Methods for accessing data in cloud storage space and apparatuses using the same

An embodiment of the invention introduces a method for accessing data in cloud storage space, which contains at least the following steps. A file is obtained. File uploads are generated, where each file upload contains partial data of the file. The file uploads are stored in storage servers of the cloud storage space, where the storage servers are governed by different cloud storage providers.

CROSS REFERENCE TO RELATED APPLICATIONS

This application claims priority of Taiwan Patent Application No. 103130201, filed on Sep. 2, 2014, the entirety of which is incorporated by reference herein.

BACKGROUND

Technical Field

The present invention relates to data storage, and in particular, to methods for accessing data in cloud storage space and apparatuses using the same.

Description of the Related Art

Cloud storage is a model of data storage where the digital data is stored in logical pools. The physical storage spans across multiple servers (and often locations) and the physical environment is typically owned and managed by a hosting company. These cloud storage providers are responsible for keeping the data available and accessible, and the physical environment protected and running. However, users are typically concerned about the data security of the cloud storage. For example, data is intercepted when being passed over a digital network to the cloud storage space, data of the storage space is lost when the physical storage system crashes, or is stolen when the cloud storage providers cannot provide rigid protection. Thus, it is desirable to have methods for accessing data in cloud storage space and apparatuses using the same to improve data security.

BRIEF SUMMARY

An embodiment of the invention introduces a method for accessing data in cloud storage space, which contains at least the following steps. A file is obtained. File uploads are generated, where each file upload contains partial data of the file. The file uploads are stored in storage servers of the cloud storage space, where the storage servers are governed by different cloud storage providers.

An embodiment of the invention introduces an apparatus for accessing data in cloud storage space, which contains at least a communications interface and a processing unit. The processing unit, coupled to the communications interface, obtains a first file; generates file uploads, where each file upload contains partial data of the first file. The processing unit further stores the file uploads in storage servers of the cloud storage space via the communications interface, where the storage servers are governed by different cloud storage providers

DETAILED DESCRIPTION

An embodiment of the invention introduces network architecture containing multiple storage servers owned by different cloud storage providers, and a client capable of distributing data to the storage servers.FIG. 1is a schematic diagram of the network architecture according to an embodiment of the invention. Three different cloud storage providers respectively own storage servers110to130, such as a Google Drive server, a Dropbox server, a SugarSync server, etc. A desktop computer150(also referred to as a client) may store data in the storage servers110to130and retrieve data from the storage servers110to130via a network100. The network100may be the Internet, a wired LAN (Local Area Network), a WLAN (wireless LAN) or any combination thereof. It should be noted that the desktop computer150needs to pass the security verification before accessing any of the storage servers110to130. Specifically, the desktop computer150needs to provide a set of an ID (Identity) and a password to the storage server and starts to access the storage server after the ID and the password have been authenticated. Although the desktop computer150is shown in the embodiment, it should be understood that alternative embodiments are contemplated to install a client in an electronic apparatus capable of communicating with the storage servers, such as a mobile phone, a tablet computer, a notebook, etc.

FIG. 2is the system architecture of a computer apparatus according to an embodiment of the invention. The system architecture may be practiced in the desktop computer150, at least including a processing unit210. The processing unit210can be implemented in numerous ways, such as with dedicated hardware, or with general-purpose hardware (e.g., a single processor, multiple processors or graphics processing units capable of parallel computations, or others) that is programmed using microcode or software instructions to perform the functions recited herein. The system architecture further includes a memory250for storing necessary data in execution, such as variables, data tables, or others, and a storage unit240for storing a wide range of electronic files, such as Web pages, documents, video files, audio files, or others. A communications interface260is included in the system architecture and the processing unit210can thereby communicate with storage servers110,120,130, or other electronic devices. The communications interface260may be a wireless telecommunications module, a LAN (Local Area Network) communications module, a WLAN (Wireless Local Area Network), or any combination thereof. The wireless telecommunications module may have modems supporting arbitrary combinations of the 2G, 3G, 4G and the higher-generation technology. The system architecture further includes one or more input devices230to receive user input, such as a keyboard, a mouse, a touch panel, or others. A user may press hard keys on the keyboard to input characters, control a mouse pointer on a display by operating the mouse, or control an executed application with one or more gestures made on the touch panel. The gestures include, but are not limited to, a single-click, a double-click, a single-finger drag, and a multiple finger drag. A display unit220, such as a TFT-LCD (Thin film transistor liquid-crystal display) panel, an OLED (Organic Light-Emitting Diode) panel, or others, may also be included to display input letters, alphanumeric characters and symbols, dragged paths, drawings, or screens provided by an application for a user's viewing.

FIG. 3is a flowchart illustrating a method for storing data in a storage server of cloud storage space according to an embodiment of the invention. The method is performed when the processing unit210of the desktop computer150loads and executes relevant software instructions. In order to improve the security of files stored in the cloud storage space, the processing unit210divides a file into several parts and respectively stores the divided parts in several storage servers110to130, which are governed by different cloud storage providers, via the communications interface260. The process begins to obtain a file (step S310). The file may contain word processing data, a digital spreadsheet, a digital presentation, image data, audio data, video data, etc. In step S310, the processing unit210may provide a MMI (Man-Machine Interface) to help a user to select a file to be uploaded and fill several sets of login accounts (also referred to as IDs) and passwords for designated storage servers.FIG. 4is a schematic diagram showing a file upload screen according to an embodiment of the invention. The MMI includes a file upload screen400. After a file selection button410is pressed, the processing unit210introduces a window manager of a UI (User Interface) control to help the user to select a file to be uploaded from the storage device240and shows a selection result in a file path field411. The file upload screen400further contains six input boxes451ato455bto facilitate the input of three sets of login accounts and passwords. For example, the input boxes451aand451bhelp the user to fill the ID and the password for logging on to the Google Drive server. The input boxes453aand453bhelp the user to fill the ID and the password for logging on to the Dropbox server. The input boxes455aand455bhelp the user to fill the ID and the password for logging on to the SugarSync server. After a submit button430is pressed, the processing unit210may store the three sets of IDs and passwords in the memory250. Although three storage servers are shown in the embodiment, it should be understood that alternative embodiments are contemplated to divide a single file into two or more than three parts and store the divided ones in the equal number of storage servers.

The processing unit210then encrypts data of the file (step S320). In step S320, the processing unit may employ DES (Data Encryption Standard), AES (Advanced Encryption Standard), or other algorithms to perform the encryption. DES is an algorithm that takes a fixed-length string of plaintext bits and transforms it through a series of complicated operations into another ciphertext bitstring of the same length. In the case of DES, the block size is 64 bits. DES uses a key to customize the transformation, so that decryption can supposedly only be performed by those who know the particular key used to encrypt. AES is based on a design principle known as a substitution-permutation network, combination of both substitution and permutation. Unlike its predecessor DES, AES does not use a Feistel network. AES is a variant of Rijndael which has a fixed block size of 128 bits, and a key size of 128, 192, or 256 bits. Conversely, the Rijndael specification per se is specified with block and key sizes that may be any multiple of 32 bits, both with a minimum of 128 and a maximum of 256 bits. In alternative embodiments, the processing unit210may omit the step S320to perform subsequent steps with plaintext of the file, and the invention should not be limited thereto. Next, the processing unit210divides the ciphered data into parts, in which the total number of divided parts may equal the total number of storage servers storing the divided parts, and generates file uploads to be transmitted to the storage servers110to130, each of which is formed by assembling several parts (step S330). In an example, the processing unit210divides the ciphered data into three parts and, for each storage server, assembles two of them into a file upload, where only the half content of one file upload is the same as that of another file upload.FIG. 5is a schematic diagram depicting file divisions and assemblies for file uploads according to an embodiment of the invention. The processing unit210divides the ciphered data500into three parts500ato500c, assembles two parts500aand500bto form a file upload510to be stored in the storage server110, assembles two parts500aand500cto form a file upload530to be stored in the storage server120, and assembles two parts500band500cto form a file upload550to be stored in the storage server130. The three file uploads510,530and550may be named “AAA_001.docx”, “AAA_002.docx” and “AAA_003.docx” respectively. In another example, the processing unit210divides the ciphered data into six parts, calculates parity information for each two parts and, for each storage server, assembles two parts and one piece of parity information to form a file upload, in which the two parts and one piece of parity information have no dependency. The file uploads formed by the aforementioned operations are similar to RAID-5 (Redundant Array of Independent Disks5).FIG. 6is a schematic diagram depicting file divisions and assemblies for file uploads according to an embodiment of the invention. The processing unit210divides the ciphered data600into six parts600ato600fand calculates parity information610aaccording to the parts600aand600b, parity information610baccording to the parts600cand600dand parity information610caccording to the parts600eand600f. Next, the processing unit210assembles the parts600aand600cand the parity information610cto form a file upload630to be stored in the storage server110, the parts600band600eand the parity information610bto form a file upload650to be stored in the storage server120, and the parity information610aand the parts600dand600fto form a file upload670to be stored in the storage server130. The three file uploads630,650and670may be named “AAA_001.docx”, “AAA_002.docx” and “AAA_003.docx” respectively. Those skilled in the art understand that, when a system crash happens in one of the storage servers110to130, the processing unit210can recover the whole ciphered data according to the partial data stored in the other two storage servers, thus, the fault-tolerant ability is increased.

The processing unit210disguises the file uploads to modify their original file types with other file types (step S340). For example, the three word-processing file uploads (.docx) can pretend to be image file uploads (.jpg) named “AAA_001.jpg”, “AAA_002.jpg” and “AAA_003.jpg” respectively. In step S340, the processing unit210may employ a file binding method to combine the file uploads into image files. In alternative embodiments, the processing unit210may omit step S340to perform subsequent steps with the original file uploads (i.e. the undisguised ones) generated in step S330. The processing unit210stores the disguised file uploads in designated storage servers via the communications interface260(step S350). For example, the disguised file uploads “AAA_001.jpg”, “AAA_002.jpg” and “AAA_003.jpg” are stored in the storage servers110to130respectively. It should be noted that, before the file uploads, the processing unit210needs to obtain the necessary sets of login accounts and passwords from the memory250and accordingly pass the authentications made by the designated storage servers. The processing unit210produces file-division-and-upload records each storing information indicating the content of each file upload and which storage server in the cloud storage space stores the file upload (step S360). With reference made toFIG. 5, exemplary file-division-and-upload records are described in Table 1:

TABLE 1Original FileStorage ServerNameFile Upload NameContentGoogle DriveAAA.docxAAA_001.jpg500a, 500bDropboxAAA.docxAAA_002.jpg500a, 500cSugarSyncAAA.docxAAA_003.jpg500b, 500c
Table 1 describes how the disguised file upload “AAA_001.jpg” is stored in the Google Drive server, which contains two parts of ciphered data500aand500bof a word-processing file “AAA.docx”, the disguised file upload “AAA_002.jpg” is stored in the Dropbox server, which contains two parts of ciphered data500aand500cof the word-processing file “AAA.docx”, and the disguised file upload “AAA_003.jpg” is stored in the SugarSync server, which contains two parts of ciphered data500band500cof the word-processing file “AAA.docx”. Moreover, with reference made toFIG. 6, exemplary file-division-and-upload records are described in Table 2:

FIG. 7is a flowchart illustrating a method for downloading data from a storage server of cloud storage space according to an embodiment of the invention. The method is performed when the processing unit210of the desktop computer150loads and executes relevant software instructions. The process begins to obtain file-division-and-upload records (step S710). Exemplary file-division-and-upload records may refer to the descriptions of Tables 1 and 2. In step S710, the processing unit210may read out the file-division-and-upload records from the storage device240or download them from one of the storage servers110to130. The processing unit210obtains disguised files from designated storage servers via the communications interface260according to the file-division-and-upload records (step S720). The disguised files mentioned in step S720may refer to the description of the file uploads in steps S340and S350ofFIG. 3. It should be noted that, before the file downloads, the processing unit210needs to obtain the necessary sets of login accounts and passwords from the memory250and accordingly passes the authentications made by the designated storage servers. It should be further noted that the processing unit may download all or parts of the disguised files to recover an original file. Taking examples as shown inFIG. 5, the processing unit210may download the disguised files from any two of the storage servers110to130. After two disguised files are successfully downloaded, the file download stops to save a file download bandwidth. However, when one disguised file fails to be downloaded, the processing unit210downloads the other disguised file from the remaining storage server. Moreover, inFIG. 6, the processing unit210may download all disguised files from the storage servers110to130.

The processing unit210uncovers the disguised files (step S730). In step S730, the processing unit210may extract the actual files from the disguised files using a file split method. For example, the word-processing files “AAA_001.docx”, “AAA_002.docx” and “AAA_003.docx” are extracted from disguised image files “AAA_001.jpg”, “AAA_002.jpg” and “AAA_003.jpg”. In alternative embodiments, when the downloaded files have no cover, the processing unit210may omit step S730to perform the subsequent steps with the downloaded files directly. The processing unit210combines data of the uncovered files according to the file-division-and-upload records (step S740). Taking examples as shown inFIG. 5, the processing unit210may recover ciphered data by combining the parts500aand500bof the file510with the part500cof the file530or by combining the part500aof the file530with the parts500band500cof the file550. Taking examples as shown inFIG. 6, the processing unit210may check the integrity of the part600aof the file630and the part600bof the file650by referring to the parity information610a, the integrity of the part600cof the file630and the part600dof the file670by referring to the parity information610b, and the integrity of the part600eof the file650and the part600fof the file670by referring to the parity information610c, and attempt to correct the error bits if required. The processing unit210finally decrypts the combined data (step S750). In step S750, the processing unit210may perform the decryption by employing DES, AES or other algorithms with a corresponding key. In alternative embodiments, when the combined data is not encrypted, the processing unit210may omit step S750and treat the combined data as the original file.

Although the embodiment has been described as having specific elements inFIG. 2, it is noted that additional elements may be included to achieve better performance without departing from the spirit of the invention. While the process flows described inFIGS. 3 and 7each include a number of operations that appear to occur in a specific order, it should be apparent that these processes can include more or fewer operations, which can be executed serially or in parallel (e.g., using parallel processors or a multi-threading environment).