TWI856887B - A distribution backup system, method non-volatile computer-readable storage medium thereof based on object storage gateway - Google Patents

Abstract

The present invention provides a distribution backup system, method and non-volatile computer-readable storage medium thereof based on object storage gateway, including a user device with distribution encryption module and an object storage gateway, wherein the distribution encryption module transmits a plurality of fragmented files to the object storage gateway, and then the object storage gateway calculates the distribution locations of a plurality of public cloud servers where these fragmented files are intended to be sent. In this way, the object storage gateway to call a plurality of public cloud storage interfaces to separately upload these fragmented files to their respective public cloud servers, thereby enhancing the confidentiality and reliability of file backups.

Description

A distributed backup system, method and non-volatile computer-readable storage medium based on an object storage gateway

The present invention relates to a storage technology, and more particularly to a distributed backup system, method and non-volatile computer-readable storage medium based on an object storage gateway.

In today's society, due to the popularity and performance improvement of smartphones, people have become accustomed to using smartphones to record their lives, work or creations through multimedia data such as photos and videos. However, as time goes by, a large amount of multimedia data is gradually accumulated, making smartphones lack sufficient storage space to provide users.

In response to this, many operators currently provide cloud storage space services, allowing users to upload their large amounts of multimedia data to cloud storage space to solve data storage problems.

However, for users, the cloud storage space services provided by a single operator can no longer meet their needs, and their security is also low.

Therefore, how to provide a technology that integrates multiple public cloud storage services to provide users with more flexible storage methods and improve information security has become an issue that the industry urgently needs to solve.

To solve the above problems, the present invention provides a distributed backup system based on an object storage gateway, which includes: a user device with a distributed encryption module, which allows a user to select at least one original file to be backed up, so that the distributed encryption module encrypts the original file and then splits the encrypted original file to obtain multiple partitions; and an object storage gateway with multiple public cloud storage interfaces, which is communicatively connected to the user device to receive the multiple partitions from the distributed encryption module and calculate the distributed locations of the multiple public cloud servers to which the multiple partitions are to be sent, so as to call the multiple public cloud storage interfaces to upload the multiple partitions to the corresponding multiple public cloud servers respectively.

The present invention further provides a method for distributed backup based on an object storage gateway, comprising: a user device having a distributed encryption module provides a user with at least one original file to be backed up; the distributed encryption module encrypts the original file and then splits the encrypted original file to obtain multiple partitions; an object storage gateway having multiple public cloud storage interfaces receives the multiple partitions from the distributed encryption module; and the object storage gateway calculates the distribution locations of multiple public cloud servers to which the multiple partitions are to be sent, so as to call the multiple public cloud storage interfaces to upload the multiple partitions to the corresponding multiple public cloud servers respectively.

In the aforementioned embodiment, the user device allows the user to edit a shared configuration file to send a request for installation including the shared configuration file, and the shared configuration file includes the public cloud server selected by the user, the backup area, and the number of copies of the original file.

In the aforementioned embodiment, the object storage gateway includes a control center module, a backup module, a partition verification module, and a first database that is communicatively connected to the partition verification module, wherein the first database stores a shared rule data table and a shared file association data table, and the shared file association data table includes the file names and identification codes of the plurality of partitions, the names of the plurality of public cloud servers, and the codes of their public cloud storage containers.

In the aforementioned embodiment, the control center module receives a shared configuration file in a provisioning request, and calls the corresponding multiple public cloud servers through the multiple public cloud storage interfaces according to the shared configuration file, so as to respectively establish public cloud storage containers in the regions of the multiple public cloud servers for storage, and then stores the relationship between the shared configuration file and the multiple public cloud storage containers in the shared rule data table.

In the above-mentioned embodiment, the control center module establishes a hash ring according to the sharing rule data table, and places the plurality of public cloud servers at relative positions of the hash ring after hash calculation to serve as the plurality of nodes on the hash ring. The control center module then calculates the corresponding position values according to the file names and file numbers of the plurality of files, so as to match the position values of the plurality of files to the corresponding plurality of nodes of the hash ring, so as to use the plurality of public cloud servers represented by the matched plurality of nodes as the sharing positions of the plurality of files.

In the aforementioned embodiment, when the user wants to restore the original file, the shared encryption module sends a download request, and after the control center module receives the download request, it obtains the identification code of the multiple sub-files corresponding to the original file according to the file name of the original file in the download request and the shared file association table, so as to obtain the multiple sub-files from the multiple public cloud servers through the multiple public cloud storage interfaces and return them to the user device, and then the shared encryption module combines and decrypts the multiple sub-files to obtain the original file.

In the aforementioned embodiment, the file division verification module queries the shared file association data table to obtain the identification codes of the multiple public cloud storage volumes and each of the files, so as to group the multiple public cloud storage volumes. The file division verification module then calls the multiple public cloud storage interfaces to make the multiple public cloud storage interfaces check whether all the corresponding identification codes of the multiple files exist in the multiple public cloud storage volumes according to the shared file association data table, and then generate a statistical report.

In the aforementioned embodiment, the backup module obtains the shareholding rule data table and the shareholding file associated data table from the first database, and periodically exports the shareholding rule data table and the shareholding file associated data table, so that the shareholding rule data table and the shareholding file associated data table are encrypted and backed up in multiple second databases outside the country.

The present invention provides a non-volatile computer-readable storage medium, which is applied to a computing device or a computer and stores instructions for executing the object storage gateway-based shared backup method as described in the above-mentioned embodiment.

As can be seen from the above, the object storage gateway-based distributed backup system, method and non-volatile computer-readable storage medium of the present invention mainly encrypts and splits at least one original file to be backed up through a distributed encryption module in a user device to obtain multiple partitions, and transmits them to an object storage gateway. The object storage gateway then calculates the distribution locations of each public cloud server to which the multiple partitions are to be sent, thereby calling each public cloud storage interface to upload the multiple partitions to each public cloud server, so as to improve the confidentiality and reliability of file backup.

1: Distributed backup system based on object storage gateway

1a: User device

10: Shared encryption module

1b: Object storage gateway

11: Control center module

111: Gateway Application Programming Interface, Gateway API

112: Storage service control module

113: Storage allocation module

114 ₁ ~114 _n : Public cloud storage interface

12: Backup module

13: Bin verification module

C ₁ ,C ₂ ,C ₃ ~C _n : Public cloud storage servers, public cloud servers

D1: First database

D2: Second database

S31 to S35: Steps

Figure 1 is a schematic diagram of the architecture of the distributed backup system based on the object storage gateway of the present invention.

Figure 2 is a schematic diagram of a hash ring.

Figure 3 is a schematic diagram of the process of the object storage gateway-based shared backup method of the present invention.

The following is a specific and concrete example to illustrate the implementation of the present invention. People familiar with this technology can easily understand other advantages and effects of the present invention from the content disclosed in this manual.

It should be noted that the structures, proportions, sizes, etc. depicted in the drawings attached to this specification are only used to match the contents disclosed in the specification for understanding and reading by people familiar with this technology, and are not used to limit the restrictive conditions for the implementation of the present invention. Therefore, they have no substantial technical significance. Any modification of the structure, change of the proportion relationship or adjustment of the size should still fall within the scope of the technical content disclosed by the present invention without affecting the effects and purposes that can be achieved by the present invention. At the same time, the terms such as "one", "first", "second", "upper" and "lower" used in this specification are only used to facilitate the clarity of the description, and are not used to limit the scope of the implementation of the present invention. The changes or adjustments in their relative relationships shall be regarded as the scope of the implementation of the present invention without substantially changing the technical content.

FIG1 is a schematic diagram of the structure of the object storage gateway-based shared backup system 1 of the present invention. As shown in FIG1, the system is a file shared encryption combined with a public cloud structure based on an object storage gateway, and includes: a user device 1a with a shared encryption module 10, an object storage gateway 1b, and a plurality of public cloud storage servers (public cloud storage service, hereinafter referred to as: public cloud server) _C1 ~ _Cn , wherein the object storage gateway 1b includes a control center module 11, a backup module 12, a file division verification module 13, and a first database D1 and a plurality of second databases D2 that are communicatively connected to the backup module 12.

Furthermore, the control center module 11 includes a gateway application programming interface (Application Programming Interface, hereinafter referred to as: gateway API) 111; a storage service control module 112 communicating with the gateway API 111; a storage allocation module 113 communicating with the gateway API 111, the storage service control module 112 and the first database D1; and a plurality of public cloud storage interfaces 114 ₁ ~114 _n communicating with the file verification module 13 and the storage service control module 112.

Specifically, the user device 1a can be an electronic device such as a smart phone, a personal computer, and a laptop, and the object storage gateway 1b can be established in an electronic device such as a server (such as a general-purpose server, a file server, a storage unit server, etc.) and a computer with an appropriate computing mechanism, wherein each module in the user device 1a and the object storage gateway 1b (i.e., the shared encryption module 10, the gateway API 111, the storage service management module 112, the storage allocation module 113, and the plurality of public cloud storage interfaces 114 ₁ ~114 _n) ) can be software, hardware or firmware; if it is hardware, it can be a processing unit, processor, computer or server with data processing and computing capabilities; if it is software or firmware, it can include instructions that can be executed by a processing unit, processor, computer or server, and can be installed on the same hardware device or distributed on different multiple hardware devices. On the other hand, the multiple public cloud servers C ₁ ~C _n include public cloud storage servers such as Google Cloud Nearline Storage (GCS nearline), AWS IA, Azure blob storage, hicloud S3, etc.

The user device 1a includes the shared encryption module 10, which is a shared encryption tool, such as a shared encryption application, installed in the user device 1a, wherein the user device 1a provides a user with the ability to edit a shared configuration file, and to send an installation request including the shared configuration file; and the user device 1a provides the user with the ability to select at least one (such as one or more) original files to be backed up, so that the shared encryption module 10 uses an encryption key to encrypt the original file, and then splits the encrypted original file to obtain multiple files.

In one embodiment, the shared configuration file includes the public cloud servers C ₁ -C _n selected by the user, the backup area, and the number of copies of the original file.

In one embodiment, the shared encryption module 10 uses an encryption method such as a symmetric encryption algorithm to encrypt the original file. For example, the symmetric encryption algorithm uses AES256 GCM, where AES (Advanced Encryption Standard) is a symmetric encryption algorithm; 256 refers to a 256-bit key; and GCM (Galois/Counter Mode) refers to the symmetric encryption algorithm using a counter mode. Furthermore, the key used in the encryption and decryption process is the same, so the receiver can use the same key to decrypt the ciphertext to obtain the plaintext, and the longer the key, the more difficult it is to crack. In this embodiment, a 256-bit key is selected to improve the security of encryption. The encryption process is as follows:

Step 1: The plaintext is divided into multiple blocks of fixed size (such as 128 bits).

Step 2: Initialize a counter and set its initial value to C.

Step 3: Use key K and counter C to generate encryption key.

Step 4: Perform an exclusive OR (XOR) operation on the plaintext block and the encryption key to obtain the ciphertext block. At the same time, use a polynomial multiplication to operate on the ciphertext block to obtain a label for authentication.

Step 5: Increment counter C and repeat steps 3 and 4 until all plaintext blocks are encrypted.

Step 6: Combine all ciphertext blocks and authentication tags to get the complete ciphertext.

In the above encryption process, each plaintext block and the encryption key are independent of each other, so they can be parallelized to improve the processing speed, and have higher performance than encryption modes that cannot be parallelized (such as CBC). In addition, the integrity and confidentiality of the text can be confirmed by the authentication tag.

The object storage gateway 1b is connected to the user device 1a by communication (e.g., using the Internet or various wireless or mobile networks) to receive the provisioning request from the user device 1a, wherein the gateway API 111 receives the shared configuration file in the provisioning request, and then the storage service control module 112 calls the corresponding plurality of public cloud servers C ₁ ~C _n through the plurality of public cloud storage interfaces 114 ₁ ~114 _n according to the shared configuration file, thereby each of the public cloud servers C ₁ ~C n Public cloud storage buckets are respectively established in the areas of _n for storage, and the corresponding relationship between the shared configuration file and each public cloud storage bucket is stored in a shared rule data table.

In one embodiment, the plurality of public cloud storage interfaces 114 ₁ -114 _n provide a unified operation interface for the storage service control module 112 to call, respectively instructing each of the public cloud servers C ₁ -C _n to perform tasks, such as: storage container creation/deletion, file upload/download/deletion, etc., and the present invention is not limited thereto.

Specifically, the object storage, authentication or access methods provided by each public cloud server C ₁ ~C _n (such as GCS nearline, AWS IA, Azure blob storage, hicloud S3) are not the same. In order to simplify the operation logic of the storage service control module 112, the multiple public cloud storage interfaces 114 ₁ ~114 _n provide a layer of abstract design to encapsulate and implement the access operations of each public cloud server C ₁ ~C _n . Specifically, the plurality of public cloud storage interfaces 114 ₁ ~114 _n are implemented based on a common access interface specification, so the storage service control module 112 only needs to know the common access interface specification to know how to operate the plurality of public cloud storage interfaces 114 ₁ ~114 _n , which is called abstraction. For example, taking the authentication mechanism as an example, AWS uses accesskey/secretkey to sign and calculate the storage service API call, and GCP/Azure uses OAuth 2.0 authentication to obtain a token (token) to make a storage service API call, wherein the storage service API is provided by AWS, GCP or Azure.

The first implementation is for file backup.

In this implementation, when the user device 1a uploads the multiple files, the gateway API 111 receives the multiple files. After the gateway API 111 receives the multiple files, the storage service control module 112 provides the file names and file numbers corresponding to the multiple files to the storage allocation module 113, so that the storage allocation module 113 calculates the storage locations of the public cloud servers _C1 ~ _Cn to which the multiple files are to be sent, and generates identification codes corresponding to each of the files.

Furthermore, the storage allocation module 113 calls each of the public cloud storage interfaces 114 ₁ -114 _n according to the distribution locations of the plurality of files to upload the plurality of files to each of the public cloud servers C ₁ -C _n , and then sets the file name of each file to its corresponding identification code and records it in a distribution file association table, thereby performing storage backup.

In one embodiment, the gateway API 111 may be an S3 API that has a multipart upload function and includes a series of API calls, such as: CreateMultipartUpload→UploadPart(multiple)→CompleteMultipartUpload, and after the completion of CompleteMultipartUpload, the multiple files are treated as a storage object.

In one embodiment, the storage allocation module 113 establishes a hash ring according to the sharing rule data table for use by the plurality of public cloud servers C ₁ ~C _n for selecting a destination during backup. The concept of the hash ring is used to place each of the public cloud servers C ₁ ~C _n at a relative position on the hash ring through hash calculation so that they are regarded as nodes on the hash ring. When calculating the share position of each of the partitions, the storage allocation module 113 obtains the position value of each of the partitions through hash calculation according to the partition file name and the partition serial number of each of the partitions. If the position value of one of the multiple partitions corresponds to a node existing in the hash ring, the public cloud server represented by the node is used as the storage destination (i.e., the share position) of one of the multiple partitions; on the contrary, if the position value of one of the multiple partitions does not correspond to a node existing in the hash ring, the closest node is found in a clockwise direction on the hash ring to use the public cloud server represented by the node as the storage destination (i.e., the share position) of one of the multiple partitions.

In one embodiment, if the number of copies is set to 2 (or more) in the shared configuration file, when uploading the split files, the storage allocation module 113 not only calculates the node (i.e., the public cloud server) where the first copy of each split file is located on the hash ring, but also selects the next node (i.e., another public cloud server) in the clockwise direction (or counterclockwise direction as required) on the hash ring as the storage destination for the second copy of each split file.

Thereby, the plurality of files can be evenly distributed to each of the public cloud servers C ₁ -C _n , and it can be ensured that when the number of the plurality of public cloud servers C ₁ -C _n is greater than the number of replicas, any public cloud server C ₁ -C _n will not contain all of the plurality of files.

In one embodiment, the file sequence number can be an integer between 1 and 10000, and this information must be included when uploading the file (UploadPart); and the shareholding rule data table and the shareholding file association data table are stored in the first database D1.

The second implementation is for file restoration.

In this implementation, when the user wants to restore the original file, the user device 1a allows the user to select the original file to be restored online, and the shared encryption module 10 allows the user to set the decryption key and storage location to issue a download request, wherein the gateway API 111 receives the download request and obtains the identification code of the multiple sub-files corresponding to the original file according to the file name of the original file in the download request and the shared file association table. Thus, the storage service control module 112 obtains the multiple sub-files from each of the public cloud servers C ₁ ~C _n according to the identification code of the multiple sub-files through each of the public cloud storage interfaces 114 ₁ ~114 _n , and then transmits them to the user device 1a. Furthermore, the multiple sub-files are combined by the sub-encryption module 10 to be decrypted using the decryption key to obtain the original file, and the original file is stored in the storage location set by the user.

The third implementation is the implementation of file verification.

In this implementation, the file verification module 13 periodically performs availability verification of the plurality of files, wherein the file verification module 13 queries the shared file association data table to obtain the identification codes of the plurality of public cloud storage volumes and each of the files, so as to group the plurality of public cloud storage volumes, and then the file verification module 13 calls each of the public cloud storage interfaces 114 ₁ ~114 _n to make each of the public cloud storage interfaces 114 ₁ ~114 _n check whether all corresponding identification codes of each of the files exist in each of the public cloud storage volumes according to the shared file association data table, and then generate a statistical report.

The fourth implementation form is the implementation form of the shareholding rules data table and the shareholding file association data table.

In this implementation, the backup module 12 obtains the shareholding rule data table and the shareholding file associated data table from the first database D1, and exports the shareholding rule data table and the shareholding file associated data table regularly, and performs the shareholding encryption process of the above-mentioned embodiment on the shareholding rule data table and the shareholding file associated data table, thereby backing up the shareholding rule data table and the shareholding file associated data table after shareholding encryption in multiple second databases D2 outside the country.

The following first embodiment is a specific embodiment of the shared settings and file backup of the present invention, and is also described with reference to Figure 1. In addition, the similarities between this embodiment and the above embodiment will not be repeated.

In this embodiment, when a user uses a computer (i.e., user device 1a) with a shared encryption module 10 to set three public cloud servers (such as the first public cloud server _C1 , the second public cloud server _C2 , and the third public cloud server _C3 ) and their areas as storage destinations, and sets the number of copies to 2, a shared configuration file is edited to send a supply request containing the shared configuration file to an object storage gateway 1b.

After the object storage gateway 1b receives the provisioning request, a gateway API 111 receives the shared configuration file in the provisioning request, and then a storage service management module 112 calls the corresponding first public cloud server _{C1, second public cloud server C2} , and third public cloud server C3 through the public cloud storage interface ₁₁₄₁ ~ ₁₁₄₃ according to the shared configuration file, and then establishes respective public cloud storage buckets (i.e., Bucket ₁ , Bucket 2, Bucket ₃ ) in the regions (i.e., Region 1, Region 2, Region 3) in each of the public cloud servers _C1 ~ _C3 , thereby forming a shared rule data table (as shown in Table 1 below) based on the shared configuration file and the corresponding relationship between each of the public cloud storage buckets.

Table 1: Shareholding Rules Data Table

After completing the above backup sharing settings, as shown in FIG2 , a storage allocation module 113 creates a hash ring according to the sharing rule data table for subsequent backup. In one embodiment, the hash ring is regarded as a non-negative integer value space, which ranges from 0 to 3 and increases in a clockwise direction. 0 and 3 both represent the same point on the hash ring (i.e., the first public cloud server C ₁ ); 1 represents the second public cloud server C ₁ on the hash ring; and 2 represents the third public cloud server C ₃ on the hash ring.

Furthermore, after the user selects a first file and a second file using the computer, the shared encryption module 10 combines the first file and the second file into a file A to be backed up (as shown in Table 2 below) and encrypts it. The shared encryption module 10 then splits the file A to be backed up into 5 sub-files A_1 to A_5 (as shown in Table 3 below) with 5MB per sub-file, and then sends a loading request to the object storage gateway 1b, and then uploads each of the sub-files A_1 to A_5 to the object storage gateway 1b.

Table 2: List of files A to be backed up

Table 3: List of files to be backed up in file A

After the gateway API 111 in the object storage gateway 1b receives the provisioning request and the sub-files A_1 to A_5, the storage service control module 112 provides the sub-file names and sub-file serial numbers of the sub-files A_1 to A_5 to the storage allocation module 113 to calculate the target public cloud (i.e., the distribution location). In this embodiment, the storage allocation module 113 calculates the hash value of each of the sub-files A_1 to A_5 based on the sub-file names and sub-file serial numbers of the sub-files A_1 to A_5. Thus, it is found in the previously established hash ring that the locations of files A_1 and A_4 correspond to the first public cloud server C ₁ ; the locations of files A_2 and A_5 correspond to the second public cloud server C ₂ ; and the location of files A_3 corresponds to the third public cloud server C ₃ .

Therefore, the storage allocation module 113 calls each of the public cloud storage interfaces 114 ₁ to 114 ₃ according to the location of each of the sub-files A_1 to A_5 to upload each of the sub-files A_1 to A_5 to the first public cloud server C ₁ , the second public cloud server C ₂ and the third public cloud server C _3. In addition, the storage allocation module 113 generates identification codes for each of the sub-files A_1 to A_5, sets the sub-file names of each of the sub-files A_1 to A_5 to the corresponding identification codes, and records them in a shared file association data table (as shown in Table 4 below), thereby performing storage backup.

Table 4: Shareholding file related data table

After the upload is completed, the shared encryption module 10 displays an online file list through the computer, and the online file list includes the file A that has been backed up and is available for the user to download.

The following second embodiment is a specific embodiment of the file restoration of the present invention, and is also described with reference to FIG1. In addition, the similarities between this embodiment and the above embodiment are not repeated here.

When the user wants to restore the file A, the user clicks on the file A in the online file list displayed by the shared encryption module 10 through the computer to send a download request to the object storage gateway 1b, thereby executing the file download, and the shared encryption module 10 provides the user with the decryption key and storage location.

In response to this, the gateway API 111 receives the download request, and obtains the identification codes a~j of the sub-files A_1~A_5 corresponding to the file A according to the file name of the file A in the download request and the sub-file association table (as shown in Table 4 above), thereby downloading the sub-files A_1~A_5 to the first public cloud server C ₁ , the second public cloud server C ₂ and the third public cloud server C 3 according to the identification codes a~j of the sub-files A_1~A_5 and through the public cloud storage interfaces 114 ₁ ~114 _{3. 3} obtains the plurality of files A_1~A_5 and transmits them to the user device 1a, and then the plurality of files A_1~A_5 are combined by the shared encryption module 10 and decrypted using the decryption key to obtain the file A, and the file A is stored in the storage location set by the user.

In addition, when the shared encryption module 10 executes the download, the Http Range Header can be substituted to download a specific segment, so that multiple segment requests can be sent to the object storage gateway 1b in parallel. When the object storage gateway 1b processes the download request, the file name of the file A and the Http Range Header (if it exists) are used to search the shared file association table for the file A and the corresponding file information of its Range, and the public cloud storage interfaces 114 ₁ ~114 ₃ are used to obtain the files A_1~A_5 through the identification code, and then the data is returned to the client.

Since the client tool knows the size (5MB) used for file upload, when making parallel requests, each Range is set as the file size, which can achieve the function of file download and ensure that each download request will only request a file on a public cloud to reduce the number of public cloud accesses. Take the parallel download of file A as an example. There are 5 download requests in total. The Range (bytes) are 0-4999999, 5000000-9999999, 10000000-14999999, 15000000-19999999, 20000000-23999999. After all requests are completed, the data is merged and stored and then decrypted to complete the restoration of file A.

The following third embodiment is a specific embodiment of the file verification of the present invention, and is also described with reference to FIG. 1. In addition, the similarities between this embodiment and the above embodiment are not repeated.

The bin verification module 13 periodically performs availability verification of the multiple bins.

Specifically, the file division verification module 13 queries the shared file association data table (as shown in Table 4 above) to obtain the identification codes of the plurality of public cloud storage volumes and each of the files, so as to group the plurality of public cloud storage volumes. The file division verification module 13 then calls each of the public cloud storage interfaces 114 ₁ ~ 114 _n to check whether all the corresponding identification codes of each of the files exist in each of the public cloud storage volumes.

For example, the file verification module 13 assigns the public cloud storage interface 114 ₁ to request the storage bucket 1 of the first public cloud server C ₁ to check whether the files with identification codes a, d, and h exist; assigns the public cloud storage interface 114 ₂ to request the storage bucket 2 of the second public cloud server C ₂ to check whether the files with identification codes b, e, f, and i exist; and assigns the public cloud storage interface 114 ₃ to request the storage bucket 3 of the third public cloud server C ₃ to check whether the files with identification codes c, g, and j exist. Therefore, after the file verification module 13 integrates the verification results, it generates a report for the administrator to review.

FIG3 is a flowchart of the object storage gateway-based shared backup method of the present invention. Meanwhile, the main contents of this file backup method are as follows, and the rest of the contents are the same as those described in FIG1 above, and will not be repeated here. Therefore, the process of this file backup method includes the following steps S31 to S35:

In step S31, a user device 1a provides a user with the ability to edit a shared configuration file through a shared encryption module 10, thereby sending a request for installation containing the shared configuration file.

In step S32, an object storage gateway 1b receives the provisioning request, and based on the shared configuration file in the provisioning request, calls the corresponding plurality of public cloud servers _C1 ~ _Cn through a plurality of public cloud storage interfaces ₁₁₄₁ ~ _114n , thereby establishing public cloud storage containers in the areas of each of the public cloud servers _C1 ~ _Cn for storage, and then stores the corresponding relationship between the shared configuration file and each of the public cloud storage containers in a shared rule data table.

In step S33, the user device 1a provides the user with the option of selecting at least one original file to be backed up, so that the backup encryption module 10 uses an encryption key to encrypt the original file, and then splits the encrypted original file to obtain multiple sub-files, which are then uploaded.

In step S34, the object storage gateway 1b receives the plurality of sub-files and calculates the locations of the public cloud servers _C1 - _Cn to which the plurality of sub-files are to be sent, so as to generate identification codes corresponding to the sub-files.

In step S35, the object storage gateway 1b calls each of the public cloud storage interfaces ₁₁₄₁ ~ _114n according to the distribution location of the plurality of files to upload the plurality of files to each of the public cloud servers _C1 ~ _Cn respectively, and then sets the file name of each file to its corresponding identification code and records it in a distribution file association data table, thereby performing storage backup.

In addition, the present invention also discloses a non-volatile computer-readable storage medium, which is applied to a computing device or computer having a processor (e.g., CPU, GPU, etc.) and/or memory, and stores instructions, and can be used by the computing device or computer to execute the non-volatile computer-readable storage medium through the processor and/or memory to execute the above-mentioned method and each step when executing the non-volatile computer-readable storage medium. In one embodiment, the present invention discloses a non-transitory computer-readable storage medium to execute the above-mentioned method and each step.

In summary, the object storage gateway-based distributed backup system, method and non-volatile computer-readable storage medium of the present invention encrypts and splits at least one original file to be backed up by a distributed encryption module in a user device to obtain multiple partitions, and transmits them to an object storage gateway. The object storage gateway then calculates the distribution locations of each public cloud server to which the multiple partitions are to be sent, and calls each public cloud storage interface to upload the multiple partitions to each public cloud server. Therefore, the present invention can decompose a single file into multiple small files, and safely and effectively store them in multiple public cloud storage services to improve the confidentiality and reliability of file backup.

In addition, the object storage gateway-based shared backup system, method, and non-volatile computer-readable storage medium of the present invention have the following advantages or technical effects:

1. This invention decomposes a single large backup file into multiple small files through a file splitting tool (shared encryption module), and then stores them in multiple offshore public cloud storage services that meet regulatory requirements, thereby improving the confidentiality and reliability of file backup.

Second, the present invention performs AES 256-bit or higher encryption before sending the shared files to multiple public cloud storage services, thereby further ensuring their confidentiality.

3. The object storage gateway of the present invention is a conversion tool or device that can convert the traditional file storage system into an object storage mode to adapt to the environment of various public cloud storage. The object storage gateway provides a unified interface and can integrate multiple public cloud storage services, which greatly increases the flexibility of storage and provides users with more choices of public cloud storage services.

The above implementation forms are merely illustrative of the principles and effects of the present invention, and are not intended to limit the present invention. Anyone familiar with this art may modify and change the above implementation forms without violating the spirit and scope of the present invention. Therefore, the scope of protection of the present invention should be as listed in the scope of the patent application.

1: Distributed backup system based on object storage gateway

1a: User device

10: Shared encryption module

1b: Object storage gateway

11: Control center module

111: Gateway Application Programming Interface, Gateway API

112: Storage service control module

113: Storage allocation module

114 ₁ ~114 _n : Public cloud storage interface

12: Backup module

13: Bin verification module

C ₁ ,C ₂ ,C ₃ ~C _n : Public cloud storage servers, public cloud servers

D1: First database

D2: Second database

Claims (11)

A distributed backup system based on an object storage gateway includes: a user device with a distributed encryption module, which allows a user to select at least one original file to be backed up, so that the distributed encryption module encrypts the original file and then splits the encrypted original file to obtain multiple sub-files; and an object storage gateway with multiple public cloud storage interfaces, which is connected to the user device to communicate with the user device. The user device receives the plurality of files from the shared encryption module and calculates the shared locations of the plurality of public cloud servers to which the plurality of files are to be sent, so as to call the plurality of public cloud storage interfaces to upload the plurality of files to the corresponding plurality of public cloud servers respectively, wherein the object storage gateway includes a control center module, a backup module, a file verification module and a communication connection to the file verification module The first database stores a share rule data table and a share file association data table, and the share file association data table includes the file names and identification codes of the plurality of files, the names of the plurality of public cloud servers and the codes of their public cloud storage volumes, wherein the control center module establishes a hash ring according to the share rule data table, and hashes the plurality of public cloud servers. After calculation, it is placed at the relative position of the hash ring as the multiple nodes on the hash ring. Then the control center module calculates the corresponding position value according to the file name and file sequence number of the multiple files, so as to match the position value of the multiple files to the multiple nodes corresponding to the hash ring, so that the multiple public cloud servers represented by the matched multiple nodes are used as the share positions of the multiple files. The object storage gateway-based shared backup system as described in claim 1, wherein the user device allows the user to edit a shared configuration file to send a request for installation containing the shared configuration file, and the shared configuration file includes the public cloud server selected by the user, the backup area, and the number of copies of the original file. The shared backup system based on the object storage gateway as described in claim 1, wherein the control center module receives a shared configuration file in a provisioning request, and calls the corresponding plurality of public cloud servers through the plurality of public cloud storage interfaces according to the shared configuration file, so as to respectively establish public cloud storage containers in the regions of the plurality of public cloud servers for storage, and then stores the relationship between the shared configuration file and the plurality of public cloud storage containers in the shared rule data table. As described in claim 1, the shared backup system based on the object storage gateway, wherein when the user wants to restore the original file, the shared encryption module sends a download request, and after the control center module receives the download request, it obtains the identification codes of the multiple sub-files corresponding to the original file according to the file name of the original file in the download request and the shared file association table, so as to obtain the multiple sub-files from the multiple public cloud servers through the multiple public cloud storage interfaces, and returns them to the user device, and then the shared encryption module combines and decrypts the multiple sub-files to obtain the original file. As described in claim 1, the shared backup system based on the object storage gateway, wherein the file verification module queries the shared file association data table to obtain the identification codes of the multiple public cloud storage volumes and each of the files, so as to group the multiple public cloud storage volumes, and then the file verification module calls the multiple public cloud storage interfaces to make the multiple public cloud storage interfaces check whether all the corresponding identification codes of the multiple files exist in the multiple public cloud storage volumes according to the shared file association data table, and then generate a statistical report. A method for distributed backup based on an object storage gateway includes: A user device with a distributed encryption module provides a user with the choice of at least one original file to be backed up; the distributed encryption module encrypts the original file and then cuts the encrypted original file to obtain multiple partitions; an object storage gateway with multiple public cloud storage interfaces receives the multiple partitions from the distributed encryption module; the object storage gateway calculates the distribution locations of multiple public cloud servers to which the multiple partitions are to be sent, so as to call the multiple public cloud storage interfaces to upload the multiple partitions to the corresponding multiple public cloud servers respectively; a first database stores a distributed rule data table and a distributed file-related data The shared file association data table includes the file names and identification codes of the multiple files, the names of the multiple public cloud servers and the codes of their public cloud storage containers; the control center module in the object storage gateway establishes a hash ring according to the shared rule data table, and places the multiple public cloud servers at relative positions in the hash ring after hash calculation. , as multiple nodes on the hash ring; and the control center module calculates the corresponding position value according to the file name and file sequence number of the multiple files, so as to match the position value of the multiple files to the multiple nodes corresponding to the hash ring, so as to use the multiple public cloud servers represented by the matched multiple nodes as the share positions of the multiple files. The object storage gateway-based shared backup method as described in claim 6 further includes providing the user with a shared configuration file edited by the user device to send a request for installation containing the shared configuration file, and the shared configuration file includes the public cloud server selected by the user, the backup area, and the number of copies of the original file. The object storage gateway-based shared backup method as described in claim 6 further includes: receiving a shared configuration file in a request for installation by a control center module in the object storage gateway, and calling the corresponding plurality of public cloud servers through the plurality of public cloud storage interfaces according to the shared configuration file to respectively establish public cloud storage containers in the regions of the plurality of public cloud servers for storage; and storing the relationship between the shared configuration file and the plurality of public cloud storage containers in the shared rule data table by the control center module. The object storage gateway-based shared backup method as described in claim 6 further includes: when the user wants to restore the original file, the shared encryption module in the object storage gateway sends a download request; after the control center module in the object storage gateway receives the download request, it obtains the identification code of the multiple sub-files corresponding to the original file according to the file name of the original file in the download request and the shared file association table, so as to obtain the multiple sub-files from the multiple public cloud servers through the multiple public cloud storage interfaces and return them to the user device; and the shared encryption module combines and decrypts the multiple sub-files to obtain the original file. The object storage gateway-based distributed backup method as described in claim 6 further includes: The partition verification module in the object storage gateway queries the distributed file association data table to obtain the identification codes of the multiple public cloud storage volumes and each of the partitions, so as to group the multiple public cloud storage volumes; and the partition verification module calls the multiple public cloud storage interfaces to make the multiple public cloud storage interfaces check whether all corresponding identification codes of the multiple partitions exist in the multiple public cloud storage volumes according to the distributed file association data table, thereby generating a statistical report. A non-volatile computer-readable storage medium is used in a computing device or a computer having a processor and/or a memory, and stores instructions for executing a shared backup method based on an object storage gateway as described in any one of claims 6 to 10.

Images