KR102819844B1 - System and method for data sharing with enhanced security through docker and nfs - Google Patents

Abstract

A data sharing system and method for providing an application for data owners and data users based on Docker to safely perform data sharing between a data owner and a data user who owns an artificial intelligence model using the data of the data owner, comprises: a data owner device including an owner Docker module which provides shared data to be shared with an external device, performs authentication and confirms access rights according to a sharing request for the shared data, encrypts the shared data, and transmits shared information for access to the shared data; and a data user device including a user Docker module which requests data sharing with the owner Docker module, accesses the data according to the received shared information, transmits it as input data of an AI model, and executes the AI model.

Description

{SYSTEM AND METHOD FOR DATA SHARING WITH ENHANCED SECURITY THROUGH DOCKER AND NFS}

The present invention provides a Docker-based application for data owners and data users to safely perform data sharing between a data owner and a data user who owns an artificial intelligence model that uses the data of the data owner, wherein the owner shares encrypted data to an authenticated user through NFS communication, and the data user accesses the encrypted data through an NFS URL, decrypts it, and then passes it as an input to an AI model to execute the AI model and output the result, and authentication, data sharing, data application and execution of the AI model are characterized by operating within Docker.

The development of the Internet and digital technology has made it easier to create and share data, accelerating the decentralization of data in which various individuals, companies, and organizations own and manage data. In particular, as artificial intelligence technology rapidly develops, artificial intelligence models require large amounts of data for learning, and in order to provide improved performance and real-time responsiveness, they must perform inference in parallel in multiple locations using distributed data and distributed models, which requires sharing and access to distributed data.

However, in order to share and access data across various devices and systems, it is important to maintain the confidentiality of the data, and there is the difficulty of operating a security environment and policy for this.

Therefore, data owners need to have ownership of their data and secure access control, and data users need data sharing technology that allows them to easily use data while reducing the burden of data management and security.

The present invention provides a Docker-based data owner and data user module to solve the above problems, wherein the owner shares encrypted data with an authenticated user through NFS communication, the data user receives the encrypted data through an NFS link and decrypts it so that an artificial intelligence model can use it, and the data sharing operation and the data application of the AI model are performed within Docker, thereby maintaining data confidentiality.

A data sharing system with enhanced security through Docker and NFS according to one embodiment of the present invention comprises: a data owner device including an owner Docker module that has shared data to be shared with an external device, performs authentication and verifies access rights in response to a sharing request for the shared data, encrypts the shared data, and then transmits shared information for access to the shared data; and a data user device including a user Docker module that requests data sharing with the owner Docker module, accesses the data in response to the received shared information, transmits it as input data of an AI model, and executes the AI model.

In addition, the owner Docker module is a Docker-based application that operates in an independent and isolated environment within the operating system of the data owner device, and the owner Docker module is a Docker-based application that operates in an independent and isolated environment within the operating system of the data user device.

In addition, the owner docker module may include an owner authentication unit that authenticates a user through a user identifier and a user OTP (One-Time Password) included in an authentication request received from the user docker module, generates an OTP for verification by looking up an OTP seed of the user identifier registered in advance, verifies it by comparing it with the received user OTP, and confirms the data access authority of the user identifier.

In addition, the owner Docker module further includes a data sharing unit that performs NFS settings to allow access to a specific directory or file of a file system according to data access rights for a user identifier received from the user Docker module, requests encryption of shared data to be provided, and transmits NFS URL and data information of encrypted shared data; and the shared data is characterized in that it exists in a file system on an operating system of the data owner device, but exists in an area outside the Docker container in which the owner Docker module operates.

In addition, the owner docker module may further include an owner password section that generates an encryption key by applying a user OTP (One-Time Password) received from the user docker module as a SALT value, and encrypts shared data requested by the user docker module by applying the encryption key.

In addition, the user docker module may include a user authentication unit that searches for authentication information including a pre-registered user identifier and an OTP (One-Time Password) Seed to generate a user OTP, transmits authentication information including the user identifier and the user OTP to the owner docker module to request authentication for data use, and receives information on the requested shared data and an NFS URL for access.

In addition, the user docker module further includes a data usage unit that reads encrypted shared data through an NFS URL of the received shared data, requests decryption, applies the decrypted data as input to a specific AI model, executes the AI model, and then stores the result of the AI model; and the AI model is characterized in that it exists in a file system on the operating system of the data user device, but exists in an area outside the docker container in which the user docker module operates.

In addition, the user docker module may further include a user password section that applies a user OTP (One-Time Password) transmitted when requesting authentication to the owner docker module as a SALT value to generate a decryption key, and decrypts encrypted shared data by applying the decryption key.

Meanwhile, a method for sharing data with enhanced security through Docker and NFS according to one embodiment of the present invention may include a step of generating a user OTP (One-Time Password) by querying user authentication information registered in advance in a user Docker module of a data user device and transmitting a user identifier and the user OTP to an owner Docker module of a data owner device to request authentication; a step of performing user authentication and a data sharing task in the owner Docker module of the data owner device; and a step of accessing shared data through shared information received from the user Docker module of the data user device and applying the same to the AI model.

In addition, the step of performing user authentication and performing data sharing operation in the owner docker module of the data owner device may include the step of performing user authentication using the received user identifier and user OTP; the step of performing NFS setting operation to enable access to shared data; the step of encrypting the shared data and storing it in an NFS setting space; and the step of transmitting the shared information including the data information of the shared data and the NFS URL.

In addition, the step of applying to the AI model may include a step of reading encrypted shared data using the NFS URL of the received shared data; a step of decrypting the shared data by generating a decryption key based on the user OTP (One-Time Password) used when requesting authentication; and a step of transmitting the decrypted data as input data of the AI model to execute the AI model and output the result.

Data access, authentication, sharing, and even AI model application are performed in a logically independent space called Docker, which maintains data security and confidentiality.

In addition, data can be shared safely as it is not provided directly to data users, but rather encrypted data is provided via NFS communication, and encryption/decryption keys are managed within Docker and not exposed to the outside.

Figure 1 is an overall relationship diagram of a data sharing system with enhanced security through Docker and NFS according to one embodiment of the present invention.
FIG. 2 is a block diagram of the function of a data owner device in a data sharing system with enhanced security through Docker and NFS according to one embodiment of the present invention.
FIG. 3 is a block diagram of the functions of a data user device in a data sharing system with enhanced security through Docker and NFS according to one embodiment of the present invention.
FIG. 4 is a flowchart illustrating a data sharing process between an owner Docker module and a user Docker module in a data sharing system with enhanced security through Docker and NFS according to one embodiment of the present invention.

Hereinafter, specific embodiments of the present invention will be described in detail with reference to the drawings. However, the spirit of the present invention is not limited to the presented embodiments, and those skilled in the art who understand the spirit of the present invention will be able to easily propose other regressive inventions or other embodiments included within the scope of the spirit of the present invention by adding, changing, deleting, etc. other components within the scope of the same spirit, but this will also be considered to be included within the scope of the spirit of the present invention.

In addition, the terms described below are terms established in consideration of their functions in the present invention, and as such, they may vary depending on the inventor's intention or custom, and therefore, their definitions should be made based on the contents throughout this specification, and if it is determined that a specific description of a known configuration or function related to the present invention in this specification may obscure the gist of the present invention, a detailed description thereof will be omitted.

Hereinafter, a data sharing system with enhanced security through Docker and NFS according to the present invention will be described with reference to the drawings.

Figure 1 is an overall relationship diagram of a data sharing system (hereinafter referred to as data sharing system (10)) with enhanced security through Docker and NFS according to one embodiment of the present invention.

Referring to FIG. 1, the data sharing system (10) includes a data owner device (100) and a data user device (200), and the devices (100, 200) are configured as physically separated servers and connected to a network.

The network referred to in the present invention may be a core network integrated with a wired public network, a wireless mobile communication network, or a portable Internet, or may mean a worldwide open computer network structure that provides various services existing in the TCP/IP protocol and its upper layer, such as HTTP (Hyper Text Transfer Protocol), HTTPS (Hyper Text Transfer Protocol Secure), Telnet, FTP (File Transfer Protocol), etc., and is not limited to these examples, but comprehensively means a data communication network capable of transmitting and receiving data in various forms.

The data sharing system (10) provides an application for data owners and data users based on Docker to safely perform data sharing between a data owner and a data user who owns an artificial intelligence model that uses the data of the data owner. The owner shares encrypted data with an authenticated user through NFS communication, and the data user receives the encrypted data through an NFS URL and decrypts it so that the artificial intelligence model can use it. The data sharing operation and the data application of the AI model are characterized by operating within Docker.

The data owner device (100) provides data and allows the data to be used by sharing it upon request, but performs management, access control, and authentication for the data so that it can be provided only to authorized users, and uses a method of sharing via NFS (Network File System) instead of directly providing the data.

The data user device (200) is equipped with at least one AI model, and learns or performs inference by applying data provided by the data owner device (100) to the AI model, but performs an authentication registration process in advance to access the data of the data owner device (100).

In addition, the data owner device (100) and the data user device (200) are characterized by performing user authentication, data encryption/decryption, data sharing tasks, and AI model execution using the data through the owner Docker module (110) and the user Docker module (210) within a Docker-based container to ensure data security and confidentiality.

Here, Docker refers to a container-based virtualization platform that creates containers, which are independent units that enable application-specific virtualization. Each container includes the libraries and configuration files required to run the application, allowing the application to run in an environment that is independent and isolated from the host system.

Additionally, it shares the host operating system and kernel, and creates and uses a separate file system (storage) within the container, so when the container is terminated, all data stored in the storage within the container is deleted.

Meanwhile, the owner Docker module (110) and the user Docker module (210) may mean an application running within a Docker container or a container itself including an application.

FIG. 2 is a block diagram of the function of a data owner device in a data sharing system with enhanced security through Docker and NFS according to one embodiment of the present invention.

The function of the data owner device (100) is described with reference to Fig. 2.

The data owner device (100) includes an owner docker module (110) and shared data (120) that have shared data to be shared with an external device, performs authentication and checks access rights in response to a request to share the shared data, encrypts the shared data, and then transmits shared information for access to the shared data.

The owner Docker module (110) is a Docker-based application that operates in an independent and isolated environment within the operating system of the data owner device, and the shared data (120) is data that exists on the file system of the data owner device (100), exists in an external area of the container in which the owner Docker module (110) operates, and is data to be shared externally.

The owner docker module (110) includes an owner authentication unit (111), a data sharing unit (112), an owner password unit (113), an owner communication unit (114), and an owner storage unit (115).

The owner authentication unit (111) authenticates the user through the user identifier and user OTP (One-Time Password) included in the authentication request received from the user docker module (210) of the data user device (200), and generates an OTP for verification by looking up the OTP seed of the user identifier registered in advance, and verifies it by comparing it with the received user OTP, and confirms the data access authority of the user identifier.

At this time, the authentication information required for authentication can be stored in the Docker storage through the authentication information registration process after installing or running the application.

The owner Docker module (110) can provide an interface to register the user identifier (Docker ID), OTP Seed, and access control policy of each user Docker module (210) that will use data.

The authentication information registered through the above interface is stored and managed in a storage within Docker, i.e., the owner storage (115), and each user Docker module (210) also stores and manages its own user identifier (Docker ID) and OTP Seed in its user storage (215).

Since the authentication information is stored in the storage of the Docker container, it is managed without being exposed to the outside, and when the task is completed and the Docker container is terminated, the storage (115, 215) within the Docker is also deleted, so the authentication information can be managed safely.

The owner authentication unit (111) authenticates the user through an OTP (One-Time Password). Here, the user OTP is generated based on the OTP Seed for each user docker module (210) registered during the initial authentication registration process.

The owner authentication unit (111) uses the user identifier received from the user docker module (210) of the data user device (200) to look up the OTP Seed and access right policy, creates an OTP for verification using the OTP Seed, and then verifies it by comparing it with the received user OTP, thereby authenticating the user.

Here, the access rights policy includes CRUD, that is, create, read, update, and delete rights for the data.

If authentication is successful, the data sharing process is performed by the data sharing unit (113).

The data sharing unit (112) performs NFS settings to allow access to a specific directory or file of the file system based on the data access rights for the user identifier received from the user docker module (210) of the data user device (200), requests encryption of the shared data to be provided, and transmits the NFS URL and data information of the encrypted shared data in response to the authentication request.

The data sharing unit (112) sets up NFS (Network File System) to enable access to data from the outside.

When access to shared data (120) is enabled through NFS settings, encryption of the shared data is requested using the owner password (113), and an NFS URL is transmitted to the user docker module (210) of the data user device (200) so that the encrypted data file can be accessed over the Internet.

The owner password unit (113) applies the user OTP received from the user docker module (210) as a SALT value to generate an encryption key, applies the encryption key to encrypt the shared data (120) requested by the user docker module (210), and then stores the encrypted data in a space where NFS is set.

At this time, encryption uses a symmetric key method, and the key used for encryption/decryption is generated by applying the user OPT as the SALT value.

The owner communication unit (114) performs communication between Docker containers. The owner communication unit (114) can operate as a server, and for example, can operate based on HTTPS-based RestAPI. However, it is not limited to this, and can operate based on various forms of communication such as TCP and GCP.

FIG. 3 is a block diagram of the functions of a data user device in a data sharing system with enhanced security through Docker and NFS according to one embodiment of the present invention.

The functions of the data user device (200) are described with reference to FIG. 3.

The data user device (200) requests data sharing with the owner docker module (110) of the data owner device (100), accesses the data according to the received sharing information, transfers it to the AI model, and includes a user docker module (210) and at least one AI model file (220) that executes the AI model.

The user docker module (210) is a Docker-based application that operates in an independent and isolated environment within the operating system of the data user device (200).

The AI model file (220) includes an execution script for starting the AI model and an AI model program, and is stored in an external area of the container in which the user docker module (210) operates.

The user docker module (210) includes a user authentication unit (211), a data usage unit (112), a user password unit (213), a user communication unit (214), and a user storage unit (215).

The user authentication unit (211) generates a user OTP using authentication information including a user identifier and OTP (One-Time Password) Seed that have been registered in advance and stored in the user storage (215).

For example, a user OTP can be generated by combining an OPT Seed and a TimeStamp and applying a hash to the value.

Thereafter, authentication information including a user identifier and a generated user OTP is transmitted to the owner docker module (110) to request authentication for data use, and if authentication is successful, information on the requested shared data and an NFS URL for access are received in response.

The data usage unit (212) reads the encrypted shared data through the NFS URL of the received shared data, requests decryption through the user encryption unit (213), applies the decrypted data as input to a specific AI model, executes the AI model, and then saves the result of the AI model.

More specifically, the data usage unit (212) accesses the encrypted shared data using the received NFS URL, reads the data, and performs decryption through the user encryption unit (213).

The decrypted data is used as data for learning or inference of an AI model, and for this purpose, the data usage unit (212) reads a specific AI model file (220) to be executed during the initialization process of the application and stores it in the user storage (215) within the docker.

At this time, the execution result of the AI model can be stored in a file system outside the user docker module (210).

The user password section (213) applies the user OTP (One-Time Password) transmitted when requesting authentication to the owner docker module (110) as a SALT value to generate a decryption key, and decrypts the encrypted shared data by applying the decryption key.

The user communication unit (214) performs communication between Docker containers. The user communication unit (214) can operate as a client, and for example, can operate based on HTTPS-based RestAPI. However, it is not limited thereto, and can operate based on various forms of communication such as TCP and GCP.

The data owner device (100) and the data user device (200) of the data sharing system (10) may be devices composed of physically separated hardware that are connected over a network.

The data owner device (100) and the data user device (200) are composed of hardware including a central processing unit (1000), memory (2000), user interface (3000), database interface (4000), network interface (5000), web server (6000), etc.

The user interface (3000) provides an input and output interface to the user by using a graphical user interface (GUI).

The database interface (4000) provides an interface between the database and the hardware architecture.

The network interface (5000) provides network connectivity between devices owned by users.

The web server (6000) provides a means for users to access the hardware structure via a network. Most users can access the web server remotely and use the data owner device (100) and the data user device (200).

Each step of the above-described configuration or method may be implemented as a computer-readable code on a computer-readable recording medium or transmitted via a transmission medium. The computer-readable recording medium is a data storage device capable of storing data that can be read by a computer system.

Examples of computer-readable recording media include, but are not limited to, databases, ROMs, RAMs, CD-ROMs, DVDs, magnetic tapes, floppy disks, and optical data storage devices. The transmission media may be transmitted via the Internet or various types of communication channels. Additionally, the computer-readable recording media may be distributed through a network-coupled computer system so that the computer-readable code is stored and executed in a distributed manner.

In addition, at least one or more components applied to the present invention may include or be implemented by a processor such as a central processing unit (CPU), a microprocessor, etc., which performs each function, and two or more of the components may be combined into a single component that may perform all operations or functions of the two or more combined components. In addition, a part of at least one or more components applied to the present invention may be performed by another component among these components. In addition, communication between the components may be performed via a bus.

FIG. 4 is a flowchart illustrating a data sharing process between an owner Docker module and a user Docker module in a data sharing system with enhanced security through Docker and NFS according to one embodiment of the present invention.

Referring to Figure 4, a method of data sharing with enhanced security through Docker and NFS is described.

The data sharing method is performed in a data sharing system (10).

First, when the owner Docker module (110) and the user Docker module (210) are executed, an initialization step can be performed.

The owner Docker module (110) operates the server communication module to communicate with the user Docker module (210) during the initialization phase so that it can receive requests.

The user docker module (210) loads an AI model for utilizing shared data into a storage (215) within the docker during the initialization phase.

After the initialization step is completed, the user docker module (210) of the data user device (200) searches for pre-registered user authentication information to generate a user OTP, and performs a step (S100) of requesting authentication by transmitting a user identifier and the user OTP.

The user identifier and OTP (One-Time Password) Seed that have been registered in advance and stored in the user storage (215) are searched, a user OTP is generated based on the OTP Seed, and then authentication is requested to the owner docker module (110) of the data owner device (100).

When an authentication request is received from the owner docker module (110) of the data owner device (100), a step (S200) of performing user authentication and performing data sharing operation is performed according to the authentication information included in the request.

Step S200 performs the substeps S210 to S240.

In step S200, user authentication is performed using the user identifier and user OTP received from the user docking module (210) of the data user device (200) (S210).

In step S210, an OTP Seed is searched using a user identifier, an OTP for verification is generated using the OTP Seed, and the user is authenticated by comparing it with the user OTP.

When a user is authenticated, NFS setup for shared data is performed to enable access to shared data via the Internet (S220).

When the NFS setup task is completed, the shared data is encrypted and stored in the NFS setup space (S230), and the data information of the shared data and the shared information including NFS are transmitted in response to the authentication request (S240).

Next, a step (S300) is performed to access the shared data through the shared information of the shared data received from the user docker module (210) of the data user device (200) and apply it to the AI model.

At step S300, step S300 performs the sub-steps S310 to S330.

First, the encrypted shared data is accessed and read using the NFS URL of the received shared data (S310), and the data is decrypted using a decryption key generated by applying the user OTP as a SALT value (S320).

Afterwards, the decrypted data is passed as input data to the AI model, the AI model is executed, and the result is output (S330).

At this time, the output result can be stored in the file system of the data user device (200).

Meanwhile, once step S300 is completed, the process of terminating data sharing can be further performed.

When sharing of data and use in an AI model is completed, the data in the user docker module (210) of the data user device (200) is deleted, a notification of application termination is transmitted to the owner docker module (110) of the data owner device (100), and then the user docker module (210) is terminated.

When the owner Docker module (110) receives a notification of termination, it performs initialization of shared data, deletes the password data, and then terminates NFS.

Through the data sharing process as above, data is not provided directly to data users, but rather encrypted data is provided through NFS communication, and the encryption/decryption keys are managed within Docker and are not exposed to the outside, so data can be shared safely.

Although the configuration and features of the present invention have been described above based on embodiments according to the present invention, the present invention is not limited thereto, and it will be apparent to those skilled in the art that various changes or modifications can be made within the spirit and scope of the present invention, and therefore, it is made clear that such changes or modifications fall within the scope of the appended patent claims.

10: Data sharing system
100: Data owner device
110: Owner Docker Module
111: Owner authentication section 112: Data sharing section
113: Owner Password 114: Owner Communications
115: Owner's Repository
120: Shared data
200: Data User Device
210: User Docker Module
211: User authentication section 212: Data usage section
213: User Password Section 214: User Communication Section
215: User storage
220: AI model file

Claims (11)

A data owner device including an owner docker module that prepares shared data to be shared with an external device, performs authentication and verifies access rights according to a sharing request for the shared data, encrypts the shared data, and then transmits shared information for access to the shared data; and
A data user device including a user docker module that requests data sharing with the owner docker module, accesses the data according to the received shared information, decrypts the encrypted data, and then transmits it as input data of the AI model to execute the AI model;
The above owner Docker module is a Docker-based application that operates in an independent and isolated environment within the operating system of the data owner device.
The above owner Docker module is a Docker-based application that operates in an independent and isolated environment within the operating system of the data user device.
The above owner docker module is,
A data sharing unit that performs NFS settings to allow access to a specific directory or file of a file system according to data access rights for a user identifier received from the user Docker module, requests encryption of shared data to be provided, and transmits NFS URL and data information of encrypted shared data;
The above shared data exists in the file system of the operating system of the data owner device, but exists in an area outside of Docker where the owner Docker module operates, and is shared from the owner Docker module to the user Docker module through the NFS settings.
The above user docker module is,
A data usage unit is included, which reads encrypted shared data through the NFS URL of the received shared data, requests decryption, applies the decrypted data as input to a specific AI model, executes the AI model, and then stores the result of the AI model.
The execution result of the above AI model is characterized in that it is stored in a file system outside of Docker where the user Docker module operates.
Data sharing system.
delete In the first paragraph,
The above owner docker module is,
An owner authentication unit that authenticates a user through a user identifier and a user OTP (One-Time Password) included in an authentication request received from the user docker module, generates an OTP for verification by looking up the OTP Seed of the user identifier registered in advance, verifies it by comparing it with the received user OTP, and verifies the data access authority of the user identifier;
Data sharing system.
delete In the first paragraph,
The above owner docker module is,
It further includes an owner password section that generates an encryption key by applying the user OTP (One-Time Password) received from the user Docker module as a SALT value and encrypts the shared data requested by the user Docker module by applying the encryption key.
Data sharing system.
In the first paragraph,
The above user docker module is,
A user authentication unit including a user identifier registered in advance and authentication information including an OTP (One-Time Password) Seed is generated to create a user OTP, and the authentication information including the user identifier and the user OTP is transmitted to the owner docker module to request authentication for data use, and receives information on the requested shared data and an NFS URL for access;
Data sharing system.
delete In the first paragraph,
The above user docker module is,
A user password section further comprising: a user OTP (One-Time Password) transmitted when requesting authentication with the above owner Docker module is applied as a SALT value to generate a decryption key, and the user password section further comprising: a user OTP (One-Time Password) transmitted when requesting authentication with the above owner Docker module is applied as a SALT value to generate a decryption key, and a ... a user OTP (One-Time Password) transmitted when requesting authentication with the above owner Docker module; a user password section further comprising a user OTP (One-Time Password) transmitted when requesting authentication with the above owner Docker module is applied as a SALT value to generate a decryption key, and a user password section further comprising a user OTP (One-Time Password) transmitted when requesting authentication with the above owner Docker module; a user OTP (One-Time Password) transmitted when requesting authentication with the above
Data sharing system.
In the data sharing method performed by the data sharing system described in Article 1,
A step of generating a user OTP (One-Time Password) by querying pre-registered user authentication information in the user docker module of the data user device, and requesting authentication by transmitting the user identifier and the user OTP to the owner docker module of the data owner device;
A step of performing user authentication and performing data sharing tasks in the owner Docker module of the above data owner device; and
A step of accessing shared data through shared information received from the user docker module of the above data user device and applying it to the AI model;
The step of performing user authentication and performing data sharing tasks in the owner Docker module of the above data owner device is as follows:
A step of performing user authentication using the received user identifier and user OTP;
Steps to perform NFS setup tasks to enable access to shared data;
A step of encrypting the above shared data and storing it in the NFS setting space; and
A step of transmitting shared information including data information of the shared data and NFS URL;
How to share data.
delete In Article 9,
The steps to apply to the above AI model are:
A step of reading encrypted shared data using the NFS URL of the received shared data;
A step of decrypting the shared data by generating a decryption key based on the user OTP (One-Time Password) used when requesting authentication; and
A step of transmitting the decrypted data as input data of the AI model, executing the AI model, and outputting the result; including;
How to share data.