Method for protecting data for information centric in-network computing and system using the same
View Patent ↗Disclosed herein are a method for protecting data for information centric in-network computing and a system using the same. The method includes: preparing, at a computing node, a an encryption key pool that includes a security key for sharing a symmetric key used for encrypting result data according to a user's request and matching information; preparing, at an INC agent receiving the user's request, a synchronization key pool for sharing the security key through the matching information; and creating, by the computing node, a processor for executing output processing of the result data and allocating a security key to the processor based on the matching information of the encryption key pool when a security key exists. The security key is allocated to the computing node which is determined to perform the request in the INC agent.
1. A method for protecting data for data name-based information centric in-network computing, the method comprising:
preparing, at a computing node, an encryption key pool that includes a security key for sharing a symmetric key used for encrypting result data according to a user's request and matching information;
preparing, at an INC agent receiving the user's request, a synchronization key pool for sharing the security key through the matching information;
creating, by the computing node, a processor for executing output processing of the result data and allocating a security key to the processor based on the matching information of the encryption key pool when a security key exists, the security key being allocated to the computing node which is determined to perform the request in the INC agent; and
removing, by the INC agent and the computing node, the allocated security key and the matching information from the synchronization key pool and the encryption key pool when the security key is allocated to the processor and creating a new security key and new matching information.
2. The method of claim 1 , wherein the security key includes a public key and the encryption key pool includes the public key, a secret key pairing up with the public key, and the matching information corresponding to the public key and the secret key.
3. The method of claim 1 , wherein, after the creating of the processor and allocating of the security key, a device of the user accesses the processor, and data exchange is implemented between the device of the user and the processor.
4. The method of claim 1 , further comprising:
transmitting, by the processor, a name of the processor and the security key to the device of the user;
creating, by the device, a symmetric key by using the security key and encrypting the symmetric key and transmitting the symmetric key to the processor;
outputting, in the processor, the result data, encrypting the result data by the symmetric key and transmitting the encrypted result data to the device; and
decoding, by the device, the encrypted result data by the symmetric key.
5. The method of claim 4 , further comprising:
checking, in the processor, a security key allocated to the processor based on the matching information of the encryption key pool after the encrypting and transmitting of the symmetric key to the processor and decoding the encrypted symmetric key by the security key.
6. The method of claim 1 , wherein the output processing of the result data is operation processing based on a requested data-related command in the user's request.
7. The method of claim 6 , further comprising:
determining, by the INC agent, whether or not to process the received user's request, by considering resource information of the computing node managed by the INC agent together with data and a function for the operation processing, which are included in the requested data-related command, and performance policy information before the creating of the processor and allocating of the security key.
8. The method of claim 1 , further comprising creating, by the computing node, a processor for executing the output processing of the result data, when there is no security key allocated to the computing node which is determined to perform the request.
9. The method of claim 8 , further comprising:
outputting, in the processor, the result data and transmitting the result data to the device of the user; and
receiving, in the device, the result data.
10. A system for protecting data for data name-based information centric in-network computing, the system comprising:
a computing node configured to prepare an encryption key pool that includes a security key for sharing a symmetric key used for encrypting result data according to a user's request and matching information; and
an INC agent configured to receive the user's request and prepare a synchronization key pool for sharing the security key through the matching information,
wherein the computing node creates a processor for executing output processing of the result data and allocates a security key to the processor based on the matching information of the encryption key pool when the security key exists, the security key being allocated to the computing node which is determined to perform the request in the INC agent,
wherein the INC agent and the computing node are further configured to remove the allocated security key and the matching information from the synchronization key pool and the encryption key pool when the security key is allocated to the processor, and are configured to create a new security key and new matching information.
11. The system of claim 10 , wherein:
the security key includes a public key, and
the encryption key pool includes the public key, a secret key pairing up with the public key, and the matching information corresponding to the public key and the secret key.
12. The system of claim 10 , wherein a device of the user accesses the processor by creating the processor and allocating the security key and data exchange is implemented between the device of the user and the processor.
13. The system of claim 10 , wherein:
the processor is further configured to transmit a name of the processor and the security key to the device of the user,
the device is further configured to create a symmetric key and to encrypt the symmetric key and transmit the symmetric key to the processor,
the processor is further configured to output the result data, to encrypt the result data by the symmetric key and to transmit the encrypt result data to the device, and
the device is configured to decode the encrypted result data by the symmetric key.
14. The system of claim 13 , wherein, when the symmetric key is encrypted and transmitted to the processor, the processor is further configured to check a security key allocated to the processor, based on the matching information of the encryption key pool, and to decode the encrypted symmetric key by the security key.
15. The system of claim 10 , wherein the output processing of the result data is operation processing based on a requested data-related command in the user's request.
16. The system of claim 15 , wherein the INC agent is further configured to determine whether or not to process the received user's request, by considering resource information of the computing node managed by the INC agent together with data and a function for the operation processing, which are included in the requested data-related command, and performance policy information before creating the processor and allocating the security key.
17. The system of claim 10 , wherein the computing node is further configured to create a processor for executing the output processing of the result data, when there is no security key allocated to the computing node which is determined to perform the request.
18. The system of claim 17 , wherein the processor is further configured to output and transmit the result data to the device of the user, and wherein the device is further configured to receive the result data.