hereinafter , the advantages and features of exemplary embodiments of the present invention and methods of accomplishing them will be clearly understood from the following description of the embodiments taken in conjunction with the accompanying drawings . however , the present invention is not limited to those embodiments and may be implemented in various forms . it should be noted that the embodiments are provided to make a full disclosure and also to allow those skilled in the art to know the full scope of the present invention . therefore , the present invention will be defined only by the scope of the appended claims . similar reference numerals refer to the same or similar elements throughout the drawings . the term “ and / or ” used herein includes all combinations of each of the items and one or more of them described herein . although the terms “ a first ”, “ a second ”, and the like are used to describe a variety of elements , components and / or sections , it is understood that these elements , components and / or sections are not limited by these terms . the use of the terms is intended to distinguish the elements , components or sections from other elements , components or sections . thus , it is understood that a first element , a first component or a first section mentioned below may be a second element , a second component , or a second section within the spirit of the present invention , as well . it should be noted that the terminologies used herein is merely intended to describe the embodiments and do not limit the scope of the present invention .) in the present application , the representation of the singular , unless it is clearly indicated in the phrase otherwise , includes multiple representations . in the present application , it should be understood that the terms “ includes ” or “ comprises ” and / or “ including ” or “ comprising ”, and variants thereof are used to specify the presence of other components , steps , operations , and / or elements mentioned herein , but are not intended to exclude the possibility of the presence or supplement of one or more other components , steps , operations , and / or elements . unless there is another definition , all terms ( including technical and scientific terminologies ) as used herein may be used as meaning that may be commonly understood by those having ordinary skill in the art . further , unless specifically defined clearly , terms that are defined in advance commonly used are not to be construed ideally or excessively . further , in the following description , well - known functions or constitutions will not be described in detail if they would obscure the subject matter of the present disclosure in unnecessary detail . moreover , the terminologies to be described below are defined in consideration of functions in the present disclosure and may vary depending on the intentions or practices of a user or an operator . accordingly , the definition may be made on the basis of the content throughout the specification . fig1 is an overall block diagram of a system for providing storage security of a cloud server in a cloud computing environment in accordance with an embodiment of the present invention , fig2 illustrates a detailed diagram of the kernel structure of a file and network system in a cloud server that is applied in an embodiment of the present invention , and fig3 a and 3b are diagrams illustrating the comparison of information on file data through a file write controller that is applied in an embodiment of the present invention . referring to fig1 to fig3 a and 3b , a system for providing storage security of a cloud server in a cloud computing environment in accordance with an embodiment of the present invention is a system to provide storage security of a cloud server 200 in a cloud computing environment in which a client terminal 100 is connected to the cloud server 200 over a wired / wireless communication network 10 . the system generally includes a file read monitor 210 ; a file read controller 220 ; a monitor 230 including a file write monitor 231 or a file transfer monitor 232 ; and a controller 240 including a file write controller 241 or a file transfer controller 242 . here , the client terminal 100 may be typically a personal computer ( pc ), for example , a desktop pc , notebook pc , or the like , but is not limited thereto , and may be any type of wired / wireless communication device capable of accessing the cloud server 200 over the wired / wireless network 10 to receive the cloud computing service . for example , the client terminal 100 may generally mean any wired / wireless home appliance or communication device having a user interface for accessing the cloud server 200 , such as a palm pc , personal digital assistant ( pda ), smart phone , wap phone ( wireless application protocol phone ), mobile gaming machine ( e . g ., mobile play - station ) that can communicate with the cloud server 200 over the wired / wireless network 10 . meanwhile , the wired / wireless network 10 may be a wired / wireless network or the internet . the internet may means a global open computer network architecture that provides tcp / ip protocol and several services on the upper layer , i . e ., http ( hyper text transfer protocol ), telnet , fpt ( file transfer protocol ), dns ( domain name system ), smtp ( simple mail transfer protocol ), snmp ( simple network management protocol ), nfs ( network file service ), nis ( network information service ), and the like and provides environments that enable the client terminal 100 to access the cloud server 200 . the internet may be the wired or wireless internet , or a core network integrated with a wired public network , a wireless mobile communication network , the mobile internet , or the like . in response to the request from the client terminal 100 , the cloud server 200 serves to provide a cloud computing service . specifically , the cloud server 200 is a server for providing a cloud computing service to the client terminal 100 , which provides computing resources requested by the client terminal 100 through the wired / wireless communication network 10 . the cloud server 200 provides a computing service allowing the device requested by the client terminal 100 to be used . the cloud server 200 thus includes a number of storage to store files received from a business operator ( a content provider ) which provides mass data , for example , such as an application program file , game program file , text data file , document file , picture file , music file , video file , bar code file , etc . especially , the cloud server 200 applied in an embodiment of the present invention includes a file read monitor 210 ; a file read controller 220 ; a monitor 230 including a file write monitor 231 or a file transfer monitor 232 ; and a controller 240 including a file write controller 241 or a file transfer controller 242 , which are provided for the purpose of storage security . the file read monitor 210 is installed in a kernel layer of a file system included in the cloud server 200 , which performs a function to monitor which file data are read among file data stored in the storage of the cloud server 200 . specifically , the file read monitor 210 is connected to a filter manager frame level included in a kernel layer in the file system of the cloud server 200 and monitors reading of the file data . further , it is preferred that the file read monitor 210 registers an irp_mj_read function and an irp_mj_acquire_for_section_synchronization function , for example , and monitors reading of the file data . meanwhile , a kernel layer in the file system of the cloud server 200 is comprised of hardware , storage driver stack , file system driver , filter manager frame , and i / o manager level , as illustrated in fig2 . in this case , the filter manager frame level includes functions to facilitate development of the file system driver , to control a loading order through assigned positions of drivers and to solve a number of problems related to existing filter driver models . further , the file system driver level perform tasks to intercept requests for a file system and to block or change the requests before they arrive at an original intended destination . the file read controller 220 is connected to the file read monitor 210 . in case that file data monitored for its reading by the file read monitor 210 is the file data stored in a secure space of a predetermined secure space of storage , the file read controller 220 performs a function to extract and store information of the file data monitored for its reading . in this case , it is preferred that the information on file data extracted through the file read controller 220 includes at least one of a portion of the relevant file data , a file path , drive information , and a process id . further , it is preferred that the information of the file data extracted by the file read controller 220 is stored in a separate storage space ( for example , a memory or a database db ) in a form of a list . the file write monitor 231 is installed in a kernel layer of the file system included in the cloud server 200 . the file write monitor 231 performs a function to monitor which file data is written among the file data stored in the storage of the cloud server 200 . specifically , the file writing monitor 231 is connected to a filter manager frame level included in the kernel layer in the file system of the cloud server 200 so as to monitor writing of the file data . further , it is preferred that the file writing monitor 231 registers a function of irp_mj_write , for example , so as to monitor writing of the file data . the file write controller 241 is connected to the file writing monitor 231 . the file write controller 241 performs a function to identify whether file data , which is monitored for its writing by the file writing monitor 231 , is a predetermined monitoring target . in case that information of the file data monitored for its writing is identical to information of file data stored by use of the file reading controller 220 , the file write controller 241 blocks or holds the writing of the file data according to a predetermined security policy . specifically , in case that the file data , which is monitored for its writing by the file writing monitor 231 , is identified to be the predetermined monitoring - target , if a identical portion to the file data stored and read by the file reading controller 220 is founded in contents of the file data that is tried for file writing when being read in the same process , the file write controller 241 determines that the writing is intended to copy the file data tried to read in the past , compares a destination of the relevant file data , and blocks or holds the writing of the file data when the destination is the outside or the location that violates the predetermined security policy . the file transfer monitor 232 is installed in the kernel layer of the network system included in the cloud server 200 . the file transfer monitor 232 performs a function to monitor which file data is transferred over a network among the file data stored in the storage of the cloud server 200 . in other words , the file transfer monitor 232 is connected between a tdi ( transport driver interface ) client level and a tdi transport level included in the kernel layer in the network system of the cloud server 200 so as to monitor the transfer of file data . further , it is preferred that the file transfer monitor 232 registers a tdi_send function and a tdi_send_datagram function to monitor the transfer of the file data . meanwhile , the kernel layer in the network system of the cloud server 200 is comprised of hardware , ndis miniport driver , ndis intermediate driver , ndis protocol driver , tdi transport , and tdi client levels , as illustrated in fig2 . the tdi client calls an irp_mj_create function in order to generate or open a file object , i . e ., a tdi file object , to embody a transport address , a connection end point or a control channel . such a call enables an i / o manager to assign irp , to align tdi client provision parameters in the irp , and to transfer the irp to a tdidispatchcreate routine of a lower tdi transport driver . when the tdi transport driver sets all status to be maintained for newly generated file objects , the tdi transport driver calls an iocompleterequest ( or tdicompleterequest ) function with irp and status_success . then , an irp_mj_create function returns to the tdi client with a handle for the file object . although two clients described same transport address when calling their irp_mj_create functions , the call of the irp_mj_create function in each client process generates a separate tdi file object . when the call of the irp_mj_create function succeeds , a transport address , a connection end point or a control channel can be opened depending on eaxxx parameter that is transferred at the call by the client . the file transfer controller 242 is connected to the file transfer monitor 232 . the file transfer controller 242 identifies whether the file data , which is monitored for its transfer by the file transfer monitor 232 , is a predetermined network monitoring target . then , when information of the file data monitored for its writing is identical to the file data stored by use of the file read controller 220 , the file transfer controller 242 performs a function to block or holds the transfer of the file data according to a predetermined security policy . specifically , in case that the file data , which is monitored for its transfer by the file transfer monitor 232 , is a predetermined network monitoring target , if a portion identical to the file data stored and read by the file read controller 220 is founded in contents of the file data that is tried for file transfer when being read in the same process , the file transfer controller 242 determines that the tried file transfer of relevant file is intended to transfer the file data trying to read in the past to the outside over a network . hereinafter , a method for providing storage security of a cloud server in a cloud computing environment in accordance with an embodiment of the present invention will be described in detail . fig4 a and 4b are overall flowcharts illustrating a method for providing storage security of a cloud server in a cloud computing environment in accordance with an embodiment of the present invention . referring to fig4 a , the method for providing storage security of a cloud server in a cloud computing environment begins to monitor which file data is read among file data stored in a storage of the cloud server 200 through the use of the file read monitor 210 included in the cloud server 200 ( block s 100 ). in this case , at block s 100 , it is preferred that the file read monitor 210 is connected to a filter manager frame level included in a kernel layer within a file system of the cloud server 200 and monitors reading of the file data . it is also preferred , at block s 100 , that the file read monitor 210 registers an irp_mj_read function and an irp_mj_acquire_for_section_synchronization function and then monitors reading of the file data . next , it is determined whether the file data , which is monitored for its reading by use of the file read controller 220 connected to the file read monitor 210 , at block s 100 is the file data that is stored in a predetermined secure space of the storage ( block s 200 ). when the file data monitored at block s 100 is determined to be the file data stored in the predetermined secure space of the storage from the determination result at block s 200 , the information on the file data monitored for its reading is extracted and stored by the file read controller 220 ( block s 300 ). in this case , at block s 300 , it is preferred that the information on file data extracted through the file read controller 220 is comprised of at least one of a portion of the relevant file data , a file path , drive information and a process id , for example . next , the file write monitor 231 included in the cloud server 200 monitors which file data is written among the file data stored in the storage of the cloud server 200 ( block s 400 ). in this case , at block s 400 , it is preferred that the file write monitor 231 is connected to a filter manager frame included in a kernel layer in a file system of the cloud server 200 and monitors the writing of file data . further , it is preferred , at block s 400 , that the file write monitor 231 registers an irp_mj_write function and monitors writing of file data , for example . thereafter , after identifying whether file data monitored for its writing at the step s 400 is a predetermined monitoring target through the use of the file write controller 241 connected to the file write monitor 231 , for example , identifies whether the file data monitored for its writing is the monitoring target to be priorly monitored , the file position in which the file data is written is identified so as to identify that the file position is a hard disk drive , an usb drive or a network drive , and the writing of the relevant file data is blocked or held according to a predetermined security policy if information of the file data of the monitoring target is identical to that of the file data stored at block s 300 ( s 500 ). in other words , at block s 500 , in case that the file data monitored for its writing by the file write monitor 231 is the predetermined monitoring - target , if a portion identical to the file data stored and read at the step s 300 is founded among contents of file data that is tried for file writing when trying to read in the same process , the file write controller 241 determines that the writing is intended to copy the file data that is tried to read in the past , determines a destination of the relevant file data , and blocks or holds the writing of the relevant file data when the destination is the outside or the location that violates a predetermined security policy . alternatively , referring to fig4 b , a method for providing storage security of a cloud server in a cloud computing environment in accordance with an embodiment of the present invention begins to monitor which file data is read among file data stored in a storage of the cloud server 200 through the use of the file read monitor 210 included in the cloud server 200 ( block s 100 ). in this case , at block s 100 , it is preferred that the file read monitor 210 is connected to a filter manager frame included in a kernel layer in a file system of the cloud server 200 and monitors reading of the file data . further , it is preferred , at block s 100 , that the file read monitor 210 registers an irp_mj_read function and an irp_mj_acquire_for_section_synchronization function and monitors reading of the file data , for example . next , it is determined whether the file data monitored for its reading at block s 100 through the use of the file read controller 220 connected to the file read monitor 210 is the file data that are stored in a predetermined secure space of the storage ( block s 200 ). when the file data monitored for its reading at block s 100 is determined to be the file data stored in the predetermined secure space of the storage from the determination result at block s 200 , the information on the file data monitored for its reading is extracted and stored through the use of the file read controller 220 ( block s 300 ). in this case , at block s 300 , it is preferred that the information on file data extracted through the file read controller 220 is comprised of at least one of a portion of the file data , a file path , drive information and a process id , for example . next , it is monitored which file data are transferred sent through the file transfer monitor 232 included in the cloud server 200 among the file data stored in the storage of the cloud server 200 ( block s 400 ). in this case , at block s 400 , it is preferred that the file transfer monitor 232 is connected between a tdi ( transport driver interface ) client level included in a kernel layer in the network system of the cloud server 200 and a tdi transport level and monitors the transfer of file data . thereafter , after identifying whether the file data monitored for its transfer at block s 400 through the use of the file transfer controller 242 connected to the file transfer monitor 232 is a predetermined network monitoring target , if information of the file data of the predetermined network monitoring - target is identical to that of the file data stored at block s 300 , the transfer of the relevant file data is blocked or held according to a predetermined security policy ( block s 500 ). that is , at block s 500 , in case that the file data monitored for its transfer by the file transfer monitor 232 is the predetermined network monitoring target , if a portion identical to the file data read and stored at block s 300 is founded among contents of file data that is tried for file transfer when trying to read in the same process , the file transfer controller 242 determines that the relevant file data trying to transfer is intended to transfer the file data that was tried to transfer in the past to the outside over a network . meanwhile , the method for providing storage security of a cloud server in a cloud computing environment in accordance with an embodiment of the present invention may also be implemented as computer - readable codes in a computer - readable recording medium . the computer - readable recording medium includes any type of recording devices in which data readable by a computer system is stored . for example , the computer - readable recording mediumstorage medium includes cd - rom , magnetic tape , hard disk , floppy disk , mobile storage device , non - volatile memory ( e . g ., flash memory ), optical data storage device and the like . also , the computer - readable medium may be distributed to computer systems connected via a computer communication network and the codes that can be read in a distribution scheme may be stored and executed in the computer - readable recording medium . while the invention has been shown and described with respect to the a preferred embodiment of a system for providing storage security of a cloud server in a cloud computing environment and a method thereof , the present invention is not limited thereto . various modifications can be made to the above - described exemplary embodiments of the present invention without departing from the spirit or scope of the invention and are intended to be embraced by the scope of the present invention .