CN1773994A - Method for realizing data safety storing business - Google Patents

Abstract

A method for realizing service of data safe storage includes up-transmitting user data to network server after it is enciphered locally for not being stolen in courses of transmission and storage, deciphering file only by using user USB bar and by inputting USN bar protection password correctly, setting USB bar backup mechanism so USB bar can be restored by applying effective status certification when USB bar is lost or damaged.

Description

A kind of implementation method of data safety storing business

Technical field

The present invention relates to a kind of implementation method of data safety storing business, exactly, the data security that relates to a kind of file-level is stored in the implementation method of the new business of network system side, belongs to the communication network value-added service

Technical field.

Background technology

Developing rapidly and popularizing along with what the Internet and diverse network were used, individual and enterprise are more and more the schedule of personal information, client list, commercial activity, and other relevant information all stores on the network.In this process, how guaranteeing to obtain safely, easily data just becomes the focus that the user pays close attention to; Many users wish in office, family even oneself the data of going out can both have access to safely during the journey.

At present, there have been many Internet Service Provider ISP that the network storage service of file-level is provided to the user, by on network storage server, distributing certain memory space for the user, under the situation that network can reach, the data of user's access whenever and wherever possible oneself efficiently solve the convenience problem of data access.Though during the sign-on access network storage server,, must use " user name+password " to carry out the authentication authentication as present most of application systems.But a little less than the fail safe of this mode was highly brittle: the user name and password was easy to be stolen; And the user uses this authentication mode just must be at any time or usually remember complicated the user name and password, very sense inconvenience.In addition, these data mostly adopt expressly form when transmission and storage, do not pass through encryption, very easily stolen and cause the leakage of important information by the disabled user, make the user can't store the critical data of commercial affairs such as the production schedule, financial statement, client list, human resources list, occurrences in human life relievedly thereon, make professional popularization be obstructed; Key is the safety issue of storage, needs to be resolved hurrily.

Now, many encryption and decryption software piece that are used for file are arranged on the market, can carry out encryption to the file and the file of this machine storage, even lose or the hacker invades under the situation of main frame at subscriber's main station (as notebook computer etc.), even Xu Ke personnel have stolen file without permission, also can't declassified document, to know user's important information.But, in case after main frame was lost or encryption key loses, damages, the user just can't fetch the file of oneself; The hacker also can adopt the method for deletion encrypt file to destroy user data.Therefore, use the method for local file encryption and decryption software piece still can't solve the safety issue of storage fully reliably merely.How to solve the file-level data and just become the new problem that those skilled in the art pay close attention in the safe storage of network side.

Summary of the invention

In view of this, the objective of the invention is the network storage and two kinds of technology of file encryption are combined, a kind of implementation method of data safety storing business is provided, and this method is to encrypt at the enterprising line data of subscriber's main station, uploads and be stored in network storage server then.Because data were encrypted before being transferred to network storage server, even the assailant intercepts data in transmission course, also can't be decrypted these data; Simultaneously, because storage is at network side, even subscriber's main station is lost, user storage can not lost in the data of network storage server yet.So the present invention can overcome the simple use network storage or the existing problem of this machine file encryption-decryption, realize the safe storage of data.

In order to achieve the above object, the invention provides a kind of implementation method of data safety storing business, it is characterized in that: comprise the following steps: at least

(1) request for utilization: the system management end requires application to open " network security storage " professional user effective identity certificate, contact telephone number and required storage size is provided, through confirmation true and accept applications after, management end carries out initialization process, and the user obtains one and stored the general-purpose serial bus USB rod of personal information and corresponding USB rod protection password;

(2) connect network storage server: after client detected USB rod insertion main frame, the prompting user imported USB rod protection password; After the user correctly imported USB rod protection password, client read IP address, user name and the password of this user on network storage server of the network storage server of storing in the USB rod, is connected to network storage server then and carries out authentication; After checking is passed through, the memory space of user on network storage server is mapped as a virtual partition of this machine by CIFS (CIFS, Common Internet File System) agreement;

(3) file encryption is uploaded: when the user write virtual partition to file, client received this request, earlier file was encrypted, and by the CIFS agreement file after encrypting was uploaded to network storage server again;

(4) down transmitting file deciphering: when the user reads file in the virtual partition, client is intercepted and captured this request, earlier file is passed to subscriber's main station under network storage server, then file is decrypted, and then the file after will deciphering is shown to the user by the CIFS agreement;

(5) disconnect and being connected of network storage server: client detects the USB rod extract main frame after, just being connected of disconnection and network storage server, former virtual partition disappears from subscriber's main station;

(6) charge: the system management end adopts monthly payment or alternate manner to charge according to the size of user applies memory space.

Described method further comprises following one or more step:

(7) recovery of USB rod: information dropout in the USB rod or damage, and the user is not when this machine backup USB rod information, the system management end requires the user that effective identity certificate is provided, after empirical tests is true, management end is searched User Information Database according to the user identity passport NO., to obtain corresponding USB rod backup file, submit to the user then; After the user took backup file, the identity document number of importing oneself can carry out the recovery of USB rod as password;

(8) backup of network storage server: the system management end regularly uses tape library backup system that the file in the network storage server is backed up.

In the described step (1), after management end was accepted user applies, the initialization process operating procedure of carrying out comprised:

(11) on network storage server, create a user name and corresponding password is set, distribute the memory space of corresponding size then according to customer requirements, and the access rights that this memory space is set are read and write for only allowing this user;

(12) a USB rod is formatd, and the protection password of USB rod is set;

(13) call the interface function of USB rod, in the USB rod, generate user's master key;

(14) in the USB rod, write IP address, user name and the password of this user on network storage server of network storage server;

(15) information in the USB rod is backed up, and the effective identity certificate number of backup password for the user is set;

(16) in User Information Database, create a new user record, wherein comprise address name, effective identity certificate number, telephone number, the user name on network storage server, USB rod backup file.

In the described step (3), the operating procedure that client is encrypted file comprises:

(31) client generates session key by the mode of random number, with session key file is encrypted;

(32) client uses the user's master key in the USB rod that session key is encrypted, and the session key after will encrypting again is attached in the file of having encrypted.

In the described step (4), client comprises the operating procedure that the file that passes down is decrypted:

(41) client reads the encrypted session key that is attached in the file, uses the user's master key in the USB rod that session key is decrypted then;

(42) client is decrypted file with session key.

Described USB rod is based on USB interface on the personal computer, card reader equipment with certain memory space and plug and play, speed is fast, volume is little, easy to carry, can finish various encryption and decryption computings to data, at least comprise: Digital Signature Algorithm (DSA, digital signature algorithm), by Rivest, the RSA public key algorithm of Shamir and Adlernan three people invention, data symmetric encipherment algorithm (DES, dataencryption standard), Secure Hash Algorithm SHA-1 (secure hash algorithm), Message Digest 5 (MD5, message-digest algorithm); It is right that the IC chip that is provided with in the rod can produce 1024,768 or 512 long keys at least, and support right importing and the derivation of key, to satisfy various application.

The present invention is a kind of implementation method of data safety storing business, and this method has adopted following multiple measure effectively to guarantee the safety of user data in conjunction with the network storage and two kinds of technology of file encryption:

(1) user data uploads to network storage server again behind local cipher, can illegally not stolen when transmitting and store to guarantee user data, makes the user can use this business to carry out the strange land storage of critical data relievedly.

(2) user only holds the USB rod, and after correctly importing USB rod protection password, could be decrypted file.Even therefore uncommitted person find the USB rod also can't the decrypted user file.

(3) have USB rod back mechanism, make the user under the situation of loss of USB rod or damage, still can recover corresponding information.

(4) in the network storage server side tape library backup device is set, the schedule backup user data is guaranteed when meeting with abnormal conditions, also restore data fast;

Description of drawings

Fig. 1 is the operating process block diagram of the implementation method of a kind of data safety storing business of the present invention.

Fig. 2 is the principle schematic of file encryption.

Embodiment

For making the purpose, technical solutions and advantages of the present invention clearer, the present invention is described in further detail below in conjunction with accompanying drawing.

Referring to Fig. 1 and Fig. 2, the present invention is a kind of implementation method of data safety storing business, mainly carries out associative operation by system management end and client two parts, comprises the following steps:

(1) request for utilization: management end requires application to open " network security storage " professional user effective identity certificate, contact telephone number and required storage size is provided, through confirmation true and accept applications after, management end carries out initialization process, and the user obtains one and stored the USB rod of personal information and corresponding USB rod protection password; The operating procedure of the initialization process of management end comprises:

(11) on network storage server, create a user name, and corresponding password is set, distribute the memory space of corresponding size then according to customer requirements, and the access rights that this memory space is set are read and write for only allowing this user;

(12) a USB rod is formatd, and USB rod protection password is set;

(13) call the interface function of USB rod, in the USB rod, generate user's master key;

(14) in the USB rod, write IP address, user name and the password of user on network storage server of network storage server;

(15) information in the USB rod is backed up, the backup password is set to user's effective identity certificate number;

(16) in User Information Database, create a new user record, wherein comprise address name, effective identity certificate number, telephone number, the user name on network storage server, USB rod backup file.

(2) connect network storage server: after client detected USB rod insertion main frame, the prompting user imported USB rod protection password; After the user correctly imported USB rod protection password, client read IP address, user name and the password of this user on network storage server of the network storage server of storing in the USB rod, is connected to network storage server then and carries out authentication; After checking is passed through, the memory space of user on network storage server is mapped as a virtual partition of this machine by the CIFS agreement.

(3) file encryption is uploaded: when the user write virtual partition to file, client received this request, earlier file was encrypted, and by the CIFS agreement file after encrypting was uploaded to network storage server again;

Wherein to carry out the operating procedure of file encryption be (referring to shown in Figure 2) to client:

(31) client generates session key by the mode of random number, with session key file is encrypted;

(32) client uses the user's master key in the USB rod that session key is encrypted, and the session key after the encryption is attached in the file of having encrypted.

(4) down transmitting file deciphering: when the user reads file in the virtual partition, client is intercepted and captured this request, earlier file is passed to subscriber's main station under network storage server, then file is decrypted, and then show file after the deciphering to the user by the CIFS agreement;

Wherein client to the operating procedure that following transmitting file is decrypted is:

(41) client reads the encrypted session key that is attached in the file, uses the user's master key in the USB rod that session key is decrypted then;

(42) client is decrypted file with session key.

(5) disconnect and being connected of network storage server: client detects the USB rod extract main frame after, just being connected of disconnection and network storage server, former virtual partition disappears from subscriber's main station;

(6) charge: the management end system adopts monthly payment or alternate manner to charge according to the size of user applies memory space.

(7) recovery of USB rod: information dropout in the USB rod or damage, and the user is not when this machine backup USB rod information, management end requires the user that effective identity certificate is provided, after empirical tests is true, management end is searched User Information Database according to the user identity passport NO., to obtain corresponding USB rod backup file, submit to the user then; After the user took backup file, the identity document number of importing oneself can carry out the recovery of USB rod as password;

(8) backup of network storage server: management end regularly uses the tape library backup device that the file in the network storage server is backed up.

Claims (6)

1, a kind of implementation method of data safety storing business is characterized in that: comprise the following steps: at least

(1) request for utilization: the system management end requires application to open " network security storage " professional user effective identity certificate, contact telephone number and required storage size is provided, through confirmation true and accept applications after, management end carries out initialization process, and the user obtains one and stored the general-purpose serial bus USB rod of personal information and corresponding USB rod protection password;

(2) connect network storage server: after client detected USB rod insertion main frame, the prompting user imported USB rod protection password; After the user correctly imported USB rod protection password, client read IP address, user name and the password of this user on network storage server of the network storage server of storing in the USB rod, is connected to network storage server then and carries out authentication; After checking is passed through, the memory space of user on network storage server is mapped as a virtual partition of this machine by CIFS CIFS agreement;

(3) file encryption is uploaded: when the user write virtual partition to file, client received this request, earlier file was encrypted, and by the CIFS agreement file after encrypting was uploaded to network storage server again;

(4) down transmitting file deciphering: when the user reads file in the virtual partition, client is intercepted and captured this request, earlier file is passed to subscriber's main station under network storage server, then file is decrypted, and then the file after will deciphering is shown to the user by the CIFS agreement;

(5) disconnect and being connected of network storage server: client detects the USB rod extract main frame after, just being connected of disconnection and network storage server, former virtual partition disappears from subscriber's main station;

(6) charge: the system management end adopts monthly payment or alternate manner to charge according to the size of user applies memory space.

2, the implementation method of data safety storing business according to claim 1 is characterized in that: described method further comprises following one or more step:

(7) recovery of USB rod: information dropout in the USB rod or damage, and the user is not when this machine backup USB rod information, the system management end requires the user that effective identity certificate is provided, after empirical tests is true, management end is searched User Information Database according to the user identity passport NO., to obtain corresponding USB rod backup file, submit to the user then; After the user took backup file, the identity document number of importing oneself can carry out the recovery of USB rod as password;

(8) backup of network storage server: the system management end regularly uses tape library backup system that the file in the network storage server is backed up.

3, the implementation method of data safety storing business according to claim 1 is characterized in that: in the described step (1), after management end was accepted user applies, the initialization process operating procedure of carrying out comprised:

(11) on network storage server, create a user name and corresponding password is set, distribute the memory space of corresponding size then according to customer requirements, and the access rights that this memory space is set are read and write for only allowing this user;

(12) a USB rod is formatd, and the protection password of USB rod is set;

(13) call the interface function of USB rod, in the USB rod, generate user's master key;

(14) in the USB rod, write IP address, user name and the password of this user on network storage server of network storage server;

(15) information in the USB rod is backed up, and the effective identity certificate number of backup password for the user is set;

(16) in User Information Database, create a new user record, wherein comprise address name, effective identity certificate number, telephone number, the user name on network storage server, USB rod backup file.

4, the implementation method of data safety storing business according to claim 1 is characterized in that: in the described step (3), the operating procedure that client is encrypted file comprises:

(31) client generates session key by the mode of random number, with session key file is encrypted;

(32) client uses the user's master key in the USB rod that session key is encrypted, and the session key after will encrypting again is attached in the file of having encrypted.

5, the implementation method of data safety storing business according to claim 1 is characterized in that: in the described step (4), client comprises the operating procedure that the file that passes down is decrypted:

(41) client reads the encrypted session key that is attached in the file, uses the user's master key in the USB rod that session key is decrypted then;

(42) client is decrypted file with session key.

6, the implementation method of data safety storing business according to claim 1, it is characterized in that: described USB rod is based on USB interface on the personal computer, has the card reader equipment of certain memory space and plug and play, can finish various encryption and decryption computings to data, at least comprise: Digital Signature Algorithm DSA, by the RSA public key algorithm of Rivest, Shamir and Adlernan three people invention, data symmetric encipherment algorithm DES, Secure Hash Algorithm SHA-1, Message Digest 5 MD5; It is right that the IC chip that is provided with in the rod can produce 1024,768 or 512 long keys at least, and support right importing and the derivation of key, to satisfy various application.

Images