JP2013003612A - System and method for concealing data when utilizing virtual server - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a virtual server utilization system for reducing a leakage risk of data of a company from a line between a data center of the company and a virtual server, and from a storage of the virtual server, when utilizing the virtual server provided by a cloud service provider.SOLUTION: Data which shall be concealed to protect from wiretapping and alteration by applying a VPN to communication between a data center of a company and a virtual server run on the cloud is stored in a file server of the data center, and is read/written through the VPN from the virtual server. By generating an encrypted disk area on the virtual server and utilizing it as a cache, file access through the VPN is speeded up.

Description

A provider (hereinafter referred to as a cloud provider) that provides a customized virtual server by constructing a virtualization platform on a cloud that integrates multiple computer systems due to recent advances in virtualization technology, improved processor performance, etc. Exists. The present invention relates to a system and method for realizing confidentiality of confidential information and the like by preventing data leakage and tampering when a virtual server is constructed and used on a virtualization platform operated by these cloud operators. is there.

RFC 4301, “Security Architecture for the Internet Protocol”, [May 23, 2011 search], [online], December 2005, Internet <http: // www. ietf. org / rfc / rfc4301. txt> RFC 5246, “The Transport Layer Security (TLS) Protocol Version 1.2”, [May 23, 2011 Search], [online], August 2008, Internet <http: // www. ietf. org / rfc / rfc5246. txt> Federal Information Processing Standards Publication 197, “ADVANCED ENCRYPTION STANDARD (AES)”, [May 23, 2011 search], [online], November 26, 2001, Internet <http: // csrc. nist. gov / publications / fips / fips197 / fips-197. pdf>

In recent years, IT systems used by companies tend to be larger and more complex, and in order to respond to rapidly changing markets, IT systems must be constructed, modified and reconfigured in a short period of time. It has been. Furthermore, in order to maintain corporate competitiveness, it is essential to carry out these measures at a low cost.

Using a virtual server provided by a cloud provider is adopted as one of the effective means for solving these problems. However, when using a virtual server, leakage of the company data from the line between the company data center and the virtual server or from the storage of the virtual server can be a problem.

Conventionally, a VPN (Virtual Private Network) is configured between an in-house data center and a group of virtual servers on the cloud by using communication path encryption technology such as Non-Patent Document 1 and Non-Patent Document 2. Protects communications between the company's data center and the virtual server from eavesdropping and tampering, and encrypts the disk area used by the virtual server by encryption technology such as Non-Patent Document 3 for storage by the cloud operator By saving, the confidentiality of the data could be maintained.

However, the prior art has the following problems.
・
The VPN technology can prevent eavesdropping and tampering in communication between the company data center and the virtual server group on the cloud, but cannot conceal the data stored on the cloud by the virtual server.
・
Encryption keeps the confidentiality of the data, but the availability of the data is lost when the cloud provider equipment becomes unavailable.
・
Since the virtual server does not include a physical tamper-resistant device or the like, the encryption key cannot be securely stored on the virtual server.

The above problem is solved by the following method.
Used by a virtual server in a virtual server utilization system consisting of a virtual server built on a cloud provider's virtualization platform, a file server in its own data center, and a communication line connecting those servers When a part of the disk area to be stored is set in the file server in the company's data center and the data that needs to be kept secret (hereinafter referred to as secret data) is stored and kept secret, and the virtual server accesses the company's disk area, By accessing via a VPN line set on the communication line, communication between the file server of the company and the virtual server operating on the cloud is protected from eavesdropping and tampering.

In addition, when a virtual server built on the cloud operator's virtualization platform accesses the disk area in its own file server connected to the virtual server via a communication line, the cache memory set in advance in the virtual server is used. Use it to speed up access.

Further, by setting the cache memory set in advance in the virtual server on the disk memory, it is possible to surely speed up the access even when the capacity of the secret data is large.

Furthermore, when the virtual server accesses the disk area in the file server using the cache line using the VPN line, the write data is encrypted when writing to the cache memory, and the read data is decrypted when reading from the cache memory. As a result, the secret data stored in the cache memory is concealed.

In addition, the encryption key for encrypting the write data when writing to the cache area and the decryption key for decrypting the read data when reading from the cache area are held not in the virtual server disk but in the memory, When the memory is cleared by stopping or restarting the virtual server, the encryption key and the decryption key are lost. As a result, when the virtual server is restarted, it is necessary to recreate a new encryption key and decryption key, but secret data can be kept secret.

According to the present invention, it is possible to reduce the risk of leakage or loss of secret data from the virtual server by storing the secret data used by the virtual server operating on the equipment of the external cloud operator in the company data center. it can. As a result, the security level of the company's secret data can be managed without being affected by the security level of the cloud operator.

Furthermore, by adopting a VPN line for transferring secret data from the company's own data center to the virtual server, access from the virtual server to the data held in the company's facilities can be wiretapped or altered even if an inexpensive internet line is used. Protected from. At that time, by providing a cache on the virtual server, it is possible to speed up access to the data in the company's equipment.

Also, by setting the cache memory in the disk area of the virtual server, it is possible to maintain the effect of speeding up access by the cache even when the capacity of the secret data is large. Furthermore, when the cache memory is secured on the disk area of the virtual server, the data temporarily stored in the cache memory is stored by encrypting the disk area and storing the encryption key in a volatile memory such as the main memory. The risk of being deciphered by the three parties can be reduced.

FIG. 2 is a configuration and operation explanatory diagram of a system that protects and further conceals secret data when using a virtual server according to the present invention from eavesdropping and tampering. Configuration and operation of a system that protects secret data when using the virtual server according to the present invention from eavesdropping and tampering and further conceals when the virtual server uses a cache memory on the memory when accessing the file server of its own equipment It is explanatory drawing. Configuration and operation of a system that protects confidential data from eavesdropping and tampering when using the virtual server according to the present invention when the virtual server uses a cache memory on the disk when accessing the file server of its own equipment, and further conceals it FIG. Configuration of a system in which secret data when using a virtual server according to the present invention is protected from eavesdropping and tampering when the virtual server uses an encrypted cache memory on a disk when accessing the file server of its own equipment, and further concealed FIG. Secret when using the virtual server according to the present invention when the virtual server uses the encrypted cache memory on the disk when accessing the file server of its own equipment and holds the encryption key and decryption key on the virtual server memory 1 is a configuration and operation explanatory diagram of a system that protects data from eavesdropping and tampering and further conceals it. It is an operation | movement flow of the cache program when CPU reads data from memory. It is an operation | movement flow of the cache program when CPU writes data in memory.

FIG. 1 shows the configuration and operation of a system for protecting data from eavesdropping and tampering and further concealing data when using a virtual server according to the present invention.

The system according to the present invention includes a file server (2), a VPN server (5), a LAN (Local Area Network) (4) connecting them, an in-house facility (1), a virtualization platform (16), and its It is composed of a cloud provider facility (6) having a plurality of virtual servers (7, 17) constructed above and the Internet (26) connecting them.

The virtual server (7) of the cloud provider facility is a virtualization system comprising a CPU (Central Processing Unit) (12), HDD (Hard Disk Driver) (13), Memory (14), and NIC (Line Interface Card) (15). And a device driver (11) that is an interface between the hardware group and the OS (10), an application program (8) installed on the OS, and a VPN program (9). .

A virtual server disk area (3) is set in the file server of the company's equipment. The VPN server of the company's equipment provides a secure VPN line with a VPN client program (hereinafter referred to as VPN program (9)) that accesses the company's equipment from outside the company via the Internet.

The VPN server (program) encapsulates the contents of the IP packet of the data to be transmitted with the VPN protocol, delivers it to the VPN program (server) via the Internet, and retrieves the original IP packet data with the VPN program (server) I do. In other words, the VPN server (program) constructs a virtual communication tunnel on the Internet, delivers the IP packet of data to be transmitted to the VPN program (server) through the tunnel, and the reverse direction also passes through the tunnel in the same way. The IP packet is received. Therefore, secure communication can be performed using the Internet.

The VPN protocol includes a layer 2 tunneling protocol,
There are PPTP (Point to Point Tunneling Protocol), L2F (Layer 2 Forwarding Protocol), and L2TP (Layer 2 Tunneling Protocol), and IPSec (Internet Protocol) is known as Layer 3 tunneling technology The description is omitted.

The present invention does not lower the security level of the company's confidential information management regardless of the security level of the virtual server when the application program installed on the virtual server on the virtualization platform of the cloud provider facility handles the secret data. A virtual server utilization system and method are provided.

To achieve the above purpose, when creating a virtual server on the cloud operator's virtualization platform, connect the virtual server to the VPN server in the company's equipment, and then set the storage area of the secret data in the company's equipment. This area is provided on the file server, and this area is set as an access destination when the virtual server reads and writes data. This eliminates the need to copy and hold the secret data on the cloud provider's equipment in advance.

Only when the secret data is accessed from the virtual server, the data is read from the file server in the company's equipment via the VPN line, and copied to the memory of the virtual server. The secret data is written to a file server in the company's equipment. Furthermore, the data created or changed by the virtual server in relation to the secret data can also be stored in the file server in the company's equipment, not in the disk in the cloud provider equipment.

Whether to read or write data handled by the application program to a disk in the virtual server or in-house equipment is set in advance when creating, initializing, or starting up the application program. It is necessary to limit access to the internal disk. This is because when a virtual server accesses a disk in its own equipment, it is performed via the Internet line, so it takes time to access and the operation of the application program is slowed down.

With the above configuration and operation, secret data is not stored on the cloud operator's disk, and when the memory is cleared by stopping or restarting the virtual server, no data is received from the cloud operator's equipment. It will be erased. In addition, even if the provider's virtualization platform suddenly becomes unavailable due to a cloud provider's equipment failure, etc., the data availability will not be lost because the secret data remains in the company's equipment. .

FIG. 2 shows a system for protecting data from eavesdropping and tampering and further concealing data when using the virtual server according to the present invention when the virtual server uses the cache memory in the memory area when accessing the file server of its own equipment. A structure and operation | movement are shown.

2 shows that a part of the memory (4) area of the virtual server (7) of the cloud operator in FIG. 1 is set in the cache memory, and the cache program (28) for performing the cache operation is installed on the OS of the virtual server. Is.

In the configuration of FIG. 1, when a virtual server accesses a disk in its own equipment, it is performed via the Internet line, so access to the data is compared to when a copy of the data is held on the cloud operator's equipment. The delay at the time becomes large. For this reason, the data read once by the virtual server is temporarily stored in the cache memory provided on the virtual server memory, and when the same data is read again, the data in the cache is read to increase the access speed. To do.

In general, a cache memory is a memory allocated to a main memory area or a dedicated cache memory. When a CPU accesses a memory medium, all or part of accessed data is stored in the cache memory. This is a technique for shortening the access time to the memory medium by reading from the cache memory or writing to the cache memory when the CPU accesses the same location of the memory medium next time. In the present invention, the memory medium is a disk memory of its own file server.

Here, the operation of the cache program will be described. FIG. 6 shows the operation flow of the cache program when the CPU reads data from the disk memory (hereinafter, real medium) of its file server, and FIG. 7 shows the operation flow of the cache program when the CPU writes data to the real medium. Show.

In FIG. 6, S001 is a step for determining whether or not the access list has a read address. If there is, the step of S002 is executed, and if not, the step of S003 is executed. The access list is a list describing addresses (hereinafter referred to as addresses) of real media accessed by the CPU, and the contents of the addresses described in the list are stored in the cache memory.

If the read address is stored in the access list (Yes in S001), if the data at the address on the real medium is newer than the cached data (Yes in S002), the real medium Data is read (S004), and it is determined whether or not the cache memory is free (S005). If the data at the address on the real medium is not newer than the cached data (No in S002), the data corresponding to the address is read from the cache memory (S003). This speeds up the reading operation.

If the read address is not stored in the access list (No in S001), data is read from the real medium (S004). Thereafter, if there is no free space in the cache memory (No in S005), an address corresponding to the data to be deleted from the cache memory is determined (S006), and the overwritten address is deleted from the access list (S007). The read data is written in the deleted part (S008), and the address is written in the access list (S009). If the cache memory is free (Yes in S005), the read data is written to the cache memory (S008), and the address is written to the access list (S009).

In FIG. 7, S011 is a step of determining whether or not the access list has a write address. If there is, the step of S012 is executed, and if not, the step of S013 is executed.

When the read address is stored in the access list (Yes in S011), data corresponding to the address is written in the cache memory (S012), thereby speeding up the write operation. If the write address is not stored in the access list (No in S011), if there is no free space in the cache memory (No in S013), the address corresponding to the data to be deleted from the cache memory is determined ( The address to be overwritten is deleted from the access list (S014) (S015), write data is written to the deleted part (S016), and the address is written to the access list (S017). When the cache memory is free (Yes in S013), write data is written to the cache memory (S016), and an address is written to the access list (S017).

After executing the steps S012 and S017, the write data is written to the real medium (S018). The process of writing data to the real medium may be performed each time the CPU performs the write process or may be performed when conditions such as overwriting the write data are complete, but the description is omitted because it is a well-known technique. To do.

In the above example, since the real medium is shared between the server and the virtual server, there is a conflict between the two servers when writing to the real medium. Since the contention control technique is a well-known technique, a description thereof will be omitted, but when exclusive access control is employed, step S002 in FIG. 6 can be omitted. The cache operation is all performed in units of addresses, but can be replaced with all methods (for example, file names, etc.) that can specify the location of data.

In FIG. 2, when the application program (8) first accesses the private data of the company, it accesses the disk area (3) in the file server of the company's equipment. At that time, access is performed through the VPN line (27) as in FIG. 1, and data obtained through the VPN line is transmitted to the application program via the OS and the cache program. Further, the data is stored in the cache memory on the memory (14) by the cache program (28).

When the application program (8) accesses the company's private data for the second time or later, the access is made to the cache memory, and the data read from the cache memory is delivered from the cache program to the application program.

With the configuration shown in FIG. 2, when a virtual server accesses a disk in its own equipment, the first access takes time, but the subsequent access is access to the memory of the virtual server. Time can be shortened. On the other hand, if the product of the capacity of the accessed data and the number of different addresses accessed exceeds the capacity of the cache memory, the data at the newly accessed address is overwritten with the data previously written in the cache memory. The Therefore, when the amount of data exchanged between the virtual server and the disk in the company's equipment and the number of accesses are small, high-speed access can be realized.

However, since the access time is shortened only when the second and subsequent accesses are the same as the addresses and data accessed before, frequent access to a large amount of data on the disk in the company's equipment When the access occurs, the cache memory is frequently overwritten, and the access speed-up effect by the cache is reduced. In such a situation, when the cache memory is allocated on the main memory as shown in FIG. 2, the cache memory capacity cannot be increased, and the access time reduction effect by the cache is limited.

FIG. 3 shows a system for protecting confidential data from eavesdropping and tampering when the virtual server uses the cache memory in the disk area when the virtual server accesses the file server of its own equipment from wiretapping and tampering, and further concealing it. The configuration and operation of the

FIG. 3 shows a configuration in which a part of the disk area of the cloud provider's virtual server in FIG. 1 or FIG. 2 is set in the cache memory, and a cache program (28) for performing a cache operation is installed on the OS of the virtual server. .

The operation is the same as in FIG. 2, but since the cache memory is set in the disk area of the virtual server, the memory capacity allocated to the cache memory can be increased. Therefore, even when a large amount of data is frequently accessed with respect to the disk in the company's equipment, the access time reduction effect by the cache can be obtained.

FIG. 4 shows the configuration and operation when the write data to the cache memory set on the disk in FIG. 3 is encrypted and decrypted at the time of reading. The encryption / decryption function uses the file system encryption / decryption function of the virtual server to perform encryption / decryption using the encryption key / decryption key generated at startup or initialization of the OS or application program. Set as follows.

When the application program (8) first accesses the company's private data, it accesses the disk area (3) in the file server of the company's equipment. At that time, access is performed through the VPN line (27) as in FIGS. 1 to 3, and data obtained through the VPN line is transmitted to the application program via the OS and the cache program. Further, the data is encrypted using the encryption key by the encryption function (29) of the virtual server and stored in the cache memory in the disk (13) area.

When the application program (8) accesses the private data of the company for the second time, the access is performed from the cache memory, but the data read from the cache memory uses the decryption key by the decryption function (29) of the virtual server. Are decrypted and delivered from the cache program to the application program.

With such a configuration, even if the contents of the cache memory in the disk area of the virtual server are read by a malicious third party, secret data will be leaked unless the encryption key and decryption key are stolen. There is no.

FIG. 5 shows a configuration in which an encryption key for encrypting write data to the cache memory set in the disk area in FIG. 4 and a decryption key for decrypting at the time of reading are stored in the memory (14). The operation is shown. The operation according to this configuration diagram is the same as that in FIG.

When the encryption key and the decryption key held on the memory (14) are cleared by restarting the virtual server, etc., and the encryption key and the decryption key are lost, a new encryption key and a decryption key are generated. Save it again. For this reason, there is no need to permanently store it on a disk or the like, and the risk of leakage of the encryption key and decryption key can be reduced.

1 to 5, the VPN program and the cache program are provided as user programs on the OS. In FIGS. 4 and 5, the encryption / decryption functions are provided as device drivers. If it is on a virtual server, it can be provided by any of virtualized hardware, firmware, device driver, OS, application program, and the like.

Next, an example of a method for realizing the system shown in FIGS. 1 to 5 will be described.
1. A virtual server is created on a virtualization platform using an interface (API or the like) of a service provided by a cloud provider. At this time, a cache area is secured separately from the area for storing the OS and application programs.

2. Set up a disk area for the virtual server in the file server in the company's equipment and allow access from the virtual server connected to the VPN server using a remote file access protocol such as NFS (Network File System). .

3. A command is issued using a remote operation program such as SSH (Secure Shell) to the virtual server activated on the cloud provider's virtualization platform, and the following settings are made.

3.1 Install the VPN program, its configuration file, and authentication information in the virtual server, and set up the activated virtual server so that it can connect to the VPN server in its own facilities. The VPN program setting file and authentication information are, for example, the IP address of the VPN server, the authentication method used in the VPN, the client certificate, the private key, and the password.

3.2 2. Is set to access the disk area on the file server permitted to be accessed from the virtual server using NFS or the like.

4). If you need to speed up access to the disk area on the file server in your company's equipment, issue a command to the virtual server using a remote operation program such as SSH (Secure Shell). Set up.

4.1 Generate an encryption key and a decryption key using random numbers, etc. At the time of access to the cache area secured in step 1, the file system encryption function of the virtual server is used to perform encryption and decryption using the generated encryption key and decryption key. At this time, the encryption key and the decryption key are not stored in the disk area but are stored in the memory area.

4.2 When the cache area is in the disk area, the disk area is formatted and made available to the application program.

4.3 Install the cache program on the virtual server, and specify the area set in 4.1 to 4.2 as the storage location where the cache program stores temporary files.

5). When the virtual server is restarted, the encryption key and the decryption key held in the memory by the OS of the virtual server are lost, and the data stored in the cache area cannot be decrypted. . The cache area and the cache program are set according to the above procedure.

1 In-house equipment 2 File server 3 Virtual server disk area 4 In-house LAN
5 VPN server 6 Cloud provider equipment 7, 17 Virtual server 8, 18, 19 Application program 9 VPN program 10, 20 OS (operating system)
11, 21 Device driver 12, 22 Virtual CPU (Central processing unit)
13, 23 Virtual HDD (Hard Disk Device)
14, 24 Virtual memory 15, 25 Virtual NIC (network interface card)
26 Internet 27 VPN line 28 Cash program

Claims (12)

In a virtual server utilization system comprising a virtual server and a file server connected to the virtual server via a communication line,
When a part of the disk area used by the virtual server is secured in the file server, and the virtual server accesses the disk area in the secured file server, a VPN line set on the communication line is used. Virtual server utilization system characterized by being performed via   2. The virtual server uses a cache memory set in advance in the virtual server when accessing a disk area in a file server connected to the virtual server via a communication line. Virtual server utilization system.   3. The virtual server utilization system according to claim 2, wherein the cache memory is set on a disk area.   When a virtual server uses a cache memory to access a disk area in a file server connected to the virtual server via a communication line, the write data is encrypted when writing to the cache memory, and when reading from the cache memory 4. The virtual server utilization system according to claim 3, wherein the read data is decrypted.   5. The volatile memory stores an encryption key for encrypting write data when writing to the cache memory and a decryption key for decrypting read data when reading from the cache memory. The virtual server utilization system described. The virtual server utilization system according to claim 1, 2, 3, 4, 4 or 5, wherein the virtual server is constructed on a cloud. In a virtual server utilization system comprising a virtual server and a file server connected to the virtual server via a communication line,
When a part of the disk area used by the virtual server is secured in the file server, and the virtual server accesses the disk area in the secured file server, a VPN line set on the communication line is used. The virtual server utilization method characterized by performing via this.   8. The virtual server uses a cache memory set in advance in the virtual server when accessing a disk area in a file server connected to the virtual server through a communication line. Virtual server usage method.   9. The virtual server utilization method according to claim 8, wherein the cache memory is set on a disk area.   When a virtual server uses a cache memory to access a disk area in a file server connected to the virtual server via a communication line, the write data is encrypted when writing to the cache memory, and when reading from the cache memory The virtual server utilization method according to claim 9, wherein the read data is decrypted.   11. The volatile memory stores an encryption key for encrypting write data when writing to the cache memory and a decryption key for decrypting read data when reading from the cache memory. The virtual server usage method described. The virtual server utilization method according to claim 7, claim 8, claim 9, claim 10, or claim 11, wherein the virtual server is constructed on a cloud.

Images