JP5133850B2 - Re-encryption system for storage node and network storage - Google Patents

Description

The present invention relates to a storage node re-encryption system and network storage that can convert encrypted data into re-encrypted data without converting it into plaintext data in the middle of the storage node.

  As shown in Non-Patent Documents 1 and 2, as the importance of information security increases, it is essential to consider various data protection requirements even in network storage. Conventionally, there is an encrypt-on-disk method as a method for maintaining the confidentiality of data during transmission, which is one of the protection requirements. This is a method of storing data in the storage in an encrypted state. Compared with the encrypt-on-wire method that uses encryption only at the time of transfer, the transfer performance is good, but encryption is accompanied by the revocation of the access right of the user. The encrypted data must be re-encrypted with a new key. On the other hand, an autonomous disk [Non-Patent Document 3] as a high-function distributed storage system is configured by a cluster of high-function disk nodes connected to a network. Functions such as fault tolerance, load balancing, and capacity distribution are autonomously executed using the node's processing power. In high-function storage that employs the encrypt-on-disk method, it is desirable to perform re-encryption processing on the storage node when the user's access right is revoked. By doing so, the burden on the client can be reduced, and at the same time, the confidentiality of the transmission path, which is the purpose of the encrypt-on-disk method, can be maintained.

  The encrypt-on-disk method is one of the encryption usage methods that protects data on the transmission path in network storage from interception by malicious users. In the encrypt-on-disk method, data is encrypted and stored in the storage node. Therefore, encryption processing is not required when data is transmitted / received on the storage side. Another method is the encrypt-on-wire method. In this method, data is stored in a plain text state, and encryption / decryption processing is performed at the time of transmission / reception. When these two methods are compared in terms of data transfer performance, the encrypt-on-disk method is superior. This is because, in the encrypt-on-wire method, encryption processing always occurs at the time of transmission / reception on the storage side, and a new encryption key is generated for each session, so the key generation cost is high.

  In a system where data is shared by multiple users, the target data must be re-encrypted with a new encryption key when the user's access rights are revoked in the encrypt-on-disk method. This is because a user whose access rights have been revoked (revoked user) may have the encryption key currently used, and access control methods such as an access control list (ACL) can be used to request access to the revoked user. Even if it is refused, information is leaked if the data is passed to revoked user by unauthorized access such as interception.

  Accordingly, the inventor has proposed a re-encryption method [BA-Rev (Backup Assist Revocation)] [Non-Patent Document 4] at the time of revocation of access right that balances performance and security in distributed storage. In this method, the re-encryption process is processed on the storage node. Therefore, by encrypting backup data with a new key in advance and making it primary when access right revocation occurs, the time until access recovery can be shortened by re-encryption processing. Then re-encrypt the original primary in the background and set it as a new backup.

JP 2005-252384 A [Patent Document 1] discloses an example of a re-encryption technique in a server system for storing encrypted data. In this server system, at the time of re-encryption, only the difference between the new key and the old key is sent to the proxy server, and the proxy server directly re-encrypts only with the key difference.
E. Riedel, M.C. Kallahalla, and R. Swaminathan, “A framework for evalating storage system security,” FAST '02: Proceedings of the 1st USENIX Conference on File and Storage Technologies, pp. 15-30, USENIX Association, 2002. P. Stanton, “Securing Data in Storage: A Review of Current Research,” ArXiv Computer Science e-prints, 2004. H. Yokota, “Autonomous Disks for Advanced Database Applications,” Proc. of International Symposium on Database Applications in Non-Traditional Environments (DANTE'99), pp. 435-442, Nov. 1999. Kazuki Takayama, Dai Kobayashi, Haruo Yokota, “Authorization Revocation Processing of Encrypted Data in Storage Using Replication”, 18th Data Engineering Workshop (DEWS2007), Feb./Mar. 2007 JP 2005-252384 A

  When re-encryption processing is performed on the storage node, the normal re-encryption method has a plaintext state during processing, or the encryption key is stored in a form that can be acquired for re-encryption, etc. For this reason, confidentiality on the storage node cannot be secured. The server system as shown in Patent Document 1 is a system that uses public key cryptography with high processing cost and depends on the nature of a specific cryptographic algorithm therein, so that the technology of the server system is directly used on the storage node. It is not suitable for use with re-encryption.

An object of the present invention is to provide a storage node re-encryption system and network storage that do not generate plain text data during re-encryption on the storage node.

  Another object of the present invention is to provide a storage node re-encryption system and network storage that can achieve the above object without storing an encryption key on the storage node.

  The re-encryption system for a storage node according to the present invention includes an encryption unit that encrypts plaintext data using a first encryption key to create encrypted data, and a data storage unit that stores the encrypted data in a readable manner. The encrypted data is converted into re-encrypted data that can be decrypted with the second encryption key. The storage node re-encryption system includes a double encryption unit and a decryption unit to convert the encrypted data into re-encrypted data that can be decrypted with the second encryption key. The double encryption unit double-encrypts the encrypted data stored in the data storage unit with the second encryption key to create double encrypted data. The decryption unit decrypts the double encrypted data using the first encryption key to create re-encrypted data, and replaces the encrypted data with the re-encrypted data.

  According to the present invention, when the encrypted data stored in the data storage unit is double-encrypted with the second encryption key, plain text data is not generated. In addition, when the double encrypted data is decrypted using the first encryption key, the first encryption key is decrypted and only re-encrypted data encrypted with the second encryption key is generated. During this process, plain text data is not generated. Therefore, according to the present invention, it is possible to re-encrypt on the storage node without generating plaintext data.

  It is preferable that the first encryption key and the second encryption key are encrypted with a public key and stored in a key server connected via a network. The double encryption unit registers the second encryption key used for double encryption in the key server, and the decryption unit decrypts the first encryption key acquired from the key server using the secret key. Thus, if the first encryption key and the second encryption key are not stored on the storage node but stored in the key server, the confidentiality of the common key can be ensured.

  The storage node may include a lock box that stores the first encryption key and the second encryption key by encrypting them with the first public key. In this case, the first secret key paired with the first public key is encrypted with the second public key and registered in the key server. The double encryption unit stores the second encryption key used for double encryption in the lock box using the first public key. Then, the decryption unit obtains the first secret key encrypted with the second public key from the key server and encrypts it using the second secret key paired with the second public key. Decrypt the first secret key. In addition, the decryption unit obtains the first encryption key encrypted with the first public key from the lock box, decrypts the encrypted first encryption key using the first secret key, and decrypts the first encryption key. The double-encrypted data is decrypted by using the first encryption key, and re-encrypted data is created.

  When the key server is used in this way, even if the first encryption key and the second encryption key are stored in the lock box provided on the storage node, unless the third party knows the second secret key. The first secret key cannot be decrypted. Therefore, the second encryption key as a new common key taken out from the lock box cannot be decrypted. Therefore, even if the first encryption key and the second encryption key are stored in the lock box on the storage node, confidentiality can be ensured.

  In addition, when a lock box for storing the first encryption key and the second encryption key is provided on the storage node, the double encryption unit and the decryption unit may be configured by a security chip. When the security chip is used, the first encryption key and the second encryption key read from the lock box are expanded in a confidential state in the security chip, and double encryption and decryption can also be executed in the confidential state. . Therefore, even if the first encryption key and the second encryption key are stored in the lock box 36 on the storage node, confidentiality can be ensured.

  The encryption unit, double encryption unit, and decryption unit perform encryption or decryption in an encryption mode in which encryption and decryption are reversible. As such an encryption mode, the OFB encryption mode can be used. As a result, re-encryption can be realized without generating plaintext for encryption and decryption, and data leakage due to a node fall by an attacker during the re-encryption process can be prevented.

A storage node re-encryption method related to the present invention includes: an encryption unit that encrypts plaintext data using a first encryption key to create encrypted data; and a data storage that stores the encrypted data in a readable manner In the storage node having the storage unit, the encrypted data is converted into re-encrypted data that can be decrypted with the second encryption key. In the method related to the present invention , the double-encrypted data is created by double-encrypting the encrypted data stored in the data storage unit with the second encryption key. Next, double-encrypted data is decrypted using the first encryption key to generate re-encrypted data. Then, the encrypted data is replaced with re-encrypted data.

  The double encryption unit and the decryption unit are preferably configured to encrypt and decrypt data in units of blocks. In this way, data processing becomes easy.

  The network storage according to the present invention includes a plurality of encryption units that encrypt plaintext data using a first encryption key to create encrypted data, and a data storage unit that stores the encrypted data in a readable manner. Storage nodes are connected in parallel to the network. The storage node includes the above-described storage node re-encryption system that converts the encrypted data into re-encrypted data that can be decrypted with the second encryption key. The storage node re-encryption system includes: a double encryption unit that double-encrypts the encrypted data stored in the data storage unit with a second encryption key to create double-encrypted data; A decryption unit that decrypts the encrypted data using the first encryption key to create re-encrypted data, and replaces the encrypted data with the re-encrypted data. A lock box for storing the first encryption key encrypted with the first public key and the second encryption key encrypted with the second public key is provided in another storage node connected to the network. It has been. The double encryption unit stores the second encryption key encrypted with the second public key in the lock box. In addition, the decryption unit decrypts the first encryption key encrypted with the first public key from the lock box using the first secret key paired with the first public key, and decrypts the first Decrypt the double-encrypted data using the encryption key to create re-encrypted data. If a lock box is provided in another storage node in this way, the encryption key is not stored on the storage node, so that confidentiality can be improved. Further, since the second encryption key that is the common key after re-encryption is encrypted with the second public key different from the first public key, the confidentiality can be further improved.

  According to the present invention, when the encrypted data stored in the data storage unit is double-encrypted with the second encryption key, plaintext data is not generated, and the double-encrypted data is Even when decryption is performed using the first encryption key, the first encryption key may be released and re-encrypted data encrypted with the second encryption key may be generated. In this case, since plaintext data is never generated, it can be re-encrypted on the storage node without generating plaintext data, and can be re-encrypted with high confidentiality.

The following embodiments of the storage node re-encryption system及beauty Netw network storage of the present invention will be described in detail. Before describing the embodiment of the present invention, an outline of the system, data structure, and encryption mode used in the embodiment of the present invention will be described.

[High-performance distributed storage system]
The inventors have proposed an autonomous disk [Non-Patent Document 3] as a system for autonomously managing data using the arithmetic processing capability on the storage device. An autonomous disk is composed of a cluster of high-function disk nodes or storage nodes connected to a network. Utilizing the computing capability of this high-function disk, functions such as fault tolerance, load balancing, and capacity distribution are autonomously executed on the storage side to reduce the burden of storage management by the user. The present embodiment is intended for a storage node re-encryption system and network storage used in a high-function storage system such as an autonomous disk that employs the above-described encrypt-on-disk method. According to the policy of the autonomous disk, the re-encryption process accompanying access right revocation is performed on the storage node side to reduce the burden on the client side.

[Network configuration]
In the network storage according to the present embodiment, a plurality of storage nodes are network-connected in parallel. These storage nodes are similarly accessed from client nodes connected to the network.

[Encryption technology used]
Ciphers can be classified into common key cryptography that uses a common key for encryption and decryption, and public key cryptography that uses a different pair of keys. In common key cryptography, the encryption side and the decryption side must share a key in a secure manner in advance. On the other hand, in public key cryptography using a pair of a public key and a private key, one of the pair (public key) can be disclosed, so there is no problem of key distribution. On the other hand, however, public key cryptography generally has a problem that its processing speed is several hundred to several thousand times that of common key cryptography. In consideration of these characteristics, in general, a common key is distributed using public key cryptography, and data is often exchanged using the common key. This method is also adopted in the present embodiment.

In a part of the present embodiment, a lock box is used as a structure for managing a data encryption key. The lock box is a key management structure that stores an encryption key and can be extracted only by a user having access rights. FIG. 1 shows non-patent literature (E. Miller, D. Long, W. Freeman, and B. Reed, “Strong Security for Network-Attached Storage,” FAST'02: Proceedings of the 1st USENIX Conference on File and Storage. Technologies, p. 1, Berkeley, CA, USA, 2002, USENIX Association.) An example of a key object that is a lock box is shown. User X, the public key Kx ⁺ and a private key Kx ^- have, certain data is assumed to be encrypted with the common key K. Each row of the key object includes a user ID, a common key Kx ⁺ (K) encrypted with the user's public key, and a type of access right Px authorized by the user. To obtain a stored common key, only a properly authorized user can obtain a common key because it can only be decrypted using a private key that is paired with the public key and stored on the user's own client node. . In some embodiments of the invention, the key object structure is used to manage keys. One key object corresponds to one file, and a key obtained by encrypting the file is stored on the storage node. Also, in some embodiments of the present invention, each storage node has a public key and a private key as well as the user, and the storage object performs a cryptographic process such as re-encryption. It shall hold an obtainable key.

[OFB encryption mode]
OFB (Output Feed Back) mode is one of encryption modes of block cipher. In this embodiment, this encryption mode is used. A simplified diagram of the flow of processing is shown in FIG. The first block of the ciphertext is obtained by encrypting an initial vector (IV) to generate a pseudo random number bit string and performing an exclusive OR operation with the plaintext block. Subsequent blocks can be obtained by further encrypting the pseudo random number bit string of the previous block and similarly performing an exclusive OR operation with plaintext. As a feature of the OFB mode, the encryption processing part can be executed independently of the plaintext, and the processing to the actual plaintext is only exclusive OR, and it is used for stream encryption. Also, the encryption and decryption processes are the same. The OFB mode has a disadvantage that it is vulnerable to random access since it starts with initial vector encryption and must be processed sequentially from the first block. On the other hand, there is a mode that is strong against random access called CTR (counter) mode. In the CTR mode, a counter value having a value corresponding to the position of the block is used as an input for the encryption process, not the pseudo random number bit string of the previous block, so that a process from an intermediate block is possible. In the present invention, it is also possible to encrypt using the CTR (counter) mode.

  In the following embodiment, it is assumed that an assumed attacker exists on the same network as the target distributed storage system and can perform the next attack.

  ・ Attacks the transmission line and intercepts data being transferred.

  ・ Attach to a storage node and cause it to fall and take internal data. It is assumed that the attacker does not have access to the stored file and does not have any data such as a key.

  The re-encryption system for a storage node according to the embodiment of the present invention that prevents the above-described attack is a highly functional storage system such as an autonomous disk. Reduce the burden on the administrator. When applying the encrypt-on-disk method with good data transfer performance to the high-function storage in the transmission data protection method, the re-encryption processing at the time of revocation of access right is also processed on the storage side. The burden on the client can be reduced. On the other hand, in the normal re-encryption process, the encrypted data is decrypted and then encrypted, so plain text appears as an intermediate product, which causes a problem that the confidentiality on the storage node cannot be protected. . With respect to this problem, when the storage node re-encryption system according to the embodiment of the present invention is used, plain text is not generated during processing.

  In the present embodiment described below, the OFB mode is used as the encryption mode. In the OFB mode, encryption is performed by obtaining an exclusive OR of plaintext and a pseudo random number bit string. Decryption is performed by performing similar processing on the ciphertext. Here, since the exclusive OR is based on an exchange rule, encryption and decryption in the re-encryption process are also reversible. By utilizing this property, re-encryption processing is performed in the order of “encryption” and “decryption” in order to realize re-encryption that does not generate plaintext. It becomes possible to prevent data leakage due to the fall. It should be noted that key management needs to be considered in order to prevent leakage due to the fall of one storage node, including the steady state. In order to perform re-encryption on the storage side, it is necessary to store the common key in a form that can be used by the storage node, but if this unprotected key is placed on the same node as the encrypted file, that node will fall. This is because the data will be leaked at the time. As a countermeasure, the key is managed by a method of managing the key in another storage node as in one embodiment described later, or by performing encryption using a dedicated hardware such as a security platform or a security chip. A possible method is to make it impossible to seize. Examples of the latter include Seagate Technology's DriveTrust (trademark) and Fujitsu Limited's MTZ2 CJ, which incorporate an encryption circuit in a hard disk (HDD).

  FIG. 3 is a block diagram showing the configuration of the first embodiment of the storage node re-encryption system of the present invention applied to the storage node, and FIG. 4 is a conceptual diagram of the re-encryption of the first embodiment. FIG. 5 is a diagram showing a flow of re-encryption in the present invention. The key management structure shown in FIG. 5 is realized by a key server or a lock box.

  This storage node re-encryption system comprises an encryption unit 1, a data storage unit 2, a double encryption unit 3 and a decryption unit 4 on the storage node A in FIG. The key server 5 is also part of this system. In this embodiment, a high-function disk node used in the above-described high-function distributed storage system is used as a storage node. Further, as described above, a plurality of storage nodes are connected in parallel to the network NW. The above-described OFB encryption mode is employed as the encryption mode used by the encryption unit 1, the double encryption unit 3, and the decryption unit 4.

The encryption unit 1 encrypts the plain text data F using the first encryption key K ₁ to create encrypted data K ₁ (F). The data storage unit 2 stores the encrypted data K ₁ (F) in a readable manner. When the encrypted data is re-encrypted with a new key in accordance with the revocation of the user access right, the double encryption unit 3 uses the encrypted data K ₁ (F) stored in the data storage unit 2. Is double-encrypted with the second encryption key K ₂ to create double encrypted data K ₁ K ₂ (F). Then, the decryption unit 4 decrypts the double encrypted data K ₁ K ₂ (F) using the first encryption key K ₁ to create re-encrypted data K ₂ (F), and the data storage unit 2 replacing the encrypted data K ₁ stored (F) a re-encrypted data K ₂ (F) to. In the present embodiment, the first encryption key K ₁ and the second encryption key K ₂ are registered (or managed) in the key server 5 connected via the network NW. As described above, the user X, public key Kx ⁺ and the secret key Kx ^- have and. The first encryption key K ₁ and the second encryption key K ₂ are encrypted with the public key Kx ⁺ and registered in the key server 5 as Kx ⁺ (K ₁ ) and Kx ⁺ (K ₂ ). Note that after the re-encryption is completed, the encrypted first encryption key Kx ⁺ (K ₁ ) may be deleted from the key server 5. Also, the encrypted second encryption key Kx ⁺ (K ₂ ) is registered as a common key in the key server 5 when the double encryption unit 3 performs double encryption. The user X obtains the _first encryption key K ₁ by decrypting the first encryption key Kx ⁺ (K ₁ ) encrypted by using the secret key Kx ⁻ in the decryption unit 4 of the storage node A. . Decoding unit 4 first decodes the double encrypted data K ₁ K ₂ (F) using an encryption key K _1, the re-encrypted data K ₂ which can be decoded by the second encryption key K ₂ ( F) is output.

According to the storage node re-encryption system of the present embodiment, the encrypted data K ₁ (F) stored in the data storage unit 2 is duplicated by the double encryption unit 3 using the second encryption key K _2. The plaintext data F is not generated when encrypting. Also in the decoding section 4 the double encrypted data K ₁ K ₂ (F) when the decrypted using the first encryption key K _1, the first encryption key K ₁ is solved in a second encryption key K only encrypted re-encrypted data K ₂ (F) is generated by _2, in the course of decoding, no plaintext data F is generated. Therefore, according to this embodiment, it is possible to re-encrypt on the storage node without generating the plaintext data F once. In the present embodiment, since the first encryption key K ₁ and the second encryption key K ₂ are stored in the key server 5 connected via the network NW, the re-encrypted data K ₂ (F) The second encryption key K ₂ necessary for decryption can be protected from attacks on the storage node, and confidentiality can be ensured.

6 and 7 are a block diagram and a conceptual diagram of re-encryption according to the second embodiment of the storage node re-encryption system of the present invention. The same blocks as those used in the first embodiment shown in FIG. 3 and FIG. 4 are given the same number of codes as the number of codes shown in FIG. 3 and FIG. Description is omitted. In the second embodiment, re-encryption is executed in the re-encryption process flow of FIG. In the second embodiment, the storage node includes a lock box 16 that stores the first encryption key K ₁ and the second encryption key K ₂ encrypted with the first public key Kx ⁺ . Prior to re-encryption, the first encryption key K ₁ is encrypted with the first public key Kx ⁺ and stored in the lock box 16. In the present embodiment, the first secret key Kx ⁻ paired with the first public key Kx ⁺ is encrypted with the second public key K _YK ⁺ and registered in the key server 15. The double encryption unit encrypts the second encryption key K ₂ used for the double encryption with the first public key Kx ⁺ and stores it in the lock box 16. The decoding unit 14, the first secret key Kx encrypted acquired from the key server 15 ^- a second secret key K _YK become the second public key K _YK ⁺ and set ^- decoding by. The decoding unit 14, first with a first encryption key K ₁ encrypted with the first public key Kx ⁺ acquired from the lock box 16 decodes the first cipher key K ₁ encrypted of the secret key Kx ^- decoded using the. Then, the decryption unit 14 decrypts the double encrypted data K ₁ K ₂ (F) using the decrypted first encryption key K ₁ and creates re-encrypted data K ₂ (F).

When the key server 15 is used as in the present embodiment, even if the first encryption key K ₁ and the second encryption key K ₂ are stored in the lock box 16 provided on the storage node, a third party There second secret key K _YK ^- without knowing the first secret key Kx ^- because it can not decode the second can not decrypt the encryption key K ₂ taken out from the lock box 16. Therefore, even if the first encryption key K ₁ and the second encryption key K ₂ are stored in the lock box 16 on the storage node, confidentiality can be ensured.

8 and 9 are a block diagram and a re-encryption conceptual diagram of the third embodiment of the re-encryption system for storage nodes used in the network storage of the present invention. The same blocks as those used in the embodiment shown in FIG. 3 and FIG. 4 are given the same reference numerals as those shown in FIG. 3 and FIG. To do. In this embodiment, re-encryption is executed in the re-encryption process flow of FIG. The network storage includes an encryption unit 21 that encrypts plaintext data using the first encryption key K ₁ to create encrypted data, and a data storage unit 22 that stores the encrypted data in a readable manner. A plurality of storage nodes A and B are configured to be connected in parallel to the network NW. The storage node A includes an encryption unit 21 and a data storage unit 22 and converts the encrypted data into re-encrypted data that can be decrypted with the second encryption key K _2. It has. The storage node re-encryption system includes a double encryption unit 23 that double-encrypts the encrypted data stored in the data storage unit 22 with the second encryption key K ₂ to create double-encrypted data. The double encrypted data K ₁ K ₂ (F) is decrypted using the first encryption key K ₁ to generate re-encrypted data K ₂ (F), and the encrypted data K ₁ (F) is And a decryption unit 24 that replaces the encrypted data K ₂ (F). Then, to the other storage node B connected to the network NW, the second encryption key encrypted with the first public key K ₁ ⁺ and the second public key K _XK ^{+ is} encrypted with the first public key Kx ⁺ . A lock box 26 for storing the encryption key K ₂ is provided. The double encryption unit 23 stores the second encryption key K ₂ encrypted with the second public key K _XK ⁺ in the lock box 26. The decoding unit 24 from the lock box 26 first secret key Kx comprising a first encryption key K ₁ encrypted with the first public key Kx ⁺ to the first public key Kx ⁺ a set ^- the Using the decrypted first encryption key K ₁ , the double encrypted data K ₁ K ₂ (F) is decrypted to generate re-encrypted data K ₂ (F). If the lock box 26 is provided in the other storage node B as described above, the encryption key is not stored on the storage node A, so that confidentiality can be improved. In addition, since the second encryption key K _{2 that} is the common key after re-encryption is encrypted with the second public key K _XK ⁺ different from the first public key Kx ⁺ , the confidentiality is further increased. Can do. Each storage node A, B is provided with a lock box 26 for other storage nodes.

10 and 11 are a block diagram and a conceptual diagram of re-encryption according to the fourth embodiment of the storage node re-encryption system of the present invention. The same blocks as those used in the embodiment shown in FIG. 8 and FIG. 9 are given the same reference numerals as those shown in FIG. 8 and FIG. To do. In this embodiment, re-encryption is executed in the re-encryption process flow shown in FIG. In the present embodiment, a lock box 36 for storing the first encryption key K ₁ and the second encryption key K ₂ is provided on the storage node. The first encryption key K ₁ and the second encryption key K ₂ stored in the lock box 36 are encrypted with the public key Kx ⁺ and stored as Kx ⁺ (K ₁ ) and Kx ⁺ (K ₂ ). ing. In the present embodiment, the double encryption unit 33 and the decryption unit 34 are constituted by the security chip 37. The security chip 37 internally expands the first encryption key K ₁ and the second encryption key K ₂ read from the lock box 36 in a confidential state, and double encryption and decryption are also executed in the confidential state. Therefore, even if the first encryption key K ₁ and the second encryption key K ₂ are stored in the lock box 36 of the storage node, confidentiality can be ensured. In this embodiment, as shown in FIG. 12, the encrypted data K ₁ (F) stored in the data storage unit 2 is converted into block units K ₁ (F) [1] to K ₁ (F) [n]. Divide and block transfer to the security chip 37. The security chip 37 sequentially encrypts the block-transferred encrypted data (F) [1] to K ₁ (F) [n] using the second fitting key K ₂ and sequentially encrypts them in block units. to create a double encrypted data _{K 1 K 2 (F) [} 1] ~K 1 K 2 (F) [n]. Then, the security chip 37 uses the decryption unit 34 to decrypt the first encryption key K ₁ acquired from the lock box and encrypted using the secret key Kx ^−, and use the decrypted first encryption key K ₁ . The block unit double encrypted data K ₁ K ₂ [1] to K ₁ K ₂ (F) [n] is decrypted, and the block unit re-encrypted data K ₂ (F) [1] to K ₂ ( F) Create [n] and transfer it to the data storage unit 32. The data storage unit 32 synthesizes the re-encrypted data K ₂ (F) [1] to K ₂ (F) [n] in units of blocks and converts the encrypted data K ₁ (F) into the re-encrypted data K _2. Replace with (F).

  Since the block cipher is used for data encryption in the present invention, processing can be performed by directly applying the block in the block cipher as the block unit.

  Hereinafter, in order to evaluate the present invention in terms of performance, the results of experiments conducted by creating an encrypted-on-disk file server client program that operates on a PC cluster will be described.

[Experimental program]
The experiment was performed for the case of using the third embodiment shown in FIGS. 8 and 9 and the conventional re-encryption method (normal re-encryption). The response time for file acquisition (get) and the execution time of re-encryption processing on the storage node were measured. In normal encryption, in order to perform normal re-encryption processing, encrypted data is decrypted with the first encryption key K ₁ without double encryption, and then with the second encryption key K ₂ . Re-encryption processing is performed by encrypting. The lock box is stored in the same storage node as the target encrypted file.

Cryptographic usage and key management were as described above. In the third embodiment shown in FIG. 8 and FIG. 9, as an initial state, the file F is encrypted in the unique first encryption key K ₁ and OFB mode, stored in the storage node A, and its lock box. Is stored in the adjacent storage node B. The lock box 26 stores a _first encryption key K ₁ encrypted with the public key Kx ⁺ for re-encryption processing. It was confirmed that the program can complete the re-encryption process without actually generating plain text by performing the following procedure.

step 1: The second encryption key K ₂ is generated at the storage node storing the encrypted file F, and double-encrypted with the second encryption key K ₂ . At this stage, the file is in a double encrypted state K ₁ K ₂ (F).

step 2: The second encryption key K ₂ is transferred to the lock box 26 of the storage node B, and the first encryption key K ₁ is received instead. Therefore Tokikagi exchange performed in a state in which the public key Kx ⁺ in the encryption of the destination node, upon reconstitution secret key Kx to the transmission before and after and the lock box 26 ^- decoding using the ⁺ and public key Kx, the encryption There is a need.

step 3: The file K ₁ K ₂ (F) double-encrypted with the first encryption key K ₁ is decrypted, and then the first encryption key K ₁ is discarded from the lock box 26. Of the processes that can be executed by the program, the file acquisition (get) includes the transfer of the common key for the target user stored in the lock box. For this reason, in this embodiment where the storage location of the lock box is different, the flow of not only the re-encryption process but also the file acquisition (get) process is different.

[Experiment environment]
The experiment was performed on a PC cluster (storage node) configured as shown in Table 1. The parameters shown in Table 2 were used.

  As described in the above table, in the experiment, 1 MB and 500 files are encrypted and stored in three storage nodes, respectively. However, the total data size does not include the size of the lock box. In addition, the file to be acquired is selected from all the files of the selected storage node according to the Zipf distribution determined by the parameter μ. For the Zipf distribution, see D. E. Knuth's "Sorting and Searching" (Addison-Wesley Publishing Company, 1973).

[Experiment 1: Comparison of file acquisition (get) response times]
For each of the three storage nodes storing the files, a file acquisition (get) request was executed 1000 times from one storage node (client node), and the response time was measured.

  FIG. 13 shows the average response time and 95% confidence interval for three storage nodes in conventional normal re-encryption (normal) and re-encryption in the present embodiment (RORE). As a result of the experiment, in the environment to which this embodiment is applied, the response time for file acquisition (get) has increased by about 4.5% on average. This is because, in the present embodiment, the storage node A storing the file acquires a common key (first and second encryption keys) corresponding to the user accessed from the adjacent storage node storing the lock box. I think this is because it must be. However, since the key has a small fixed length, it can be seen that the influence of the transfer is very small.

[Experiment 2: Comparison of re-encryption processing time]
On each of the three storage nodes storing the files, each re-encryption process was executed 1000 times, and the time from the start to the end was measured. Here, the file to be re-encrypted is selected at random. FIG. 14 shows an average processing time and a 95% confidence interval in conventional normal re-encryption (normal) and this embodiment (RORE). From the figure, the re-encryption processing time of the present embodiment (RORE) is increased by about 100 milliseconds, about 47%, compared to normal re-encryption (normal). This is thought to be because, in addition to communication between storage nodes, encryption processing using public key encryption is required when transferring the common key. Here, when a new key is transmitted / received from the storage node A to the storage node B, a new key is set in the lock box, and an old key is transmitted / received from the storage node B to the storage node A, the encryption process using the public key encryption is performed. Necessary. From the results of Experiment 1, it can be seen that the effect of the public key encryption process on the performance is large because the influence of the key transfer process itself is very small.

[Experiment 3: Comparison of effects of re-encryption on other accesses]
The effect of the re-encryption process on other simultaneous accesses was measured experimentally. With the files stored in the storage nodes A and B, the re-encryption process is continuously executed in the storage node A. At this time, the storage node B is a node in which the lock box of the file stored in the storage node A is stored. That is, in the conventional normal re-encryption (normal), the re-encryption process is executed only by the storage node A. In this embodiment (RORE), the re-encryption is performed by the storage node A as shown in FIGS. In this state, the lock box process is executed on the storage node B. In this state, file acquisition (get) was executed 1000 times for the storage nodes A and B, and the response time was measured. FIG. 15 shows the average response time and 95% confidence interval of file acquisition (get) for each storage node in normal re-encryption (normal) and this embodiment (RORE). As a result, compared with a normal state without re-encryption processing (normal: storage node B in the figure), the response time of file acquisition (get) is about 29% in a normal environment, and in this embodiment (RORE) Both storage nodes A and B increased by about 14 percent. Normally, re-encryption processing is performed within one storage node, which greatly affects other accesses. In this embodiment (RORE), where processing is distributed to two storage nodes, It can be seen that the impact on access is also distributed.

  From the result of Experiment 1, it can be seen that the performance degradation of the file acquisition (get) due to the separation of the storage node of the file body and the lock box is very small and can be ignored. Experiment 2 shows that the re-encryption processing time increases. For this reason, performance degradation may occur depending on the location and timing of re-encryption. For example, when the file to be accessed is being re-encrypted, the access is blocked until the processing is completed, and the response time becomes long. The influence on the performance by the re-encryption process in the background is that, in the present embodiment (RORE), the influence is exerted on a plurality of storage nodes, but the degree of performance deterioration per node is small. From the viewpoint of QoS (Quality of Service), it can be said that it is excellent because there is no storage node that significantly deteriorates in performance.

  Also, by applying this embodiment (RORE), plaintext is not generated during re-encryption processing, and data (encrypted file, common key) that can generate plaintext simultaneously exists in one storage node Since there is no period to perform data leakage, it is possible to prevent data leakage when one storage node falls. Further, data leakage can be prevented unless one of the storage nodes storing the lock box corresponding to the storage node storing the file falls. On the other hand, if the storage node that stores a file and the storage node that stores the lock box fall simultaneously, or the storage node that stores the lock box falls, and the target file being communicated is intercepted If so, the file is leaked. However, compared to a system in which data is leaked due to the fall of one storage node, as in the normal method in which plaintext is generated by re-encryption processing, the structure of the distributed storage system is different from that of this embodiment. In this case, since the data is not leaked unless the attacker takes a plurality of steps, it can be said that this embodiment is superior in terms of security compared to the conventional technology. Compared to an environment where the system is assumed not to be trust like an existing secure storage system, this embodiment is not secure because the raw key is handled to perform re-encryption processing on the storage side. It can be said. However, on the other hand, the re-encryption process is performed on the storage side without bothering the user, so that the burden on the client side can be greatly reduced. Therefore, the high-function storage system to which this embodiment (RORE) is applied is suitable for application to a large-capacity distributed file server shared by many people. In such a system, the data management cost is high, and it is desirable to perform the management led by the storage to reduce the burden on the user side. In addition, by applying this embodiment (RORE), the burden on the client side at the time of revoking access rights and system performance degradation can be prevented, and higher confidentiality can be maintained than when performing normal re-encryption processing. be able to.

  In each of the above embodiments, by using the OFB encryption mode that can reversibly perform the encryption process and the decryption process during the re-encryption process, it is possible to realize a re-encryption process that does not generate plaintext as an intermediate product. It is possible to prevent leakage due to a storage node fall during re-encryption processing. In addition, if storage of encrypted files and key management are managed by different nodes, or if hardware dedicated to encryption processing (security chip) is installed in the storage node so that the key cannot be taken, one storage node By considering the processing so that there is no period in which plaintext can be captured with the data of the above, it is possible to realize confidentiality against the above-mentioned one storage node fall.

It is a figure which shows the example of a lock box. It is a figure which shows the flow of the process using OFB encryption mode. It is a block diagram which shows the structure of 1st Embodiment of the re-encryption system for storage nodes of this invention applied to a storage node. It is a figure which shows notionally the re-encryption of 1st Embodiment. It is a figure which shows the flow of the re-encryption in this invention. It is a block diagram of 2nd Embodiment of the re-encryption system for storage nodes of this invention. It is a conceptual diagram of the re-encryption of 2nd Embodiment. It is a block diagram of 3rd Embodiment of the re-encryption system for storage nodes used with the network storage of this invention. It is a conceptual diagram of the re-encryption of 3rd Embodiment of the re-encryption system for storage nodes used with the network storage of this invention. It is a block diagram of 4th Embodiment of the re-encryption system for storage nodes of this invention. It is a conceptual diagram of the re-encryption of 4th Embodiment. It is a figure which shows the flow of the process of the re-encryption in 4th Embodiment. It is a figure which shows the comparison of the average response time in a file acquisition (get) command. It is a figure which shows the comparison of the processing time of encryption. It is a figure which shows evaluation of the influence which encryption processing has on file acquisition (get) in the background.

1, 11, 21, 31 Encryption unit 2, 12, 22, 32 Control data storage unit 3, 13, 23, 33 Double encryption unit 4, 14, 24, 34 Decryption unit 5 Key server 16, 26, 36 Lockbox

Claims (7)

Provided in a storage node comprising: an encryption unit for encrypting plaintext data using a first encryption key to create encrypted data; and a data storage unit for storing the encrypted data in a readable manner, A re-encryption system for a storage node that converts encrypted data into re-encrypted data that can be decrypted with a second encryption key,
A double encryption unit that double-encrypts the encrypted data stored in the data storage unit with a second encryption key to create double-encrypted data;
A decryption unit that decrypts the double encrypted data using the first encryption key to create the re-encrypted data, and replaces the encrypted data with the re-encrypted data;
The storage node includes a lock box for storing the first encryption key and the second encryption key encrypted with a first public key,
A first secret key paired with the first public key is encrypted with a second public key and stored in a key server;
The double encryption unit encrypts the second encryption key used for double encryption with the first public key and stores it in the lock box,
The decryption unit obtains the first secret key encrypted with the second public key from the key server and encrypts it using the second secret key paired with the second public key. Decrypting the encrypted first secret key, obtaining the first encryption key encrypted with the first public key from the lock box, and obtaining the encrypted first encryption key Re-encryption for storage node, wherein decryption is performed using a first secret key, and the re-encrypted data is generated by decrypting the double-encrypted data using the decrypted first encryption key System. The first encryption key and the second encryption key are registered by being encrypted with a public key in a key server connected via a network,
The double encryption unit registers the second encryption key used for double encryption in the key server, and the decryption unit uses the first encryption key acquired from the key server as a secret key. The re-encryption system for a storage node according to claim 1, wherein the re-encryption system is used for decryption. A lock box for storing the first encryption key and the second encryption key;
The storage node re-encryption system according to claim 1, wherein the double encryption unit and the decryption unit are configured by a security chip.   The storage node re-encryption system according to any one of claims 1 to 3, wherein the double encryption unit and the decryption unit encrypt and decrypt data in units of blocks.   The said encryption part, the said double encryption part, and the said decryption part respectively perform encryption or decryption by the encryption mode in which encryption and decryption are reversible. Re-encryption system for storage nodes. A plurality of storage nodes including an encryption unit that encrypts plaintext data using a first encryption key to create encrypted data, and a data storage unit that stores the encrypted data in a readable manner are provided on a network. Configured in parallel,
In the network storage comprising the storage node re-encryption system, wherein the storage node converts the encrypted data into re-encrypted data that can be decrypted with a second encryption key;
A double encryption unit for re-encrypting the encrypted data stored in the data storage unit with the second encryption key to create double encrypted data; ,
A decryption unit that decrypts the double-encrypted data using the first encryption key to create the re-encrypted data, and replaces the encrypted data with the re-encrypted data.
A lock for storing the first encryption key encrypted with the first public key and the second encryption key encrypted with the second public key in the other storage node connected to the network A box is provided,
The double encryption unit stores the second encryption key encrypted by the second public key in the lock box;
The decryption unit decrypts the first encryption key encrypted with the first public key from the lock box using a first secret key paired with the first public key, and decrypts the first encryption key. A network storage that creates the re-encrypted data by decrypting the double-encrypted data using the first encryption key. The network storage according to claim 6 , wherein the encryption unit, the double encryption unit, and the decryption unit perform encryption or decryption in an encryption mode in which encryption and decryption are reversible.

Images