TWI805438B - Management system and management method for access authorization of electronic document - Google Patents

Abstract

A management system and a management method for access authorization of an electronic document are provided. The method includes: storing, by a cloud server, a hash value of a first redacted document, a ciphertext of confidential information, an authorization level corresponding to the confidential information, and an index corresponding to the confidential information, the first redacted document includes a redacted area corresponding to the index; storing, by a first terminal device, the first redacted document, and receiving, from the cloud server, the hash value, the ciphertext, the authorization level, and the index; recovering, by the first terminal device, the redacted area of the first redacted document according to the index, the authorization level, and the ciphertext so as to generate a second redacted document in response to the hash value matching the first redacted document; and transmitting, by the first terminal device, the second redacted document to the cloud server.

Description

Management system and method for access rights of electronic files

The invention relates to a management system and a management method of access rights of electronic files.

With the popularization of network technology, the author of the article can quickly share the article with multiple readers through the cloud device. However, the traditional cloud sharing method does not allow the author to effectively manage the access rights of each reader. For example, for paid access to all content in a document, an author may need to create two versions of a document: a trial version that includes some content and a production version that includes all content. When access rights need to be further subdivided, the author may also need to make more than two versions of the document. This way is very inconvenient for the author.

The invention provides a management system and method for access rights of electronic files, which allow users to manage the access rights of electronic files in a convenient manner.

A management system for access rights of electronic files of the present invention includes a cloud server and a first terminal device. The cloud server stores the hash value of the first deleted file, the ciphertext of the confidential data, the authority level corresponding to the confidential data, and the index corresponding to the confidential data, wherein the first deleted file includes the deleted area corresponding to the index. The first terminal device stores the first deleted file, and communicates with the cloud server, wherein the first terminal device receives the hash value, ciphertext, authority level and index from the cloud server, wherein the first terminal device responds to the hash value and The first deleted file is matched to restore the deleted area of the first deleted file according to the index, authority level and ciphertext, thereby generating a second deleted file, wherein the first terminal device transmits the second deleted file to the cloud server.

In an embodiment of the present invention, the above-mentioned management system further includes a second terminal device. The second terminal device is communicatively connected to the cloud server, wherein the second terminal device sends an authorization request to the cloud server to obtain the second deleted file from the cloud server.

In an embodiment of the present invention, the above-mentioned first terminal device receives the operation of marking the confidential information on the original file to generate a hash value, ciphertext, authority level and index according to the original file, wherein the first terminal device transmits the hash value , ciphertext, permission level and index to the cloud server for storage on the cloud server.

In an embodiment of the present invention, the above-mentioned first terminal device encrypts the confidential data according to the public key to generate a ciphertext.

In an embodiment of the present invention, the above-mentioned first terminal device receives the user-defined authority, and judges whether to restore the deleted area according to the user-defined authority and the authority level.

In an embodiment of the present invention, the above-mentioned first terminal device receives an authorization request from the cloud server, and sends a hash value to the cloud server in response to receiving the authorization request, wherein the cloud server returns a hash value in response to receiving the hash value hash value, ciphertext, permission level and index to the first terminal device.

In an embodiment of the present invention, the above-mentioned first terminal device receives the user identification code from the cloud server, generates a hardware hash value according to the hardware characteristic value of the first terminal device, and transmits the user identification code and the hardware hash value to a cloud server for registration.

In an embodiment of the present invention, the above-mentioned cloud server allows the first terminal device to communicate with the cloud server in response to receiving the user identification code and the hardware hash value from the first terminal device.

In an embodiment of the present invention, the above-mentioned first terminal device transmits the access period of the second deleted file to the cloud server, wherein the cloud server transmits the second Delete files to the second terminal device.

A method for managing the access rights of electronic files of the present invention, comprising: storing the hash value of the first deleted file, the ciphertext of the confidential data, the permission level corresponding to the confidential data, and the index corresponding to the confidential data by the cloud server , wherein the first deleted file includes a deleted area corresponding to the index; the first terminal device stores the first deleted file, and receives the hash value, ciphertext, authority level and index from the cloud server; the first terminal device restoring the truncated area of the first truncated file according to the index, authority level, and ciphertext in response to the hash value matching the first truncated file, thereby generating a second truncated file; and transmitting the second truncated file by the first terminal device file to the cloud server.

Based on the above, the cloud server of the present invention can provide functional webpage modules to the terminal devices of authors or readers of electronic documents. The author of the electronic file can operate the terminal device to mark the confidential information and the corresponding authority level on the electronic file, so as to generate the electronic file with part of the content deleted. Readers without an advanced permission level can only read redacted electronic files. If the reader wants to obtain a higher level of authority, the reader can operate the terminal device to send a request to the author. Authors can define the reader's permission level to restore some or all of the deleted content for the electronic file. Authors can share the restored electronic files with readers through the cloud server within the access period. Accordingly, the management system of the present invention can make the management of access rights of electronic files more convenient and simple.

In order to make the content of the present invention more comprehensible, the following specific embodiments are taken as examples in which the present invention can actually be implemented. In addition, wherever possible, elements/components/steps using the same reference numerals in the drawings and embodiments represent the same or similar parts.

FIG. 1 shows a schematic diagram of a management system 10 for access rights of electronic files according to an embodiment of the present invention. The management system 10 may include a terminal device 100 corresponding to the author of the electronic document, a terminal device 200 corresponding to the reader of the electronic document, and a cloud server 500 . The cloud server 500 can be communicatively connected to the terminal device 100 or the terminal device 200 .

The terminal device 100 may include a processor 110 , a storage medium 120 and a transceiver 130 . The processor 110 is, for example, a central processing unit (central processing unit, CPU), or other programmable general purpose or special purpose micro control unit (micro control unit, MCU), microprocessor (microprocessor), digital signal processing Digital Signal Processor (DSP), Programmable Controller, Application Specific Integrated Circuit (ASIC), Graphics Processing Unit (GPU), Image Signal Processor (ISP) ), image processing unit (image processing unit, IPU), arithmetic logic unit (arithmetic logic unit, ALU), complex programmable logic device (complex programmable logic device, CPLD), field programmable logic gate array (field programmable gate array , FPGA) or other similar components or combinations of the above components. The processor 110 can be coupled to the storage medium 120 and the transceiver 130 , and access and execute multiple modules and various application programs stored in the storage medium 120 .

The storage medium 120 is, for example, any type of fixed or removable random access memory (random access memory, RAM), read-only memory (read-only memory, ROM), flash memory (flash memory) , hard disk drive (hard disk drive, HDD), solid state drive (solid state drive, SSD) or similar components or a combination of the above components, and are used to store multiple modules or various application programs executable by the processor 110 . In this embodiment, the storage medium 120 can store a plurality of modules including a functional webpage module 121, and its functions will be described later.

The transceiver 130 transmits and receives signals in a wireless or wired manner. The transceiver 130 may also perform operations such as low noise amplification, impedance matching, frequency mixing, up or down frequency conversion, filtering, amplification, and the like. The terminal device 100 can communicate with the cloud server 500 or the terminal device 200 through the transceiver 130 .

The terminal device 200 may include a processor 210 , a storage medium 220 and a transceiver 230 . The processor 210 is, for example, a processor having the same structure or function as the processor 110 . The processor 210 can be coupled to the storage medium 220 and the transceiver 230 , and access and execute multiple modules and various application programs stored in the storage medium 220 . The storage medium 220 is, for example, a storage medium having the same structure or function as the storage medium 120 , and is used for storing a plurality of modules or various application programs executable by the processor 210 . In this embodiment, the storage medium 220 can store a plurality of modules including a functional webpage module 221, and its functions will be described later. The transceiver 230 is, for example, a transceiver having the same structure or function as the transceiver 130 . The terminal device 200 can communicate with the cloud server 500 or the terminal device 100 through the transceiver 230 .

The cloud server 500 may include a processor 510 , a storage medium 520 and a transceiver 530 . The processor 510 is, for example, a processor having the same structure or function as the processor 110 . The processor 510 can be coupled to the storage medium 520 and the transceiver 530 , and access and execute multiple modules and various application programs stored in the storage medium 520 . The storage medium 520 is, for example, a storage medium having the same structure or function as the storage medium 120 , and is used for storing a plurality of modules or various application programs executable by the processor 510 . The transceiver 530 is, for example, a transceiver having the same structure or function as the transceiver 130 . The cloud server 500 can be communicatively connected to the terminal device 100 or the terminal device 200 through the transceiver 530 .

FIG. 2 shows a signaling diagram for generating a deleted file from an electronic file according to an embodiment of the present invention. In order to use the services provided by the cloud server 500 , the terminal device 100 may first perform steps S201 and S202 to complete the registration. In step S201 , the terminal device 100 may download the functional webpage module 121 and a user identifier (UID) specific to the terminal device 100 from the cloud server 500 .

In step S202 , the function webpage module 121 can send the hardware hash value and the UID to the cloud server 500 for registration. Specifically, the functional webpage module 121 transmits the hardware hash value and the UID to the cloud server 500 through a secure sockets layer (SSL) connection. After obtaining the hardware hash value and UID corresponding to the terminal device 100 , the cloud server 500 determines that the terminal device 100 is registered, and allows the terminal device 100 to communicate with the cloud server 500 or use services provided by the cloud server 500 . In addition, the cloud server 500 sends a reply message to the terminal device 100 through the same SSL connection, so as to remind the terminal device 100 that the user registration has been successfully completed. If there is an unregistered terminal device trying to access the cloud server 500, the cloud server 500 can output an alarm message to the user of the cloud server 500 or the user of the unregistered terminal device through the transceiver 530.

In one embodiment, the cloud server 500 may record the mapping relationship between the hardware hash value, the UID, and the terminal device 100 in the storage medium 520 for identifying the registered terminal device 100 .

In one embodiment, the functional webpage module 121 generates a hardware hash value according to the hardware characteristic value of the terminal device 100 . For example, if the operating system of the terminal device 100 is the iOS system, the functional web module 121 uses the DeviceCheck application programming interface (application programming interface, API) to generate a token or identification code for identifying the terminal device 100 as the hardware characteristic value, such as IDFV (identifier for vendor). If the operating system of the terminal device 100 is the Android system, the functional webpage module 121 uses the Android ID (SSAID) as the hardware characteristic value. For another example, the functional webpage module 121 reads a universally unique identifier (UUID) in a basic input/output system (BIOS) as a hardware characteristic value. For another example, the hardware characteristic value includes a central processing unit identification code (CPU ID), a BIOS serial number or a machineGUID.

In one embodiment, the functional webpage module 121 uses the UID to "salt" the hardware characteristic value to generate the hardware hash value. Specifically, the function webpage module 121 inserts the UID at any fixed position of the hash content of the hardware characteristic value to perform "salting" and generate the hardware hash value.

In step S203 , the function webpage module 121 sends the hardware hash value and the UID to the cloud server 500 for login. The cloud server 500 judges whether the terminal device 100 is a registered terminal device according to the hardware hash value and the UID. If the cloud server 500 determines that the registration of the terminal device 100 has been completed, the cloud server 500 can provide services for the terminal device 100 .

In step S204, the functional webpage module 121 obtains the original file. The functional webpage module 121 receives a complete original file through the transceiver 130, or receives an input command generated by a user through an input device (such as a keyboard) to create an original file. The terminal device 100 creates an original document through a document object model (document object model, DOM) of Javascript.

In step S205, the functional webpage module 121 receives the operation of marking the confidential information on the original document through the transceiver 130, so as to generate the deleted document and its hash value, the ciphertext of the confidential information, and the authority level set by the author for the confidential information and an index of classified material. The functional webpage module 121 can store a predefined permission level set S = {1, 2, ..., N} as a reference for setting permission levels, where N is a positive integer.

FIG. 3 shows a schematic diagram of marking an original file 300 according to an embodiment of the present invention. Specifically, the author operates the terminal device 100 to mark part of the data in the original file 300 , and selects a permission level from the permission level set S to set for the marked content. As shown in FIG. 3, the author marks the strings 310 and 320, and sets the permission level of the strings 310 and 320 to "1". The author also marks the image 330 and sets the permission level of the image 330 to "2". The character string 310, the character string 320 and the image 330 are the confidential information defined by the author. The higher the authority level, the more confidential information can be read. Taking Figure 3 as an example, a reader with an authority level of "1" can only read the unmarked part of the original file 300, and can read the contents of the string 310 and the string 320, but cannot read the contents of the image 330. content. Relatively speaking, a reader whose authority level is “2” can read all the content in the original file 300 including the character string 310 , the character string 320 and the image 330 .

After marking the original file 300, the terminal device 100 can extract the marked data as confidential data, and delete the confidential data from the original file 300 to generate a deleted file. The terminal device 100 performs a hash operation on the deleted file to generate a hash value of the deleted file. On the other hand, the terminal device 100 generates a key pair including a public key and a private key based on an asymmetric encryption algorithm using a cryptographic pseudo-random number generator technique. The terminal device 100 stores the private key in the storage medium 120, and uses the public key to perform Base encoding encryption on confidential data to generate ciphertext, wherein the confidential data may include but not limited to UTF-8 encoded text or images. In addition, the terminal device 100 assigns an index to each confidential material, wherein the deleted file includes a deleted area corresponding to the index. The terminal device 100 can store the deleted file and its hash value in the storage medium 120 .

FIG. 4 is a schematic diagram of a deleted file 400 according to an embodiment of the present invention. Referring to FIG. 3 and FIG. 4 , the terminal device 100 extracts the character string 310 , the character string 320 and the image 330 from the original file 300 as confidential information. The terminal device 100 replaces the word string 310 with the mask to generate the deleted area 410 , replaces the word string 320 with the mask to generate the deleted area 420 , and replaces the image 330 with the mask to generate the deleted area 430 . The mask used to mask the word string may be a black square, and the mask used to mask the image may be a black block of the same size as the image. The terminal device 100 can perform a hash operation on the deleted file 400 to obtain a hash value of the deleted file 400 .

On the other hand, the terminal device 100 uses the public key of the asymmetric encryption algorithm to encrypt the confidential data extracted from the original file 300 to generate ciphertext. The terminal device 100 can assign an index to each confidential data (or each deleted area). For example, since the character string 310 is the first confidential information marked by the author, the terminal device 100 sets the index of the character string 310 (or the deleted area 410 ) to “1”. Since the character string 320 is the second confidential information marked by the author, the terminal device 100 sets the index of the character string 320 (or the deleted area 420 ) to “2”. Since the image 330 is the third confidential information marked by the author, the terminal device 100 sets the index of the image 330 (or the deleted area 430 ) as “3”. After completing the encryption of the confidential data, setting the authority level and assigning the index to generate the deleted file 400, the functional webpage module 121 converts the deleted file 400 from the HTML format to the PDF format conforming to the ISO standard through the Open API.

In step S206 , the functional webpage module 121 transmits information such as the hash value of the deleted file 400 , the ciphertext of the confidential data, the permission level of the confidential data, and the index of the confidential data to the cloud server 500 for storage. The deleted file 400 , the hash value of the deleted file 400 and the private key can be stored in the storage medium 120 by the functional webpage module 121 to be kept locally in the terminal device 100 . In one embodiment, the functional webpage module 121 only stores the deleted file 400 and the private key in the storage medium 120 . When the functional webpage module 121 wants to obtain the hash value of the deleted file 400, the functional webpage module 121 reads the deleted file 400 in the storage medium 120 to perform a hash operation on the deleted file 400, thereby generating the hash value of the deleted file 400 hash value. When reading the deleted file 400 from the storage medium 120, the functional webpage module 121 needs to check the local path to avoid the risk of path manipulation and prevent attackers from using the path to access protected system resources (for example: delete file 400).

FIG. 5 shows a signaling diagram for obtaining a pruned file 400 corresponding to a permission level according to an embodiment of the present invention. In this embodiment, it is assumed that the terminal device 200 has registered with the cloud server 500 in a manner similar to steps S201 and S202 , and has obtained the functional webpage module 221 from the cloud server 500 . If the reader wants to read the confidential information in the deleted area in the deleted file 400, the reader can operate the terminal device 200 to send an authorization request for authorization to read the confidential information. Specifically, in step S501 , the functional webpage module 221 sends an authorization request to the cloud server 500 through the transceiver 230 , so that the cloud server 500 forwards the authorization request to the terminal device 100 .

In step S502 , the functional webpage module 121 transmits the hardware hash value, the hash value of the deleted file 400 and the UID to the cloud server 500 through the SSL connection for login. The cloud server 500 queries the mapping relationship in the storage medium 520 according to the UID, so as to determine whether the hardware hash value from the terminal device 100 and the hash value of the deleted file 400 are legal.

If the cloud server 500 determines that the data from the terminal device 100 is legal, in step S503, the cloud server 500 sends the ciphertext corresponding to the UID of the terminal device 100 and the hash value of the deleted file 400, the authority level and The index is transmitted to the terminal device 100 . The cloud server 500 can further send back the hash value of the deleted file 400 to the terminal device 100 . The functional webpage module 121 of the terminal device 100 judges whether the data from the cloud server 500 corresponds to the deleted file 400 according to the hash value of the deleted file 400 . If the hash value from the cloud server 500 matches the hash value of the deleted file 400 in the storage medium 120, then the functional webpage module 121 judges that the ciphertext, authority level and index from the cloud server 500 are consistent with the deleted file 400 correspond.

In step S504 , the functional webpage module 121 restores a specific deleted area in the deleted file 400 according to the ciphertext, authority level and index corresponding to the deleted file 400 to generate a restored deleted file. Specifically, the function webpage module 121 receives the user-defined authority through the transceiver 130 , wherein the user-defined authority is the reading authority set by the author for the reader holding the terminal device 200 . The functional webpage module 121 determines whether to restore the deleted area according to the user-defined authority and the authority level of the deleted area. For example, if the author sets the reading permission for readers holding the terminal device 200 as "1" (that is, the user-defined permission is set to "1"), the functional webpage module 121 can set the permission level to be less than or equal to "1" "The deleted area is restored. As shown in FIG. 4 , the functional webpage module 121 restores the deleted area 410 to a word string 310 , and restores the deleted area 420 to a word string 320 . Since the authority level of the deleted area 430 is higher than the user-defined authority, the function webpage module 121 will not restore the deleted area 430 . That is to say, the reader holding the terminal device 200 will not be able to read the relevant content of the image 330 .

In order to restore the specific deleted area, the functional webpage module 121 decrypts the ciphertext corresponding to the index of the specific deleted area to obtain the confidential information, and fills the confidential information into the specific deleted area to complete the restoration. The functional webpage module 121 can use the private key in the storage medium 120 to decrypt the ciphertext to obtain the Base coded string, and then decode the Base coded string to obtain confidential information, wherein the confidential information includes, for example, UTF-8 encoded text or images. picture. For example, since the pruned area 410 corresponds to the index “1”, the functional webpage module 121 can use the private key to decrypt the ciphertext corresponding to the index “1” to obtain the string 310 . The function webpage module 121 fills the character string 310 into the deleted area 410 to complete the restoration of the deleted area 410 .

In step S505 , the functional webpage module 121 transmits the restored deleted file to the cloud server 500 through the transceiver 130 through the SSL connection. In one embodiment, the functional webpage module 121 further transmits the access period corresponding to the restored deleted file to the cloud server 500 .

If the cloud server 500 receives an access command from the terminal device 200 within the access period, in step S506 , the cloud server 500 sends the restored deleted file to the terminal device 200 through the SSL connection. The reader holding the terminal device 200 can read the word string 310 and the word string 320 in the restored deleted file, but cannot read the image 330 associated with the deleted area 430 .

FIG. 6 shows a flow chart of a method for managing access rights of electronic files according to an embodiment of the present invention, wherein the management method can be implemented by the management system 10 shown in FIG. 1 . In step S601, the cloud server stores the hash value of the first deleted file, the ciphertext of the confidential data, the authority level corresponding to the confidential data, and the index corresponding to the confidential data, wherein the first deleted file contains the index corresponding to the index the deleted area. In step S602, the first terminal device stores the first deleted file, and receives hash value, ciphertext, permission level and index from the cloud server. In step S603, the first terminal device restores the pruned area of the first pruned file according to the index, authority level and ciphertext in response to the hash value matching the first pruned file, thereby generating a second pruned file. In step S604, the first terminal device transmits the second deleted file to the cloud server.

To sum up, in order to improve the inability to effectively manage reader authority in the existing electronic document access mechanism, the present invention discloses a management method of electronic document access authority, wherein the management method covers the electronic document output process and access to document confidential information. Way. The management system of the present invention uses the cloud server at the network side to identify the terminal device used by the user (for example, the author or reader of the electronic document) as being recognized by the cloud server. The electronic document production process generates a pair of keys through an asymmetric encryption algorithm, encodes several confidential data with restricted access, and encrypts them with the public key. The ciphertext is recorded in the cloud server, and the private key is stored in the author's terminal device. By setting the permission level, the author replaces the part of the electronic document that is restricted from access with a mask, and produces a deleted document that only partially discloses the content. Deleted files are both disseminated and replicated. When the reader who gets the deleted file needs to access the confidential information, the cloud server will notify the author of the electronic file. The author can determine the authority level of the reader, and decrypt the ciphertext with the private key to obtain the confidential information corresponding to the authority level. Data that meets the reader's authority level can be shared in the cloud with an access period added to achieve secure access management of electronic documents.

The present invention has the following features and effects: for access equipment, the present invention first performs hardware device verification when accessing confidential data is required, so as to prevent confidential data from being read by an illegal or unexpected third party; for data security, the present invention The invention replaces the confidential data with a cover of the same size as the original content, and sets the permission level of each data to avoid making multiple electronic files with different content; for the management method, the present invention dynamically manages the permission of the hardware device that requires access to the confidential data Level, to ensure that the equipment and access time for requesting access to confidential information are agreed by the author of the document.

10: Management system 100, 200: terminal device 110, 210, 510: Processor 120, 220, 520: storage media 121, 221: Functional webpage module 130, 230, 530: Transceiver 300: Original file 310, 320: String 330: Image 400: delete file 410, 420, 430: deleted area 500: cloud server S201, S202, S203, S204, S205, S206, S501, S502, S503, S504, S505, S506, S601, S602, S603, S604: steps

FIG. 1 shows a schematic diagram of a management system for access rights of electronic files according to an embodiment of the present invention. FIG. 2 shows a signaling diagram for generating a deleted file from an electronic file according to an embodiment of the present invention. FIG. 3 shows a schematic diagram of marking an original file according to an embodiment of the present invention. FIG. 4 shows a schematic diagram of deleting a file according to an embodiment of the present invention. FIG. 5 shows a signaling diagram for obtaining a pruned file corresponding to a permission level according to an embodiment of the present invention. FIG. 6 is a flow chart of a method for managing access rights of electronic files according to an embodiment of the present invention.

S601, S602, S603, S604: steps

Claims (10)

A management system for access rights of electronic files, including: The cloud server stores the hash value of the first deleted file, the ciphertext of the confidential data, the authority level corresponding to the confidential data, and the index corresponding to the confidential data, wherein the first deleted file includes the the truncated region of the index; and The first terminal device stores the first deleted file and communicates with the cloud server, wherein The first terminal device receives the hash value, the ciphertext, the permission level and the index from the cloud server, wherein restoring, by the first terminal device, the pruned area of the first pruned file according to the index, the authority level, and the ciphertext in response to the hash value matching the first pruned file , resulting in a second pruned file in which The first terminal device transmits the second deleted file to the cloud server. The management system as described in claim 1, further comprising: A second terminal device is communicatively connected to the cloud server, wherein the second terminal device sends an authorization request to the cloud server to obtain the second deleted file from the cloud server. The management system as claimed in item 1, wherein The first terminal device receives an operation of marking the confidential information on the original file to generate the hash value, the ciphertext, the authority level, and the index according to the original file, wherein The first terminal device transmits the hash value, the ciphertext, the permission level and the index to the cloud server for storage by the cloud server. The management system according to claim 3, wherein the first terminal device encrypts the confidential data according to a public key to generate the ciphertext. The management system according to claim 1, wherein the first terminal device receives user-defined permissions, and judges whether to restore the deleted area according to the user-defined permissions and the permission level. The management system according to claim 2, wherein the first terminal device receives the authorization request from the cloud server, and transmits the hash value to the cloud server in response to receiving the authorization request, Wherein the cloud server returns the hash value, the ciphertext, the permission level and the index to the first terminal device in response to receiving the hash value. The management system according to claim 1, wherein the first terminal device receives the user identification code from the cloud server, generates a hardware hash value according to the hardware characteristic value of the first terminal device, and transmits the The user identification code and the hardware hash value are registered to the cloud server. The management system according to claim 7, wherein the cloud server permits the first terminal device to communicate with the The cloud server communicates. The management system according to claim 2, wherein the first terminal device transmits the access period of the second deleted file to the cloud server, wherein the cloud server responds to the receiving the access command and transmitting the second deleted file to the second terminal device. A method for managing access rights of electronic files, comprising: The cloud server stores the hash value of the first deleted file, the ciphertext of the confidential data, the authority level corresponding to the confidential data, and the index corresponding to the confidential data, wherein the first deleted file includes the corresponding a truncated region of said index; storing the first deleted file by the first terminal device, and receiving the hash value, the ciphertext, the permission level and the index from the cloud server; Restoring, by the first terminal device, the pruning of the first pruned file based on the index, the authority level, and the ciphertext in response to the hash value matching the first pruned file region, thereby generating a second pruned file; and The first terminal device transmits the second deleted file to the cloud server.

Images