as one object so that the digital data of the user stored in the digital data repository 100 can be stored in the metadata There is an effect that no information about the digital data of the user can be obtained.

When the digital data safe 100 receives the encrypted metadata and the encrypted digital data of the user, the digital data safe 100 generates metadata for the encrypted metadata and the encrypted digital data, .

The metadata generated by the digital data repository 100 includes an object name (e.g., OBJ1.obj) of the encrypted data and a location (e.g., / usr / storage1) where the encrypted data is stored in the object DB 300. [ .

As described above, the cloud-based digital data security system according to the present invention differs from the prior art in that the encryption of the digital data of the user is not performed in the digital data safe 100 but the metadata of the encrypted digital data The digital data safe 100 does not have any information about the digital data of the user, so that the security of the digital data of the user can be improved.

In the present invention, unlike the prior art, the client 200 performs encryption of the digital data of the user and the metadata of the digital data, and the encryption key used in the encryption is transmitted to the client 200 of the user. A third party other than the user can not browse the stored digital data and can not know any information about the digital data so that the security of the digital data of the user can be remarkably improved It is effective.

3 is a diagram illustrating an example of a method for managing metadata in a cloud-based digital data security system according to an exemplary embodiment of the present invention, in which a user uploads digital data.

As shown in FIG. 3, the user selects at least one piece of digital data to be stored in the digital data security box 100 through the digital data security client 200.

Meanwhile, the digital data security client 200 refers to an application program such as an application that can access the digital data security box 100 through a wire / wireless network. The application is provided from the digital data security box 100, Downloaded from the store and installed in the user's terminal.

Also, the user encrypts the selected at least one digital data through the digital data security client 200 and transmits the encrypted digital data to the digital data safe 100. [

Meanwhile, the encryption can be performed through various encryption methods as described above, and the present invention does not limit the encryption method.

When the encrypted digital data of the user is received from the client 200, the digital data repository 100 defines the encrypted digital data as one object, stores the encrypted digital data in the object DB 300, And transmits the object ID to the digital data security client 100 of the user.

Also, the digital data repository 100 generates an object management table that matches the issued object ID with the corresponding object, and stores the object management table in the metadata DB 400.

On the other hand, the object management table is metadata generated by matching the object ID with the object of the digital data of the encrypted user.

The object management table generated by the digital data repository 100 includes an object name indicating the name of the object of the encrypted digital data and an object ID issued to the object.

When receiving the object ID of the encrypted digital data from the digital data repository 100, the client 200 of the digital data repository 200 stores the file name of the transferred digital data (e.g., Test. and transmits the updated metadata to the digital data repository 100. The digital data repository 100 transmits the updated metadata to the digital data repository 100 by encrypting the updated metadata.

Also, when the digital data safe 100 receives the encrypted metadata from the user safe client 100, the digital data safe 100 recognizes the encrypted metadata, gives an object ID to the recognized encrypted metadata, Matches the user ID with the assigned object ID, and records it in the member management table and the object management table.

Meanwhile, the member management table is metadata generated by matching the user's name (or ID) with the object ID issued to the encrypted metadata, as in the object management table.

Also, the object IDs for the encrypted metadata are respectively assigned to the users, and unlike the object IDs issued to the encrypted digital data, the IDs are fixedly issued according to the user. Also, the fixed ID may be specified when the user subscribes to the digital data safe or may be an ID automatically issued from the digital data safe 100.

Also, the digital data repository 100 can update the encrypted metadata by replacing the encrypted metadata of the user stored in the encrypted metadata with the received encrypted metadata.

The reason why the metadata of the digital data of the user generated by the digital data security client 200 is stored in the digital data safe 100 is that the restriction of the database provided in the digital data security client 200 To allow the user to access the digital data safe 100 through various terminals and to download the digital data of the user stored in the digital data safe 100 or to upload new digital data to be. That is, the digital data safe 100 can be used at any time and anywhere without restriction of the terminal through various terminals of the user.

Of course, in order to use the digital data safe 100, the user must access the digital data safe 100 to perform the subscription procedure and perform user authentication.

Meanwhile, although FIG. 3 and FIG. 4 described above illustrate only a text document as digital data of the user, the digital data of the user includes not only the text document but also various multimedia data including an image or a moving image There is no limitation on the kind of the digital data.

4 is a diagram illustrating a method of managing metadata in a cloud-based digital data security system according to an exemplary embodiment of the present invention, in which a user downloads digital data stored in the digital data safe.

4, a method for a user to download his / her digital data from the digital data safe 100 through the digital data security client 200 includes the steps of: Accesses the safe 100 and provides the user information including the ID and password of the user provided at the time of subscription to the digital data safe 100 to perform user authentication.

Also, when the user authentication is successful, the user requests encrypted metadata of the digital data of the user stored in the digital data repository 100.

Next, the digital data safe 100 refers to the member management table and the object management table, and transmits the encrypted metadata of the user to the digital data security client 200 of the user.

When the digital data security client 200 receives the encrypted metadata, the digital data security client 200 decrypts the corresponding metadata and refers to the decrypted metadata to generate a file for digital data that the user desires to download And transmits the extracted object ID to the digital data repository 100 to request the encrypted digital data of the corresponding user.

Next, the digital data repository 100 refers to the object management table to retrieve the encrypted digital data of the user matched with the received object ID, and transmits the digital data to the digital data repository client 200.

Next, the digital data security client 200 of the user receives the encrypted digital data and decrypts the encrypted digital data so that the digital data can be used by the user.

FIG. 5 is an exemplary diagram illustrating a concept of a logical structure of metadata according to an embodiment of the present invention. Referring to FIG.

As shown in FIG. 5, the concept of metadata defined in the present invention includes information on digital data stored in the object DB 300 through the digital data safe 100 for each of a plurality of users, The digital data of the user means all the data files that can be stored in various user terminals such as a user's PC, smart phone, tablet PC or notebook computer.

Accordingly, each of the digital data (file) has information about a file itself including a file name, a size, a type, a directory structure, and the like. The client stores digital data The metadata for the digital data is configured so that information on a file (file) can be displayed to the user.

In addition, the master metadata shown in FIG. 5 is metadata in which information of at least one sub-meta data is recorded, and the sub-meta data includes metadata indicating a directory map, a file map, an object map, .

The plurality of sub-meta data may be metadata generated according to the format of the user's digital data (e.g., image, moving image, text, or the like), or metadata generated by dividing the digital data of the user according to timing. That is, the sub-meta data is metadata about a plurality of digital data to be stored in the digital data safe 100.

In addition, a logical directory structure of digital data of a user to be stored in the object DB 300 is recorded in the directory map, information on a file of actually stored digital data is recorded in the file map, And metadata in which the encrypted digital data of the user stored in the DB 300 and which object IDs are matched is recorded.

The event map, the directory map, the file map, and the object map are metadata for performing the metadata management method according to an embodiment of the present invention more efficiently. Will be described in detail.

FIG. 6 is a diagram illustrating a configuration of metadata managed by a client of a user according to an exemplary embodiment of the present invention. Referring to FIG.

As shown in FIG. 6, the client 200 manages digital data of the user or generates master metadata for the digital data so that information on the digital data can be easily recognized.

In addition, the generated master metadata can be transferred to the digital data safe 100 and stored, and the user can download and use the master metadata through the user terminal at any time.

The master metadata is composed of a plurality of sub meta data, and the sub meta data includes a directory map, a file map, an object map, an event map, or a combination thereof.

The master metadata may further include a repository ID (e.g., 1, 2, or other identifying character) indicating at least one repository included in the user's client, a repository name (e.g., C driver, D driver, A pub_key indicating a user's public key used for the encryption, a pri_key indicating a user's private key used for the decryption, and the directory map, the file map, the object map, and the event map.

Each of the constituent parts constituting the master metadata is one meta data, and each of the meta data includes information of data represented by the corresponding meta data.

The directory map is metadata for recording a logical directory structure of the digital data of the user. The directory map includes at least one of a repository ID, a directory ID (e.g., a natural number of 1 or more) of at least one repository provided in the client of the user, It consists of the parent directory ID of the directory ID (for example, a natural number greater than 0) and the directory name (for example, Document).

In addition, the IDs of the top root directory are given as 0, and the directory IDs are sequentially given from top to bottom and from left to right. That is, if the directory is displayed in a tree structure according to the directory map shown in FIG. 6, it can be expressed by the tree structure shown in FIG.

In addition, the file map is metadata that records information about a file actually stored in the repository. The file map includes a repository ID for a plurality of repositories provided to the client of the user, an ID of a specific file, an upper directory ID , The size of the file, and the file name indicating the name of the file.

The object map is metadata for recording an object ID of the digital data of the user stored in the digital data repository 100. The object ID is received from the digital data repository 100 and recorded.

Whenever the digital data security client 100 uploads and stores the digital data of the user in the digital data safe 100, the digital data security client 100 issues an object ID for the digital data to the digital data safe 100, Matches the issued object ID and records it in the master metadata. However, every time the digital data of the user is uploaded to the digital data repository 100, the entire master metadata is re-recorded, encrypted, and then transmitted to the digital data repository 100 for storage. Is consumed.

Accordingly, in the present invention, the problem can be solved by utilizing the event map to efficiently operate the master metadata.

That is, the event map is generated when the contents of the various metadata are changed or additional recording is required as described above. The generated event map is encrypted in the client 200 of the user and transmitted to the digital data repository 100, and the remaining metadata is not transmitted.

Thereafter, when the user accesses the digital data safe 100, all the metadata are requested and downloaded, and the event map is analyzed to update the remaining metadata, and the updated metadata To the digital data safe 100 and stores the data.

Accordingly, instead of re-recording the large-capacity master metadata every time the digital data of the user is uploaded to the digital data repository 100, only the changed metadata is updated through the event map, For example, memory, storage space) and processing time can be significantly reduced.

2 to 4, the client 200 may generate the event map by matching the file name with the object ID issued to the corresponding file name. For example, One metadata can also be an event map.

The configuration of the event map will be described in detail with reference to FIG.

7 is a diagram illustrating an exemplary structure of an event map according to an embodiment of the present invention.

As shown in FIG. 7A, the event map includes an event ID indicating a corresponding event when various contents including metadata are added, changed, deleted, or included in the metadata generated by the client 200, A VAULT_ID indicating an ID of the digital data repository 100 in which the event occurred, a target ID indicating a directory or file ID in which the event occurred, and a comment recording contents necessary for event processing .

In addition, the event ID may be assigned in the order in which the event occurs, and may be differently assigned according to the event code.

The event code indicates various kinds of events including a file addition, an object ID addition, a file deletion, a file movement, a directory creation, a directory deletion, a file movement, or a combination thereof as shown in FIG.

In addition, the VAULT_ID indicates an ID of the digital data vault 100 in which the event occurred. The event generated in the digital data vault 100 includes an issuance of an object ID for specific digital data, And storing or deleting the digital data.

Also, the digital ID security client 200 performs an event generated according to the event code to indicate a directory or a file indicated by the target ID, The master metadata (or sub-meta data) can be updated.

FIG. 8 is a block diagram illustrating a configuration of a digital data vault client of a user according to an exemplary embodiment of the present invention.

8, the digital data security client 200 of the user includes a user interface unit 210 for providing a user interface, a digital data management unit 220 for managing digital data of a user, A decryption unit 240 for decrypting the encrypted digital data and the encrypted metadata, a second metadata management unit 250 for managing the metadata, and a digital data security unit 100. The encryption unit 230 encrypts the encrypted digital data and the encrypted metadata, And a communication interface 260 for connecting the communication with the communication interface 260.

Meanwhile, the digital data security client 200 can access the digital data security box 100 through a wire / wireless network to use the digital data security box 100.

Also, the digital data security client 200 may be installed in the terminal of the user in the form of an application or an application program provided in the digital data security box 100.

In addition, the user interface unit 210 displays various functions for the user to use the digital data safe 100 on the user's terminal and allows the user to easily operate the digital data secure client 200 Provides GUI (Graphic User Interface).

The digital data management unit 220 may read at least one or more digital data of a user to be stored in the digital data repository 100 from a repository provided in the digital data repository client 200, Stores the received digital data of the user in the storage or makes the digital data available to the user.

In addition, the encryption unit 230 may encrypt at least one or more pieces of digital data read from the digital data management unit and metadata of the digital data, and transmit the encrypted metadata to the digital data safe 200.

Also, the decryption unit 240 decrypts the encrypted metadata of the user received from the digital data safe 100 and the encrypted digital data of the user.

Also, the encryption / decryption method performed by the encryption unit 230 or the decryption unit 240 may be performed using a symmetric or asymmetric method. In the present invention, the encryption / decryption method is not limited thereto.

On the other hand, when the encrypted metadata of the user is received from the digital data repository 100, the decryption unit 240 decrypts the corresponding metadata, and the digital data management unit 220 refers to the decrypted metadata Extracts an object ID of the encrypted digital data stored in the digital data repository 100 and provides the object ID to the digital data repository 100 through the wired / wireless communication interface 260, request.

Also, when the requested encrypted digital data is received, the decryption unit 240 decrypts the encrypted digital data so that the user can use the corresponding digital data.

The second metadata management unit 250 includes a second metadata generation unit 251 for generating metadata for the digital data and a second metadata update unit 252 for updating the generated metadata .

The second metadata management unit 250 generates, adds, modifies, deletes, or combines metadata of at least one or more digital data read by the digital data management unit, stores the generated metadata in a storage .

When the second metadata update unit 252 receives the object ID of the encrypted digital data transmitted from the digital data repository 100, the second metadata update unit 252 matches the transmitted digital data with the received object ID And records it in the metadata to update it. Meanwhile, the updated metadata is encrypted through the encryption unit 230 and then transmitted to the digital data security system 100 to update and store the encrypted metadata of the user.

9 is a block diagram illustrating a configuration of a digital data safe according to an embodiment of the present invention.

9, the digital data security system 100 includes a user authentication processing unit 110 for processing authentication of a user, encrypted digital data and metadata of a user received from the digital data security client 200 of the user, An object ID issuing unit 120 for issuing an object ID for the user, a first metadata managing unit 130 for managing metadata about the object, a second metadata managing unit 130 for managing the digital data of the user from the digital data security client 200, A digital data providing unit 140 and a storage interface unit 150 for providing the digital data to the user's digital data vault client 200 when requested.

The user authentication processing unit 110 processes authentication of the user with respect to the digital data security box 100 and receives user information including the user ID and password of the user from the digital data security client 200 of the user And processes the authentication request of the user by comparing the user information provided by the user at the time of subscribing to use the digital data security box 100. [

The object ID issuing unit 120 also issues an object ID for the encrypted digital data of the user or the encrypted metadata. Also, the object ID is an identifier for identifying the digital data and the metadata, not simply the name of the digital data or the metadata, and the object ID issued to the encrypted digital data is transmitted to the digital data secure client 200 So that it can be recorded in the metadata of the digital data security client 200.

Meanwhile, a different object ID is issued according to the user, and the metadata about the digital data of the user can be identified for each user through the issued object ID.

The first metadata management unit 130 includes a first metadata generation unit 131 for generating a management table for the encrypted digital data and objects of the encrypted metadata, and a second metadata generation unit 131 for updating the encrypted metadata And a metadata update unit 132. [

The first metadata generation unit 131 generates an object management table by matching the object ID issued to the encrypted digital data of the user with the encrypted digital data. Also, the first metadata generation unit 131 generates an object management table by matching the object ID issued to the metadata with a user of the corresponding metadata, and stores the created member management table in the metadata DB 400.

Also, the first metadata management unit 130 matches the object ID issued to the metadata with the corresponding metadata, and records the object ID in the object management table.

In addition, when the first metadata update unit 132 receives the updated and encrypted metadata from the digital data repository 100, the first metadata update unit 132 may replace the previously stored encrypted metadata of the user with the received metadata And updates it.

When there is a request for metadata of the user from the digital data security client 200, the digital data providing unit 140 refers to the member management table and the object management table, DB 300 and transmits the retrieved DB 300 to the digital data vault client 200.

When receiving the object ID of the specific digital data from the digital data security client 200, the digital data providing unit 140 refers to the object management table and transmits the encrypted digital data And transmits it to the digital data security client 200.

The digital data safe 100 has been described in detail with reference to FIG. Although the term digital data or metadata is used in the above description, the digital data or metadata stored in the digital data vault 100 is encrypted by the digital data security client 200, And the encrypted digital data or the encrypted metadata is defined and stored as one object in the digital data safe 100. [

10 is a flowchart illustrating a procedure for uploading and downloading digital data of a user according to an embodiment of the present invention.

As shown in FIG. 10, the procedure for the user to upload or download the user's digital data through the digital data security client 200 of the user includes: first, the digital data security client 200 transmits, Selects and encrypts one or more pieces of digital data, generates metadata for the selected piece of digital data, and transmits the encrypted digital data to the digital data safe 100 (S110).

Meanwhile, the metadata generated by the digital data security client 200 includes the name of the transmitted digital data and the object ID.

Next, the digital data repository 100 issues an object ID to the received encrypted digital data and transmits the object ID to the digital data secure client 200 (S120).

Also, the digital data repository 100 stores the encrypted digital data in the object DB 300, creates an object management table matching the issued object ID or adds the object management table to an existing object management table, And stores it in the metadata DB 400. [

At this time, the digital data repository 100 generates metadata that matches an object name of the encrypted digital data of the stored user with a storage location where the encrypted digital data is stored, and stores the generated metadata in the metadata DB 400.

Next, the digital data security client 200 updates the metadata by matching the name of the transmitted digital data with the received object ID in the generated metadata, encrypts the updated metadata, To the data vault 100 (S130).

Meanwhile, the updated metadata may be stored in a storage provided in the digital data security client 200. The reason for encrypting the metadata and transmitting the metadata to the digital data repository 100 is to restrict the storage capacity And the user always uses the digital data safe through various terminals without restriction of time and space.

When the digital data safe 100 receives the metadata of the updated and encrypted user, the digital data safe 100 replaces the encrypted metadata of the user with the encrypted metadata of the received user, And updates the metadata of the corresponding user (140).

Next, the digital data security client 200 accesses the digital data security box 100 to download specific digital data of the user stored in the digital data security box 100, performs an authentication process of the user, And receives the metadata of the digital data of the terminal (S150).

Meanwhile, when there is a request for the metadata of the user, the digital data repository 100 searches and provides the metadata of the user with reference to the member management table and the object management table stored in the metadata DB 400 .

Next, the digital data security client 200 extracts the object ID of the specific digital data of the user who desires to decrypt and download the received metadata of the user, and transmits the extracted object ID to the digital data safe 100 (S160).

Next, the digital data safe 100 searches the encrypted digital data of the user corresponding to the object ID by referring to the received object ID and the object management table, and transmits the encrypted digital data to the digital data secure client 200 S170).

Next, the digital data security client 200 decrypts the received digital data so that the user can use the digital data (S180).

As described above, in the cloud-based digital data security system of the present invention, the metadata management method allows the user to always use the digital data safe without restriction on the terminal, time and space, And the encryption key used for encrypting the digital data are managed by the user's safe client 200, it is possible to prevent leakage of the digital data of the user due to an unauthorized route and to enhance security have.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. .

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, but, on the contrary, It will be understood by those skilled in the art that various changes and modifications may be made without departing from the spirit and scope of the present invention.

100: digital data safe 110: user authentication processor
120: Object ID issuing unit 130: First metadata management unit
131: first metadata generating unit 132: first metadata updating unit
140: Digital data providing unit 150: Storage interface unit
200: digital data vault client 210: user interface section
220: digital data management unit 230:
240: decryption unit 250: second metadata management unit
251: second metadata generating unit 252: second metadata updating unit
260: wired / wireless communication interface unit 300: object DB
400: Metadata DB

Claims (10)

Uploading at least one digital data of the user to the digital data safe; And
Updating the metadata of the uploaded digital data to the digital data safe and storing the updated metadata,
Wherein the digital data and the metadata are encrypted,
Wherein the uploading comprises:
Issuing an object ID for the encrypted digital data, storing the encrypted digital data, and generating an object management table including the object name of the encrypted digital data and the object ID A method for managing metadata in a cloud - based digital data vault system. delete The method according to claim 1,
Wherein the updating and storing comprises:
Transmitting the issued object ID to a digital data secure client;
Generating and encrypting the metadata including the object ID in the digital data secure client, and transmitting the encrypted metadata to the digital data safe;
Storing the transmitted encrypted metadata; And
And issuing an object ID to the encrypted metadata according to a user. ≪ Desc / Clms Page number 19 > The method according to claim 1,
Wherein the encryption key used for the encryption is directly managed by the client of the digital data safeguard. The method according to claim 1,
In the cloud-based digital data security system,
And downloading the encrypted digital data and the encrypted metadata. ≪ Desc / Clms Page number 13 > The method of claim 5,
Wherein the downloading comprises:
Transmitting encrypted metadata from the digital data repository to a digital data secure client;
Extracting an object ID from the transmitted encrypted metadata and requesting encrypted digital data corresponding to the object ID to the digital data safe; And
And retrieving the encrypted digital data from the object ID and transmitting the encrypted digital data to the digital data secure client. A digital data vault client for uploading or downloading user ' s digital data and metadata; And
And a digital data safe for storing the digital data and the metadata,
Wherein the digital data and the metadata are encrypted,
The digital data safe includes:
Issuing an object ID for the encrypted digital data, storing the encrypted digital data, and generating an object management table including the object name of the encrypted digital data and the object ID A cloud-based digital data vault system featuring. delete The method of claim 7,
Wherein the digital data secure client comprises:
An encryption unit for encrypting the digital data and the metadata; And
And a decryption unit for decrypting the encrypted digital data and the metadata. The method of claim 7,
Wherein the encryption key used for the encryption is directly managed by the client of the digital data safeguard.

Images