CN105516117A - A method for safe storage of electric power data based on cloud computing - Google Patents

Abstract

The invention discloses a cloud computing-based electric power data safe storage method, which comprises the following steps: (1) a user applies for a cloud storage space through a service interface, accesses the cloud storage space into a cloud computing architecture to access data, and simultaneously selects whether the data needs to be encrypted; (2) distributing a cloud storage space to a user, if data needs to be encrypted, distributing a key according to an algorithm, and storing a mapping relation between the storage space and the key; (3) after the cloud storage space is distributed, informing a user to start the cloud storage resources; (4) the user accesses the cloud storage according to the applied service mode, and encrypted ciphertext data are landed in the storage system through encryption processing when the user writes data; (5) and when a legal user allowed by the service reads the cloud storage space data, the encrypted data block is decrypted and restored to be a plaintext and returned to the user interface.

Description

A method for safe storage of electric power data based on cloud computing

technical field

The invention relates to data processing of a power system, and more specifically, to a method for safely storing power data based on cloud computing.

Background technique

Cloud computing is a large-scale distributed computing model that inherits existing distributed security issues and technologies. However, due to the characteristics of virtualized environment, high data aggregation and mobility, and separation of data control storage and use in the cloud computing application mode, a large number of new problems have arisen in data security in the power cloud computing environment. and management challenges.

Whether it is the sharing of infrastructure or the interactive use of resources and services in the power grid, it is in line with the essence and connotation of the cloud. The construction of power cloud computing should maximize the overall planning and allocation of power resources, strive to improve resource utilization efficiency, and strive to make enterprises The operation and maintenance cost is minimal.

On the storage platform based on power cloud computing, users access data from various business systems to the cloud computing architecture through specific application programs or existing storage service interface layers (such as samba). The storage service interface layer provides multi-interface support and handles the load balancing logic of the access service at the same time. After the interface layer, the system can be roughly divided into four logical structures: (1) The system configuration management module provides a friendly management interaction entry, controls Manage the behavior of the overall system; (2) storage data encryption and decryption module, responsible for processing the security of data content on the storage platform; (3) storage pool management module, manage the operation of the overall cluster nodes (node status, storage space, cluster status, (4) The system monitoring and management module is responsible for monitoring the overall business status and behavior of the audit platform. In this storage environment, data transmission runs on a self-built network, and the transmission path is no longer a security threat. Instead, data storage and sharing have higher security requirements.

Contents of the invention

The purpose of the present invention is to provide a secure storage method for electric power data based on cloud computing, which separates data security and control strategies from the architecture in the cloud computing environment, thereby ensuring data security.

In order to achieve the above object, the present invention provides a method for safely storing power data based on cloud computing, which includes the following steps: (1) The user applies for cloud storage space through the service interface and accesses the data in the cloud computing architecture, and at the same time selects whether the data Encryption is required; (2) Allocate cloud storage space to users. If the data needs to be encrypted, the key is allocated according to the algorithm, and the mapping relationship between the storage space and the key is stored; (3) After the cloud storage space is allocated, the user is notified to enable Cloud storage resources; (4) The user accesses the cloud storage according to the business method applied for. When the user writes data, the encrypted ciphertext data will be landed in the storage system through encryption processing; (5) Legal users allowed by the business When reading the data in the cloud storage space, the encrypted data block is decrypted and restored to plain text and returned to the user interface.

As an improvement of the present invention, the encryption in step (4) and the decryption in step (5) are based on the security encryption and decryption of storage space and content, and are completed when the data is written and read. The service interface is decoupled.

As an improvement of the present invention, in step (1), it also includes: (101) each service interface controls the user's access through its own access control mechanism, allocates access space for each user, and reads and writes Authority control; (102) When the user accesses the corresponding path through the service interface, if it is a legal user, it will access the correct content through the file system interface of the secure cloud storage; if it is an illegal user, the authentication fails at the access control layer, then The cloud storage path browsed by the user contains encrypted content, and real business data cannot be obtained.

As a kind of improvement of the present invention, in step (2), also comprise the management step of key: (201) provide key management entry, support the generation and modification of key; (202) when key generation or modification , perform a backup operation, encrypt and back up the key in a secure area, and separate it from the data storage; (203) regularly synchronize the key corresponding to the storage space through a secure channel, and complete the key distribution; (204) when the user writes data, encrypt The module encrypts the data through the corresponding path key and writes it to the storage medium; (205) when the user reads the data, the decryption module decrypts the data through the corresponding path and returns it to the user.

As an improvement of the present invention, it also includes: setting the initial owner of the storage path as the key owner, and the key owner has management authority over the key; other sharers of the storage path can only use The key is used to encrypt and decrypt data.

As an improvement of the present invention, the service interface is a samba service data access interface, and a data security encryption and decryption module encrypts and decrypts the data transmitted by the samba service data access interface and writes it into storage or returns it to the application layer after decryption.

Compared with the prior art, the present invention can separate data security and control strategy from the architecture on the storage platform of electric power cloud computing, thereby ensuring the security of data.

Description of drawings

The structure and beneficial technical effects of the present invention will be described in detail below in conjunction with the accompanying drawings and specific embodiments.

FIG. 1 is a schematic diagram of a security policy based on an access interface in the present invention.

FIG. 2 is a structural diagram of the present invention based on cloud storage key management architecture.

FIG. 3 is a diagram of the relationship between cloud storage keys and storage space in the present invention.

Fig. 4 is the flow chart of VFS security encryption and decryption based on samba in the present invention.

detailed description

In order to make the purpose of the invention, technical solution and beneficial technical effects of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings and specific implementation methods. It should be understood that the specific implementations described in this specification are only for explaining the present invention, not for limiting the present invention.

The electric power data safe storage method based on cloud computing of the present invention is implemented on the storage platform based on electric power cloud computing, and it comprises the following steps: (1) access user/business apply storage space to administrator (storage platform system), access mode ( samba, nfs, ftp, S3, etc.) and whether the data needs to be encrypted (determined by the security level); (2) The administrator allocates cloud storage space, if the data needs to be encrypted, check the configuration that requires encrypted storage, and the system assigns keys according to the algorithm , and store the mapping relationship between the storage space and the key; (3) After the administrator allocates, notify the user/business system to enable cloud storage resources; When entering data, the IO layer of the platform will encrypt the encrypted ciphertext data in the storage system of the platform; (5) when a legitimate user allowed by the business reads the data in the storage space, the system will encrypt the encrypted data block and then Decryption is restored to plain text and returned to the user/business interface.

Please refer to Figure 1. The core data encryption and decryption is completed when the data is written and read. It is based on the security encryption and decryption of the storage space and content, and automatically decouples the security from the interface layer. At the business interface layer, it is only necessary to maintain the status quo, authenticate access users, and control the read and write permissions of users to a given space (each existing interface has different support for user access control mechanisms, such as samba , S3 has a different access control mechanism), and the safe access of data is effectively guaranteed. The user's access control is restored to the user security access control mechanism of each access service interface. If the business system authorizes a user to have the read and write permissions of the current path, the user can read and write data correctly, otherwise the user can only Can access encrypted data. Each business controls user access through its own access control mechanism. Samba, NFS, FTP, S3 and other services allocate access space for each user and control read and write permissions; users use amba, NFS, FTP, S3 When accessing the corresponding path with other service interfaces, if it is a legitimate user, it will access the correct content through the file system interface of the secure cloud storage; if it is an illegal user, the authentication fails at the access control layer, and the cloud The storage path is also encrypted, and real business data cannot be obtained.

Please refer to Figure 2. Data encryption and decryption are implemented on the data storage layer, which is transparent to upper-layer applications and user encryption and decryption functions. Therefore, the most important key in encryption and decryption is also related to the corresponding storage space location. Each storage location will correspond to a key. For the application or user of the storage system, each storage path must be used by a certain application or user, so the key management system can intuitively use the initial user of the storage space as the owner of the key of the space, through The key owner, storage space, and key close the key management function of the entire encryption and decryption system. The management platform provides a key management portal, which supports the generation and modification of keys; when a key is generated or modified, the system simultaneously performs a backup operation, encrypting and backing up the key in a secure area, and separates it from data storage; in a secure cloud storage cluster , regularly synchronize the key corresponding to the storage space through the secure channel to complete the key distribution; when the user or application system writes data through the storage cluster, the encryption module encrypts the data through the corresponding path key and writes it to the storage medium; when When a user or application system reads data through the storage cluster, the decryption module decrypts the data through the corresponding path and returns it to the user or application system.

Please refer to Fig. 3. In the method of the present invention, the key is different from the traditional user-based key management. The proposed encryption and decryption occurs at the data storage layer. For upper-level applications or users, the encrypted and decrypted data is transparent. Therefore, the owner of the key is based on the storage space path. The initial owner of the storage path is set as the key owner, and the key owner has the management authority over the key, which makes it easy to interface with the traditional user-based system in key management; other sharing of storage space paths Or, only support the use of the key (use the key to encrypt and decrypt data).

Referring to Fig. 4, the method of the present invention is based on ceph storage, and provides a samba service data access interface. However, conventional samba services do not support secure encryption and decryption of stored data. After analyzing the samba communication protocol, this verification platform develops a data security encryption and decryption module based on the samba VFS module. The VFS module encrypts and decrypts the data transmitted by the samba application interface and then writes it into storage or decrypts it and returns it to the application layer. When reading and writing samba data, rewrite the intermediate data through the VFS module, and realize the encryption and decryption of the data by writing the VFS module (Samba’s vfs source code is generally stored under the source path moudes, and the code naming format of the VFS module is as follows: vfs_<module_name >.c, where module_name is the name of the module, which is also the abbreviation of the module function; the code function structure of a VFS module mainly includes the initialization of the VFS module, the definition of the VFS function pointer structure, the header files that need to be included, and the functions that VFS implements specific functions) ;Based on the improvement of the above VFS code structure and encryption and decryption functions, the core functions of the vfs encryption and decryption module are mainly shown in Table 1:

Table 1 Core encryption function table

After the code is compiled, the VFS dynamic link library my_encrypt.so is generated and stored in the location of the VFS module. After restarting the samba service, it can be loaded to take effect.

According to the disclosure and teaching of the above specification, those skilled in the art to which the present invention pertains can also make appropriate changes and modifications to the above embodiment. Therefore, the present invention is not limited to the specific embodiments disclosed and described above, and some modifications and changes to the present invention should also fall within the protection scope of the claims of the present invention. In addition, although some specific terms are used in this specification, these terms are only for convenience of description and do not constitute any limitation to the present invention.

Claims (6)

1. A method for safely storing power data based on cloud computing, characterized in that it comprises the steps: (1) The user applies for cloud storage space through the service interface and accesses the data in the cloud computing architecture, and at the same time chooses whether the data needs to be encrypted; (2) Allocate cloud storage space to users, and if the data needs to be encrypted, then distribute the key according to the algorithm, and store the mapping relationship between the storage space and the key; (3) After the cloud storage space allocation is completed, notify the user to enable cloud storage resources; (4) The user accesses the cloud storage according to the business method applied for, and when the user writes data, the encrypted ciphertext data will be landed in the storage system through encryption processing; (5) When a legitimate user permitted by the service reads the cloud storage space data, the encrypted data block is decrypted and restored to plain text and returned to the user interface. 2. according to claim 1, based on cloud computing power data security storage method, it is characterized in that, the encryption in step (4) and the decryption in step (5) are based on the security encryption and decryption of storage space and content, and in the data The writing and reading are completed, and at the same time, the security and service interfaces are decoupled. 3. According to claim 1, the method for safely storing electric power data based on cloud computing is characterized in that, in step (1), further comprising: (101) Each service interface controls user access through its own access control mechanism, allocates access space for each user, and controls read and write permissions; (102) When a user accesses the corresponding path through the service interface, if it is a legal user, it will access the correct content through the file system interface of the secure cloud storage; if it is an illegal user, the authentication fails at the access control layer, and the user browses The encrypted content under the cloud storage path cannot obtain real business data. 4. according to claim 1, based on cloud computing power data safe storage method, it is characterized in that, in step (2), also comprises the management step of key: (201) Provide a key management entry to support key generation and modification; (202) When the key is generated or modified, a backup operation is performed, and the key is encrypted and backed up in a secure area, which is separated from the data storage; (203) periodically synchronizing the key corresponding to the storage space through the secure channel to complete the key distribution; (204) When the user writes data, the encryption module encrypts the data and writes it into the storage medium through the corresponding path key; (205) When the user reads the data, the decryption module decrypts the data through the corresponding path and returns it to the user. 5. According to claim 4, the method for safely storing power data based on cloud computing, further comprising: setting the initial owner of the storage path as the key owner, and the key owner has management authority over the key; Other sharers of the storage path can only use the key to encrypt and decrypt data. 6. according to claim 1 based on the power data safe storage method of cloud computing, it is characterized in that, described service interface is samba business data access interface, after a data security encryption and decryption module encrypts and decrypts the data that samba business data access interface transmits Write to storage or return to the application layer after decryption.