JP4395611B2 - Encrypted database search device and method, and encrypted database search program - Google Patents

Description

  The present invention relates to an encrypted database search apparatus and method, and an encrypted database search program, which includes an encrypted database in which documents are encrypted and stored, and searches the encrypted database while being encrypted.

In recent years, many companies have attempted to improve work efficiency by converting various data into electronic data and storing and managing them online.
Along with this, a service called “data center” business that provides materials and environment necessary for databases has also appeared. In such a form, since the administrator who manages the database environment is different from the user who actually uses the database, the user stores it to prevent the confidential information of the user from being intercepted by the administrator. It is conceivable to encrypt the data.

By the way, in the above usage pattern, a classic attack called “frequency analysis” is a threat. "Frequency analysis" is an analysis that collects a large number of ciphertexts from a database, etc., aggregates the appearance frequencies of each encrypted word, and compares them with general appearance frequencies to estimate plaintext Is the method.
In contrast to the classic frequency analysis described above, there exists a data encryption method and system that disturbs the frequency by inserting dummy data that does not exist in the plaintext (see, for example, Patent Document 1).
JP 2001-356852 A (paragraphs 0007 to 0010, FIG. 2)

According to the technique disclosed in Patent Document 1 described above, the data stored in the computer is not understood and stolen, but the data size of the database increases because a large number of dummy data is inserted for frequency disturbance. There are drawbacks.
On the other hand, there is a method for searching a document in an encrypted state in order to cope with the above-mentioned attack, but a full-text search is essential when searching for a necessary document. there were. On the other hand, there is a technique to speed up the search process by indexing process that caches frequently used keywords, but it is applied as it is to the search system that can perform the search with the document still encrypted. It had the inconvenience that it was not possible.

  The present invention has been made in view of the above circumstances, and performs an index creation process applicable to a search system that searches documents stored in an encrypted database while encrypting them. An object of the present invention is to provide an encrypted database search apparatus and method, and an encrypted database search program, which are accelerated.

In order to solve the above problems, an encrypted database search apparatus according to the present invention includes an encrypted database in which documents are encrypted and stored, and an encrypted database search apparatus that searches the encrypted database as it is encrypted An index storage unit storing a keyword, an encrypted document name including the keyword, and a date when the keyword is searched; and a search request including the encrypted keyword; When the search processing is executed, a search processing unit that transmits the document name when the document name is present in the index storage unit, and transmits the document name by searching the encrypted database in a full text when it does not exist, and score computing unit the frequency of the search, and to generate a score from the importance of the keyword sequentially updated, the score computing Based on the updated score by, and an index update management unit to update the contents stored in the index storage unit, the score computing unit, per the search frequency, the scores in the new keyword order of the retrieved date Set a high value, and measure the ratio of the keyword in the accumulated document and the ratio of appearance in a specific document for the importance of the keyword, and set the score higher in order of increasing the ratio. Features.
In the encrypted database search device according to the present invention, the index update management unit deletes a keyword having the lowest score from the index storage unit and places a newly searched keyword in the index storage unit. To do.

In order to solve the above-described problems, an encrypted database search method according to the present invention includes an encrypted database in which documents are encrypted and stored, and an encrypted database search device that searches the encrypted database while being encrypted The encrypted database search apparatus includes a search processing unit, a score calculation unit, and an index update management unit, and the search processing unit receives a search request including an encrypted keyword. a step of, the retrieval processing unit, the keyword, and keywords, the document name when the encrypted document name includes the keyword, and the date when the keyword is searched is present in the index that is stored Send and search for the full text of the encrypted database and send the document name if it does not exist And step, the score calculation unit, each time the search processing is executed, the steps of sequentially updating to generate a score from the importance of the frequency of the search, and keyword, the index update management unit, is the updated based on the score, have a, and updating the contents stored in the index, the score computing unit, per the search frequency, setting a high score to the new keyword order of the searched date and the For the importance of the keyword, the ratio of the keyword to the accumulated document and the ratio of the keyword appearing in the specific document are measured, and the score is set higher in the order of the ratio .

In order to solve the above-described problem, an encrypted database search program according to the present invention includes an encrypted database in which documents are encrypted and stored, and an encrypted database search device that searches the encrypted database while being encrypted A search request including an encrypted keyword, the keyword being a keyword, an encrypted document name including the keyword, and a date when the keyword was searched A process for transmitting the document name when it exists in the stored index, a process for transmitting the document name by searching the encrypted database in a full text when it does not exist, and a search process each time the search process is executed. and score computing process of sequentially updating and generates a score from the frequency and keyword importance, is the updated Based on the score, the process of updating the contents stored in the index, there is provided a program for causing a computer to execute the said score calculation process, per the search frequency, high set a score to the new keyword order of the retrieved date In addition, with respect to the importance of the keyword, the ratio of the keyword to the accumulated document and the ratio of the keyword appearing in a specific document are measured, and the score is set to be higher in the descending order of the ratio. .

According to the present invention, the keyword, the encrypted document name including the keyword, and the keyword are sorted in the order of the searched date and stored in the index storage unit, and the keyword requested for search exists in the index storage unit. If this is done, the search process can be speeded up by responding immediately.
In addition, since it is necessary to store keywords that are highly likely to be searched in the index storage unit, every time a search process is performed, an index and a new search are performed from the viewpoint of search frequency and keyword importance. By scoring (score calculation) for keywords, removing the lowest score from the index storage unit, placing the newly searched keywords in the index storage unit, and executing processing to update the index storage unit The index storage unit can be maintained and managed in the best state from the viewpoint of search frequency and keyword importance. This makes it possible to construct an encrypted DB search system that is safe and speeds up the search process.

FIG. 1 is a diagram cited for explaining an application system (encrypted DB search system) of an encrypted database search apparatus (hereinafter referred to as an encrypted DB search apparatus 21a) of the present invention. Here, it is assumed that a company entrusts database management of important documents in the company to a data center.
The user terminal 12 is installed with a program (encryption module 124 here) for creating encrypted data, and is connected to the in-house management server 11 via a LAN (Local Area Network) 13. The management server 11 is connected to the encryption DB 22 of the data center 20 via a public line such as the Internet 30.

When a user wants to create and store data using the user I / F 122, the encryption module 124 is activated to encrypt the data, and the data center 20 is accessed via the communication module 123 and the Internet 30. Then, the data is uploaded to the encrypted DB 22 via the encrypted DB search / registration module 21.
On the other hand, when performing a search, the user encrypts the keyword to be searched and transmits it to the data center 20 via the Internet 30. In the data center 2, the DB search / registration module 21 is activated. The DB search / registration module 21 searches the encrypted DB 22, performs matching processing in an encrypted state, extracts the matched data, and returns it. . The user terminal 12 decrypts the returned data by the decryption module 125 and provides it to the user.

FIG. 2 is a block diagram showing the functional expansion of the internal configuration of the encrypted DB search apparatus of the present invention, and is constructed as a part of the DB search registration module 21 shown in FIG.
The encrypted DB search device 21a of the present invention includes a search request receiving unit 211, a search processing unit 212, an index storage unit 213, a score calculation unit 214, an index update management unit 215, and a search request answering unit 216. Is done.

The search request receiving unit 211 receives a search request including a keyword and transfers it to the search processing unit 312. The search processing unit 212 receives a search request including a keyword from the search request receiving unit 211, transmits a document name when the received keyword exists in the index storage unit 213, and searches the encrypted DB 22 for a full text when it does not exist And has a function of transmitting the document name via the search request answering unit 126.
The index storage unit 21 stores a keyword, an encrypted document name including the keyword, and a date on which the keyword is searched in the order of the date.

On the other hand, each time the search processing unit 212 executes search processing, the score calculation unit 214 has a function of generating a score from the search frequency or the importance of the keyword and sequentially updating it. As will be described later, the score calculation unit 214 sets the score points higher in the order of the new keywords on the searched date, as will be described later, and the ratio of the keywords to the accumulated document with respect to the importance of the keyword is specified. The ratio of appearing in the document is measured, and the score is set higher in descending order of the ratio.
The index update management unit 215 has a function of updating the contents stored in the index storage unit 214 based on the score updated by the score calculation unit 214. Specifically, each time the search process is executed, the index update management unit 215 has the lowest score. A so-called roll-in / out process is executed in which the keyword is deleted from the index storage unit 213 and the newly searched keyword is added to the index storage unit 213. When the score of the newly searched keyword is the lowest, the index storage unit 213 is not updated.

FIG. 3 is a flowchart cited for explaining the operation of the embodiment of the present invention, and also shows the processing procedure of the encrypted DB search program of the present invention.
The operation of the encrypted DB search device of the present invention shown in FIGS. 1 and 2 will be described in detail below with reference to the flowchart shown in FIG.

First, the encrypted DB search device 21a receives an encrypted keyword transmitted from the user terminal 12 via the Internet 30 by the search request receiving unit 211 (S31). The search processing unit 312 to which the keyword is supplied from the search request receiving unit 211 refers to the index storage unit 213 (S32), and if it is confirmed that the received keyword exists in the index storage unit 213 (HIT), the index The corresponding document name is read from the storage unit 213, and the requested user terminal 12 is answered via the search request answering unit 216 (S34). On the other hand, if it does not exist (MISS HIT), the document name corresponding to the keyword is read from the encryption DB 22 as usual, and the requested user terminal 12 is answered via the search request answering unit 216 (S35). . In any case, when there is a further document acquisition request, the corresponding document is acquired and transmitted with reference to the encryption DB 212.
Note that the score calculation unit 214 calculates a score based on the hit keyword in parallel with the above-described processing being executed by the search processing unit 212 (S36).

That is, the score calculation unit 214 uses the search date to estimate the search frequency, and gives a high score to the keyword having the newest date. Also, by measuring the ratio of keywords to the entire document stored in the encryption DB 22 and the ratio of occurrence of a keyword multiple times in a specific document, the degree of importance as a keyword is determined, and the keyword with the higher ratio is selected. A process for giving a high score is executed.
Specifically, the score s (w) for a certain word (w) is calculated by executing the following arithmetic expression (1) in S36.

s (w) = Pr _w (k ≧ m | k ≧ n) to df _m (w) / df _n (w) (1)
Here, Pr _w (k ≧ m | k ≧ n) is a conditional probability that when a word w is included n times or more in a certain document, the word w is included m times or more in a certain document, and m> n. df _m (w) represents the number of documents including the word w m times or more, and df _n (w) represents the number of documents including the word w n times or more. Here, m and n can be arbitrarily set. The total score S (w) is calculated by calculating the following equation (2) from the approximated and calculated scores and the ranking Qt (w) in the ascending order of search date and time (in order from the oldest). Calculate Here, N is the total number of words registered in the index storage unit 213. Further, α and β are set in consideration of the environment to which the DB search system is applied.

S (w) = αqt (w) / N + βs (w) (2)
In the dynamic index, an encrypted word, a document name including the word, and a fixed number of date information on which the word is searched are registered, and the search target is given priority over the full-text search. In the initial state, nothing is registered in the index storage unit 213. Therefore, the words hit in the full-text search are sequentially registered and stored.
In the search in the index, only the date information is updated for the hit word. Then, the total score S (w) described above is calculated only after reaching a certain number, and the index update management unit 215 deletes the keyword (search character string) having the lowest score from the index storage unit 213 (S37).

As described above, the present invention sorts the encrypted keywords, the encrypted document names including the keywords, and the keywords in the order of the retrieved date, stores them in the index storage unit 213, and requests the retrieval. If the keyword is present in the index storage unit 213, the search process can be speeded up by replying immediately.
At this time, since it is necessary to store keywords that are highly likely to be searched in the index storage unit 213, an index and a new search are performed from the viewpoint of search frequency and keyword importance each time search processing is performed. A process of scoring (score calculation) for the keyword obtained, removing the one with the lowest score from the index storage unit 213, placing the newly searched keyword in the index storage unit 213, and updating the index storage unit 213 Execute. Thus, the index storage unit 213 is maintained and managed in the best state from the viewpoint of search frequency and keyword importance. Therefore, it is possible to construct an encrypted DB search system that is safe and speeds up the search process.

  Note that the computer-readable recording of the procedures executed by each of the search request receiving unit 211, the search processing unit 212, the score calculation unit 214, the index update management unit 215, and the search request answering unit 216 shown in FIG. The encrypted DB search apparatus of the present invention can also be realized by recording on a medium, causing the computer system to read and execute the program recorded on the recording medium. The computer system here includes an OS and hardware such as peripheral devices.

Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW system is used.
The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.
The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

  The embodiments of the present invention have been described in detail with reference to the drawings. However, the specific configuration is not limited to the embodiments, and includes designs and the like that do not depart from the gist of the present invention.

It is the figure quoted in order to explain the application system of the encrypted database search device of the present invention. It is the block diagram which expanded the function and showed the internal structure of the encryption DB search device of this invention. It is the flowchart quoted in order to demonstrate operation | movement of this invention embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 12 ... User terminal, 20 ... Data center, 21 ... DB search registration module, 21a ... Encrypted DB search device, 22 ... Encrypted DB, 211 ... Search request receiving part, 212 ... Search processing part, 213 ... Index storage part , 214 ... Score calculation unit, 215 ... Index update management unit, 216 ... Search request answering unit

Claims (4)

An encrypted database search device comprising an encrypted database in which documents are encrypted and stored, and searching the encrypted database while being encrypted,
An index storage unit for storing a keyword, an encrypted document name including the keyword, and a date on which the keyword was searched;
When a search request including an encrypted keyword is received, the document name is transmitted when the keyword exists in the index storage unit, and when the keyword does not exist, the document name is transmitted by performing a full text search on the encrypted database. A search processing unit to
Each time the search process is executed, a score calculation unit that generates a score from the frequency of the search and the importance of the keyword and sequentially updates it,
An index update management unit that updates the content stored in the index storage unit based on the score updated by the score calculation unit ,
The score calculation unit
For the search frequency, set a higher score in order of new keywords on the searched date, and
For the importance of the keyword, measure the ratio of the keyword in the accumulated document and the ratio of appearance in a specific document, and set the score higher in the order of the ratio,
An encrypted database search device characterized by the above. 2. The encrypted database search according to claim 1, wherein the index update management unit deletes a keyword having the lowest score from the index storage unit and places a newly searched keyword in the index storage unit. apparatus. An encrypted database search method in an encrypted database search device that includes an encrypted database in which documents are encrypted and stored, and searches the encrypted database while being encrypted ,
The encrypted database search device includes a search processing unit, a score calculation unit, and an index update management unit,
The search processing unit receiving a search request including an encrypted keyword;
The search processing unit transmits the document name when the keyword exists in an index storing a keyword, an encrypted document name including the keyword, and a date when the keyword is searched, and exists. If not, full-text searching the encrypted database and sending the document name;
Each time the score calculation unit executes the search process, a step of generating a score from the frequency of the search and the importance of the keyword and sequentially updating the score,
The index update management unit, based on the updated score, have a, and updating the contents stored in the index,
The score calculation unit is
For the search frequency, set a higher score in order of new keywords on the searched date, and
For the importance of the keyword, measure the ratio of the keyword in the accumulated document and the ratio of appearance in a specific document, and set the score higher in the order of the ratio,
An encrypted database search method characterized by the above. A program for use in an encrypted database search apparatus that includes an encrypted database in which documents are encrypted and stored, and that searches the encrypted database while being encrypted,
Receiving a search request including the encrypted keyword;
If the keyword is present in an index in which the keyword, the encrypted document name including the keyword, and the date when the keyword was searched are stored, the document name is transmitted. If the keyword is not present, the encryption is performed. Processing to search the database for the full text and sending the document name;
Each time the search process is executed, a score calculation process for generating and sequentially updating a score from the frequency of the search and the importance of the keyword;
A program for causing a computer to execute processing for updating the content stored in the index based on the updated score ,
The score calculation process is:
For the search frequency, set a higher score in order of new keywords on the searched date, and
For the importance of the keyword, measure the ratio of the keyword in the accumulated document and the ratio of appearance in a specific document, and set the score higher in the order of the ratio,
An encrypted database search program characterized by that .

Images