KR20180099310A - Apparatus and method for searching in searchable encryption system - Google Patents

Abstract

In a searchable encryption system, a server receives a cipher text for corresponding data from at least one user terminal and a search index including a keyword included in the corresponding data and information of an identifier of the corresponding data and stores them in a search index table. When receiving a trap door corresponding to the keyword of data to be searched from a user terminal requesting a search, the server performs searching using the search index table and a reconstruction index table configured in the server and, when the identifier of the data corresponding to the trap door is searched from the search index table, reconstructs the search index for the identifier of the retrieved data and adds them to the reconstruction index table. It is possible to provide effective search performance for the data.

Description

[0001] APPARATUS AND METHOD FOR SEARCHING IN SEARCHABLE ENCRYPTION SYSTEM [0002]

The present invention relates to a search apparatus and method in a searchable cipher system, and more particularly, to a search apparatus and method in a searchable cipher system that provides effective data search for cipher data for data privacy protection.

The present invention is derived from a research carried out by the Korea Electronics and Telecommunications Research Institute as a part of the research and operation support project [Task Control Number: 15ZS1500, Project Title: Development of Cryptographic Source Technology for Data Storage and Retrieval in Encrypted Database].

Recently, data usage through cloud and big data environment is gradually increasing, and there is increasing concern about privacy leakage of circulating user data. While it is possible to protect data privacy by applying encryption technology to stored data, it is difficult to apply general data encryption technology to an environment that frequently uses data such as cloud and big data environment. In the case of general encryption techniques, it is extremely limited to directly use encrypted data because it aims at providing high confidentiality to encrypted data. In order to utilize data, inefficient process such as decryption of entire encrypted data is required.

The searchable encryption technology is a data encryption technology for providing a search function for encrypted data. It aims at providing both confidentiality of data due to encryption and data utilization through retrieval at the same time. In other words, searchable encryption technology is a very important safety requirement to design not only an external attacker but also a data server storing / managing data as a potential attacker so that it is difficult to deduce information about stored data from encrypted data and search index . For this reason, the search index also ensures confidentiality through encryption (or a similar process) using the secret information of the user.

Searchable encryption technology was first proposed in the early 2000s. In the searchable encryption technique, each data is represented by a set of keywords. In addition to encryption of data, a search index for data retrieval is configured based on the keywords included in the data. The search index is stored in the server together with the encrypted data through a separate encryption process from the data encryption. In order to search for encrypted data, specific information called 'Trapdoor' is generated from a keyword to be searched and a secret key to be transmitted to a server. In the search process, instead of directly accessing the encrypted data, the server confirms information about the data including the search index and the keyword to be searched from the trap door. That is, the searchable encryption technique can be embodied as a search index creation process, a trap door creation process, and a search process by a server. Since the searchable encryption techniques are all designed on the basis of a similar scheme, the difference of each technique is determined by the method of generating / managing the search index and the method of performing the search through the search index.

The initial searchable cryptosystem was intended to provide systematic security to provide confidentiality to stored data from external and internal attackers, and used a method of generating a search index based on public key cryptography. However, since the public key index generation method is a method of individually generating an index for each piece of data, a process of collating the trap door transmitted from the search process with each search index is required, And thus is not suitable for an environment for managing a large amount of data. In 2006, Curtmola et al. Proposed a technique to provide search time independent of the amount of stored data through a method of constructing a search index in the form of a linked chain. In order to provide an efficient search time, The technique design has been actively pursued. However, the method of constructing the search index based on the association between the data, such as the linked chain, is not easy to reflect the modification in the search index stored in the server when the existing data is deleted or new data is added . For this reason, there is a growing demand for searchable cryptosystems that provide effective search performance in dynamically changing data utilization environments.

SUMMARY OF THE INVENTION It is an object of the present invention to provide a search apparatus and method in a searchable cryptographic system that can provide effective search performance for cryptographic data in a dynamically changing data utilization environment.

According to an embodiment of the present invention, a search method of a server in a searchable cryptosystem is provided. The search method includes receiving a search index including at least one of a cipher text for the corresponding data, a keyword included in the corresponding data, and an identifier of the corresponding data from at least one user terminal and storing the search index in the search index table, Searching for a trap door corresponding to a keyword of a material to be searched using the search index table and a reconfiguration index table configured in the server, When the identifier is retrieved, adding a search index for the identifier of the retrieved data to the reorganization index table and reconstructing.

The retrieval method may further include deleting, from the retrieval index table, a retrieval index for data corresponding to the trap door retrieved from the retrieval index table.

The retrieval method may further include deleting an index and a ciphertext corresponding to the identifier of the corresponding data in the reconfiguration index table upon receiving the identifier of the data to be deleted from the user terminal.

The reconstructing step may include extracting a search index for the retrieved data, and adding the retrieved index to the reconstruction index table as it is.

The searching method may further include receiving a search index for newly added data from the user terminal, and adding a search index for the newly added data to the search index table.

The reconstructing may include encrypting the reconstructed index with the secret key of the server.

The performing step may further include transmitting an identifier of the data corresponding to the trap door to the user terminal requesting the search.

According to another embodiment of the present invention, a search apparatus of a server in a searchable cryptosystem is provided. The search device may comprise a network interface, and a processor. The network interface provides an interface with a user terminal. When the processor receives the search index including at least one of the cipher text, the identifier of the corresponding data, and the keyword information included in the corresponding data from the at least one user terminal through the network interface, the processor searches the cipher text and the search index The search index table, the search index table, the search index table, and the search index table, and adds the index to the reorganization index table by reconstructing the search index for the identifier of the data retrieved from the search index table. Retrieve the reorganization index table.

The processor may delete an index for data corresponding to the trap door retrieved from the retrieval index table from the retrieval index table.

Upon receipt of an identifier of a data item to be deleted from the user terminal through the network interface, the processor may delete an index and a cipher text corresponding to the identifier of the data to be deleted from the reconfiguration index table.

The processor may extract an index of the retrieved data and use the retrieved index as an index in the reconstruction index table.

The processor may add the ciphertext and the search index to the search index table when receiving the ciphertext and the search index for the newly added data from the user terminal through the network interface.

The processor may encrypt the reconstructed index with the secret key of the server.

The trap door may be created using the secret key of the user terminal and the keyword of the data to be searched by the user terminal requesting the search.

According to the embodiments of the present invention, it is possible to provide a method for effectively searching and indexing cryptographic data that changes dynamically through an index reconstruction method.

1 is a diagram schematically showing a searchable cryptosystem according to an embodiment of the present invention.
FIG. 2 is a flowchart illustrating a method of performing an indexing and encryption step in a user terminal according to an exemplary embodiment of the present invention.
3 is a flowchart illustrating a method of performing a trap door generation step in a user terminal according to an exemplary embodiment of the present invention.
4 is a flowchart illustrating a method of performing a search step in a server according to an embodiment of the present invention.
5 is a diagram illustrating a method of performing an index rearrangement step in a server according to an embodiment of the present invention.
6 is a diagram illustrating a method for performing a deletion step in a user terminal and a server according to an embodiment of the present invention.
7 is a diagram illustrating a search apparatus according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily carry out the present invention. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In order to clearly illustrate the present invention, parts not related to the description are omitted, and similar parts are denoted by like reference characters throughout the specification.

The terms used in the embodiments of the present invention are used to illustrate specific embodiments and are not intended to limit the present invention. The singular expressions include plural expressions unless the context clearly dictates otherwise.

Also, throughout the specification and claims, when a component is referred to as " comprising ", it means that it can include other components, rather than excluding other components .

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS A search apparatus and method in a searchable cryptosystem according to an embodiment of the present invention will now be described in detail with reference to the drawings.

1 is a diagram schematically showing a searchable cryptosystem according to an embodiment of the present invention.

Referring to FIG. 1, the searchable cipher system allows the searchable cipher system to search for information including specific keywords, while securing the security of the encrypted information such as existing cipher text.

The searchable cryptographic system includes at least one user terminal (100) and a server (200).

In the searchable cryptosystem, data that is the subject of encryption is called a document. That is, the data is the information that the user wants to hide, and each data is assumed to have a unique identifier id. In addition, information for a user to search for a desired data is called a keyword. In general, data is defined as a set of keywords contained in the data. In other words. the data M (id) having the identifier id including t keywords k1, k2, ..., kt can be expressed as Equation (1).

The searchable cryptographic system includes a key generation step S10, an index and a build index step S20, a trapdoor generation step S30, and a search step S40 . The searchable cryptosystem according to the embodiment of the present invention may perform an index rearrangement step S50, an index addition step S60 and a deletion step S70 and S80 .

The key generation step S10 is a step of preparing the searchable encryption system to be used by the user terminal 100 in the future. In the key generation step, each user terminal 100 generates and stores its own secret key, and discloses the public information of the searchable encryption system to the server 200 and other user terminals. Also, the user terminal 100 initializes the search index table, and the server 200 initializes the reconfiguration index table.

The index and encryption step (S20) encrypts the given data to generate a cipher text, and generates a search index for searching the corresponding data.

FIG. 2 is a flowchart illustrating a method of performing an indexing and encryption step in a user terminal according to an exemplary embodiment of the present invention.

Referring to FIG. 2, in the index and encryption step S10, the user terminal 100 generates a cipher text by encrypting the data itself with the secret key of the user terminal 100 for a given data (S210) A search index including information of the included keyword is generated (S220). The cipher text and the search index are transmitted to the server 200 at step S230 and the server 200 stores the cipher text encrypted by the user terminal 100 and the search index generated by the user terminal 100 at step S240. At this time, the server 200 stores and manages the search index in the search index table.

The trap door creation step (S30) is executed by the user terminal (100).

3 is a flowchart illustrating a method of performing a trap door generation step in a user terminal according to an exemplary embodiment of the present invention.

Referring to FIG. 3, the user terminal 100 generates a trap door corresponding to a keyword to be searched using the secret key of the user terminal 100 and the keyword to be searched (S310). The trap door can only be created using the secret key of the user terminal 100. For example, the user terminal 100 may generate a trap door by encrypting the hash value obtained by hashing the keyword with the secret key of the user terminal 100. [ The user terminal 100 transmits a trap door to the server 200 and requests a search (S320).

The search step S40 is performed by the server 200 as a step of searching for data corresponding to a given trap door. According to an embodiment of the present invention, the server 200 performs a search using the trap door transmitted from the user terminal 100 and the index stored in the search index table, and performs a search using the reconstruction index of the self- Perform a search.

4 is a flowchart illustrating a method of performing a search step in a server according to an embodiment of the present invention.

4, when the server 200 receives the trap door from the user terminal 100 (S410), the server 200 determines whether there is data matching the keyword to be searched using the received trap door and the index stored in the search index table Search is performed (S420).

In operation S430, the server 200 further searches whether there is data matching the keyword to be searched using the received trap door and the reconstruction index of the reconstruction index table. The retrieval of the reconstruction index requires the secret key of the server 200 in addition to the trap door transmitted by the user terminal 100. Since the reconstruction index is encrypted through the secret key of the server 200 and stored in the reconstruction index table as described later, the server 200 decodes the reconstruction index of the reconstruction index table using the secret key of the server 200, Can be performed.

As a result of the search, the server 100 transmits an identifier of a data corresponding to the trap door to be searched to the user terminal 100 (S440). The user terminal 100 receives the identifier of the data as a search result, and then performs data processing such as downloading of the cipher text of the actual data using the identifier of the searched data.

The index rearrangement step S50 is a step of rearranging or reorganizing the index according to the search result performed by the server 200. [

5 is a diagram illustrating a method of performing an index rearrangement step in a server according to an embodiment of the present invention.

Referring to FIG. 5, the server 200 extracts a search index for an identifier of the searched data (S510), adds the extracted search index to the reconstruction index table, and reconstructs the search index (S520). In this case, the index reorganization method performed by the server 200 may vary according to the configuration of the search index provided by the user terminal 100. [ The server 200 can directly use the search index for the identifier of the searched data as the reconstruction index. Or the server 200 may use a separate algorithm to generate a reconstruction index associated with the search index for the identifier of the retrieved data.

The server 200 independently encrypts and manages the reconfiguration index through the secret key of the server 200 (S530). Since the information on the search index for the identifier of the data retrieved by the search request of the user terminal 100 among the search index stored in the server 200 is partially known to the server 200, . ≪ / RTI > Therefore, the reorganization index generated by the server 200 is added to the reorganization index table based on the retrieved index. At this time, the server 200 performs a process of adding and modifying the reconfiguration index through the secret key of the server 200, thereby enabling more effective index management. In addition, the server 200 can easily construct a technique for searching for additional functions other than basic keyword search including additional information in the index reconstruction process.

Next, the server 200 deletes the search index for the identifier of the retrieved data in the retrieval index table (S540).

The index addition step (S60) is a step of performing encryption on dynamically added data and adding a new search index to the search index table. The server 200 adds the search index provided by the user terminal 100 to the search index table. Here, the method of adding is determined according to the method of configuring the search index.

Finally, the deleting step (S70, S80) is a step of deleting the data and the search index.

6 is a diagram illustrating a method for performing a deletion step in a user terminal and a server according to an embodiment of the present invention.

Referring to FIG. 6, the user terminal 100 deletes stored data through an identifier of the retrieved data (S610).

The user terminal 100 transmits the identifier of the data to be deleted to the server 200 (S620).

Upon receiving the identifier of the data to be deleted from the user terminal 100, the server 200 deletes all the reconfiguration indexes corresponding to the identifier of the corresponding data from the reconfiguration index table and deletes the ciphertext corresponding to the identifier of the corresponding data (S630, S640).

Since the search index is encrypted in the user terminal 100 and transmitted to the server 200, the server 200 can not distinguish the identifier of the data in the search index. Therefore, in order to delete the search index and ciphertext corresponding to the identifier of the corresponding data in the server 200, additional information such as a trap door and additional operation are required, so that the deletion operation may be difficult. However, according to the embodiment of the present invention, when the server 200 encrypts the reconstruction index using the secret key of the server 200, only the identifier of the data to be deleted is given, the reconstruction index of the reconstruction index table is re- It is possible to retrieve the index, thereby making it easy to delete the reconstruction index corresponding to the identifier.

As described above, according to the embodiment of the present invention, the searchable cryptographic system deletes the search index for the identifier of the searched data from the search index table through the index rearrangement step (S50), and searches the search index for the identifier of the searched data When the identifier of the data to be deleted is received from the user terminal 100, all the identifiers of the corresponding data are deleted from the reconfiguration index table, and the ciphertext corresponding to the identifier of the corresponding data is easily deleted .

7 is a diagram illustrating a search apparatus according to an embodiment of the present invention.

7, the search apparatus 700 includes at least one processor 710, a memory 720, a storage 730, an input / output (I / O) interface 740, and a network interface 750 ).

The processor 710 may be implemented as a central processing unit (CPU) or other chipset, microprocessor, or the like.

The memory 720 may be any type of memory such as RAM, such as dynamic random access memory (DRAM), random access memory (RAM) DRAM, random access memory (RDRAM), synchronous DRAM (SDRAM), static RAM . ≪ / RTI >

The storage device 730 may be a hard disk, a compact disk read only memory (CD-ROM), a compact disk rewritable (CD-RW), a digital video disk ROM, , An optical disk such as a blu-ray disk, a flash memory, various types of RAM, or a permanent or volatile storage device.

I / O interface 740 allows processor 710 and / or memory 720 to access storage 730. The I / O interface 740 may provide an interface with the administrator of the server 200.

The network interface 750 provides an interface with the user terminal 100.

The processor 710 may perform the functions of the searching step S40, the index rearranging step S50 and the deleting step S70 of the server 200 described in FIGS. The processor 710 loads a program instruction for implementing the functions of the search step S40 of the server 200, the index rearrangement step S50 and the deletion step S70 into the memory 720, 6 can be controlled so as to be performed. Such a program command may be stored in the storage device 730 or may be stored in another system connected to the network.

Hereinafter, an embodiment of the present invention will be described in detail with reference to an example of index configuration using a linked list. However, the embodiment of the present invention is not limited to the index structure using the linked list.

First, in the key generation step S10, the user terminal 100 selects an arbitrary key SK, sets it as a secret key of the user terminal 100, initializes the search index table, and stores it in the server 200. [ Here, the size of the search index table can be determined by the amount of data to be stored. Also, the user terminal 100 generates a keyword table storing a link ' a, ek ' including the encryption key and the location information of the search index for each keyword. The keyword table is initially set to an empty state. Then, the server 200 initializes the reconfiguration index table.

It is assumed in the embodiment of the present invention that each piece of data has a unique distinguishable data identifier. Also, each data is represented by a set of keywords included in the data as shown in Equation (1).

In the index and encryption step (S20), the user terminal (100) extracts a pair of keyword-data identifiers from each piece of data and creates an index from the pair of identifiers of each piece of keyword-data. That is, {k1, k2, ... (k1-id), < k2-id &gt;, ...) from the data M (id) , <kt-id> can be extracted. When a pair of keyword-data identifier <k-id> is given to the user terminal 100, the user terminal 100 receives the address a of the empty node in the search index table from the server 200, Check the link information <a ', ek'>. If the link is empty, 'empty' information is stored in the link. The user terminal 100 generates an Enc _ek (id, link) by encrypting an (id, link) with ek after selecting an arbitrary encryption key ek and transmits Enc _ek (id, link) to the server 200 And stores it in the a-th node of the search index table. Also, the user terminal 100 changes information corresponding to the keyword k in the keyword table to a new link &lt; a, ek &gt;. The user terminal 100 encrypts the data to be stored with the secret key SK and transmits the encrypted data to the server 200.

The user terminal 100 generates search indexes and ciphertexts for all the data to be stored, and transmits the search indexes and ciphertexts to the server 200. In this way, the search index provided by the user terminal 100 is stored in the search index table of the server 200.

In the trapdoor generation step S30, the user terminal 100 confirms the link information <a, ek> corresponding to the keyword k in the keyword table for the keyword k to be searched. Also, the user terminal 100 generates a hash value H (k) for the keyword k using the hash function, encrypts the hash value H (k) with the secret key of the user terminal 100, _SK (k) and link information < a, ek > to the server 200 as a trap door.

In the search step S40, the server 200 performs the following search for the trap door delivered by the user terminal 100. [ The server 200 first collects the identifier id of all the data included in the linked list starting from the a-th node of the search index table for the given link information < a, ek &gt;. ek is used as the key to decode the first node of the linked list. Also, the server 200 decodes the data identifier id corresponding to H _SK (k) with the secret key of the server 200 in the reconfiguration index table managed by the server 200, (100).

After receiving the search result, the user terminal 100 modifies the value of the keyword table corresponding to the keyword k that performed the search to 'empty'.

In index rearrangement step (S50), the server 200 collects all of the identifier id of the data corresponding to the search results retrieved from the trapdoor, encrypted with the secret key of the server 200 to reconstruct the index that corresponds to the H _SK (k) Add to the table.

In this example, the case where the simple keyword search is supported, and the process of configuring the reorganization index is explained by applying the simple encryption technique. However, a separate index configuration for providing an additional search function is also possible. In addition, the server 200 deletes all nodes of the linked list identified in the search process.

The index addition step (S60) is the same as the index and encryption step in the user terminal (100). That is, in the additional step, the user terminal 100 encrypts the newly added data, generates an index, and provides the index to the server 200.

In the deletion step (S70, S80), the user terminal 100 deletes the retrieved data. If the server 200 provides the identifier of the data to be deleted to the server 200, the server 200 deletes the identifier id, and delete the ciphertext corresponding to the identifier id of the data.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, It belongs to the scope of right.

Claims (14)

A search method of a server in a searchable cryptosystem,
Receiving, from at least one user terminal, a search index including a cipher text for the corresponding data, a keyword included in the corresponding data, and an identifier of the corresponding data, and storing the received search index in a search index table;
Performing a search using the search index table and a reconfiguration index table configured in the server when a trap door corresponding to a keyword of a data to be searched is received from a user terminal requesting the search,
If an identifier of the data corresponding to the trap door is retrieved from the retrieval index table, adding a retrieval index for the identifier of the retrieved data to the reorganization index table and reconstructing
/ RTI &gt; The method of claim 1,
A step of deleting, from the search index table, a search index for data corresponding to the trap door searched from the search index table
Further comprising: 3. The method of claim 2,
Upon receipt of an identifier of a data item to be deleted from the user terminal, deleting an index and a ciphertext corresponding to the identifier of the corresponding data item in the reconfiguration index table
Further comprising: The method of claim 1,
The reconstructing step
Extracting a search index for the searched data, and
And adding the extracted search index to the reconstruction index table as it is. The method of claim 1,
Receiving a search index for newly added data from a user terminal; and
Adding a search index for the newly added data to the search index table
Further comprising: The method of claim 1,
Wherein the reconstructing comprises encrypting the reconstructed index with a secret key of the server. The method of claim 1,
Wherein the step of performing the step comprises transmitting an identifier of the data corresponding to the trap door to the user terminal requesting the search
Further comprising: A search apparatus of a server in a searchable cryptosystem,
A network interface for communicating with the user terminal, and
When a search index including at least one of a ciphertext for the corresponding data, an identifier of the corresponding data and information of keywords included in the corresponding data is received from the at least one user terminal through the network interface, the ciphertext and the search index are stored in the search index table The search index table and the reconfiguration index table are managed based on the trap door received from the user terminal requesting the search, and the search index table is added to the reorganization index table. Processor to search
. 9. The method of claim 8,
Wherein the processor deletes, from the search index table, an index for data corresponding to the trap door retrieved from the search index table. The method of claim 9,
Wherein the processor deletes an index and a cipher text corresponding to an identifier of the data to be deleted from the reconfiguration index table when receiving an identifier of a data to be deleted from the user terminal through the network interface. 9. The method of claim 8,
Wherein the processor extracts an index of the retrieved data and uses the extracted index as an index in the reconstruction index table. 9. The method of claim 8,
Wherein the processor adds a corresponding ciphertext and a search index to the search index table when receiving a ciphertext and a search index for newly added data through the network interface from the user terminal. 9. The method of claim 8,
And the processor encrypts the reconstructed index with the secret key of the server. 9. The method of claim 8,
Wherein the trap door is generated using a secret key of the user terminal and a keyword of a data to be searched by the user terminal requesting the search.

Images