CN111460480A - A secure ciphertext file sharing method in ciphertext search system - Google Patents

Abstract

The invention relates to the technical field of information security, and discloses a secure ciphertext file sharing method in a ciphertext search system. The index is uploaded to the big data storage platform, and the search key and file key are shared to the shared user through a secure channel, and the shared user uses the received search key and file key to search and decrypt ciphertext files. Based on password management, the present invention provides users with a secure ciphertext file sharing service. Users only need to log in to their own clients and select the users, files and file keywords that need to be shared to realize file sharing, and the sharing process does not need to pass search passwords. key. The shared users only need to update their own ciphertext index and obtain the file key from the secret management to obtain the shared file, realize the division of responsibilities and rights, and improve the security of the file sharing process.

Description

A secure ciphertext file sharing method in ciphertext search system

technical field

The invention relates to the technical field of information security, in particular to a secure ciphertext file sharing method in a ciphertext search system.

Background technique

The existing ciphertext search system has the following problems:

(1) The security of file sharing is low. When the searchable encryption technology is sharing ciphertext files, the file key and search key are directly delivered to the shared user through a "secure channel". Even if the shared user obtains the search key and decryption key safely, it is difficult to prevent it. The key is leaked in the subsequent continuous sharing, which reduces the security of the stored ciphertext file.

(2) The user experience is poor. When users share ciphertext files, there is no clear "secure channel" transmission method for engineering implementation. The method of manually transmitting keys offline is too cumbersome, which hinders the application of searchable encryption technology.

(3) The boundaries of file sharing security responsibilities are unclear. While ciphertext files are shared, there are also security responsibilities. Simple key sharing, one-way responsibility, and simple auditing will inevitably lead to "joint sitting" of security responsibilities, which is not conducive to the source of responsibility in the process of ciphertext file sharing, but also frustrates The enthusiasm of each user to share ciphertext files is not conducive to the popularization of ciphertext search technology.

Since the ciphertext search technology has the feature that the ciphertext file and the ciphertext index are separated from each other, the size of the ciphertext file is usually much larger than the size of the ciphertext file index. , to issue different keys for different users, to realize the safe sharing of lightweight ciphertext files while removing the risk of key transmission, which helps to solve the problems of low security, ambiguous division of responsibilities and rights, and poor user experience in ciphertext file sharing. , to improve the security of stored data.

SUMMARY OF THE INVENTION

Aiming at the ciphertext file sharing requirements among different users in the ciphertext search system, the present invention proposes a secure ciphertext file sharing method in the ciphertext search system. The storage space of the file is only needed by the sharer to update the index list with their own key, and distribute the file key through the key management server, so that lightweight, secure and supervised ciphertext file sharing can be realized. The method does not increase the storage overhead of the ciphertext file of the shared person, does not share the user's search key, prevents the risk of ciphertext file leakage caused by the leakage of the search key, and effectively supervises the sharing behavior of the ciphertext file.

A secure ciphertext file sharing method in a ciphertext search system, comprising the following steps:

S11. The data owner encrypts his own file data and generates a ciphertext index, and uploads the ciphertext file and ciphertext index to the big data storage platform. At this time, the data owner and the shared user have the encryption of the ciphertext file. text search capability;

S12. The data owner shares the search key and the file key with the shared user through a secure channel;

S13. The shared user searches and decrypts the ciphertext file using the received search key and file key.

Further, the data owner can store and read the ciphertext file from the big data storage platform through the secret state data search client, and query the ciphertext index from the secret state data search service subsystem, and the secret state data search client. The terminal and the encrypted data search service subsystem are issued the relevant keys by the encrypted data key management subsystem.

Further, the encrypted data search client can provide encryption and decryption functions for user files, file indexes, and search requests, send encrypted files to the big data storage platform for storage, and send encrypted search requests to the encrypted search request. Dynamic data search service subsystem.

Further, the big data storage platform includes a distributed file system, and the distributed file system is used to provide a secret state search service.

Further, the secret state data search client directly stores the ciphertext file in the distributed file system, and locates the ciphertext file stored in the distributed file system based on the keyword index list of the secret state data search service subsystem. ciphertext file.

Further, the secret state data search service subsystem is deployed on a separate server, and can establish a keyword index list of the ciphertext file for locating the location where the ciphertext file is stored in the distributed file system; the secret state The data search service subsystem can respond to the search request of the encrypted data search client, search for the location of the encrypted text file and return to the encrypted data search client.

Further, the encrypted data key management subsystem can provide a search key and a file encryption key for the encrypted data search client, and a search key for the encrypted data search service subsystem.

Further, the ciphertext file sharing method specifically includes the following steps:

S21. After the data owner selects the file to be shared, the file keyword and the shared user, initiate a sharing request to the encrypted data key management subsystem through the encrypted data search client, and the request content includes the encrypted data key management subsystem. Share the user ID and the ID of the file to be shared and its keyword information;

S22. the encrypted state data key management subsystem calculates the file encryption key according to the request information submitted by the user;

S23. The encrypted state data key management subsystem informs the shared user to update the index list, and issues a file key to it through a secure channel;

S24. After the shared user receives the shared content through the encrypted state data search client, the encrypted state data search client uses the shared user's search key and the keyword of the shared file to update its own ciphertext index, and published to the distributed file system;

S25. The distributed file system notifies that the shared user index is updated successfully;

S26. The encrypted data key management subsystem informs the data owner that the file sharing is successful.

The beneficial effects of the present invention are: based on password management, the present invention provides users with a secure ciphertext file sharing service. Users only need to log in to their own client and select users, files and file keywords to be shared, and file sharing can be realized. , the sharing process does not need to pass the search key. The shared users only need to update their own ciphertext index and obtain the file key from the secret management to obtain the shared file, realize the division of responsibilities and rights, and improve the security of the file sharing process, including the following advantages:

(1) Low cost: When users share their own files with other users, they do not need to send ciphertext files to the shared users and then upload them to the storage server, saving network bandwidth. The shared users only need to update their own ciphertext index list stored in the ciphertext data search service subsystem, and HDFS on the storage server does not need to add new storage overhead, saving storage costs.

(2) Regulatorability. When a user shares a file, the key management server of a trusted third party notifies the shared user to update the index list. The trust transfer responsibility is clear and clear, and the sharing path of sensitive files is safely supervised.

(3) Convenience and safety. When users share files, they do not need to share their own search keys or send ciphertext files to the shared users and then upload them to the server for storage, which reduces the communication overhead of the client and makes the sharing process more concise. The file key is issued by a trusted third-party key management server through a secure channel to be shared with the user. The shared user uses his own search key to update the index. During the sharing process, the user fully controls the initiative of his own data through the private key, and the storage end cannot know, steal or leak the user's plaintext data. It is also impossible to perform correlation analysis on the user's search behavior, which improves security.

(4) In ciphertext file sharing, users can realize file sharing without sharing their own search keys, which ensures key security.

(5) Users only need to select users and files to be shared and set keywords on the client side to realize convenient, fast and lightweight file sharing.

(6) Clearly divide the responsibility boundary in file sharing, and provide technical support for safe file sharing and supervision sharing.

Description of drawings

Figure 1 Searchable encryption model;

Figure 2 Ciphertext file sharing model;

Figure 3 File security sharing process.

Detailed ways

In order to have a clearer understanding of the technical features, objects and effects of the present invention, the specific embodiments of the present invention will now be described. It should be understood that the specific embodiments described herein are only used to explain the present invention, but not to limit the present invention, that is, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work fall within the protection scope of the present invention.

This embodiment provides a secure ciphertext file sharing method in a ciphertext search system, as shown in FIG. 1 , including the following steps:

S11. The data owner encrypts his own file data and generates a ciphertext index, and uploads the ciphertext file and ciphertext index to the big data storage platform. At this time, the data owner and the shared user have the encryption of the ciphertext file. text search capability;

S12. The data owner shares the search key and the file key with the shared user through a secure channel;

S13. The shared user searches and decrypts the ciphertext file using the received search key and file key.

In a preferred embodiment of the present invention, as shown in FIG. 2 , the data owner can store and read ciphertext files to the big data storage platform through the encrypted data search client, and query the encrypted data search service subsystem from the Ciphertext index, encrypted data search client and encrypted data search service subsystem are issued relevant keys by the encrypted data key management subsystem.

In a preferred embodiment of the present invention, the encrypted data search client can provide encryption and decryption functions for user files, file indexes, and search requests, send encrypted files to the big data storage platform for storage, and send encrypted search requests to Secret state data search service subsystem.

In a preferred embodiment of the present invention, the big data storage platform includes a distributed file system (HDFS, Hadoop Distributed File System), and the distributed file system is used to provide a secret state search service.

In a preferred embodiment of the present invention, the encrypted data search client directly stores the encrypted file in the distributed file system, and locates the encrypted file stored in the distributed file system based on the keyword index list of the encrypted data search service subsystem. text file.

In a preferred embodiment of the present invention, the encrypted state data search service subsystem is deployed on a separate server, and can establish a keyword index list of the encrypted text file for locating the location where the encrypted text file is stored in the distributed file system; The state data search service subsystem can respond to the search request of the encrypted state data search client, search the location of the encrypted text file and return the encrypted state data search client.

In a preferred embodiment of the present invention, the cryptographic data key management subsystem can provide a cryptographic data search client with a search key and a file encryption key, and provide a cryptographic data search service subsystem with a search key.

In a preferred embodiment of the present invention, as shown in FIG. 3 , the ciphertext file sharing method specifically includes the following steps:

S21. After the data owner selects the file to be shared, the file keyword and the shared user, initiate a sharing request to the encrypted data key management subsystem through the encrypted data search client, and the request content includes the shared user ID and The ID of the file to be shared and its keyword information;

S22. The encrypted data key management subsystem calculates the file encryption key according to the request information submitted by the user;

S23. The encrypted data key management subsystem notifies the shared user to update the index list, and issues a file key to it through a secure channel;

S24. After the shared user receives the shared content through the encrypted data search client, the encrypted data search client updates its ciphertext index using the shared user's search key and the keyword of the shared file, and publishes it to the distribution file system;

S25. The distributed file system informs the shared user that the index update is successful;

S26. The encrypted data key management subsystem informs the data owner that the file sharing is successful.

To sum up, the method for safe ciphertext file sharing in a ciphertext search system proposed by the present invention does not need to share the search key of the sharer, nor does it need to increase the storage space of the ciphertext file. The key update index list of , and the file key is distributed through the key management server, which can realize lightweight, secure, and supervised ciphertext file sharing. The method does not increase the storage overhead of the ciphertext file of the shared person, does not share the user's search key, prevents the risk of ciphertext file leakage caused by the leakage of the search key, and effectively supervises the sharing behavior of the ciphertext file.

The foregoing are only preferred embodiments of the present invention, and it should be understood that the present invention is not limited to the forms disclosed herein, and should not be construed as an exclusion of other embodiments, but may be used in various other combinations, modifications, and environments, and Modifications can be made within the scope of the concepts described herein, from the above teachings or from skill or knowledge in the relevant field. However, modifications and changes made by those skilled in the art do not depart from the spirit and scope of the present invention, and should all fall within the protection scope of the appended claims of the present invention.

Claims (8)

1. A secure ciphertext file sharing method in a ciphertext search system is characterized by comprising the following steps:

s11, a data owner encrypts file data of the data owner to generate a ciphertext index, and uploads the ciphertext file and the ciphertext index to a big data storage platform, wherein the data owner and a shared user have ciphertext searching capability for the ciphertext file;

s12, sharing the search key and the file key to the shared user through a secure channel by the data owner;

and S13, the shared user searches and decrypts the ciphertext file by using the received search key and the file key.

2. The method as claimed in claim 1, wherein a data owner can store and read ciphertext files to and from the big data storage platform through a secret data search client, and query a ciphertext index from a secret data search service subsystem, and the secret data search client and the secret data search service subsystem issue related keys from a secret data key management subsystem.

3. The method as claimed in claim 2, wherein the cryptographic data search client is capable of providing encryption and decryption functions of user files, file indexes and search requests, sending the cryptographic files to the big data storage platform for storage, and sending the encrypted search requests to the cryptographic data search service subsystem.

4. The method as claimed in claim 2, wherein the big data storage platform comprises a distributed file system, and the distributed file system is configured to provide a cryptographic search service.

5. The method as claimed in claim 3, wherein the cryptographic data search client directly stores the cryptographic file in the distributed file system, and locates the cryptographic file stored in the distributed file system based on the key index list of the cryptographic data search service subsystem.

6. The method for sharing the safe ciphertext file in the ciphertext search system according to claim 3, wherein the ciphertext data search service subsystem is deployed in a separate server, and is capable of establishing a keyword index list of the ciphertext file, so as to locate a position where the ciphertext file is stored in the distributed file system; the secret state data search service subsystem can respond to the search request of the secret state data search client, search the position of the ciphertext file and return the position to the secret state data search client.

7. The method as claimed in claim 3, wherein the secret data key management subsystem is capable of providing a search key and a file encryption key for the secret data search client, and providing a search key for the secret data search service subsystem.

8. The method for sharing a ciphertext file in a ciphertext search system of claim 3, wherein the method for sharing a ciphertext file specifically comprises the following steps:

s21, after a data owner selects a file to be shared, a file keyword and a shared user, initiating a sharing request to the secret data key management subsystem through the secret data search client, wherein the request content comprises an ID of the shared user, an ID of the file to be shared and keyword information of the ID;

s22, the secret state data key management subsystem calculates a file encryption key according to request information submitted by a user;

s23, the secret state data key management subsystem informs the shared user of updating the index list and issues a file key to the shared user through a secure channel;

s24, after the shared user receives the shared content through the secret state data searching client, the secret state data searching client updates the own ciphertext index by using the searching key of the shared user and the keyword of the shared file and issues the ciphertext index to the distributed file system;

s25, the distributed file system informs the shared user that the index is updated successfully;

and S26, the secret data key management subsystem informs a data owner of successful file sharing.

Images