JP4490068B2 - Data storage system using network - Google Patents

Description

  The present invention relates to a data storage system using a network. In particular, the present invention relates to a data storage system capable of distributing and storing valuable digital data copies in a plurality of locations on a network for the purpose of backup.

  It is widely performed to transfer the backup data of the created data from the computer or the like that created the data to another file server or the like connected via a network and store valuable data. If this network is extended to a global wide area network such as the Internet, data can be stored and stored from anywhere in the world as long as there is an environment that can access the Internet. You can retrieve your data from anywhere in the world. However, as the scale of the network to be used is increased, the convenience for the user is improved, but on the contrary, the security is lowered. Data to be stored usually contains private information of individuals, and it is necessary to ensure sufficient security so that only the person who deposited the data or the agent entrusted by the person can retrieve it. . As described above, in the conventional data archiving system using a network, there is a problem that security is lowered when convenience is improved so that data can be deposited and retrieved from anywhere.

Therefore, in Patent Document 1 below, in order to solve such a problem, only the person who has deposited the data or a specific person authorized to access the data can safely access the data deposited from any place. There has been disclosed a distributed data archive device that can be accessed and does not require any special device or software on the server side for storing data. In the apparatus disclosed in this document, storage target data is divided into a plurality of divided files and distributed and stored in a plurality of storage locations on the network. If such a storage method is adopted, even if the security of each individual divided file stored in each storage location is low, unless the original division method of the file to be stored and the storage location of each individual divided file can be recognized, It is difficult to restore the original file to be stored, and sufficient security can be ensured.
PCT International Publication No. WO01 / 46808

  The importance of digital data varies greatly depending on the economic or social significance of the information contained in it, and depending on the type of data, it is more reliable and secure in terms of backup. There is a need for reliability. Accordingly, a first object of the present invention is to provide a data storage system using a network that can ensure higher reliability.

  Further, in a system that backs up data using a network, the time required for backup includes the data transmission time on the network. For this reason, in a conventional system, it may be difficult to back up a large amount of data in a short time. Accordingly, a second object of the present invention is to provide a data storage system using a network that can complete a data storage operation in a shorter time.

(1) The first aspect of the present invention is a function for distributing and storing data to be stored in a plurality of storage locations accessible via a network, and a function for retrieving stored data as needed. In a data storage system using a network having
When storing data, deposit processing means for performing deposit processing to divide the storage target data into a plurality of divided files and distribute and store the data in a plurality of storage locations via a network, and management data indicating the method of the deposit processing Management data output means for creating and outputting this data directly or indirectly to a predetermined recording medium by online transmission, and management data input means for inputting management data at the time of data retrieval; A plurality of distributed data archiving apparatuses are provided, each having a withdrawal processing unit for performing a withdrawal process for taking out a plurality of divided files stored in a distributed manner based on the input management data and restoring them to the original storage target data ,
A specific divided file stored in a specific storage location by deposit processing of the nth (n is an integer equal to or greater than 1) distributed data archive device is stored as the (n + 1) th distributed data archive device. The data is handled as data, and a specific divided file is further divided into a plurality of divided files, and then distributed and stored in a plurality of storage locations different from the specific storage location.

(2) According to a second aspect of the present invention, in the data storage system using the network according to the first aspect described above,
Prepare all N- stage distributed data archive devices from the first- stage distributed data archive device to the N -th (N is an integer of 2 or more) distributed data archive device ,
A specific divided file stored in a specific storage location by the depositing process of the i-th stage (i = 1 to N−1) distributed data archive apparatus is assigned to the (i + 1) -th stage distributed data archive apparatus. In the distributed data archive device in the (i + 1) -th stage, the specific divided file is further divided into a plurality of divided files, and a plurality of storage locations different from the specific storage location Configured to be distributed and stored in
When the original storage target data is stored in the first- stage distributed data archive device, the first- stage management data to the Nth- stage data created by the first- stage distributed data archive device are stored. All N sets of management data up to the Nth stage management data created by the distributed data archiving apparatus are directly or indirectly transmitted online by the first stage distributed data archive apparatus. This is output to a recording medium .

(3) According to a third aspect of the present invention, in the data storage system using the network according to the first or second aspect described above,
The storage location itself as the storage location of the divided file by the deposit processing of the nth (n is an integer of 1 or more) distributed data archive device is configured by the (n + 1) th distributed data archive device. Is.

(4) According to a fourth aspect of the present invention, in the data storage system using the network according to the first to third aspects described above,
The depositing processing means of each distributed data archive device stores a division processing unit that divides storage target data into a plurality of divided files based on a predetermined division method, and stores each divided file in different storage locations via a network. A storage processing unit,
A retrieval processing unit of each distributed data archive device recognizes the storage location of each divided file from the input management data, and takes out each divided file from the recognized storage location via the network; An integrated processing unit that recognizes the division method from the input management data, and based on the recognized division method, integrates the extracted individual divided files to generate the original storage target data,
The management data output means of each distributed data archive device has a function of creating management data including information indicating the division method and information indicating the storage location of each divided file.

(5) According to a fifth aspect of the present invention, in the data storage system using the network according to the fourth aspect described above,
In the deposit processing means, before or after dividing the storage target data, an encryption processing unit for performing encryption processing on the storage target data or the divided file is provided, and the management data creation means determines the encryption processing method. A function of adding information to the management data, and the encryption processing method is recognized from the input management data in the extraction processing means, and the decryption processing is performed based on the recognized encryption processing method. Is used, and a distributed data archiving apparatus that restores the original storage target data through the decryption process is used.

(6) According to a sixth aspect of the present invention, in the data storage system using the network according to the fourth or fifth aspect described above,
In the deposit processing means, a dummy data adding unit for executing dummy data adding processing for adding dummy data to the storage target data or the divided file is provided, and the management data creating means determines the method of the dummy data adding processing. A function for adding the information shown to the management data. The drawer processing means recognizes the dummy data addition processing method from the inputted management data, and performs dummy processing based on the recognized dummy data addition processing method. A distributed data archiving apparatus is provided that includes a dummy data removal processing unit that executes dummy data removal processing for removing data and restores original storage target data through dummy data removal processing.

(7) The seventh aspect of the present invention is a function for distributing and storing data to be stored in a plurality of storage locations accessible via a network, and a function for retrieving stored data as needed. In a data storage system using a network having
When storing data, deposit processing means for performing deposit processing to divide the storage target data into a plurality of divided files and distribute and store the data in a plurality of storage locations via a network, and management data indicating the method of the deposit processing Management data output means for creating and outputting this data directly or indirectly to a predetermined recording medium by online transmission, and management data input means for inputting management data at the time of data retrieval; A plurality of distributed data archiving devices, each having a withdrawal processing unit for performing a withdrawal process for taking out a plurality of divided files stored in a distributed manner based on the input management data and restoring them to the original storage target data; ,
The original storage target data is divided into a plurality of partial storage target data, and each partial storage target data is provided as a storage target data to a plurality of distributed data archive devices, and a plurality of distributed data A data dividing / integrating device having a function of integrating the partial storage target data extracted by the archive device and generating the original original storage target data;
Is provided.

(8) According to an eighth aspect of the present invention, in the data storage system using the network according to the seventh aspect described above,
When storing data, the data division / integration device outputs and stores a collection of management data output from each distributed data archive device directly or indirectly to a predetermined recording medium by online transmission. And a function of inputting a collection of management data and giving it to each distributed data archive device at the time of data extraction.

  According to the data storage system using the network according to the present invention, it is possible to ensure higher reliability by cascading a plurality of distributed data archive devices. Further, by connecting a plurality of distributed data archive devices in parallel, it is possible to complete the data storage operation in a short time.

  Hereinafter, the present invention will be described based on the illustrated embodiments.

<<< §1. Configuration and operation of distributed data archive device >>
The feature of the present invention is that by providing a plurality of distributed data archive devices disclosed in the above-mentioned Patent Document 1, it is possible to store data with high reliability and complete the data storage operation in a short time. The point is to make it possible. First, the configuration and operation of this distributed data archive device will be briefly described.

  FIG. 1 is a block diagram for explaining the basic configuration and operation of a distributed data archive device 100 used in the present invention. The distributed data archiving apparatus 100 is stored with a function for distributing and storing the storage target data D in a plurality of storage locations 310 to 350 accessible via the network 200 (in this example, the Internet). And a function of retrieving data as needed.

  When the storage target data D is deposited in the distributed data archive device 100, the data D is divided into a plurality of divided files, and the individual divided files are stored in the storage locations 310 to 310 via the network 200. Management data M is issued as a so-called deposit receipt. On the other hand, when the deposited data is required, when the management data M is given to the distributed data archive device 100, the divided files stored in a distributed manner are collected and integrated into the original storage target data D. This can then be pulled out.

  FIG. 2 is a block diagram showing the concept of such deposit processing. In the example shown in the figure, the storage target data D is divided into three divided files D1, D2, and D3, and is distributed and stored in the storage locations 320, 340, and 310, respectively. When the extraction process is performed, the divided files D1, D2, and D3 are taken out from the storage locations 320, 340, and 310, and are integrated to restore the original storage target data D.

  Each of the storage locations 310 to 350 is configured by a computer accessible via the network 200. In the example shown in the figure, an example in which only five storage locations 310 to 350 are provided is shown for convenience of explanation, but in reality, a larger number of storage locations are provided. Each storage location may be configured by any hardware as long as it can provide an environment in which digital data can be written and read out as needed. However, practically, it is realistic to configure each storage location by a part of the recording area constituted by the hard disk device in the data server.

  In the embodiment shown here, since the Internet is used as the network 200, each of the storage locations 310 to 350 can be configured by any data server distributed in the world. Therefore, in practice, for example, the storage location 310 is constituted by one recording area in a specific data server installed in Tokyo, and the storage location 320 is one in a specific data server installed in London. It is constituted by a recording area and can take a form such as. Of course, each data server does not need to be a data server managed by the same business entity, and may be a rental server provided by another business operator.

  As shown in FIG. 1, the distributed data archiving apparatus 100 is composed of management data output means 110, deposit processing means 120, withdrawal processing means 130, and management data input means 140. However, each of these components focuses on the function of the distributed data archive device 100 and is regarded as a functional component. In reality, the function of each of these components is distributed data. This is realized by a software program incorporated in a computer constituting the archive device 100.

  The deposit processing means 120 divides the storage target data D into a plurality of divided files when storing the data, and stores a plurality of storage locations (in the illustrated example, among the storage locations 310 to 350 via the network 200). It is a component that performs deposit processing to be distributed and stored in some). In the example shown in FIG. 2, the storage target data D is divided into three divided files D1, D2, and D3, and is distributed and stored in storage locations 320, 340, and 310, respectively. In the embodiment shown here, as shown in FIG. 1, the deposit processing means 120 is composed of four parts: a split processing unit 121, an encryption processing unit 122, a dummy data adding unit 123, and a storage processing unit 124. . Details of processing performed in each of these units will be described later.

  On the other hand, the management data output means 110 has a function of creating management data M indicating the method of deposit processing performed by the deposit processing means 120 and outputting this as a deposit receipt for the storage target data D. Specifically, the information indicating the deposit processing method includes information indicating the division method of the storage target data D and information indicating the storage locations of the individual divided files D1, D2, and D3.

  The management data output means 110 and the deposit processing means 120 described above are used when depositing the storage target data D into the distributed data archive device 100. The user receives the management data M as a so-called deposit card in exchange for depositing the storage target data D. Of course, since the management data M is digital data, for example, the management data M is provided from the distributed data archive device 100 in a state of being recorded on a recording medium such as an IC card, or online, the distributed data archive device 100. It is issued from the side.

  On the other hand, the withdrawal processing unit 130 and the management data input unit 140 are used when retrieving the storage target data D deposited in the past. First, the management data input means 140 is a component having a function of inputting management data M that functions as a deposit receipt into the distributed data archive device 100. When the user performs an operation of inputting the management data M issued at the time of deposit, the management data M is taken into the distributed data archive device 100 by the management data input means 140. When the management data M is recorded on a recording medium such as an IC card, the management data input means 140 functions to read the management data M from such a medium, and the management data M is sent online. In this case, the management data input means 140 has a function of receiving it.

  The extraction processing unit 130 is a component that performs extraction processing for extracting a plurality of divided files stored in a distributed manner and restoring them to the original storage target data D based on the input management data M. For example, when division and storage are performed by the method shown in FIG. 2, the management data M includes the original storage target data D divided into three divided files D1, D2, and D3, and Since the fact that each of the divided files D1, D2, D3 has been stored in the storage locations 320, 340, 310 is recorded as information, based on this information, the divided files D1 from the storage locations 320, 340, 310 are recorded. , D2 and D3 are extracted and then integrated to restore the original storage target data D. In the case of the embodiment shown here, the extraction processing means 130 is composed of four parts: an integration processing unit 131, a decoding processing unit 132, a dummy data removal unit 133, and an extraction processing unit 134, as shown in FIG. . Details of processing performed in each of these units will be described later.

  Next, individual components constituting the deposit processing unit 120 and the withdrawal processing unit 130 will be described. Here, the division processing unit 121, the encryption processing unit 122, the dummy data addition unit 123, the storage processing unit 124, and the integration processing unit 131 and the decryption processing unit 132 that constitute the withdrawal processing unit 130. The dummy data removing unit 133 and the extraction processing unit 134 are respectively corresponding components, and these corresponding components are components that perform operations opposite to each other.

First, the division processing unit 121 performs a function of performing a division process of dividing the storage target data D into a plurality of divided files based on a predetermined division method. For example, the example shown in FIG. 2 shows an example in which the storage target data D is divided into three and three divided files D1, D2, and D3 are created. However, the division method executed by the division processing unit 121 is not limited to the method shown in FIG. 2, and any division method may be executed. For example, it can be divided into four divided files D1 to D4, and the data length of each divided file can be arbitrarily set. FIG. 2 shows an example in which the original storage target data D is divided into three equal parts, but even if the method is divided into the same three divided files D1, D2, D3, for example, the storage target data D It is also possible to determine a dividing method in which the first divided file D1 is set up to 10 Mbytes from the beginning of the file, the second divided file D2 is set up to the next 25 Mbytes, and the remaining divided file is set as the third divided file D3. . Alternatively, from the beginning of the storage target data D, the first divided file D1 is defined as the first divided file D1, the odd-numbered bytes extracted from the remaining data are defined as the second divided file D2, and the even-numbered bytes are extracted as the first divided file D2. It is also possible to determine a division method such as three division files D3.

  As described above, the “division” in the present invention does not necessarily mean only the division that cuts out the sheep, but is an aggregate obtained by collecting a predetermined part of the original storage target data D in a discrete manner. This includes a method of forming one divided file by In practice, the division processing unit 110 has a function of performing a plurality of division methods (if a method of specifying the number of bytes using a random number is employed, a substantially infinite number of division methods are defined. It is preferable to select and execute a specific division method based on a predetermined algorithm or entirely at random.

  Information indicating the division method applied to the storage target data D in the division processing unit 121 is transmitted to the management data output unit 110 and included in the management data M. That is, the management data M is subjected to division processing based on what kind of algorithm is performed on the storage target data D, and is divided into a total number of divided files, and the length of each divided file becomes each byte. Is written.

  On the other hand, the integration processing unit 131 recognizes the division method implemented in the past based on the above-described information included in the management data M, and extracts from each storage location based on the recognized division method. A function of performing an integration process for integrating the individual divided files and generating the original storage target data D is achieved.

  The encryption processing unit 122 and the decryption processing unit 132 are components that perform encryption and decryption for further enhancing security. These components are not indispensable components for carrying out the present invention, but it is preferable to provide these components for practical use.

  The encryption processing unit 122 is a component that executes encryption processing for the storage target data D or the divided file before or after the storage target data D is divided. Information indicating the encryption processing method performed by the encryption processing unit 122 is transmitted to the management data output unit 110 and included in the management data M. On the other hand, the decryption processing unit 132 is a component having a function of recognizing the encryption processing method included in the management data M and executing the decryption processing based on the recognized encryption processing method. The original storage target data D is restored through this decryption process.

  As described above, the encryption process may be performed before the storage target data D is divided or may be performed after the division. FIG. 3A is a conceptual diagram in which encryption is performed before division. In this example, the encrypted data Dc is first generated by performing an encryption process on the original storage target data D, and the divided encrypted file Dc1 is generated by performing a division process on the encrypted data Dc. , Dc2, Dc3 are generated. Therefore, these divided encrypted files Dc1, Dc2, and Dc3 are stored in the respective storage locations.

  On the other hand, FIG. 3B is a conceptual diagram in which encryption is performed after division. In this example, the original storage target data D is first divided to generate divided files D1, D2, and D3, and then encryption processing is performed on each of the divided files D1, D2, and D3, and the encryption is performed. Divided files D1c, D2c, and D3c are generated. Accordingly, the encrypted divided files D1c, D2c, and D3c are stored in each storage location.

  In any case, the file itself stored in each storage location is not meaningful data, so it can be used illegally even if it is downloaded by a person who does not have the proper title. Therefore, security can be improved.

  As a method different from encryption, a method of adding dummy data to the original data is also effective. FIG. 4 is a diagram for explaining the concept of the method of adding the dummy data. For example, as shown in FIG. 4 (a), when dummy data (hatched portion) that is not related to the original data is added, unnecessary data that is originally unnecessary is mixed. The correct data cannot be used. In particular, as shown in FIG. 4 (b), if a method of inserting dummy data in a format in which the original data is divided at a plurality of locations, it is almost impossible to use the original data. Of course, this dummy data addition processing may be performed before the storage target data D is divided, or may be performed on each divided file after the division.

  Based on such a principle, the dummy data adding unit 123 and the dummy data removing unit 133 are components that perform a process of adding dummy data when depositing the storage target data D and removing it when extracting the data to be stored. These components are not indispensable components for carrying out the present invention. However, in practice, if these components are provided, security can be further improved.

  More specifically, the dummy data adding unit 123 is a component that executes a dummy data adding process for adding dummy data to the storage target data D or the divided file. Information indicating the method of the dummy data adding process performed by the dummy data adding unit 123 is transmitted to the management data output means 110 and included in the management data M. On the other hand, the dummy data removal unit 133 has a function of recognizing the dummy data addition process method included in the management data M and executing the dummy data removal process based on the recognized dummy data addition process method. It is a component, and the original storage target data D is restored through this dummy data removal process.

  The storage processing unit 124 is a component having a function of storing individual divided files in different storage locations via the network 200. Which division file is stored in which storage location is determined by a predetermined algorithm incorporated in the storage processing unit 124. This algorithm may be arbitrary. For example, a list of available storage locations is prepared in advance in the storage processing unit 124, and a completely random storage location is selected for each divided file from among them using a random number. May be taken.

  Information indicating the storage location of each divided file is transmitted to the management data output means 110 and included in the management data M. When the Internet is used as the network 200, it is convenient to use a URL as information indicating the storage location. On the other hand, the extraction processing unit 134 has a function of recognizing information indicating the storage location of each divided file included in the management data M and extracting each divided file from the recognized storage location via the network 200. It is a component with. The extracted divided files are integrated in the integration processing unit 131 (at this time, decoding processing in the decoding processing unit 132 and dummy data removal processing in the dummy data removal unit 133 are executed as necessary). .

  The advantage of this distributed data archive device 100 is that unless the management data M is present, the original storage target data D cannot be pulled out, so that sufficient security can be ensured. That is, even if an unauthorized user who does not have the management data M tries to extract the storage target data D by unauthorized means, first, where each individual divided file necessary for restoration is stored Therefore, it is impossible to recognize all the necessary divided files. In the first place, it is unclear how many divided files are necessary to restore the specific storage target data D. Of course, there is no way to know the individual storage locations where these divided files are stored. Secondly, even if the necessary divided files are successfully obtained, it is impossible to know what division method each divided file was generated unless there is management data. It is difficult to integrate these and restore to the original storage target data D. In particular, restoration becomes more difficult if encryption or dummy data is added.

  After all, even if the individual divided files stored in each storage location are in a state where anyone can download them at any time, they can be downloaded and restored to meaningful data for use. Only authorized users with management data can do so.

<<< §2. Form of cascade connection of distributed data archive devices >>
In §1, the configuration and operation of the distributed data archive device 100 used in the present invention have been described. FIG. 5 is a block diagram showing the principle of data storage by the distributed data archive device 100. As illustrated, when the user performs an operation of depositing the storage target data D that the user wants to back up in the distributed data archive device 100, the storage target data D is, for example, three divided files D1, D2, and D3. (Encrypted or added with dummy data as necessary) and stored in a predetermined storage location (in this example, storage locations 301, 302, 303) via the network 200, and management data M Is issued.

  The first feature of the present invention is that a plurality of distributed data archive devices 100 are prepared, and a plurality of distributed data archive devices are cascaded to ensure higher reliability. FIG. 6 is a block diagram showing an embodiment having the first feature. In this example, two distributed data archive apparatuses 100A and 100B are prepared, and both are connected in cascade.

  Here, the cascade connection is a serial connection so that the divided file created by the first distributed data archive device 100A becomes storage target data for the second distributed data archive device 100B. It means being done. In other words, when performing the data depositing process, the divided file D3 which is the output data of the first distributed data archive device 100A becomes the input data of the second distributed data archive device 100B. When the data extraction process is performed, the divided file D3, which is the output data of the second distributed data archive device 100B, has a relationship to become the input data of the first distributed data archive device 100A.

  The operation of depositing the storage target data D using the data storage system shown in FIG. 6 is as follows. First, the user performs an operation of depositing the storage target data D in the first distributed data archive device 100A. This is exactly the same as the work of depositing data in the conventional distributed data archive device 100 shown in FIG. In the first distributed data archive device 100A, the storage target data D is divided into, for example, three divided files D1, D2, and D3 (encryption and dummy data are added as necessary), and the network 200, the data is stored in a predetermined storage location (in this example, storage locations 301, 302, and 303). At this time, the management data M that functions as a receipt is issued to the user.

  This system is characterized in that distributed storage processing is further performed via the network 200 for the divided files stored in the specific storage location. That is, in the example shown in FIG. 6, the divided file D3 stored in the storage location 303 is distributed and stored in further storage locations 304, 305, and 306 by the second distributed data archive device 100B. Yes. Since the depositing process of the divided file D3 by the second distributed data archive device 100B is a process automatically performed without the user being aware of it, the work seen from the user is the work on the system shown in FIG. Is exactly the same.

  Here, focusing on the first distributed data archive device 100A, the divided file D3 stored in the storage location 303 is the storage destination data stored in a distributed manner, but the second distributed data archive device. Focusing on 100B, the divided file D3 stored in the storage location 303 is positioned as storage target data. Therefore, the second distributed data archiving apparatus 100B handles the divided file D3 as the storage target data, further divides it into a plurality of divided files D31, D32, and D33, and stores them separately via the network 200. The processing stored in the locations 304, 305, and 306 is executed, and management data M3 that functions as a receipt for the divided file D3 is issued. In the illustrated example, the management data M3 is stored in the storage location 303 together with the divided file D3.

  The operation of extracting the storage target data D deposited in the data storage system is exactly the same as the extraction operation in the conventional system shown in FIG. 5 as long as the divided file D3 is stored in the storage location 303 without any trouble. is there. That is, when the user gives management data M that functions as a deposit receipt to the first distributed data archive device 100A and makes a data withdrawal request, the storage location is stored by the function of the first distributed data archive device 100A. The divided files D1, D2, D3 are extracted from 301, 302, 303, and the original storage target data D is restored by integration processing and provided to the user.

  The advantage of this embodiment is that even if the divided file D3 stored in the storage location 303 is damaged, it can be restored by the function of the second distributed data archive device 100B. In the point. That is, when the first distributed data archiving apparatus 100A gives an instruction to read the divided file D3 in the storage location 303, but the reading of the divided file D3 is not performed normally (reading is not possible at all). In addition to a case where an error occurs due to verification of the error check code, the management data M3 is given to the second distributed data archive device 100B to request the withdrawal of the divided file D3. If the processing to be performed is automatically performed, the second distributed data archive device 100B obtains the divided file D3 from the divided files D31, D32, D33 stored in the storage locations 304, 305, 306. Can be restored. Of course, such a restoration process is a process that is automatically performed without the user's awareness, and therefore the extraction process seen from the user is exactly the same as the work for the system shown in FIG.

  As described above, the information of the divided file D3 is stored in the storage location 303 and distributedly stored in the storage locations 304, 305, and 306. Therefore, the redundancy is increased, but the data Reliability in terms of backup will be improved.

  In the figure, an example is shown in which only the divided data D3 stored in the storage location 303 is backed up by the second distributed data archive device 100B, but of course, it is practically stored in the storage locations 301 and 302. Similarly, if the divided data D1 and D2 are backed up using a distributed data archive device, the reliability can be further improved. In this case, the second distributed data archive device 100B may be used to back up the divided data D1 and D2, or a separate distributed data archive device may be provided as necessary. Good.

  In the figure, an example in which the distributed data archiving apparatus is cascade-connected in two stages is shown. Similarly, cascade connection in three or more stages is also possible. For example, in order to back up the divided file D31 stored in the storage location 304 shown in the figure, a third distributed data archive device 100C is provided, and the divided file D31 is further divided into three divided files D311, D312. , D 313, and these can be distributed and stored in separate storage locations via the network 200. Of course, cascade connection of four or more stages can be performed.

  In short, the main point of the embodiment described in this §2 is that the specific divided file stored in the specific storage location by the deposit processing of the nth (n is an integer of 1 or more) distributed data archive device is the (( Treated as storage target data for the (n + 1) th distributed data archiving apparatus, further dividing this specific divided file into a plurality of divided files and then distributing them to a plurality of storage locations different from the specific storage location. The number of stages to be cascade-connected is not limited.

  The management data issued by each distributed data archiving apparatus is preferably stored not only in one storage location but also in another storage location. For example, in the case of the example shown in FIG. 6, the management data M3 issued by the second distributed data archive device 100B (management data for the divided file D3) is stored in the storage location 303. When the data server that provides the storage location 303 becomes completely inoperable, the management data M3 is also lost along with the divided file D3, so that the second distributed data archive device 100B functions. However, the divided file D3 cannot be restored. In such a case, if the management data M3 is stored in another storage location, the divided file D3 can be restored using the management data M3 stored in the other storage location.

  Further, it is convenient to send a copy of the management data M3 from the storage location 303 to the first distributed data archive device 100A, and provide it to the user together with the management data M as a receipt. That is, in the case of the example shown in FIG. 6, the management data M and the management data M3 are provided to the user as a custody for the original storage target data D. Then, even if the data server that provides the storage location 303 becomes completely inoperable, the divided file D3 can be restored based on the management data M3 provided by the user. Of course, the restoration of the divided file D3 can also be performed in the first distributed data archive device 100A.

  Similarly, in a case where three or more stages of distributed data archive devices are cascade-connected, all management data issued by each stage of distributed data archive devices may be provided to the user. That is, in general, all N distributed data archive devices from the first distributed data archive device to the Nth (N is an integer equal to or greater than 2) distributed data archive device are used in a cascade manner. In the case of the data storage system configured by the above, when the user stores the original storage target data D, the first management data to the Nth distributed data created by the first distributed data archive device All N sets of management data up to the Nth management data created by the archive device may be output as a deposit certificate for the original storage target data D.

  In the example shown in FIG. 6, the storage location 303 and the second distributed data archive device 100B are shown as separate components. However, the storage location 303 itself is not necessarily required to have a separate and independent configuration. May be configured by the second distributed data archive device 100B. That is, as a general rule, the storage location itself that becomes the storage location of the divided file by the deposit processing of the nth (n is an integer of 1 or more) distributed data archive device is the (n + 1) th distributed data archive device. It is also possible to configure by.

<<< §3. Form to connect distributed data archive devices in parallel >>>
A second feature of the present invention is that a data storage operation can be completed in a short time by connecting a plurality of distributed data archive devices in parallel. FIG. 7 is a block diagram showing an embodiment having the second feature. In this example, three distributed data archive devices 100A, 100B, and 100C are prepared and connected in parallel to each other. In addition, a data division / integration device 400 is provided in the preceding stage of these three distributed data archive devices. The data division / integration device 400 divides the original storage target data D into a plurality of partial storage target data, and the individual partial storage target data is divided into a plurality of distributed data archive devices 100A, 100B, and 100C. A process to be provided as each storage target data, a process of integrating the partial storage target data extracted by the plurality of distributed data archive devices 100A, 100B, and 100C to generate the original original storage target data D; It has a function to perform.

  When the data division / integration device 400 stores data, the aggregate of the management data M1, M2, M3 output from the individual distributed data archive devices 100A, 100B, 100C is used as the original storage target data D. A process of outputting as a receipt for is performed. Further, when the data division / integration device 400 takes out the data, a process of inputting the aggregate of the management data M1, M2, and M3 and giving it to the individual distributed data archive devices 100A, 100B, and 100C Is done.

  The operation of depositing the original storage target data D using the data storage system shown in FIG. 7 is as follows. First, the user performs an operation of depositing the original storage target data D into the data division / integration device 400. Then, the data division / integration device 400 performs processing for dividing the original storage target data D into, for example, three parts and generating three partial storage target data D1, D2, and D3. The partial storage target data D1, D2, and D3 are given as storage target data to the distributed data archive devices 100A, 100B, and 100C, respectively.

  Thereafter, the processing performed in each of the distributed data archive devices 100A, 100B, and 100C is as described in §1. For example, in the distributed data archive device 100A, the partial storage target data D1 is divided into three divided data D11, D12, and D13, and stored in the storage locations 301, 302, and 303 via the network 200. Similarly, in the distributed data archive device 100B, the partial storage target data D2 is divided into three divided data D21, D22, and D23 and stored in the storage locations 304, 305, and 306 via the network 200. In the device 100C, the partial storage target data D3 is divided into three divided data D31, D32, and D33 and stored in the storage locations 307, 308, and 309 via the network 200.

  As a result of such work, management data M1, M2, and M3 are output from the respective distributed data archive devices 100A, 100B, and 100C. The data division / integration apparatus 400 outputs the collection of the management data M1, M2, and M3 as a deposit certificate for the original storage target data D to the user.

  On the other hand, the operation of extracting the original storage target data D using the data storage system shown in FIG. 7 is as follows. First, the user gives a collection of management data M1, M2, and M3 to the data division / integration device 400 and makes a request for drawing out the original storage target data D. Then, the data division / integration device 400 gives the management data M1, M2, and M3 to the distributed data archive devices 100A, 100B, and 100C, respectively, and requests the partial storage target data D1, D2, and D3 to be withdrawn. . When the partial storage target data D1, D2, and D3 are output from the respective distributed data archive devices 100A, 100B, and 100C in this way, the data dividing / integrating device 400 performs a process of integrating them, and finally. The restored original storage target data D is provided to the user.

  The advantage of the data storage system shown in FIG. 7 is that the time required for depositing and withdrawing original storage target data D can be shortened. Each of the distributed data archiving apparatuses 100A, 100B, and 100C performs a process of storing the divided file in a predetermined storage location via the network 200. Therefore, if it takes time to transmit data on the network 200, the process is performed accordingly. It will take time. In particular, when the Internet is used as the network 200 and a server device installed at a location that is a topological distance away via a router is used as each storage location, data transmission often takes time. Further, as described in §2, in the case where the distributed data archiving apparatuses are cascaded in a plurality of stages, a longer time is required until the data transmission to the final distributed data archiving apparatus is completed.

  On the other hand, from the user's standpoint, the data backup processing time is preferably as short as possible. In particular, in business sites, operations are often performed in which a large volume of data is backed up at a specific time during the night. For example, when it is necessary to back up necessary data for 3 hours from 2 am to 5 am, a conventional data storage system as shown in FIG. There will also be situations where it cannot be completed within the specified time.

  As shown in FIG. 7, if a plurality of distributed data archiving apparatuses are connected in parallel, the plurality of distributed data archiving apparatuses can share work, and the above-described problems can be solved. . That is, as in the example shown in FIG. 7, if three distributed data archive devices are connected in parallel, the time required for processing by one distributed data archive device is approximately 1/3 of the time required. It becomes possible to execute processing.

  The division process performed in the data division / integration apparatus 400 is a process for sharing work among a plurality of distributed data archive apparatuses. Therefore, the division process executed by the division processing unit 121 shown in FIG. Is different. That is, the division processing performed by the division processing unit 121 needs to adopt a method in which a third party is not expected to have a division method as much as possible to ensure security. There is no need for such a division process. Therefore, the data division / integration apparatus 400 only needs to perform a simple division process (for example, to divide the sheep into three equal parts so as to cut it).

It is a block diagram for demonstrating the basic composition and the operation | movement of the distributed data archive apparatus 100 utilized by this invention. It is a block diagram which shows the concept of the deposit process by the distributed data archive apparatus 100 shown in FIG. It is a conceptual diagram which shows the procedure of the encryption process which concerns on this invention. It is a conceptual diagram which shows the dummy data addition process which concerns on this invention. It is a block diagram which shows the data storage principle by the distributed data archive apparatus 100 utilized by this invention. It is a block diagram which shows the structure of the data storage system using the network which concerns on the 1st Embodiment of this invention. It is a block diagram which shows the structure of the data storage system using the network which concerns on the 2nd Embodiment of this invention.

Explanation of symbols

100, 100A, 100B, 100C ... distributed data archive device 110 ... management data output means 120 ... deposit processing means 121 ... split processing section 122 ... encryption processing section 123 ... dummy data addition section 124 ... storage processing section 130 ... extraction process Means 131 ... Integration processing unit 132 ... Decryption processing unit 133 ... Dummy data removal unit 134 ... Extraction processing unit 140 ... Management data input means 200 ... Network (Internet)
301-350 ... Storage location (data server device)
400: Data division / integration device D: Original storage target data D1, D2, D3: Split file (storage target data)
D1c, D2c, D3c ... Encrypted divided file Dc ... Encrypted data Dc1, Dc2, Dc3 ... Divided encrypted files D11-D33 ... Divided files M, M1-M3 ... Management data

Claims (8)

A data storage system having a function of distributing and storing data to be stored in a plurality of storage locations accessible via a network, and a function of retrieving stored data as needed,
Depositing processing means for performing deposit processing for storing data to be divided into a plurality of divided files and distributing the data to a plurality of storage locations via the network when storing data, and management data indicating the method of the deposit processing Management data output means for generating and storing the data directly or indirectly via online transmission to a predetermined recording medium, and management data input means for inputting the management data at the time of data retrieval And a withdrawal processing means for performing a withdrawal process for taking out a plurality of divided files stored in a distributed manner and restoring them to the original storage target data based on the inputted management data With multiple
A specific divided file stored in a specific storage location by deposit processing of the nth (n is an integer equal to or greater than 1) distributed data archive device is stored as the (n + 1) th distributed data archive device. It has a function of handling as data and further dividing the specific divided file into a plurality of divided files, and performing a process of storing in a plurality of storage locations different from the specific storage location. A data storage system using a network. The data storage system according to claim 1,
A total of N stages of distributed data archiving apparatuses from the first stage of the distributed data archiving apparatus to the Nth stage (N is an integer of 2 or more) of the distributed data archiving apparatus ;
A specific divided file stored in a specific storage location by the depositing process of the i-th stage (i = 1 to N−1) distributed data archive apparatus is assigned to the (i + 1) -th stage distributed data archive apparatus. In the distributed data archive device at the (i + 1) -th stage, the specific divided file is further divided into a plurality of divided files, and a plurality of storages different from the specific storage location are stored. It is configured to be distributed and stored in places,
When the original storage target data is stored in the first- stage distributed data archive device, the first- stage management data to the N-th data created by the first- stage distributed data archive device. the stage of the distributed all N sets of management data in the data archive device up to the N-th stage of the management data created, the first stage of the distributed data archive device, indirectly by directly or online transmission A data storage system using a network characterized in that the data is output to a predetermined recording medium . The data storage system according to claim 1 or 2,
The storage location itself as the storage location of the divided file by the deposit processing of the nth (n is an integer of 1 or more) distributed data archive device is configured by the (n + 1) th distributed data archive device. Data storage system using the network. In the data storage system according to claims 1 to 3,
The depositing processing means of each distributed data archive device stores a division processing unit that divides storage target data into a plurality of divided files based on a predetermined division method, and stores each divided file in different storage locations via a network. A storage processing unit,
A retrieval processing unit of each distributed data archive device recognizes the storage location of each divided file from the input management data, and takes out each divided file from the recognized storage location via the network; An integrated processing unit that recognizes the division method from the input management data, and based on the recognized division method, integrates the extracted individual divided files to generate the original storage target data,
Data using a network, wherein the management data output means of each distributed data archive device has a function of creating management data including information indicating the division method and information indicating the storage location of each divided file Storage system. The data storage system according to claim 4,
In the deposit processing means, before or after dividing the storage target data, an encryption processing unit for performing encryption processing on the storage target data or the divided file is provided, and the management data creation means determines the encryption processing method. A function of adding information to the management data, and the encryption processing method is recognized from the input management data in the extraction processing means, and the decryption processing is performed based on the recognized encryption processing method. A data storage system using a network, comprising a distributed data archiving apparatus that includes a decryption processing unit that performs the above-described processing and restores original storage target data through the decryption process. The data storage system according to claim 4 or 5,
In the deposit processing means, a dummy data adding unit for executing dummy data adding processing for adding dummy data to the storage target data or the divided file is provided, and the management data creating means determines the method of the dummy data adding processing. A function for adding the information shown to the management data. The drawer processing means recognizes the dummy data addition processing method from the inputted management data, and performs dummy processing based on the recognized dummy data addition processing method. A network having a distributed data archive device provided with a dummy data removal processing unit for performing dummy data removal processing for removing data, wherein the original data to be stored is restored through the dummy data removal processing Data storage system using A data storage system having a function of distributing and storing data to be stored in a plurality of storage locations accessible via a network, and a function of retrieving stored data as needed,
Depositing processing means for performing deposit processing for storing data to be divided into a plurality of divided files and distributing the data to a plurality of storage locations via the network when storing data, and management data indicating the method of the deposit processing Management data output means for generating and storing the data directly or indirectly via online transmission to a predetermined recording medium, and management data input means for inputting the management data at the time of data retrieval And a plurality of distributed data having a drawer processing unit that performs a drawer process of taking out a plurality of divided files stored in a distributed manner and restoring them to the original storage target data based on the inputted management data An archive device;
The original storage target data is divided into a plurality of partial storage target data, and each partial storage target data is given to each of the plurality of distributed data archive devices as the storage target data, and the plurality of distributions A data dividing / integrating device having a function of integrating the partial storage target data extracted by the type data archive device and generating the original original storage target data;
A data storage system using a network characterized by comprising: The data storage system according to claim 7,
When storing data, the data division / integration device outputs and stores a collection of management data output from each distributed data archive device directly or indirectly to a predetermined recording medium by online transmission. it has a make function, when extraction of the data, enter the collection of the management data, data storage system using a network and having a function of providing it to the individual distributed data archive device.