KR102244764B1 - Storage device and control method thereof - Google Patents

Abstract

The present invention discloses a data storage device and a method of operating the data storage device. That is, the present invention relates to a technology for enhancing security for information stored in a data storage device (eg, cloud storage), and provides a specific service (eg, data search) without decrypting the encrypted and stored personal information. Can provide.

Description

Data storage device and operation method of data storage device {STORAGE DEVICE AND CONTROL METHOD THEREOF}

The present invention relates to a technology for reinforcing the security of information stored in a data storage device (e.g., cloud storage), and more particularly, to a specific service (e.g., data) without decrypting the encrypted and stored personal information. It relates to a data storage device capable of providing search) and a method of operating the data storage device.

Existing data storage devices (e.g., cloud storage) mainly contain personal information (e.g., photos, videos, emails, etc.) (hereinafter referred to as encrypted data) encrypted by an encryption algorithm that cannot be computed such as the Advanced Encryption Standard (AES) encryption algorithm. Was saved.

However, the conventional method of encrypting data using an encryption algorithm that cannot be operated as described above is a decryption process for encrypted data through a virtual drive linked to a data storage device when a user requests a specific service such as data search. You can only provide search results after performing.

In other words, in this conventional data storage method, when a specific service is to be provided, a secret key must be received from an intermediate service provider, and the encrypted data is decrypted in the data storage device using the received secret key. Because it must be done, the secret key may be leaked or hacked in the process of sending and receiving the secret key with an intermediate service provider, and personal information stored in the data storage device may be exposed to the outside, resulting in malicious theft and illegal use. There is a risk of causing.

In addition, when the size of the encrypted data is large, the search speed becomes slow as the decryption time increases, and thus a problem in that the service cannot be provided quickly may occur.

In addition, the secret key may be leaked or hacked in the process of sending and receiving the secret key with the intermediate service provider, and accordingly, the personal information stored in the data storage device is exposed to the outside, thereby preventing problems such as malicious theft and illegal use. There is a risk of causing it.

Accordingly, in the present invention, a data storage device capable of quickly providing a specific service (eg, data search) without performing decryption of encrypted and stored information and an operating method of the data storage device is proposed.

The present invention was created in view of the above circumstances, and the problem to be solved in the present invention is a data storage device capable of providing a specific service (e.g., data search) without performing decryption of encrypted and stored information, and It is to provide a method of operating a data storage device.

In addition, the problem to be solved of the present invention is not limited to those mentioned above, and another problem to be solved that is not mentioned will be clearly understood by those of ordinary skill in the art from the following description. .

A data storage device according to the first aspect of the present invention for achieving the above object generates mapping information by mapping encrypted data obtained by encrypting at least one piece of data and encrypted metadata obtained by encrypting metadata corresponding to the data. Mapping unit; And when an encrypted search word generated as a result of encryption of a search word for searching for specific data from a user terminal is received, when an encryption algorithm applied to the encrypted search word and an encryption algorithm applied to the encryption metadata are the same, the encryption search word and the encryption And a search unit configured to compare metadata to detect specific encryption metadata matching the encryption search word, and to provide specific encryption data mapped to the specific encryption metadata based on the mapping information.

Preferably, the search unit includes: an operation unit that performs a comparison operation between the encrypted metadata and the encrypted information without a decryption process for the encrypted search word; A detector configured to detect the specific encryption metadata matching the encryption search word based on the comparison operation result; And a selection unit for selecting specific encrypted data mapped to the specific encryption metadata based on the mapping information.

Preferably, the encryption metadata and the encryption algorithm applied to the encrypted search word are the same, and the encryption algorithm applied to the encrypted data is different from the encryption metadata and the encryption algorithm applied to the encrypted search word.

Preferably, the encryption algorithm applied equally to the encryption metadata and the encrypted search word is characterized in that it is based on a homomorphic encryption technique capable of calculating between encrypted information.

In order to achieve the above object, a method of operating a data storage device according to a second aspect of the present invention provides mapping information by mapping encrypted data obtained by encrypting at least one data and encrypted metadata corresponding to the data. A mapping step of generating; And when an encrypted search word generated as a result of encryption of a search word for searching for specific data from a user terminal is received, when an encryption algorithm applied to the encrypted search word and an encryption algorithm applied to the encryption metadata are the same, the encryption search word and the encryption And a providing step of comparing metadata to detect specific encryption metadata matching the encryption search word, and providing specific encryption data mapped to the specific encryption metadata based on the mapping information.

Preferably, the providing step comprises: an operation step of performing a comparison operation between the encrypted metadata and the encrypted information without a decryption process for the encrypted search word; A detection step of detecting the specific encryption metadata matching the encrypted search word based on the result of the comparison operation; And a selection step of selecting specific encrypted data mapped to the specific encryption metadata based on the mapping information.

Preferably, the encryption metadata and the encryption algorithm applied to the encrypted search word are the same, and the encryption algorithm applied to the encrypted data is different from the encryption metadata and the encryption algorithm applied to the encrypted search word.

Preferably, the encryption algorithm applied equally to the encryption metadata and the encrypted search word is characterized in that it is based on a homomorphic encryption technique capable of calculating between encrypted information.

Accordingly, according to the data storage device and the operating method of the data storage device of the present invention, a specific service (eg, data search) can be provided without decrypting the encrypted and stored personal information. It is possible to derive the effect of providing a service with enhanced security.

1 is an exemplary diagram showing a communication environment to which a data storage device according to an embodiment of the present invention is applied.
2 is a block diagram showing a configuration of a terminal according to an embodiment of the present invention.
3 is a block diagram showing the configuration of a data storage device according to an embodiment of the present invention.
4 is a flowchart illustrating a flow of providing a specific service without performing decryption of encrypted and stored personal information according to an embodiment of the present invention.
5 is a flowchart showing an operation flow of a data storage device according to an embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described with reference to the accompanying drawings.

First, a communication environment to which the data storage device of the present invention is applied will be described with reference to FIG. 1.

1, a communication environment to which the present invention is applied may include a terminal 100 and a data storage device 200.

The terminal 100 stores personal information (eg, photos, videos, emails, etc.) in the data storage device 200, and stores specific services related to the stored personal information (eg, data search) from the data storage device 200. As a device to be provided, it may be a wired terminal or a wireless terminal.

For example, the terminal 100 may correspond to a smartphone, a desktop, a notebook, a tablet PC, and a PDA, and the like, but is not limited thereto, and all devices capable of communicating with the data storage device 200 may be included.

The data storage device 200 is a device that stores personal information transmitted from a plurality of terminals including the terminal 100, and in particular, a specific service (e.g. : It is a device to provide data search).

To this end, the data storage device 200 may store/manage encrypted personal information (eg, photos, videos, emails, etc.) previously stored in relation to the corresponding terminal for each of a plurality of terminals.

The data storage device 200 may be mounted on a server operated by a mobile communication service provider to perform the same function.

Hereinafter, a configuration of a terminal according to an embodiment of the present invention will be described in detail with reference to FIG. 2.

As shown in FIG. 2, the terminal 100 according to the present invention applies a first encryption algorithm to encrypt personal information (eg, photos, videos, e-mails, etc.) (hereinafter, content data) to encrypt data. And generates encrypted metadata by applying a second encryption algorithm to encrypt metadata corresponding to the content data.

Here, the first encryption algorithm may be an encryption algorithm based on an advanced encryption standard (AES) technique in which an operation between encrypted information, which is mainly used to encrypt existing content data, is impossible.

That is, the first encryption algorithm is low in complexity and can quickly encrypt data, and is mainly used to encrypt content data whose file size is relatively larger than that of metadata.

On the other hand, the second encryption algorithm is an encryption algorithm based on a Homomorphic Encryption (HE) technique in which an operation between encrypted information is possible.

That is, the second encryption algorithm is used to encrypt information such as metadata, for example, having a small file size. Here, the metadata may include a file name, a content summary, a creation time, whether or not to be modified, a storage location, a title, and a tag.

In summary, the present invention uses a first encryption algorithm that can quickly encrypt data due to low complexity in encrypting information having a large file size such as content data, and encrypting information having a small file size such as metadata. Is high in complexity and takes some encryption time, but uses a second encryption algorithm capable of calculating between encrypted information.

Accordingly, even if a second encryption algorithm with high complexity is used to generate encrypted metadata, since the file size of the metadata is small, the operation can be performed in a short time.

More specifically, the terminal 100 includes an encryption key generation unit 110, an encryption unit 120, and a service request unit 130.

The encryption key generation unit 110 generates an encryption key for a second encryption algorithm in order to encrypt metadata corresponding to the content data and then store it in the data storage device 200.

Here, the encryption key includes a public key (pk) and a secret key (sk).

That is, the encryption key generation unit 110 generates a public key (hereinafter, HE public key) and a secret key (hereinafter, HE secret key) for the second encryption algorithm.

The encryption unit 120 generates encrypted data using a first encryption algorithm, and generates encryption metadata using a second encryption algorithm.

That is, the encryption unit 120 generates encrypted data by applying the first encryption algorithm to the content data. In addition, the encryption unit 120 generates encryption metadata by applying a second encryption algorithm, that is, an HE public key, to metadata corresponding to the encrypted data.

On the other hand, the encryption unit 120, after the storage of at least one encrypted data and encrypted metadata in the data storage device 200 is completed, when a specific service needs to be requested from the data storage device 200, Encrypted search word is generated by encrypting the search word.

In this case, the search word may be information related to a file name, a content summary, a creation time, a modification status, a storage location, a title, a tag, etc. included in the metadata, or a combination thereof.

Hereinafter, a description will be made by mentioning that a specific service is a search request for specific content data.

That is, the encryption unit 120 generates an encrypted search word using the second encryption algorithm applied to the encryption metadata.

As described above, in the present invention, since encryption is performed by applying the second encryption algorithm to the encrypted metadata and the encrypted search word in the same manner, the data storage device 200 calculates between encrypted information without a decryption process for the encrypted metadata and the encrypted search word. It is possible to provide search results by performing.

In the present invention, the process of performing encryption using the first encryption algorithm and the second encryption algorithm corresponds to a known technique, and thus will not be described in detail.

The service request unit 130 performs communication with the data storage device 200 to store information and request a specific service.

That is, when the generation of the encrypted data and the encrypted metadata is completed, the service requesting unit 130 requests to transmit the encrypted data and the encrypted metadata to the data storage device 200 and store the encrypted data and the encrypted metadata.

Meanwhile, when the generation of the encrypted search word for the search request is completed, the service request unit 130 transmits the encrypted search word to the data storage device 200 to request data search.

Hereinafter, a configuration of a data storage device according to an embodiment of the present invention will be described in detail with reference to FIG. 3.

As shown in FIG. 3, the data storage device 200 according to the present invention includes a receiving unit 210, a mapping unit 220, a search unit 230, and a storage unit 240.

The receiving unit 210 receives encrypted data that is a result of encrypting at least one content data from the terminal 100 and encrypted metadata that is a result of encrypting metadata corresponding to the content data.

Thereafter, the receiving unit 210 notifies the mapping unit 220 that the encrypted data and the encrypted metadata have been received.

The mapping unit 220 generates mapping information by mapping the encrypted data and the encrypted metadata. Hereinafter, for convenience of description, the j-th encrypted data and the j-th encrypted metadata are generated by the terminal 100 and described as being requested to be stored in the data storage device 200.

That is, the mapping unit 220 sets the mapping information of the j-th encrypted data and the j-th encrypted metadata, and the j-th encryption metadata is stored in the first storage unit 241 in the storage unit 240 according to the mapping information. And stores the j-th encrypted data in the second storage unit 242.

Here, the mapping information is information that can detect the j-th encrypted data if only information on the j-th encryption metadata is known, for example, location information where the j-th encryption metadata is stored and a location where the j-th encryption data is stored. A storage location mapping table generated by mapping information may be included.

When an encrypted search word is received in order to request a search for specific content data from the terminal 100, the search unit 230, when the encryption algorithm applied to the encrypted search word and the encryption algorithm applied to the encrypted metadata are the same, the encrypted search word and the encryption The metadata is compared to detect specific encryption metadata matching the encryption search word, and specific encryption data mapped to the specific encryption metadata is provided based on the mapping information.

More specifically, the search unit 230 includes an operation unit 231, a detection unit 232 and a selection unit 234.

When the encryption algorithm applied to the encrypted search word and the encryption algorithm applied to the encrypted metadata are the same, the calculating unit 231 performs a comparison operation between the encrypted information without a decryption process for the encrypted metadata and the encrypted search word.

That is, the encryption algorithm applied to the encryption metadata and the encrypted search word is based on a Homomorphic Encryption technique that enables computation between encrypted information, and thus, the operation unit 231 is stored in the first storage unit 241 without a decryption process. Performs an operation that compares the stored encrypted metadata with the encrypted search word.

Thereafter, the operation unit 231 compares the encrypted metadata stored in the first storage unit 241 with the encrypted search word and transmits the result of the comparison operation to the detection unit 232.

Here, the comparison operation result may be a result value numerically indicating a degree of matching to enable detection of specific encryption metadata matching the encrypted search word among the previously stored encryption metadata.

The detection unit 232 detects specific encrypted metadata matching the encrypted search word based on the comparison operation result.

Thereafter, the detection unit 232 transmits the specific encryption metadata to the selection unit 234.

The selection unit 234 selects specific encrypted data mapped to specific encrypted metadata based on the mapping information.

That is, the selection unit 234 selects specific encrypted data mapped to specific encryption metadata from among the encrypted data stored in the second storage unit 242.

Meanwhile, the storage unit 240 includes a first storage unit 241 and a second storage unit 242.

The first storage unit 241 stores at least one encryption metadata, and the second storage unit 242 stores at least one encryption data.

In this case, the storage unit 240 includes the first storage unit 241 and the second storage unit 242 as long as mapping information for at least one encryption metadata and at least one encryption data, that is, data to be mapped, can be distinguished. ) May be implemented as a single storage unit.

Hereinafter, a method of providing a specific service without performing decryption of encrypted and stored personal information according to an embodiment of the present invention will be described in detail with reference to FIGS. 4 and 5. Hereinafter, for convenience of description, reference numerals mentioned in FIGS. 1 to 3 will be referred to.

First, with reference to FIG. 4, a description will be made of the overall flow of providing a specific service without performing decryption of encrypted and stored personal information according to an embodiment of the present invention.

For reference, the parameters shown in FIG. 4 may be defined as shown in Table 1.

[Table 1]

The terminal 100 performs an encryption process to store personal information (eg, photos, videos, emails, etc.) (hereinafter, content data) in the data storage device 200 (S100).

That is, the terminal 100 generates encrypted data by applying the first encryption algorithm to encrypt the content data. In addition, the terminal 100 generates encryption metadata by applying a second encryption algorithm to encrypt metadata corresponding to the content data.

Here, the first encryption algorithm may be an encryption algorithm based on an advanced encryption standard (AES) technique in which an operation between encrypted information, which is mainly used to encrypt existing content data, is impossible.

That is, the first encryption algorithm is low in complexity and can quickly encrypt data, and is mainly used to encrypt content data whose file size is relatively larger than that of metadata.

On the other hand, the second encryption algorithm is an encryption algorithm based on a Homomorphic Encryption (HE) technique in which an operation between encrypted information is possible.

That is, the second encryption algorithm is used to encrypt information such as metadata, for example, as small as several bytes in file size. Here, the metadata may include a file name, a content summary, a creation time, whether or not to be modified, a storage location, a title, and a tag.

In summary, the present invention uses a first encryption algorithm that can quickly encrypt data due to low complexity in encrypting information having a large file size such as content data, and encrypting information having a small file size such as metadata. Is high in complexity and takes some encryption time, but uses a second encryption algorithm capable of calculating between encrypted information.

Accordingly, even if a second encryption algorithm with high complexity is used to generate encrypted metadata, since the file size of the metadata is small, the operation can be performed in a short time.

Hereinafter, for convenience of description, it will be described by mentioning that the j-th encrypted data Ij and the j-th encrypted metadata cj are generated by the terminal 100 and stored in the data storage device 200.

When the generation of the j-th encrypted data Ij and the j-th encrypted metadata cj is completed as described above, the terminal 100 stores the j-th encrypted data Ij and the j-th encrypted metadata cj. Transfer to the device 200 to request storage (S110, S120).

The data storage device 200 generates mapping information by mapping the j-th encrypted data Ij and the j-th encrypted metadata cj.

That is, the data storage device 200 sets the mapping information of the j-th encrypted data Ij and the j-th encrypted metadata cj, and the first storage unit 241 in the storage unit 240 according to the mapping information. ) To store the j-th encrypted metadata cj, and store the j-th encrypted data Ij in the second storage unit 242.

Meanwhile, after storage of the j-th encrypted data Ij and the j-th encrypted metadata cj in the data storage device 200 is completed, the terminal 100 needs to request a specific service from the data storage device 200. In this case, the encrypted search word Q is generated by encrypting the search word for a specific service, and then transmitted to the data storage device 200 (S130).

Hereinafter, a specific service will be described by referring to a search request for the recently stored j-th encrypted data Ij among at least one encrypted data I1, I2, In previously stored in the data storage device 200.

That is, the terminal 100 generates the encrypted search word Q using the same algorithm as the second encryption algorithm applied to the j-th encryption metadata cj. Thereafter, the terminal 100 transmits the encrypted search word Q to the data storage device 200 to request a search for the j-th encrypted data Ij.

As described above, in the present invention, since encryption is performed by applying the second encryption algorithm to the encrypted metadata and the encrypted search word in the same manner, the data storage device 200 calculates between encrypted information without a decryption process for the encrypted metadata and the encrypted search word. It is possible to provide search results by performing.

In the present invention, the process of performing encryption using the first encryption algorithm and the second encryption algorithm corresponds to a known technique, and thus will not be described in detail.

When an encrypted search word is received in order to request a search for specific content data from the terminal 100, the data storage device 200, when the encryption algorithm applied to the encrypted search word and the encryption algorithm applied to the encrypted metadata are the same, the encrypted search word and the The encryption metadata is compared to detect specific encryption metadata matching the encryption search word, and specific encryption data mapped to the specific encryption metadata is provided based on the mapping information.

More specifically, the data storage device 200 performs a comparison operation between encrypted information without a decryption process for the encrypted metadata (c1, c2, cn) and the encrypted search word (Q) stored in the first storage unit 241 Do (S140).

That is, the encryption algorithm applied to the encryption metadata (c1, c2, cn) and the encryption search word (Q) is based on a Homomorphic Encryption technique that enables calculation between encrypted information. , It is possible to perform an operation comparing the encrypted metadata (c1, c2, cn) stored in the first storage unit 241 and the encrypted search word Q without a decryption process.

Thereafter, the data storage device 200 compares the encrypted metadata c1, c2, and cn with the encrypted search word Q to generate a comparison operation result. The data storage device 200 includes specific encryption metadata C matching the encryption search word Q among the encryption metadata c1, c2, and cn previously stored in the first storage unit 241 based on the comparison operation result. That is, the j-th encryption metadata cj is detected (S150).

Subsequently, the data storage device 200 includes specific encryption metadata C, that is, specific encryption data I mapped to the j-th encryption metadata cj, that is, the j-th encryption data Ij, based on the mapping information. Select (S160).

That is, the data storage device 200 is the j-th encrypted data mapped to the j-th encryption metadata cj among the encrypted data I1, I2, In previously stored in the second storage unit 242 based on the mapping information. Choose (Ij).

Thereafter, the data storage device 200 transmits the j-th encrypted data Ij as a search result for the encrypted search word Q requested by the user to the terminal 100 in an encrypted state (S170).

The terminal 100 receives the j-th encrypted data Ij from the data storage device 200. Thereafter, the terminal 100 decrypts and uses the j-th encrypted data Ij as necessary.

Hereinafter, a method of operating a data storage device according to an embodiment of the present invention will be described in detail with reference to FIG. 5. In FIG. 5, it is mentioned that the terminal generates the j-th encrypted data (Ij) by applying the first encryption algorithm, and generates the j-th encryption metadata (cj) by applying the second encryption algorithm to request storage to the data storage device. I will explain.

4 and 5, the receiving unit 210 of the data storage device 200 according to an embodiment of the present invention includes the j-th encrypted data Ij and the j-th encrypted metadata cj from the terminal 100. It receives (S210). Thereafter, the receiving unit 210 notifies the mapping unit 220 that the second encrypted data Ij and the j-th encrypted metadata cj have been received.

The mapping unit 220 generates mapping information by mapping the j-th encrypted data Ij and the j-th encrypted metadata cj (S220).

That is, the mapping unit 220 sets the mapping information of the j-th encrypted data Ij and the j-th encrypted metadata cj, and the first storage unit 241 in the storage unit 240 according to the mapping information. The j-th encrypted metadata cj is stored in and the j-th encrypted data Ij is stored in the second storage unit 242.

Meanwhile, after the storage of the encrypted data and the encrypted metadata in the data storage device 200 is completed as described above, when the encrypted search word Q is received as a result of the encrypted search word for a specific service from the terminal 100 (S230) ), the search unit 230 performs a comparison operation between the encrypted metadata and the encrypted information without a decryption process for the encrypted search word (S240).

That is, the encryption algorithm applied to the encryption metadata and the encrypted search word is based on a Homomorphic Encryption technique that enables computation between encrypted information, so the search unit 230 includes the first storage unit 241 without a decryption process. An operation to compare the encrypted metadata (c1, c2, cn) stored in the encrypted search word (Q) is performed.

Thereafter, the search unit 230 compares the encrypted metadata c1, c2, and cn with the encrypted search word Q to generate a comparison operation result. The search unit 230 includes specific encryption metadata C matching the encryption search word Q among the encryption metadata c1, c2, and cn previously stored in the first storage unit 241 based on the comparison operation result, That is, the j-th encryption metadata cj is detected (S250).

Subsequently, the search unit 230 selects specific encryption metadata C, that is, specific encryption data mapped to the j-th encryption metadata cj, that is, the j-th encryption data Ij based on the mapping information ( S260).

That is, the search unit 230 includes the j-th encrypted data mapped to the j-th encryption metadata cj among the encrypted data I1, I2, In previously stored in the second storage unit 242 based on the mapping information. Select Ij).

Thereafter, the search unit 230 transmits the j-th encrypted data Ij as a search result for the encrypted search word Q requested by the user to the terminal 100 in an encrypted state (S270).

As described above, according to the present invention, an algorithm for encrypting content data and an algorithm for encrypting metadata corresponding to the content data in a terminal that uploads personal information (eg, photos, videos, e-mails, etc.) are applied differently for encryption. As a result of performing, the encryption key is managed by the user, unlike the conventional intermediate service provider to manage the encryption key, so that decryption becomes impossible even if the data storage device is hacked or an information leakage problem occurs, thus providing anonymity and security. You can derive an effect that can be reinforced.

In addition, according to the present invention, security by providing a specific service (e.g., data search) by delivering the search result to the user in an encrypted state without performing the process of decrypting the personal information stored in the data storage device. It is possible to derive an effect that can improve customer satisfaction through the provision of services with more enhanced sexuality.

Embodiments of the present invention may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be specially designed and configured for the present invention, or may be known and usable to those skilled in computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floptical disks. -A hardware device specially configured to store and execute program instructions such as magneto-optical media, and ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine language codes such as those produced by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like. The hardware device described above may be configured to operate as one or more software modules to perform the operation of the present invention, and vice versa.

Until now, the present invention has been described in detail with reference to preferred embodiments, but the present invention is not limited to the above-described embodiments, and the technical field to which the present invention belongs without departing from the gist of the present invention claimed in the following claims. Anyone of ordinary skill in the art will say that the technical idea of the present invention extends to the range in which various modifications or modifications are possible.

According to the data storage device and the operating method of the data storage device according to the present invention, it exceeds the limitations of the existing technology in that it provides a specific service (e.g., data search) without decrypting the encrypted and stored personal information. According to this invention, it is an invention that has industrial applicability because it is not only the use of the related technology, but also the possibility of marketing or business of the applied device is sufficient, and it can be practically clearly implemented.

100: terminal
110: encryption key generation unit 120: encryption unit
130: service request unit
200: data storage device
210: receiving unit 220: mapping unit
230: search unit 231: operation unit
232: detection unit 233: selection unit
240: storage

Claims (8)

A mapping unit for generating mapping information by mapping encrypted data obtained by encrypting at least one piece of data and encrypted metadata obtained by encrypting metadata corresponding to the data; And
When an encrypted search word generated as a result of the encrypted search word for searching for specific data is received from the user terminal, detecting specific encryption metadata matching the encrypted search word and providing specific encrypted data mapped to the specific encryption metadata Includes a search unit;
The search unit,
Performs a comparison operation between the encrypted metadata and the encrypted information without a decryption process for the encrypted search word, detects the specific encryption metadata matching the encrypted search word based on the comparison operation result, and based on the mapping information And selecting and providing specific encrypted data mapped to the specific encrypted metadata. The method of claim 1,
The search unit,
And when the encryption algorithm applied to the encrypted search word and the encryption algorithm applied to the encryption metadata are the same, detecting the specific encryption metadata and providing the mapped specific encrypted data. The method of claim 1,
The encryption algorithm applied to the encryption metadata and the encryption search word is the same,
An encryption algorithm applied to the encrypted data is different from an encryption algorithm applied to the encryption metadata and the encrypted search word. The method of claim 3,
The data storage device, characterized in that the encryption algorithm applied equally to the encryption metadata and the encrypted search word is based on a Homomorphic Encryption technique capable of calculating between encrypted information. A mapping step of generating mapping information by mapping encrypted data obtained by encrypting at least one piece of data and encrypted metadata obtained by encrypting metadata corresponding to the data; And
When an encrypted search word generated as a result of the encrypted search word for searching for specific data is received from the user terminal, detecting specific encryption metadata matching the encrypted search word and providing specific encrypted data mapped to the specific encryption metadata It includes a provision step;
The providing step,
Performs a comparison operation between the encrypted metadata and the encrypted information without a decryption process for the encrypted search word, detects the specific encryption metadata matching the encrypted search word based on the comparison operation result, and based on the mapping information And selecting and providing specific encrypted data mapped to the specific encrypted metadata. The method of claim 5,
The providing step,
When the encryption algorithm applied to the encrypted search word and the encryption algorithm applied to the encryption metadata are the same, detecting the specific encryption metadata and providing the mapped specific encrypted data is performed. The method of claim 5,
The encryption algorithm applied to the encryption metadata and the encryption search word is the same,
An encryption algorithm applied to the encrypted data is different from an encryption algorithm applied to the encryption metadata and the encrypted search word. The method of claim 7,
The method of operating a data storage device, characterized in that the encryption algorithm applied equally to the encryption metadata and the encrypted search word is based on a homomorphic encryption technique capable of calculating between encrypted information.

Images