KR101428649B1 - Encryption system for mass private information based on map reduce and operating method for the same - Google Patents

Abstract

A method of operating a system to encrypt mass private information based on map-reduce includes the following steps of: distributing a plurality of private information file blocks into which a private information sequential access method (SAM) file is divided to a plurality of slave servers, and copying and storing the private information file blocks; setting a private information encryption policy in units of private information fields of a private information record included in the private information SAM file; distributing encryption processing tasks to encrypt the private information file blocks to the slave servers; dividing each private information record included in the private information file blocks into a plurality of private information field values in the slave servers, and encrypting each of the private information field values in accordance to the private information encryption policy to generate encrypted field values; reconstructing the encrypted field values generated from the same private information record to generate an encrypted record; and aligning and combining the encrypted records in one of the slave servers to generate an encrypted SAM file.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention [0001] The present invention relates to a large-capacity personal information encryption system based on map re-

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a large-capacity personal information processing method, and more particularly, to a large-capacity personal information encryption system based on map reduction and an operation method thereof.

Recently, a server for storing personal information is hacked, and personal information is leaked. Therefore, accidents related to leakage of personal information frequently occur, and the problem of management of personal information is very serious. In addition, privacy of personal information has become very important because legal information such as personal information protection law and information communication network law is required to protect personal information.

A database management system for storing personal information mainly uses a method of encrypting and storing personal information in order to prevent leakage of personal information due to hacking or the like. For example, encrypting and storing personal information in a database management system involves encrypting personal information using an encryption module at the application level and storing it in a database, encrypting personal information using a cryptographic module performed at the database level And applying encryption to the columns to be stored. Such encryption methods of personal information may cause a heavy load on the server in the course of performing encryption in handling a large amount of personal information, and may degrade the overall performance of the system.

An object of the present invention is to provide a large-capacity personal information encryption system capable of distributing encryption for large-capacity personal information.

Another object of the present invention is to provide a method of operating the large-capacity personal information encryption system.

It should be understood, however, that the present invention is not limited to the above-described embodiments, and may be variously modified without departing from the spirit and scope of the present invention.

In order to accomplish one object of the present invention, a method of operating a mapping-based large-capacity personal information encryption system according to embodiments of the present invention includes a plurality of personal information file blocks divided from a personal information SAM (Sequential Access Method) Distributing and copying the personal information file blocks to a plurality of slave servers and storing them, setting a personal information encryption policy for each personal information field of the personal information record included in the personal information SAM file, And dividing each of the personal information records included in the individual information file blocks into a plurality of personal information field values in the slave servers, Encrypts the personal information field values according to the personal information encryption policy to generate encryption field values And reassembling the encrypted field values generated from the same personal information record to generate an encrypted record; and sorting and merging the encrypted records in one of the slave servers to generate an encrypted SAM file .

According to an embodiment, in each of the slave servers, the encryption records generated from the personal information records included in the distributed personal information file block are sorted in the same order as the personal information records, And transmitting the encrypted records to one of the slave servers.

According to an embodiment, the encryption field values may be generated in at least one encryption server by an encryption request using the personal information encryption policy and the private information field value.

According to one embodiment, a pre-specified number of said personal information records may be provided to said at least one encryption server via one said encryption request.

According to an embodiment, the step of generating the encrypted record may include the steps of removing the encryption field value among the encrypted field values, and replacing the encryption field values corresponding to the same encrypted record with the encryption field values And sorting them in the same order as the fields of the personal information.

According to one embodiment, the high capacity personal information encryption system may use a Hadoop system.

According to another aspect of the present invention, there is provided a method for encrypting private information based on mapridesses, the method comprising: setting a policy for an encryption processing task for encrypting private information; A master server for distributing the encryption processing task for processing, and a plurality of slave servers for performing the encryption processing task distributed from the master server. Wherein the master server comprises a personal information SAM file management unit for managing information on a plurality of personal information file blocks divided from the personal information SAM file, A policy setting unit for setting a policy, and a task distribution unit for distributing the encryption processing task for the personal information file blocks to the slave servers. Wherein the slave server comprises: a personal information file block storage unit for storing the personal information file blocks; a storage unit for dividing the personal information record included in the personal information file blocks into a plurality of personal information field values, An encryption unit generating an encryption record by reassembling the encryption field values generated from the same personal information record by encrypting each of the private information field values to generate encryption field values, And an encrypted SAM file generating unit for merging and generating an encrypted SAM file.

According to an embodiment, the encryption record generating unit may sort the encrypted records generated from the personal information records included in the personal information file block in the same order as the personal information records.

According to an embodiment, the encryption unit may perform an encryption request to at least one encryption server using the personal information encryption policy and the private information field value, and may receive the encryption field value generated at the encryption server .

According to one embodiment, the encryption unit may provide a predetermined number of the personal information records to the encryption server through one encryption request.

According to an embodiment, the personal information SAM file management unit and the personal information file block storage unit use a Hadoop Distributed File System (HDFS), and the policy setting unit, the task distribution unit, the encryption unit, The encrypted record generating unit and the encrypted SAM file generating unit may use the Hadoop map-reduce.

The operation method of the large-capacity personal information encryption system based on the map reduction according to the embodiments of the present invention is a method of distributing and encrypting a large amount of personal information using a plurality of computer clusters, And speed up the execution of large-capacity personal information encryption.

The mapping-based large-size personal information encryption system according to other embodiments of the present invention can speed up the execution of large-capacity personal information encryption. In addition, a large-capacity personal information encryption system can be constituted by a small computer cluster, and a system can be flexibly constructed by expanding the system according to an increase in the capacity of personal information to be processed.

However, the effects of the present invention are not limited to the above effects, and may be variously extended without departing from the spirit and scope of the present invention.

FIG. 1 is a block diagram illustrating a mapping-based, large-capacity personal information encryption system in accordance with embodiments of the present invention.
FIG. 2 is a flowchart illustrating an operation method of a large-capacity personal information encryption system based on mapridesses according to embodiments of the present invention.
FIG. 3 is a diagram illustrating an example of setting a personal information encryption policy in the method of operating the large-capacity personal information encryption system of FIG.
FIG. 4 is a diagram showing an example in which personal information SAM files are distributedly processed in the method of operating the large-capacity personal information encryption system of FIG.
5 is a flowchart illustrating how encryption field values are generated from a personal information record in the map task of FIG.
FIG. 6 is a diagram illustrating an example in which encryption field values are generated in a method in which the encryption field values of FIG. 5 are generated.
7 is a flowchart illustrating a method of generating encrypted records in an operation method of the large-volume personal information encryption system of FIG.
FIG. 8 is a diagram showing an example in which encrypted records are generated in a method in which the encrypted records of FIG. 7 are generated. FIG.
9 is a diagram showing an example in which an encrypted SAM file is generated in an operation method of the large-capacity personal information encryption system of FIG.
FIG. 10 is a diagram illustrating an effect of a large-capacity personal information encryption system according to embodiments of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. The same or similar reference numerals are used for the same components in the drawings.

FIG. 1 is a block diagram illustrating a mapping-based, large-capacity personal information encryption system in accordance with embodiments of the present invention.

Referring to FIG. 1, a large-capacity personal information encryption system may include a master server 120 and a plurality of slave servers 140. The master server 120 may set a policy for an encryption processing task that encrypts personal information and may distribute the encryption processing task to the slave server 140 for distributed processing of the encryption processing task. Each slave server 140 can perform a distributed cryptographic processing task from the master server 120. In one embodiment, a large personal information encryption system may utilize the Hadoop system of cloud computing methods for distributed parallel processing of personal information data. Hadoop consists of a Hadoop Distributed File System (HDFS) that distributes data and a Map-Reduce that distributes and analyzes data. A large personal information encryption system using the Hadoop system may include one job tracker in the master server 120 and a plurality of task trackers in the slave server 140. [ A job tracker can receive a job execution request from a map re- ducer and divide a job into a map and a re- duse, and assign it to a task tracker on a task-by-task basis. Task tracker can execute task assigned from job tracker.

The master server 120 may include a personal information SAM (Sequential Access Method) file management unit 122, a policy setting unit 124, and a task distribution unit 126.

The personal information SAM file management unit 122 can manage information on a plurality of personal information file blocks divided from the personal information SAM file. In one embodiment, the personal information SAM file management unit 122 stores information on which slave server a plurality of personal information file blocks, which are divided from the personal information SAM file, . For example, the client may divide the personal information SAM file into a plurality of personal information file blocks and request the personal information SAM file manager 122 to store the personal information SAM file. In response, the personal information SAM file management unit 122 may provide the client with information on which slave server each personal information file block should be stored. The client can request the slave servers to store the personal information file blocks using the information provided from the personal information SAM file management unit 122. [ In one embodiment, the personal information SAM file manager 122 may manage information about personal information file blocks. For example, the personal information SAM file management unit 122 stores and manages metadata of the personal information SAM file divided into personal information file blocks, the size of personal information file blocks, storage locations of personal information file blocks, and the like can do. In one embodiment, the personal information SAM file manager 122 may use HDFS. In the large-capacity personal information encryption system using the Hadoop system, the personal information SAM file management unit 122 can manage information on the personal information SAM file using the HDFS. That is, the personal information SAM file management unit 122 divides the personal information SAM file into personal information file blocks corresponding to the name node of the HDFS, generates information distributed and duplicated and stored, and manages the information . In the case of using the HDFS, since the personal information SAM file is distributed and duplicated in the slave servers 140, the reliability and reliability of the data can be enhanced by the multiplexing process.

The policy setting unit 124 may set the personal information encryption policy in units of personal information fields of the personal information records included in the personal information SAM file. In one embodiment, the policy setting unit 124 may distinguish between a personal information field as an object of encryption and a private information field that is not an object of encryption, and may specify an encryption method and an encryption code that can be mapped Can be specified. In one embodiment, the policy setting unit 124 may utilize Hadoop's mapping reduction. In the large-capacity personal information encryption system using the Hadoop system, the policy setting unit 124 may be defined in a driver class.

The task distribution unit 126 distributes the encryption processing task for the personal information file blocks divided from the personal information SAM file to the slave servers 140 so that the slave servers 140 can distribute the personal information encryption . In one embodiment, the task distributor 126 may utilize Hadoop's map reduction. In the large-capacity personal information encryption system using the Hadoop system, the task distribution unit 126 may be included in the job tracker, and may be allocated to the task tracker of the slave server 140 on a task-by-task basis upon receipt of the job execution request.

The slave server 140 may include a personal information file block storage unit 141, an encryption unit 142, an encrypted record generation unit 144, and an encrypted SAM file generation unit 146.

The personal information file block storage unit 141 may store the personal information file blocks by receiving the request for storing the personal information file blocks divided from the personal information SAM file. In one embodiment, the personal information file block storage unit 141 may use HDFS. In the high-capacity personal information encryption system using the Hadoop system, the personal information file block storage unit 141 can store the personal information file blocks using the HDFS. That is, the file block storage unit 141 may store the personal information file blocks by receiving a request for storing the personal information file blocks corresponding to the data node of the HDFS.

The encryption unit 142 may divide the personal information record included in the personal information file blocks into a plurality of personal information field values and encrypt the individual information field values according to the personal information encryption policy to generate the encryption field values . That is, the encryption unit 142 may obtain the personal information field values by dividing one personal information record included in the personal information file blocks by fields. The encryption unit 142 may generate the encryption field values using a personal information encryption policy corresponding to each personal information field value and a personal information field value. The encryption unit 142 may encrypt the private information field value in the encryption unit 142 or may perform encryption using an external system such as the encryption server 30 or the like. In one embodiment, the encryption unit 142 performs an encryption request to at least one encryption server 30 using the personal information encryption policy and the private information field value, and transmits the encryption field value generated at the encryption server 30 . In this case, when the encryption request is performed for each value of the private information field, the number of encryption request-response is greatly increased, and the network load and the system load can be increased accordingly. Accordingly, the encryption unit 142 can be performed with one encryption request by grouping a plurality of personal information field values. In one embodiment, the encryption unit 142 may provide a predetermined number of personal information records to the encryption server 30 through one encryption request. For example, the encryption unit 142 may group the personal information field values of 10,000 personal information records into one encryption request. To this end, the encryption unit 142 performs an encryption request by bundling ten thousand personal information records included in the personal information file block, and when the end of the file is reached, requests encryption for the remaining personal information records . In one embodiment, the encryption unit 142 may utilize Hadoop's mapping reduction. In the large-capacity personal information encryption system using the Hadoop system, the encryption unit 142 can be defined in a mapper class.

The encryption record generation unit 144 can re-assemble the encryption field values generated from the same personal information record to generate an encrypted record. That is, the encryption record generation unit 144 may reassemble the encryption field values generated by the encryption unit 142 to generate an encryption record corresponding to the personal information record. In one embodiment, the cryptographic record generator 144 may reassemble the cryptographic field values generated in each slave server 140 in one slave server 140 to generate an encrypted record. In another embodiment, the encryption record generator 144 may reassemble the encryption field values generated in each slave server 140 in each slave server 140 to generate an encrypted record. At this time, the encryption record generation unit 144 may sort the encrypted records generated from the personal information records included in the personal information file block in the same order as the personal information records. That is, the encryption record generation unit 144 partially sorts the encrypted records re-assembled by the slave servers 140, thereby efficiently increasing the sorting speed of the encrypted records performed by the encrypted SAM file generation unit 146 have. In one embodiment, the encryption record generation unit 144 may use Hadoop's mapping reduction. In the large-capacity personal information encryption system using the Hadoop system, the encryption record generation unit 144 may be defined in a Combiner class or a Reducer class.

The encrypted SAM file generation unit 146 may sort and merge the encrypted records generated by the encrypted record generation unit 144 to generate an encrypted SAM file. The encryption SAM file generation unit 146 may be performed in one slave server 140. In one embodiment, the encrypted SAM file generation unit 146 may utilize Hadoop's mapping reduction. In the large-capacity personal information encryption system using the Hadoop system, the encrypted SAM file generation unit 146 may be defined in the Reducer Class.

FIG. 2 is a flowchart illustrating an operation method of a large-capacity personal information encryption system based on mapridesses according to embodiments of the present invention.

Referring to FIG. 2, the personal information SAM file may be generated (S110) according to a format for collecting and processing personal information from various databases or file systems. In one embodiment, a personal information SAM file may be generated at the client. For example, the client may include a personal information SAM file generation unit, and the SAM file generation unit may collect at least one personal information SAM file by collecting personal information. The personal information SAM file creating unit can load the personal information from at least one of the databases and generate the personal information SAM file. Accordingly, the personal information SAM file generation unit can load and store the personal information SAM from a plurality of databases having various platforms, and the generated personal information SAM file can be one or more.

The personal information SAM file is divided into a plurality of personal information file blocks, and the personal information file blocks may be distributed and duplicated and stored in the slave servers (S120). In a large-capacity personal information encryption system using the Hadoop system, a personal information SAM file can be divided into individual information file blocks by HDFS and stored in each slave server.

The personal information encryption policy may be set (S130) on a personal information field basis of the personal information record included in the personal information SAM file. The personal information encryption policy may be specified by distinguishing between a personal information field as an encryption target and a personal information field that is not an encryption target, and an encryption method and an encryption code that can be mapped may be designated for a personal information field to be encrypted. In a large-capacity personal information encryption system using the Hadoop system, the encryption policy can be defined in a driver class.

An encryption processing task for encrypting private information file blocks may be distributed to a plurality of slave servers and executed in each slave server (S140). That is, an encryption processing task for encrypting personal information file blocks stored in each slave server can be distributed so that personal information encryption can be distributed on each slave server. Can be assigned to the task tracker of the slave server on a task-by-task basis by the job tracker of the Map Reduce in a large-capacity personal information encryption system using the Hadoop system.

Each of the personal information records included in the individual information file blocks is divided into a plurality of personal information field values at the slave servers, and the personal information field values are encrypted according to the personal information encryption policy to generate encrypted field values ). That is, the personal information field values may be generated by dividing one personal information record included in the personal information file blocks into fields. In addition, the encryption field values may be generated using a personal information encryption policy corresponding to each personal information field value and a personal information field value. In one embodiment, the encryption field values may be generated in the at least one encryption server by a request for encryption using a personal information encryption policy and a private information field value. In one embodiment, a predetermined number of personal information records may be provided to at least one encryption server via one encryption request. However, since the encryption method for the personal information record using the encryption server has been described above, a duplicate description thereof will be omitted. In a large-capacity personal information encryption system using the Hadoop system, a task for generating encryption field values may be defined in a Mapper class and assigned to a task tracker.

The encryption record may be generated (S160) by reassembling the encryption field values generated from the same personal information record. In one embodiment, the encrypted field values generated in each slave server may be reassembled in one slave server to generate an encrypted record. In another embodiment, the encryption field values generated in each slave server may be reassembled in each slave server to generate an encrypted record. At this time, in each of the slave servers, the encrypted records generated from the personal information records included in the distributed personal information file block are sorted in the same order as the personal information records, and the sorted encrypted records are generated in the encrypted SAM file It can be transmitted to any slave server. That is, by partially sorting the reassembled encrypted records in each slave server, it is possible to efficiently increase the sorting speed of the encrypted records to be performed when generating the encrypted SAM file. In a large-capacity personal information encryption system using the Hadoop system, tasks for generating encrypted records can be defined in the Combiner Class or the Reducer Class and assigned to the Task Tracker.

The encrypted SAM file may be generated (S170) by sorting and merging the encryption records in one of the slave servers. In a large-capacity personal information encryption system using the Hadoop system, a task for generating an encrypted SAM file may be defined in the Reducer class and assigned to the task tracker.

FIG. 3 is a diagram illustrating an example of setting a personal information encryption policy in the method of operating the large-capacity personal information encryption system of FIG.

Referring to FIG. 3, the personal information encryption policy may be set in units of personal information fields of the personal information record included in the personal information SAM file. The personal information encryption policy may be specified by distinguishing between a personal information field as an encryption target and a personal information field that is not an encryption target, and an encryption method and an encryption code that can be mapped may be designated for a personal information field to be encrypted. For example, the personal information SAM file may consist of an ID, a name, a resident registration number, and a telephone number field, and the encryption policy file may be composed of a field sequence number and an encryption code. Since the encryption policy file can set an encryption policy for each field, encryption is not applied to the ID and the name field for which encryption is not required, the resident registration number field is the first encryption policy (P001), the telephone number field is the second encryption A policy (P002) can be specified. The first encryption policy P001 may be set to partially encrypt the last six digits of the string and the second encryption policy P002 may be set to partially encrypt the last five digits of the string.

FIG. 4 is a diagram showing an example in which personal information SAM files are distributedly processed in the method of operating the large-capacity personal information encryption system of FIG.

4, a personal information SAM file is divided into a plurality of personal information file blocks and stored in slave servers, and an encryption processing task for encrypting each personal information file block is distributed to a plurality of slave servers , Divides each personal information record included in the individual information file blocks in the slave servers into a plurality of private information field values, and encrypts individual information field values according to the private information encryption policy to generate encryption field values . In the large-capacity personal information encryption system using the Hadoop system, the personal information SAM file is divided into personal information file blocks by HDFS and stored in each slave server, and the task tracker of the map redesses the task tracker of the slave server Can be assigned. The task of generating the encryption field values is defined in a mapper class and can be performed as a map task in each of a plurality of slave servers. For example, the first personal information record (id001 Hongdil 7801011234567 01012341234) stored in the personal information SAM file is stored in the divided personal information file block and each field is stored in the personal information field values 'id001', 'Hongdongdong', '7801011234567' , &Quot; 01012341234 "). According to the encryption policy for the personal information field values, the encryption for the ID and the name is not performed, and the encryption for the resident registration number and the telephone number corresponding to the respective policies can be performed. In one embodiment, encryption is performed on the private information field values to generate an encryption field value, and a key including an encryption field value and an encryption result value (key, value) composed of a value value Lt; / RTI > The format of the encryption result value may be 'line number' as a key and 'field sequence number * encryption field value' as a value. At this time, the encryption can be performed in units of individual information fields included in a plurality of personal information records, so that it is possible to store a plurality of encryption field values belonging to the same personal information record in one value. As described above, by storing a plurality of encryption field values belonging to the same personal information record in one value, it is possible to reduce the burden on sorting and merging when generating an encrypted record, thereby increasing the speed of generating encrypted records.

On the other hand, the key value of the encryption result value may be a key value other than 'line number'. In addition, the value format of the encryption result value may be various formats in addition to 'field sequence number * encryption field value'. For example, if all personal information fields are to be encrypted, the value format may be an 'encryption field value'.

FIG. 5 is a flowchart showing how encryption field values are generated from a personal information record in the map task of FIG. 4, FIG. 6 is a diagram illustrating an example of how encryption field values are generated in a method in which encryption field values of FIG. to be.

Referring to FIG. 5, one personal information record is read out from the personal information file block, and the personal information record is divided into personal information fields (S210). It is checked whether the private information field is an encryption target (S220). If the encryption information is an encryption target, the encryption policy and personal information field values are stored in the first list to perform encryption, and the encryption result value is generated and reassembled into an encrypted record A key value may be stored in the second list, and a field sequence number may be stored in the third list (S230). Encryption may be performed using the first list and an encryption field value may be generated (S240). The generated encryption field value is output (S250), and whether or not the presence of the unprocessed private information field exists exists (S260), the above steps can be repeatedly performed.

6, when the same personal information SAM file and encryption policy file as in FIG. 3 are set, a first personal information record (id0001) is read out from a personal information file block and personal information fields ('id001' Quot ;, and " 01012341234 "). Since the ID and the password are not fields to be encrypted, they can be output as '1 1 * id001' and '1 2 * Hong Kil Dong' as encryption result values (key, value) without performing encryption. 'P001, 7801011234567', 'P002, 01012341234' are stored in the first list to perform encryption because the resident registration number corresponds to the first encryption policy P001 and the mobile phone number corresponds to the second encryption policy P002, The line numbers '1' and '1' are stored in the second list as key values, and the field numbers '1' and '3' are stored in the third list. Personal information encryption can be performed using a separate encryption server. At this time, the personal information field values included in the plurality of personal information records may be performed with one encryption request to reduce the network load and the system load. Thus, values may be stored in the first, second, and third lists for a predetermined number of personal information records, and provided to at least one encryption server via one encryption request. Encryption field values ('7801011iqxkqf', '010123ajqjk') are generated by performing encryption on the private information field at the encryption server, which may be updated in the first list. Accordingly, the first list may store data including the encryption field values such as 'P001, 7801011iqxkqf', 'P002, 010123ajqjk', 'P001, 5602011diqjkj', 'P002, 010998qksjq' The encrypted result values such as '13 * 7801011iqxkq', '14 * 010123ajqjk', '13 * 5602011diqjkj', and '14 * 010998qksjq' are updated using the updated first list and the second and third lists Respectively. At this time, in order to increase the speed of sorting the encrypted field values in the same order as the private information field of the personal information record when generating the encrypted record, the encryption field values are sorted and merged by the same record, and '1 3 * 7801011iqxkqf 4 * 010123ajqjk ',' 1 3 * 5602011diqjkj 4 * 010998qksjq 'can be output, respectively.

FIG. 7 is a flowchart illustrating a method of generating encrypted records in an operation method of the large-capacity personal information encryption system of FIG. 2, and FIG. 8 illustrates an example of generating encrypted records in a method of generating encrypted records of FIG. 7 .

Referring to FIG. 7, the duplicated encryption field value among the encryption field values may be removed (S310) to generate the encrypted record. It may happen that encryption of the same private information field value is performed redundantly in the network transmission / reception characteristic of the cloud computing or the encryption request, so that the encryption field value is duplicated. Therefore, redundant encryption field values among encryption field values can be removed for data integrity. It is possible to determine whether there is an unencrypted encryption field value in the field sequence number order (S320). If an unaligned encryption field value does not exist, the encrypted field values are already sorted in advance by the same record, so an encrypted record can be generated without any sorting. For example, if all the private information fields are to be encrypted, the encryption records can be generated (S340) without any sorting because all encryption field values can be sorted in advance when they are generated. On the other hand, when there is an unaligned encryption field value, the encrypted field values corresponding to the same encrypted record are sorted in the same order as the private information field of the personal information record (S330 ), And an encrypted record may be generated (S340).

Referring to FIG. 8, an encrypted record may be generated by reassembling encrypted field values generated from the same personal information record. In one embodiment, in each of the slave servers, the encrypted records generated from the personal information records contained in the distributed personal information file block may be arranged in the same order as the personal information records. That is, by partially sorting the reassembled cryptographic records in each slave server, it is possible to increase the efficiency in generating the encrypted SAM file. A large-capacity personal information encryption system using the Hadoop system is defined in the Reducer class for the task of generating encrypted records, and can be performed in a combiner stage in each slave server. For example, '1 1 * id0001', '1 2 * Hong Kil Dong', '1 3 * 7801011iqxkqf 4 * 010123ajqjk', '2 1 * id0002', ... If generated, the encrypted field values generated from the first personal information record may be reassembled to generate the encrypted record '1 id0001 Hong Gil Dong 7801011iqxkqf 010123ajqjk'. Similarly, the encrypted field values generated from the second personal information record are reassembled to generate an encrypted record '2 id0002 yi 5602011diqjkj 010998qksjq', and the encrypted field values generated from another personal information record are reassembled to generate an encrypted record . At this time, the encrypted records generated from the personal information records included in the same personal information file block processed in the same slave server can be arranged in the same order as the personal information records.

On the other hand, the large-capacity personal information encryption system using the Hadoop system has a problem that a task for generating an encrypted record is not defined in a combiner class performed in each slave server, but a reducer class Class).

9 is a diagram showing an example in which an encrypted SAM file is generated in an operation method of the large-capacity personal information encryption system of FIG.

Referring to FIG. 9, the encrypted SAM file may be generated by sorting and merging encrypted records in one of the slave servers. In the large-capacity personal information encryption system using the Hadoop system, a task for generating the encrypted SAM file is defined in the Reducer Class and can be performed as a Reduce Task in one of the slave servers. In one embodiment, the cryptographic records generated on each slave server may be collected, sorted and merged in one slave server to generate a cryptographic SAM file. For example, in the combiner stage performed on each slave server, encrypted records can be generated and partially sorted. The encrypted records generated in each slave server are transmitted to the server executed in one slave server, and the Reduce Task can collect, sort and merge the encrypted records to generate the encrypted SAM file.

In another embodiment, encrypted records and encrypted SAM files may be generated with a Reduce Task performed on one slave server without a combiner step. That is, encrypted field values generated in each slave server are transmitted to one slave server, encrypted records are generated in one slave server, and an encrypted SAM file can be generated by sorting and merging the generated encrypted records . However, when an encrypted record is generated in one slave server, the load on the slave server may be increased.

FIG. 10 is a diagram illustrating an effect of a large-capacity personal information encryption system according to embodiments of the present invention.

Referring to FIG. 10, a method 200 for sequentially processing personal information in a single node may be configured such that a next encryption request is not received until a response to an encryption request is received after an encryption request is performed by the encryption server. . On the other hand, the method 300 for performing the distributed processing using the Hadoop system can be regarded as having no restriction on the waiting time for the encryption request since a plurality of encryption requests are simultaneously performed in the slave servers. The results of performing a performance test on a method of sequentially processing personal information encryption in one node and a method of distributing private information by using Hadoop system including seven nodes are shown in Table 1 same.

[Table 1]

As described above, in the method of operating the large-capacity personal information encryption system according to the embodiments of the present invention, the large-capacity personal information is distributed and encrypted by using the plurality of computer clusters, The speed of execution can be increased. In addition, a large-capacity personal information encryption system can be constituted by a small computer cluster, and a system can be flexibly constructed by expanding the system according to an increase in the capacity of personal information to be processed. At this time, the encryption processing speed can be increased in proportion to the number of devices, which is more effective.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the present invention is not limited to the disclosed exemplary embodiments. Modifications and alterations may be made by those skilled in the art. For example, although personal information is described as personal information of individuals, the personal information should be understood to include all information that needs to be encrypted and protected. The encryption method may use various methods, and is not limited to the embodiments.

The present invention can be applied to any system that manages information to be subjected to encryption processing. For example, the present invention can be applied to a customer information management system, a transaction history management system, a trade secret management system, and the like.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it will be understood by those skilled in the art that various changes and modifications may be made therein without departing from the spirit and scope of the invention as defined in the appended claims. You will understand.

30: encryption server 120: master server
122: personal information SAM file management unit 124: policy setting unit
126: task distributor 140: slave server
141: Personal information file block storage unit 142: Encryption unit
144: Encryption record generation unit 146: Encryption SAM file generation unit

Claims (11)

Distributing and copying a plurality of personal information file blocks divided from a personal information SAM (Sequential Access Method) file to a plurality of slave servers and storing the same;
Setting a personal information encryption policy for each personal information field of the personal information record included in the personal information SAM file;
Distributing an encryption processing task for encrypting the personal information file blocks to the slave servers;
The slave servers divide each of the personal information records included in the individual information file blocks into a plurality of personal information field values and encrypt the individual information field values in accordance with the personal information encryption policy, Generating values;
Reassembling the encrypted field values generated from the same personal information record to generate an encrypted record; And
And sorting and merging the encrypted records in one of the slave servers to generate an encrypted SAM file. The method according to claim 1,
Each of the slave servers arranges the encrypted records generated from the personal information records included in the distributed personal information file block in the same order as the personal information records, To the slave server in response to the request from the slave server. The method as claimed in claim 1, wherein the encryption field values are generated in at least one encryption server by an encryption request using the personal information encryption policy and the private information field value. 4. The method of claim 3, wherein a predetermined number of said personal information records are provided to said at least one encryption server via one said encryption request. 2. The method of claim 1, wherein generating the encrypted record comprises:
Removing redundant encryption field values among the encryption field values; And
And arranging the encrypted field values corresponding to the same encrypted record in the same order as the fields of the private information of the private information record. The method as claimed in claim 1, wherein the large-capacity personal information encryption system uses a Hadoop system. A master server for setting a policy for an encryption processing task for encrypting personal information and distributing the encryption processing task for distributed processing of the encryption processing task; And
And a plurality of slave servers for performing the encryption processing task distributed from the master server,
The master server comprises:
A personal information SAM file management unit for managing information on a plurality of personal information file blocks divided from the personal information SAM file;
A policy setting unit for setting a personal information encryption policy in units of personal information fields of the personal information record included in the personal information SAM file; And
And a task distributor for distributing the encryption processing task for the personal information file blocks to the slave servers,
The slave server includes:
A personal information file block storage unit for storing the personal information file blocks;
An encryption unit for dividing the personal information record included in the personal information file blocks into a plurality of personal information field values and encrypting the personal information field values according to the personal information encryption policy to generate encrypted field values;
An encryption record generation unit for generating an encryption record by reassembling the encryption field values generated from the same personal information record; And
And a cipher SAM file generation unit for sorting and merging the encrypted records to generate an encrypted SAM file. 8. The method according to claim 7, wherein the encryption record generation unit arranges the encrypted records generated from the personal information records included in the personal information file block in the same order as the personal information records. system. The information processing apparatus according to claim 7, wherein the encryption unit performs an encryption request to at least one encryption server using the personal information encryption policy and the private information field value, and receives the encryption field value generated in the encryption server A large-capacity personal information encryption system. 10. The system of claim 9, wherein the encryption unit provides the predetermined number of the personal information records to the encryption server through one encryption request. 8. The system according to claim 7, wherein the personal information SAM file management unit and the personal information file block storage unit use a Hadoop Distributed File System (HDFS)
Wherein the policy setting unit, the task distribution unit, the encryption unit, the encryption record creation unit, and the encryption SAM file creation unit use the Hadoop map-reduce.

Images