KR102131306B1 - Apparatus for M anaging Data, Method for Managing Data, System for Managing Data - Google Patents

Abstract

The present invention relates to a data management device, a data management method, and a data management system. The data management device according to an embodiment of the present invention encrypts and stores a plurality of keywords, and sets the ID information of the data including the keyword. A storage unit that encrypts and stores the bloom filter, a control unit that extracts a set of ID information corresponding to the same keyword from the storage unit based on a request from the user, and a decoding unit that decodes the set of extracted ID information. Is characterized in that the data matching the decoded ID information is provided to the user, and the set of ID information is processed as bit information.

Description

Data management device, data management method and data management system {Apparatus for M anaging Data, Method for Managing Data, System for Managing Data}

The present invention relates to a data management device, a data management method and a data management system, and more specifically, encrypts and stores data and keywords in an external storage space under a cloud environment, and generates a searchable ciphertext for keywords, For example, the present invention relates to a data management device, a data management method, and a data management system that enables retrieval of data including the keyword from keywords encrypted by using a token for the keyword to be searched.

Encrypted Keyword Search, which allows keyword search for encrypted data, is divided into a symmetric key-based technique and an asymmetric key-based technique. The symmetric key-based technique has the same object for uploading and downloading data, The asymmetric key technique has different targets.

In a keyword-based searchable encryption system using a symmetric key, a user stores data encrypted with his secret key and its index in an external storage space. The index is an encryption of information on keywords included in the data, and is used when searching the encrypted data based on the keyword. When searching, the user passes the token corresponding to the search keyword to the server, and the server returns the encrypted data to the user after a series of test processes using the token and index. And the user decrypts the data using his/her own secret key.

The keyword-based search encryption system using a symmetric key is divided into a forward index method and an inverted index method according to a search method. In the forward index method, keywords included in each data are stored as a set, and it is checked whether each set includes a search keyword. Therefore, the search time increases in proportion to the number of stored data. However, it is easy to add new data or delete stored data because there is an independent set of encrypted keywords for each data. On the other hand, in the inverted index method, IDs of data including the keyword are stored as a set for each keyword, and data included in the set corresponding to the search keyword is returned when searching. Therefore, the search speed is faster than the forward index method. However, since IDs of data are stored as a set according to a keyword, there is a disadvantage that a set corresponding to a keyword included in data to be added and deleted needs to be updated every time when adding and deleting.

However, conventionally known keyword-based searchable cryptosystems focus on single keyword search, and boolean supports conjunctive search of keywords and disjunctive search of keywords. search), it is not possible to propose an efficient search method.

In addition, conventional systems cannot be applied without modification of an existing database (DB), and there is a problem in that a large amount of cost is required to update a set of IDs of data corresponding to keywords when adding and deleting data.

According to an embodiment of the present invention, data and keywords are encrypted and stored in an external storage space under a cloud environment, for example, a searchable cipher text is generated for keywords, and the corresponding keyword is encrypted using a token for a keyword to be searched. An object of the present invention is to provide a data management device, a data management method, and a data management system that enable retrieval of data including keywords.

The data management apparatus according to an embodiment of the present invention encrypts and stores a plurality of keywords, and stores the data by encrypting and storing a set of ID information of the data including the keyword, based on a request from a user. A control unit for extracting the set of ID information in a column corresponding to the same keyword, and a decoding unit for decoding the set of extracted ID information, wherein the control unit provides data matching the decoded ID information to the user , The set of ID information is processed as bit information.

Here, the bit information may be expressed in the form of a bloom filter or a bit map.

The number of bit information may match the number of data.

Meanwhile, when the user requests the addition or deletion of the data, the data management device may further include an encryption unit that encrypts the added keywords and data and stores the added keywords and data in the storage unit.

On the other hand, by receiving a token (token) from the user further comprises an interface unit to request the search, addition or deletion of the data, the token may include a key for the keyword and the encryption and decryption.

Meanwhile, when the user requests the data including a plurality of keywords, the data management apparatus further includes an operation unit for logically calculating a set of ID information corresponding to each of the plurality of keywords to output a calculation result. , The controller may provide the data to the user based on the bit information of the operation result.

In addition, in the data management method according to an embodiment of the present invention, a plurality of keywords are encrypted and stored, and a set of ID information of the data including the keywords is encrypted and stored in a storage unit, based on a request from a user Extracting the set of ID information in a column corresponding to the same keyword from the storage unit, decoding the set of extracted ID information, and providing data matching the decoded ID information to the user However, the set of ID information is processed as bit information.

Here, the bit information may be expressed in the form of a bloom filter or a bitmap.

Also, the number of bit information may match the number of data.

Meanwhile, when the user requests to add or delete the data, the data management method may further include encrypting the added keyword and data and storing the added keyword and data in the storage unit.

On the other hand, receiving the token (token) from the user further comprises the step of requesting the search, addition or deletion of the data, the token may include a key for the keyword and the encryption and decryption.

Meanwhile, the data management method further includes, when the user requests the data including a plurality of keywords, logically calculating a set of ID information corresponding to each of the plurality of keywords to output a calculation result. However, in the step of providing to the user, the data may be provided to the user based on the bit information of the operation result.

Meanwhile, the data management system according to an embodiment of the present invention encrypts and stores a set of ID information added to one data by matching a plurality of keywords and each of the plurality of keywords, and based on the keyword provided from the user. A first data management apparatus for processing the encrypted ID information in the form of bit information, and the ID information and the ID information matched with each ID information to store the data, and the ID in the form of bits processed by the first data management apparatus And a second data management device that retrieves the stored data based on information and provides it to the user.

1 is a view showing the structure of a data management system according to an embodiment of the present invention,
2 is an exemplary view of the index and data table of the data management apparatuses 1 and 2 of FIG. 1,
3 is an exemplary view of an inverted index according to an embodiment of the present invention,
4 is a block diagram showing the structure of the data management device 1 of FIG. 1,
5 is a view for explaining a data search process according to an embodiment of the present invention,
6 is a view for explaining a data addition process according to an embodiment of the present invention,
7 is a view for explaining a data deletion process according to an embodiment of the present invention, and
8 is a flowchart illustrating a data management method according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

An embodiment of the present invention may be called an EKS system as a keyword-based searchable encryption system. The EKS system efficiently manages the index by applying a bloom filter in an inverted index method according to an embodiment of the present invention. In the EKS system, users have an external index table for keyword search and a data table for data search, and search, add and delete external encrypted data through search, add, and delete requests. Delete it. In an embodiment of the present invention, the maintenance target of the index table may be referred to as Manager_1, the maintenance target of the data table may be referred to as Manager_2, and Manager_1 and Manager_2 may be integrated into one Manager.

1 is a diagram showing the structure of a data management system according to an embodiment of the present invention, Figure 2 is an exemplary view of the index and data table of the data management apparatus 1 and 2 of Figure 1, Figure 3 is an embodiment of the present invention It is an example of an inverted index according to.

As shown in FIG. 1, the data management system 90 according to an embodiment of the present invention includes a user device 100, a communication network 110, a data management device 1 (Manager 1) 120_1, and a data management device 2 ( Some or all of Manager 2) 120_2.

Here, the data management device 2 (120_2) may be a DB, and includes some or all of the data management device 1 (120_1) and data management device 2 (120_2) are integrated into one data management device (or cloud device) ), and means to be able to form a cloud network by combining with the communication network 110, and is described as including everything to help the understanding of the invention.

The user device 100 corresponds to a device for a user to perform data generation. For example, the user device 100 may be a laptop and a desktop computer for performing document work, or a mobile phone and a recording device for generating photographing data such as photos and videos. According to an embodiment of the present invention, the user device 100 preferably stores the generated data in the data management device 1 120_1 or the data management device 2 120 via the communication network 110 when the operation is completed. At this time, the user device 100 may be able to process data by accessing the communication network 110 by wireless communication as well as by wired communication as in FIG. 1.

For example, the user device 100 generates a keyword or a token that can replace a keyword (hereinafter referred to as a keyword) along with the data to store the generated data and provides it to the data management device 1 (120_1). Using it, data stored in the data management device 1 (120_1) or the data management device 2 (120_2), or more accurately, the data management device 2 (120_2) may be loaded. Here, the keyword may be expressed as various types of information, and the token may be understood as a combination of the information and a key for encryption and decryption.

Through this process, the user device 100 may not only update the data by storing the additionally generated data in the data management device 2 (120_2), but also delete pre-stored data through keywords. In other words, the user device 100 uploads/downloads data and requests a query for search, addition, and deletion to the data management device 1 120_1 through a token. Other search, addition, and deletion processes will be described in detail later.

The communication network 110 includes both wired and wireless communication networks. Here, the wired network includes an Internet network such as a cable network or a public telephone network (PSTN), and the wireless communication network includes CDMA, WCDMA, GSM, Evolved Packet Core (EPC), Long Term Evolution (LTE), and WiBro network. to be. Therefore, when the communication network 110 is a wired communication network, the access point can access a switching center of a telephone station or the like, but in the case of a wireless communication network, it can process data by accessing a SGSN or a Gateway GPRS Support Node (GGSN) operated by a communication company or processing a BTS (Base). Station Transmission), NodeB, e-NodeB, and other repeaters to process data.

The data management devices 1 and 2 (120_1, 120_2) are a kind of server, and the data management device 2 (120_2) may be a DB, but are configured as independent devices as shown in FIG. 1 to interlock with each other. These independent two devices can be integrated with each other to form a single clouding device. When configuring one device, data management devices 1 and 2 (120_1, 120_2) will be referred to as information processing units 1 and 2, respectively. Can.

The data management device 1 120_1 uses a bloom filter for efficient search and index management. Bloom filter is a data structure that can express elements of a specific set S={x ₁ , x ₂ , ..., x _n } in a fixed-size array, for example, used as a membership test algorithm, and given input is included in a specific set Returns true/false. And a bloom filter representation for a particular set _{S = {x 1, x 2} , ..., x n} in the embodiment of the present invention to BF_S, and Bloom filter member for x _i is represented as _i bf_x. BF_S=∑ _i=1 ⁿ bf_xi, where'+' operation means member accumulation process of bloom filter, and'-' means member elimination process of bloom filter. And'∧' means the set intersection of bloom filters, and BF_S∧BF_S' becomes the bloom filter for the intersection of sets S and S'. Set intersection of bloom filters can be implemented by bitwise AND operation.

Data management device 1 (120_1) processes the query from the user. The index table is composed of two columns, as shown in FIGS. 2(a) and 3, where the encrypted keyword for the keyword wi is stored in column 1, and the column 2 contains data of the keyword wi. The bloom filter (BF_wi) for the set of IDs is encrypted and stored. For example, the applied encryption algorithm is a deterministic encryption algorithm, and outputs the same result for the same input. And, K_s and K_wi represent encryption/decryption keys that can be calculated from the user's master key (=K).

Looking more closely, the data management device 1 (120_1) combines the data and keywords generated by the user and stores it in the form of a data structure of a bloom filter. That is, an index table is created. In other words, the data management device 1 (120_1) stores a plurality of keywords, as shown in FIG. 3, matches each keyword, configures the ID information of the data including the keyword in a set form, and stores it by encrypting it. At this time, a set of IDs may be expressed as bit information. For example, when all the data stored in the data management apparatus 2 (120_2) is seven, the ID information in the form of aggregation may be represented as 7-bit information. For example, if only the first data among 7 data has keyword 1 (w1), 7-bit information is expressed as "1000000", and only the 7th data has keyword 1 (w1), 7-bit information is also "0000001 Is expressed as ".

Accordingly, when there is no keyword for the data generated by the user device 100, the data management device 1 120_1 generates ID information in the form of a set matching the keyword together with the new keyword. If a keyword exists for new data, only ID information in the form of a set of the keyword needs to be updated. On the other hand, when there is a request to delete data for a specific keyword, the ID of the data having the deletion request is deleted from the set type ID information.

In addition, the data management device 1 (120_1), when the user provides information in the form of a logical combination of a plurality of keywords, for example, to search for data having both keyword 1 (w1) and keyword 2 (w2) AND At this time, the data management device 1 (120_1) calculates new bit information using the set of bit information, and provides it to the data management device 2 (120_2). For example, if the 7-bit information of the set having the keyword 1 (w1) is "1000000", and the 7-bit information of the set having the keyword 2 (w2) is also "1000000", AND operation is performed on the two information to calculate "1000000". The result can be provided to the data management device 2 (120_2).

The data management device 2 (120_2) may be a kind of DB interlocked with the data management device 1 (120_1). The data management device 2 (120_2) stores encrypted data, and the data required by the data management device 1 (120_1) Returns a set of As shown in (b) of FIG. 2, the data table stores encrypted data (E(Datai)) and the corresponding bf_IDi (=bloom filter number), and satisfies the bloom filter provided from the data management device 1 (120_1). Only for bf_IDi, the encrypted data is returned to the data management device 1 (120_1). The encryption algorithm for encrypting data Datai can be selected separately from the EKS system, for example.

For example, in the above case, if the data management device 1 (120_1) is alone or by logical operation, for example, if the 7-bit information ""1000000" is provided, the data management device 2 (120_2) recognizes this and is the first It will return the data 1 corresponding to the bit string.If the data corresponding to the first bit string is data 7, it returns the data 7. In this way, the data corresponding to each bit string can be changed and matched in various ways. In the embodiment of the invention, it will not be particularly limited.

As a result of the above configuration, the data management system 90, that is, the EKS system according to an embodiment of the present invention provides a keyword search function for data encrypted and stored in an external storage space, thereby preventing leakage of personal information to the user while Convenience can be secured.

In addition, the EKS system can be applied without changing the conventional database, and an efficient Boolean search function and index management function can be provided using a bloom filter. Accordingly, it can be usefully used in cloud storage services that support data storage outside.

4 is a block diagram showing the structure of the data management device 1 of FIG. 1.

Referring to FIG. 4 together with FIG. 1, the data management device 1 120_1 according to an embodiment of the present invention includes an interface unit 400, a storage unit 410, a control unit 420, an operation unit 430, and encryption/decryption. A part or all of the part 440 may be included. Here, the inclusion of part or all is the same as the meaning above.

The interface unit 400 includes a communication module for performing communication with the user device 100 and the data management device 2 120_2 via the communication network 110 of FIG. 1. The interface unit 400 may perform a process such as information conversion in the communication process. For example, a process such as decoding the compressed information may be performed.

The storage unit 410, in the form of an index table, encrypts and stores a plurality of keywords, matches each of the keywords, and encrypts and stores a set of ID information for data. At this time, the stored information may be added or deleted according to a user's request to update the index table.

The control unit 420 controls the overall operation of the interface unit 400, the storage unit 410, the operation unit 430, and the encryption/decryption unit 440 in the data management device 1 120_1. For example, when the user provides a token including the keyword 1 (w1), the control unit 420 reads the information of the column matching the token from the storage unit 410 and decrypts it in the encryption/decryption unit 440 And, it can be controlled to output a set of decoded ID information, that is, bit information through the interface unit 400. In addition, when a plurality of keywords are provided, the interface unit 400 may be controlled to output new bit information calculated by calculating the two bit information obtained in the decoding process through the operation unit 430.

When the user wants to receive data including two keywords, for example, the operation unit 430 may logically operate the bit information decoded by the encryption/decryption unit 440 with a set of ID information for the two keywords. For example, the operation unit 430 may specifically perform an AND operation or an OR operation. In this regard, further explanation is omitted, since it has been sufficiently described above.

The encryption/decryption unit 440, for example, when the user wants to update the index table of the data management device 1 (120_1) by adding or deleting data including a new keyword, the information of the index table is encrypted and the storage unit 410 To be stored in. In addition, by extracting and decrypting the encrypted and stored information, it is possible to provide decrypted information, for example, information representing a set of ID information as bit information, to the operation unit 430.

5 is a view for explaining a data search process according to an embodiment of the present invention.

Referring to FIG. 5 together with FIG. 1, when searching for data including the keyword w2 in the data management system 90 according to an embodiment of the present invention, for example, the EKS system, the user has Token for w2 = ｛E_k_s( w2) and K_w2' are generated and transmitted to the data management device 1 (120_1).

Then, the data management device 1 (120_1) recovers BF_w2 using K_w2 in a row including E_k_s(w2), and transfers BF_w2 to the data management device 2 (120_2).

Data management device 2 (120_2) tests whether bf_IDi of each Datai is a member of BF_w2, and returns E (Datai) of bf_IDi, which returns True, to data management device 1 (120_1).

In the process of this, for example, in the case of the intersection search of the keywords w1 and w2, the data management device 1 (120_1) recovers BF_w1 and BF_w2 using the token and transmits (BF_w1∧BF_w2) to the data management device 2 (120_2). And the data management device 2 (120_2) returns only bf_IDi included in (BF_w1∧BF_w2).

In the case of a union search of keywords w1 and w2, the data management device 1 (120_1) recovers BF_w1 and BF_w2 using a token, and transmits (BF_w1 + BF_w2) to the data management device 2 (120_2). In addition, the data management device 2 (120_2) returns only bf_IDi included in (BF_w1 + BF_w2).

6 is a view for explaining a data addition process according to an embodiment of the present invention.

Referring to FIG. 6 together with FIG. 1, when data 8 including keywords w2 and w5 is added in the data management system 90 according to an embodiment of the present invention, that is, the EKS system, the user is prompted for an encrypted text E ( Data8), and calculates E _{K _S} (w2) and E _{K _S} (w5) for w2 and w5. Then, Bloom filter member bf_ID8 is calculated. The token for addition is as shown in <Relationship 1>.

[Relationship 1]

Token = {E _{K _S} (w2), E _{K _S} (w5), K_w2, K_w5, bf_ID8, E(Data8)}

In the above process, for example, if the user does not know the ID for Data 8, that is, the Bloom filter member bf_ID8, the user receives the ID information from the Bloom filter member bf_ID8 from the EKS system, for example, the data management device 1 (120_1), or the user himself. You could also specify this yourself. In this case, bf_ID8 may be omitted from <Relational Formula 1>, and any number of changes may be possible depending on the generation method of bf_08.

Subsequently, the data management device 1 120_1 recovers BF_w2 using K_w2 in the column containing E _{K s} (w2) and accumulates (BF_w2=BF_w2+bf_ID8) bf_ID8. Then, for the new keyword w5, E _{K _S} (w5) and E _{K _ w5} (BF_w5=bf_ID8) are added to the index table as new columns, and {bf_ID8, E(Data8)} is transferred to the data management device 2 (120_2). .

In addition, the data management device 2 (120_2) stores bf_ID8 and E (Data8) in a data table.

On the other hand, if the bit information is not in the form of a bloom filter as described above, and the number of bit information is a bitmap that matches the number of data, the process of encrypting/decoding BF_w2 and BF_w5 in the above process can be omitted. , bf_ID8 can be accumulated by bitwise EX-OR operation on the ciphertexts of BF_w2 and BF_w5. In other words, when the bit information is expressed in the form of a bloom filter, in order to add data, after decrypting the encrypted BF_w2 and BF_w5, and then adding the relevant information and then encrypting it again, in the case of a bitmap, It may be possible to omit this process. Accordingly, K_w2 and K_w5 may be omitted in <Relational Formula 1>.

7 is a view for explaining a data deletion process according to an embodiment of the present invention.

Referring to FIG. 7 together with FIG. 1, when data 8 including keywords w2 and w5 is deleted from the data management system 90 according to an embodiment of the present invention, that is, the EKS system, the user can use E _{K _S} for w2 and w5. Calculate (w2) and E _{K _S} (w5). Then, Bloom filter member bf_ID8 is calculated. Token for deletion is as in <Equation 2>.

[Relationship 2]

Token = {E _{K _S} (w2), E _{K _S} (w5), K_w2, K_w5, bf_ID8}

Data management device 1 (120_1) recovers BF_w2 and BF_w5 using K_w2 and K_w5 from the columns containing E _{K _s} (w2) and E _{K _S} (w5), and BF_w2=BF_w2-bf_ID8 and BF_w5=BF_w5-bf_ID8 To calculate At this time, the column where BF_wi becomes 0 is removed from the index table. Then, bf_ID8 is transferred to the data management device 2 (120_2).

Subsequently, the data management apparatus 2 (120_2) deletes bf_ID8 and E (Data8) from the data table.

On the other hand, if the number of bit information is a bitmap that matches the number of data, the process of encrypting/decrypting BF_w2 and BF_w5 in the above process can be omitted, and bitwise EX-OR operation is performed on bf_ID8 to the ciphertexts of BF_w2 and BF_w5. Can be extracted. Accordingly, K_w2 and K_w5 may be omitted in <Relational Formula 1>.

8 is a flowchart illustrating a data management method according to an embodiment of the present invention.

Referring to FIG. 8 together with FIG. 4 for convenience of description, the data management device 1 (120_1) according to an embodiment of the present invention includes two columns to store the encrypted keywords for the keyword wi in column 1, and column 2 In the Bloom filter (BF_wi) for a set of ID information of data including the keyword wi is encrypted and stored (S800). At this time, the set of ID information is preferably processed as bit information. For example, the bit information may be expressed as 7-bit information for data 1 to data 7.

Of course, in the embodiment of the present invention, preferably, the bit information is sequentially expressed with respect to the data 1 to 7, but the bit information may be expressed by mixing the order. For example, rather than expressing bits in the order of data 1, data 2, and data 3, bits may be expressed in a non-sequential order in the same order as data 1, data 3, and data 2. At this time, only the data management device 1 (120_1) can know that the second ID information, that is, the bit information is for the data 3. Furthermore, even if there are seven data, it is not necessarily processed by matching them with 7 bits, but it may be possible to set any function relationship and express it as 4-bit information or other information.

In addition, the data management device 1 (120_1) extracts a set of ID information of the column corresponding to the same keyword in the storage unit 410 based on the request from the user (S810). At this time, the request corresponds to the token, and the ID information is bit information.

Subsequently, the data management device 1 (120_1) decodes and outputs the set of extracted ID information (S820). In the process of this, the data management device 1 120_1 may use a decryption key included in the token for decryption.

Thereafter, the data management device 1 (120_1) provides data matching the decrypted ID information to the user (S830). The provision of such data can be provided to the user by receiving data from the interlocked data management device 2 (120_2) as shown in FIG. 1, but in the case of constructing a separate database, data extracted by searching the database is provided to the user. Will be able to.

In addition, the description of the data including a plurality of keywords or the addition and deletion of data including specific keywords has been sufficiently described with reference to FIGS. 5 to 7 above, and thus the contents thereof will be replaced.

9 is a flowchart illustrating a process of adding data according to another embodiment of the present invention, and assumes that bit information is expressed in the form of a bitmap.

Referring to FIG. 9 together with FIG. 1 for convenience of description, the data management device 1 (120_1) according to an embodiment of the present invention provides ciphertexts and keywords for data including a plurality of keywords from a user for the purpose of adding data. Tokens including ciphertexts are received (S900).

Subsequently, the data management apparatus 1 (120_1) adds ID information of data added from ID information of a column corresponding to the keyword ciphertext included in the received token (S910).

Thereafter, for example, the data management device 2 (120_2) stores the encrypted text and the corresponding ID of the data to be added to the storage unit (S920).

10 is a flowchart illustrating a data deletion process according to another embodiment of the present invention, and assumes that bit information is expressed in the form of a bitmap.

For convenience of description, referring to FIG. 10 together with FIG. 1, the data management device 1 120_1 according to an embodiment of the present invention provides ciphertexts for keywords included in data to be deleted from a user for the purpose of data deletion. The included token is received (S1000).

Subsequently, the data management device 1 (120_1) deletes the ID information of the data to be deleted from the column ID information corresponding to the keyword ciphertext included in the received token (S1010).

Thereafter, the data management device 2 (120_2) may delete the encrypted text and the corresponding ID of the data to be deleted from the storage unit (S1020).

On the other hand, that all components constituting the embodiments of the present invention are described as being combined or operated as one, the present invention is not necessarily limited to these embodiments. That is, within the scope of the present invention, all of the constituent elements may be selectively combined and operated. In addition, although all of the components may be implemented as one independent hardware, a part or all of the components are selectively combined to perform a part or all of functions combined in one or a plurality of hardware. It may be implemented as a computer program having a. The codes and code segments constituting the computer program can be easily deduced by those skilled in the art of the present invention. Such a computer program is stored in a computer-readable non-transitory computer readable media, and read and executed by a computer, thereby implementing an embodiment of the present invention.

Here, the non-transitory readable recording medium means a medium that stores data semi-permanently and that can be read by a device, rather than a medium that stores data for a short moment, such as a register, a cache, or a memory. Specifically, the above-described programs may be stored and provided on a non-transitory readable recording medium such as a CD, DVD, hard disk, Blu-ray disk, USB, memory card, ROM, and the like.

Although the preferred embodiments of the present invention have been shown and described above, the present invention is not limited to the specific embodiments described above, and it is usually in the technical field to which the present invention pertains without departing from the gist of the present invention as claimed in the claims. Of course, various modifications can be implemented by a person having knowledge of these, and these modifications should not be individually understood from the technical idea or prospect of the present invention.

100: user device 110: communication network
120_1: Data management device 1 120_2: Data management device 2
400: interface unit 410: storage unit
420: control unit 430: operation unit
440: cancer/decryption unit

Claims (13)

In the data management device,
A storage unit for encrypting and storing a plurality of keywords, and encrypting and storing a set of IDs corresponding to each of the plurality of keywords;
A control unit for extracting a set of IDs corresponding to a user request from the storage unit; And
Includes; a decoder for decoding the set of extracted ID;
The control unit,
Provide data to the user matching the decrypted ID,
The set of IDs,
Processed as bit information,
The number information of the bit information (number) is a data management device, characterized in that the number of stored data. According to claim 1,
The bit information is a data filter, characterized in that it is expressed in the form of a bloom filter (bloom filter) or a bit map (bit map). delete According to claim 1,
And an encryption unit that encrypts the keywords and data to be added and stores them in the storage unit when the user requests the addition of data. According to claim 4,
It further includes an interface unit that receives a token from the user and is requested to search, add, or delete data.
The token comprises a keyword and a key for encryption and decryption. According to claim 1,
Further comprising, when the user requests data including at least two keywords, the at least two keywords to perform a logical operation on a set of IDs corresponding to each keyword to output a calculation result;
The control unit,
Data management device characterized in that it provides the data to the user based on the bit information of the calculation result. Encrypting and storing a plurality of keywords, and storing a set of IDs corresponding to each of the plurality of keywords by storing them in a storage unit;
Extracting a set of IDs corresponding to a user request from the storage unit;
Decoding the set of extracted IDs; And
Including; providing data matching the decrypted ID to the user;
The set of IDs,
Processed as bit information,
The number information of the bit information (number) is a data management method characterized in that it matches the number of stored data. The method of claim 7,
The bit information is a data management method characterized in that it is expressed in the form of a bloom filter (bloom filter) or a bit map (bit map). delete The method of claim 7,
And when the user requests the addition of data, encrypting the keywords and data to be added and storing the data in the storage unit. The method of claim 10,
The method further includes receiving a token from the user and requesting to search, add, or delete the data;
The token comprises a keyword and a key for encryption and decryption. The method of claim 7,
Further comprising, when the user requests data including at least two keywords, logically calculating a set of IDs corresponding to each keyword from the at least two keywords and outputting a calculation result;
The step of providing to the user,
A data management method characterized by providing the data to the user based on the bit information of the result of the calculation. A first data management apparatus for encrypting and storing a plurality of keywords and a set of IDs corresponding to each of the plurality of keywords, and processing IDs corresponding to a user's request in the form of bit information; And
A second that matches and stores the ID and data, and retrieves the stored data based on the bit-type ID processed by the first data management device and provides the user with data corresponding to the user's request. It includes a data management device;
The data management system, characterized in that the number of bit information (number) matches the number of stored data.

Images