Summary of the invention
The shortcoming of prior art in view of the above; the object of the present invention is to provide access control method and the system of search engine under a kind of cloud environment; be used for solving search engine under the current cloud environment when realizing effective search, the problem of lacks good access control, data protection, controlling flexibly.
Reach for achieving the above object other relevant purposes, the invention provides the access control method of search engine under a kind of cloud environment, described access control method comprises:
S1, the new file that processing receives is new file generated index, specifying access structure is new file encryption also, and stores the new file of having encrypted;
S2, the request of sending the required file of retrieval begins retrieving files after obtaining key, and filters result for retrieval;
S3 selects download file, for file engraves watermark, at last described file is passed to the user.
Preferably, also comprise in described step S1:
S11 uploads new file;
S12 processes the content of described new file and generating indexes;
S13 specifies access structure, and namely which kind of attribute designated user need to have and just have the authority of opening new file;
S14, for new file carries out encryption attribute, namely using described access structure is new file encryption;
S15, the new file that storage has been encrypted is in order to use its stores service.
Preferably, also comprise in described step S2:
S21, the required file of request retrieval;
S22 obtains user key; Described key is unique voucher of the new file of decoding;
S23 is according to the indexed search file that generates; Namely according to index, find the All Files tabulation with the user key words coupling.
S24 filters result for retrieval, namely to that retrieve and the listed files user key words coupling, uses the user key that obtains that ciphertext is decrypted one by one, and judges whether the file decryption success to retrieving; If represent that then this user has the desired attribute of the described new file of access, continues to carry out next step; If not, represent that then this user does not have the desired attribute of the described new file of access, end process;
S25 returns to the user with the result for retrieval that obtains after filtering.、
Preferably, successful decryption mark result for retrieval is authority, and Decryption failures mark result for retrieval is the unauthorized file.
Preferably, also comprise in described step S3:
S31 browses result for retrieval, and selects to download result for retrieval;
S32 is for authority engraves watermark, in order to make copyright protection and document track;
S33 will process file transfer later to the user.
The invention provides the access control system of search engine under a kind of cloud environment, described access control system comprises:
Administration module is used for key and attribute that management is obtained;
Data retrieval module is used for receiving the file of uploading, and the retrieval service of mass file data is provided, and is described new file generated index, specifies access structure;
Access control module is used to new file encryption, after retrieval finishes, result for retrieval is filtered, and judges whether the file decryption that retrieves successful;
Data storage module is used for the new file that storage is uploaded.
Preferably, described administration module comprises attribute management module and key management module, and described attribute management module is used for the leading subscriber characteristic information, and described key management module is used for generating key, and when guaranteeing that user property changes, the corresponding change of its authority can in time embody among the key.
Preferably, the retrieval of described data retrieval module was divided into for two steps, for the first time retrieval done in the key word that the first step provides according to the user, the tabulation of formation alternative file, whether second step is paid access control module with key and alternative file tabulation that the user provides, have authority to obtain the information of file to judge the user.
As mentioned above, the access control method of search engine under the cloud environment of the present invention has following beneficial effect:
1, the high efficiency that has kept search engine;
2, cryptographic operation and access control have been realized simultaneously
Embodiment
Below by specific instantiation explanation embodiments of the present invention, those skilled in the art can understand other advantages of the present invention and effect easily by the disclosed content of this instructions.The present invention can also be implemented or be used by other different embodiment, and the every details in this instructions also can be based on different viewpoints and application, carries out various modifications or change under the spirit of the present invention not deviating from.
See also accompanying drawing.Need to prove, the diagram that provides in the present embodiment only illustrates basic conception of the present invention in a schematic way, satisfy only show in graphic with the present invention in relevant assembly but not component count, shape and size drafting when implementing according to reality, kenel, quantity and the ratio of each assembly can be a kind of random change during its actual enforcement, and its assembly layout kenel also may be more complicated.
The present invention is described in detail below in conjunction with embodiment and accompanying drawing.
The access control method of search engine and system are according to the encryption attribute fine size, can realize the fine-grained access control of search engine under the cloud environment under the cloud environment of the present invention, and control neatly other cipher application of data security level.
Embodiment one
The present embodiment provides the access control method of search engine under a kind of cloud environment, described access control method is applied to comprise on the access control system of search engine of administration module, data retrieval module, access control module and data memory module, as shown in Figure 1, described access control method comprises:
S1 prepares retrieving files, namely receives new file, and the new file that the deal with data retrieval module receives is new file generated index, and specifying access structure is new file encryption also, the new file that storage has been encrypted; When the user upload a new file to Cloud Server to do to preserve or when shared.Prepare the step of retrieving files specifically as shown in Figure 2, comprising:
S11 uploads new file.
S12 processes the content of described new file, and generating indexes, for after search operaqtion prepare.
S13 specifies access structure, and namely which kind of attribute designated user need to have and just have the authority of opening new file.
S14, for new file carries out encryption attribute, namely using described access structure is new file encryption.In ciphering process, the access structure of user's appointment is embedded in the ciphertext, so that only have qualified user successfully to decipher.Like this, encrypting new file, when protecting this newly to ask the valency content, also realized the fine-grained access control that encryption attribute can reach.
S15, the new file that storage has been encrypted is in order to use its stores service.
S2, retrieving files, the request of namely sending the required file of retrieval begins retrieving files behind the generation key, and filters result for retrieval.This step specifically comprises as shown in Figure 3:
S21, the required file of request retrieval;
S22 obtains user key; After the user asks retrieving files, obtain private key for user, as unique voucher of the new file of decoding.Wherein, the user key that obtains can be taked dual mode, and a kind of namely is to generate user key when using, and another kind namely is that the user generates when registering, and is preserved by the user at ordinary times, passes to server by the user during use.
S23 is according to the indexed search file that generates; The process of retrieving files is as good as with general search engine, namely according to index, finds the All Files tabulation with the user key words coupling.
S24 filters result for retrieval, namely to that retrieve and the listed files user key words coupling, uses the private key that obtains that ciphertext is decrypted one by one, and judges whether the file decryption success to retrieving.If successful decryption represents that then this user has the desired attribute of the described new file of access, therefore, this result for retrieval of mark is authority, continues to carry out next step; With upper opposite, if Decryption failures represents that then this user does not have the desired attribute of the described new file of access, this result for retrieval of mark is the unauthorized file so, finishes retrieval.
S25 returns to the user with the result for retrieval that obtains after filtering; Level of security according to setting returns to the user with result for retrieval.Detailed process is: when setting higher level of security for the moment, only return the file name information of the file that retrieves and the summary of file, and the operation of open authority; When setting lower level of security two, return the file name information of All Files and the summary of file, but only open the down operation of authority.
S3 downloads the file that retrieves, and namely selects to download authority, for file engraves watermark, at last described file is passed to the user; This step comprises specifically as shown in Figure 4:
S31, the user browses result for retrieval, and selects to download result for retrieval.
S32 is for authority engraves watermark, in order to make copyright protection and document track.
S33 will process file transfer later to the user.
The present embodiment provides the access control method that uses search engine under the cloud environment that the ciphertext policy attribute encrypts, particular flow sheet as shown in Figure 5, the method can a step realize fine-grained access control, data protection and protect the high efficiency of search performance.
Embodiment two
The present embodiment provides the access control system of search engine under a kind of cloud environment, and as shown in Figure 6, the access control system of search engine comprises under the described cloud environment: administration module 1, data retrieval module 2, access control module 3 and data memory module 4.
Administration module 1 is used for managing keys and attribute, and described private key is unique voucher of declassified document.Administration module is when user registration or key need to upgrade (situations such as key expires, the renewal of user's active request), the attribute all according to the user, for it generates its key of authority at that time of unique representative, and the key management work after being responsible for, the adoptable scheme of key management is more, a kind of method is the unactual user's of the giving keeping of user key, but each when needs use the up-to-date attribute according to the user be its dynamic generation, thereby guaranteed validity and the security of user key.Another kind is that key is transferred to user management, and is each cipher key setting term of validity, and key namely can lose efficacy after expiring.The user can be when at ordinary times attribute change new key or then upgrade in request when the term of validity more initiatively.Described administration module is complementary module, but the access control system of search engine is an indispensable part under whole cloud environment, and it comprises attribute management module and key management module two parts.
Wherein, described attribute management module is used for the leading subscriber characteristic information, and for example, user's age, work, department, email address etc. are to realize complicated access control condition.For example, the access control condition of the file of a certain the university's art festival registration condition of access and detailed rules and regulations,
The access control condition is: teacher or the student that must be this school; Must specify corporations referring to crossing two at least; The necessary age is between 20 to 30 years old.
That is: (certain university student OR university teacher) AND(2,3) of(participated in dancing corporations, skidding corporations, music corporations) the AND(age greater than the 20AND age less than 30)
Adopted (t in this access control condition, n) thresholding, the principle of this thresholding is to distribute secret method in n participant, under this method, each participant has the partial information of untiing secret, arbitrarily t participant can the original secret of reconstruct, and any t-1 participant can not obtain any information about secret.Be applied in the formation of access structure, (t, n) thresholding then with door or class seemingly, its general form can be expressed as (t, n) (P1, P2, Pn), represent and to satisfy at least t in n the Parameter Conditions (Pi) and just can export True for True, otherwise export False.This in above example access structure then expression need at least to participate in two ability in 3 corporations' conditions by this thresholding.
Described key management module is used for generating key, and guarantee when user property changes, the corresponding change of its authority can in time embody among the key, otherwise, if user property has occured to change but its authority is for being changed accordingly, can cause like this disunity of user's actual authority and execution authority.The adoptable scheme of key management is also more, and a kind of method is the unactual user of giving of user key keeping, but each when needs use the up-to-date attribute according to the user be its dynamic generation, thereby guaranteed validity and the security of user key.Another kind is that key is transferred to user management, and is each cipher key setting term of validity, and key namely can lose efficacy after expiring.The user can be when at ordinary times attribute change new key or then upgrade in request when the term of validity more initiatively.
Data retrieval module 2 is used for receiving the file of uploading, and the retrieval service of mass file data is provided, and is described new file generated index, specifies access structure.The index that described data retrieval module generates is plaintext, resource then is the form of ciphertext, the retrieval actions of data retrieval module 2 in two stages, for the first time retrieval done in the key word that at first provides according to the user, the tabulation of formation alternative file, whether second step is paid access control module with key and alternative file tabulation that the user provides, have authority to obtain the information of this document to judge the user.
Access control module 3 is used to new file encryption, after retrieval finishes, result for retrieval is filtered, and judges whether the file decryption that retrieves successful; If successful decryption represents that then this user has the desired attribute of the described new file of access, therefore, this result for retrieval of mark is for authorizing; Otherwise if Decryption failures represents that then this user does not have the desired attribute of the described new file of access, this index structure of mark is unauthorized so.
Data memory module 4 is used for new file that storage uploads to high in the clouds.
The principle of work of the access control system of search engine under the described cloud environment:
Data retrieval module 2 receives the new file of uploading, and be these new file generated index, specifies access structure, and the new file encryption of described access control module 3 for uploading followed the new file of having encrypted that data memory module 4 will upload and be stored to high in the clouds; When the user asks to retrieve required file, administration module 1 obtains user key, 2 pairs of mass files of data retrieval module are namely retrieved according to the key word that the user provides according to the index that generates, and form the alternative file tabulation, then access control module 3 result for retrieval of coming, in described listed files, user's key is decrypted it one by one, and the file that result for retrieval need to select download is browsed by end user, for file engraves watermark, at last with the deciphering file transfer to the user.
Access control method and the system of search engine under a kind of cloud environment of the present invention; utilize encryption attribute to have access control fine size, data protection high safety, the acceptable characteristics of arithmetic speed; it is attached in the effective search engine under the cloud environment can realizes simultaneously cryptographic operation and access control, and keep the high efficiency of search engine.
In sum, the present invention has effectively overcome various shortcoming of the prior art and the tool high industrial utilization.
Above-described embodiment is illustrative principle of the present invention and effect thereof only, but not is used for restriction the present invention.Any person skilled in the art scholar all can be under spirit of the present invention and category, and above-described embodiment is modified or changed.Therefore, have in the technical field under such as and know that usually the knowledgeable modifies or changes not breaking away from all equivalences of finishing under disclosed spirit and the technological thought, must be contained by claim of the present invention.