KR20110057369A - Data encryption apparatus and its method - Google Patents

Abstract

PURPOSE: A device of encoding data and method thereof are provided to enable an effective search about encoded database and reinforce privacy about a database by generating index information and enabling data based on the index information. CONSTITUTION: An encoding unit(102) encodes stored data. An index generator(104) partitions a total interval of the encoded data into subdivisions and rearranges the partitioned subdivisions. The index generating unit generates index information corresponding to a reordering order and transmits the index information and the rearranged encoded data to a storing device. The encoding unit transmits a search query including index information to a storage unit an receives searched and extracted data according to the index information from the storing device.

Description

DATA ENCRYPTION APPARATUS AND ITS METHOD}

The present invention relates to a technique for encrypting and storing data, and more particularly, to a data encryption apparatus and method suitable for encrypting and storing data to be stored, and easily searching according to corresponding information.

As is well known, the security of sensitive information stored in the database has become an important hot issue, as can be seen in the recent case of customer personal information leakage or hacking in the corporate database. In particular, when the important database is stored on an external server for storage space or service, such a vulnerability may be more vulnerable.

If the database is stored on the external server in plain text, it is impossible to prevent the database from being accessed, leaked, and malicious by the external server administrator, so that the user can encrypt and store his database on the external server to prevent this. .

However, if the user encrypts and stores their database on an external server, the server cannot retrieve the encrypted database, so the server sends all the encrypted databases of the user to the user whenever the user wants, after which the user After decrypting all encrypted databases, desired data may be obtained.

Here, since the data stored in the external server is usually a large amount of data, decryption after receiving all encrypted data has a disadvantage in that it takes too much time. Therefore, a method of efficiently searching for encrypted data by adding additional information to the encrypted data has been studied.

As described above, various search functions such as keyword search, range search, and sorting, which are conventionally performed in a plain text database, are required in an encrypted database. However, most of the currently developed encryption data retrieval methods are mainly keyword search. Recently, a technique for searching subsets and ranges based on cryptographic techniques has been proposed, but it is difficult to apply in practice due to the large amount of computation.

Accordingly, an aspect of the present invention is to provide an apparatus and method for encrypting data that can encrypt data to be stored and then generate and store an index corresponding thereto.

The present invention also provides a data encryption apparatus and method for easily searching, extracting and outputting stored data according to a generated index.

According to an embodiment of the present invention, the encryption unit encrypts the data to be stored, and divides the entire section of the encrypted data into a plurality of detailed sections, and rearranges the divided plurality of detailed sections. There is provided a data encryption apparatus including an index generator for generating index information corresponding to the order of the data and transmitting the generated index information and the rearranged encrypted data to a storage device.

Preferably, the encryption unit transmits a search query including the index information corresponding to the data to be searched to the storage device, and receives detection data searched and extracted according to the index information through the storage device. A data encryption device for decrypting and outputting is provided.

Preferably, the index generator includes detailed section information including start point information, endpoint information, and rearrangement information, an encrypted data type, an index area, and an index value according to a result of rearranging the divided plurality of detailed sections. A data encryption device for storing the index information corresponding to user information is provided.

Preferably, the index generator, when generating the index information is provided with a data encryption device for allocating the index of the plurality of subsections to the index area according to the user selection.

Preferably, the index generator is provided with a data encryption device for generating the index information, the order is preserved using the start point information, end point information and the index area.

According to another embodiment of the present invention, after encrypting the data to be stored, dividing the entire section of the encrypted data into a plurality of detail sections, and rearranging the divided plurality of detail sections, A method of encrypting data is provided, the method including generating index information corresponding to the arranged order, and transmitting the generated index information and the rearranged encrypted data to a storage device.

Preferably, the data encryption method, after the step of transmitting to the storage device, transmitting a search query including the index information corresponding to the data to be searched to the storage device, and through the storage device; A data encryption method is provided, further comprising: receiving the detection data searched and extracted according to the index information, and decoding and outputting the received detection data.

Preferably, the generating of the index information may include detailed section information including start point information, end point information, and rearrangement information, an encrypted data type, an index area, and the like according to a result of rearranging the plurality of divided subsections. A data encryption method is provided in which the index information including an index value is stored corresponding to user information.

Preferably, the generating of the index information provides a data encryption method in which the indexes of the plurality of sub-sections are allocated to an index area according to a user selection when generating the index information.

Preferably, the generating of the index information is provided with a data encryption method in which the index information is stored using the starting point information, the end point information, and the index area.

The present invention provides an index for efficiently searching an encrypted database and a database encryption for preventing a privacy breach that may occur when a user, such as an individual, a company, or a public institution stores their large database on an external server. The method relates to the generation, by dividing the entire section to which the data belongs to the subdivision, arbitrarily rearranged the subdivisions irrespective of the order, and generates index information that preserves the order for the data contained in each subdivision By storing the data, not only can the efficient search for the encrypted database, but also the privacy of the database can be enhanced.

In addition, since the present invention only needs to detect, receive, and decode some data to be detected according to the index information, the use efficiency can be improved, and various search functions such as keyword search, range search, and sorting can be additionally provided. In addition, a new database system is not needed to perform database encryption and encryption data retrieval. By providing a system that can be implemented by using an existing database system, it is possible to provide a practical security technology to prevent a privacy breach of an important database. .

The present invention encrypts the data to be stored in the data storage system, divides the entire section of the encrypted data into a plurality of detailed sections, randomly rearranges them, and generates an index corresponding to the rearranged encrypted data, After storing the rearranged encrypted data and the index information together, according to the query of the data to be searched, the corresponding data corresponding to the index information is searched and extracted and transmitted to the data encryption device, and the detected data is then duplicated and output. Through such technical means, problems in the prior art can be solved.

Advantages and features of the present invention, and methods for achieving them will be apparent with reference to the embodiments described below in detail in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but may be implemented in various forms, and only the embodiments of the present invention make the disclosure of the present invention complete and the general knowledge in the technical field to which the present invention belongs. It is provided to fully convey the scope of the invention to those skilled in the art, and the present invention is defined only by the scope of the claims. Like reference numerals refer to like elements throughout.

In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear. The following terms are defined in consideration of the functions in the embodiments of the present invention, which may vary depending on the intention of the user, the intention or the custom of the operator. Therefore, the definition should be made based on the contents throughout the specification.

Combinations of each block of the accompanying block diagram and each step of the flowchart may be performed by computer program instructions. These computer program instructions may be mounted on a processor of a general purpose computer, special purpose computer, or other programmable data processing equipment such that instructions executed through the processor of the computer or other programmable data processing equipment may not be included in each block or flowchart of the block diagram. It will create means for performing the functions described in each step. These computer program instructions may be stored in a computer usable or computer readable memory that can be directed to a computer or other programmable data processing equipment to implement functionality in a particular manner, and thus the computer usable or computer readable memory. It is also possible for the instructions stored in to produce an article of manufacture containing instruction means for performing the functions described in each block or flow chart step of the block diagram. Computer program instructions may also be mounted on a computer or other programmable data processing equipment, such that a series of operating steps may be performed on the computer or other programmable data processing equipment to create a computer-implemented process to create a computer or other programmable data. Instructions that perform processing equipment may also provide steps for performing the functions described in each block of the block diagram and in each step of the flowchart.

In addition, each block or step may represent a portion of a module, segment or code that includes one or more executable instructions for executing a specified logical function (s). It should also be noted that in some alternative embodiments, the functions mentioned in the blocks or steps may occur out of order. For example, the two blocks or steps shown in succession may in fact be executed substantially concurrently or the blocks or steps may sometimes be performed in the reverse order, depending on the functionality involved.

Hereinafter, with reference to the accompanying drawings will be described an embodiment of the present invention;

1 is a block diagram of a data storage system suitable for generating an index for encrypted data and storing encrypted data according to an embodiment of the present invention. The data encryption apparatus 100, the communication network 200, and a storage device are shown in FIG. 300 and the like.

Referring to FIG. 1, the data encryption apparatus 100 encrypts data using, for example, a symmetric key encryption method. When a data storage request is input from a user, the data encryption apparatus 100 accordingly stores a secret key corresponding to the data to be stored. Create and encrypt the data, for example, by symmetric key cryptography.

The data encryption apparatus 100 divides the entire section of the data into a plurality of detailed sections, and then rearranges them randomly using a keyed hash function or the like, and rearranges them. The index corresponding to the order of the plurality of detailed intervals is generated. Here, detailed section information (for example, starting point information, endpoint information, rearrangement information, etc.) corresponding to the plurality of rearranged subsections may be stored, and index information (for example, corresponding to the generated index) may be stored. Encrypted data type, index area, index value, etc.) can be stored together.

In addition, the data encryption apparatus 100 transmits the rearranged encrypted data and corresponding index information to the storage device 300 through the communication network 200.

Thereafter, when a data search is requested from a user, the data encryption apparatus 100 transmits a query including index information corresponding thereto to the storage device 300 through the communication network 200, and accordingly, the storage device. Detected data transmitted from 300 is decrypted in correspondence with an encryption method and then output.

Next, the communication network 200 includes, for example, a wired communication network, a wireless communication network, and the like, and provides various data communication environments between the data encryption apparatus 100 and the storage device 300.

Meanwhile, the storage device 300 stores and manages rearranged encrypted data and index information transmitted from the data encryption device 100, and, when a data search is requested from the data encryption device 100, the index information transmitted together with the index information. The data corresponding to the index information is searched and extracted according to the included query, and the detected data is transmitted to the data encryption apparatus 100.

Therefore, after encrypting the data to be stored, the entire section of the encrypted data is divided into a plurality of detailed sections, randomly rearranged, an index corresponding to the rearranged encrypted data is generated, and the rearranged encrypted data By storing the and index information together, the corresponding data can be easily detected and provided according to the index information of the data to be searched.

Next, in the data storage system having the above-described configuration, the data to be stored is encrypted, the entire section of the encrypted data is divided into a plurality of detailed sections, and randomly rearranged to correspond to the rearranged encrypted data. A data encryption apparatus for generating and transmitting an index to be stored in a storage device, transmitting a search query, receiving detection data corresponding thereto, and decrypting and outputting the index is described.

2 is a block diagram of a data encryption apparatus suitable for generating an index for encrypted data according to an embodiment of the present invention. The data encryption apparatus 100 includes an encryption unit 102, an index generator 104, The first storage unit 106 and the like can be included.

Referring to FIG. 2, the encryption unit 102 encrypts data using, for example, a symmetric key encryption method. When a data storage request is input from a user, the encryption unit 102 generates a secret key corresponding to the data to be stored. For example, the data is encrypted using a symmetric key encryption method.

In addition, when a data search is requested from a user, the encryption unit 102 transmits a query including index information corresponding to the storage device 300 to the storage device 300 through the communication network 200, and accordingly, the storage device 300. The detected data is decrypted using a secret key corresponding to an encryption method (for example, a symmetric key encryption method, etc.) and then output.

The index generator 104 divides the entire section of the encrypted data into a plurality of subsections, and then randomly rearranges the data using a kid hash function, for example, and then reorders the plurality of subsections. Create an index corresponding to. Here, detailed section information (eg, start point information, end point information, rearrangement information, etc.) corresponding to the rearranged plurality of detailed sections may be stored in the first storage unit 106 and correspond to the generated indexes. Index information (eg, encrypted data type, index area, index value, etc.) may be stored together in the first storage unit 106.

At this time, the index generator 104 may divide the entire section of the encrypted data into a plurality of detailed sections including a similar number of data, the detailed section information is user information (eg, ID, password) Etc.), and may be variously divided according to a user's operation.

를 다수의 세부 구간

로 분할할 수 있고, 전체 구간을 다수의 세부 구간으로 분할할 때 유사한 개수의 데이터를 포함하는 다수의 세부 구간으로 분할할 수 있다.For example, the index generator 104 may cover the entire section of the encrypted data.

Multiple subsections

When dividing the entire interval into a plurality of subdivisions, the subdivision may be divided into a plurality of subdivisions including a similar number of data.

In addition, the index generator 104 transmits the rearranged encrypted data and the corresponding index information to the storage device 300 through the communication network 200.

Meanwhile, the first storage unit 106 includes a database in which data is stored, and various data are stored, and a secret key, an encryption algorithm, detailed interval information, index information, and the like corresponding to the encrypted data are stored. These can be extracted and provided as necessary.

Therefore, after encrypting the data to be stored in the data storage system, rearrange a plurality of detailed sections in which the entire sections of the encrypted data are divided, and generate an index corresponding to the rearranged encrypted data and store them in the storage device. By transmitting the search query, receiving the corresponding detection data, and decoding and outputting the search query, large data can be efficiently stored and easily detected and output.

Next, in the data storage system having the above-described configuration, the rearranged encrypted data transmitted from the data encryption device and the index information are stored together, and then the corresponding data is retrieved and extracted according to the data retrieval request, and the detection is performed. A storage device for transmitting data will be described.

3 is a block diagram of a storage device suitable for storing the generated index and encrypted data according to an embodiment of the present invention, the storage device 300 is a management server 302, the second storage unit 304, etc. It may include.

Referring to FIG. 3, the management server 302 stores and manages rearranged encrypted data and index information transmitted from the data encryption device 100 in the second storage unit 304, and stores data from the data encryption device 100. When the query according to the search request is transmitted, after searching and extracting data corresponding to the index information transmitted with the search request, the detection data is transmitted to the data encryption apparatus 100.

On the other hand, the second storage unit 304 includes a database for storing data, and stores the rearranged encrypted data from the management server 302 and its index information together, which are extracted and managed as necessary. May be provided to the server 302.

Therefore, after storing the rearranged encrypted data transmitted from the data encryption device and the index information together, the corresponding data corresponding to the index information is retrieved and extracted according to the data retrieval request, and the detection data is transmitted. The data can be stored and managed effectively, and the data can be easily extracted and provided according to the transmitted index information.

Next, in the data storage system having the above-described configuration, the data to be stored is encrypted, the entire section of the encrypted data is divided into a plurality of detailed sections, and randomly rearranged to correspond to the rearranged encrypted data. A process of creating an index and storing rearranged encrypted data and index information together will be described.

4 is a flowchart illustrating a process of generating an index for encrypted data and storing encrypted data according to another embodiment of the present invention.

Referring to FIG. 4, in the standby mode of the data storage system (step 402), the encryption unit 102 of the data encryption apparatus 100 checks whether data storage is requested from the user (step 404).

As a result of the check in step 404, when data storage is requested, the encryption unit 102 of the data encryption apparatus 100 generates a secret key corresponding to the data to be stored, for example, a symmetric key encryption method. The data is encrypted (step 406).

의 값으로, 예를 들면,

로 나타낼 수 있다.As an example, Figures 5 and 6 are diagrams for explaining the storage of encrypted data according to an embodiment of the present invention, the database showing the user ID and salary as shown in Figure 5 in a symmetric key encryption method In the case of encryption, an encrypted database as shown in Fig. 6 can be obtained. Here, the first row of the column Enc as shown in Fig. 6'1110110011100... Is a symmetric key algorithm with secret key K

As a value of,

It can be represented as.

The index generator 104 of the data encryption apparatus 100 divides the entire section of the encrypted data encrypted by the encryption unit 102 into a plurality of detailed sections (step 408).

를 다수의 세부 구간

로 분할할 수 있는데, 도 5의 salary의 경우, salary 전체의 범위가

인 경우,

의 세 부분으로 나눌 수 있으며, 세부 구간 [30, 50)에는 34, 41, 44의 세 원소, 세부 구간 [50, 70)에는 51, 59, 65의 세 원소, 세부 구간 [70, 80]에는 73, 79의 두 원소가 포함된다.As an example, the entire interval of data

Multiple subsections

In the salary of FIG. 5, the entire salary range is

Quot;

It can be divided into three parts, with three elements of 34, 41, 44 in the detail section [30, 50), three elements of 51, 59, 65 in the detail section [50, 70), and three elements of the detail section [70, 80]. Includes two elements, 73 and 79.

In addition, the index generator 104 randomly rearranges the entire sections of the encrypted data for each of a plurality of detailed sections by using, for example, a kid hash function or the like (step 410). Here, detailed section information (eg, start point information, end point information, rearrangement information, etc.) corresponding to the rearranged plurality of detailed sections may be stored in the first storage unit 106.

As an example, the subsections I ₁ , I ₂ ,, and I _k may be rearranged randomly in any order. For example, h _k may be a keyed hash function at a start value of the subsection. If (30) = 11100011, h _k (50) = 011011, h _k (70) = 1011011, the subsections can be rearranged in the order of I ₂ , I ₃ , and I ₁ . Where h _k () is the key hash function with the secret key K. Accordingly, if the secret key K is not known, the relocation information of the detailed section cannot be known, thereby improving data safety.

For this safety, the detailed section information (for example, start point information, end point information, rearrangement information, etc.) may be kept as a secret value, for example, the start point information and the end point information 30, 50, 70, 80, and the like. The array information I ₂ , I ₃ , and I ₁ may be kept secret.

Next, the index generator 104 generates an index corresponding to the order of the plurality of rearranged subdivisions (step 412). Here, index information (for example, encrypted data type, index area, index value, etc.) corresponding to the generated index may be stored in the first storage unit 106, and when dividing the entire section of the encrypted data. It may be divided into a plurality of detailed sections including a similar number of data, and the detailed section information may be viewed only when inputting secret information (i.e., user information) corresponding to user information (for example, ID, password, etc.). Information), and may be variously divided according to a user's operation.

내의 값으로 할당될 수 있다.As an example, an index that preserves the order of data belonging to the relocated detail interval may be created, and the index value may be a predetermined index area.

Can be assigned a value within.

에 대해 재배치된 세부 구간의 순서가 I_j1, I_j2, , I_jk, (j₁, j₂, , j_k는 1, 2, , k 의 순열(permutation)로 간주할 수 있음)라고 하면, t 번째 세부 구간

에 속해 있는 x 에 대해 세부 구간

에 포함되도록 아래의 수학식 1과 같은 순서 보존 인덱스를 설정할 수 있다.If k detail intervals

If the order of the _subarrays relocated for is I _j1 , I _{j2 ,,} I _jk , (j ₁ , j _{2 ,,} j _k can be considered as permutations of 1, 2,, k), t detail interval

Interval for x belonging to

An order preservation index, such as Equation 1 below, may be set to be included in.

에 대해,

를 만족할 수 있다.These functions are functions whose order is preserved.

About,

Can be satisfied.

[1/3, 2/3)

[2/3, 1]에 할당하면, 세부 구간

는 이전에 설명한 바와 같이

,

,

의 순서로 재배치될 수 있고, 34

= [30, 50), 79

= [70, 80]이기 때문에, 아래의 수학식 2와 같은 인덱스를 생성할 수 있다.For example, if the salary is 34, 79, as shown in FIG. 5, the index for this value is set to the range [0,1] = [0, 1/3).

(1/3, 2/3)

If you assign to [2/3, 1], the subsection

As previously explained

,

,

Can be rearranged in the order of 34

= (30, 50), 79

Since [70, 80], an index such as Equation 2 below can be generated.

>

임을 알 수 있는데, 각각의 세부 구간에 원소들은 순서가 보존되고 있으나, 다른 세부 구간에 있는 원소들 사이에는 순서가 보존되지 않음을 알 수 있다. 이것은 세부 구간을 어떻게 재배열하는지에 의존하며, 이를 통해 사용자 데이터의 프라이버시를 강화할 수 있다. 한편, 인덱스 영역을 [0,1] = [0, 1/3)

[1/3, 2/3)

[2/3, 1]로 할당하였으나, 사용자 선택에 따른 인덱스 영역에 할당할 수 있고, 필요에 따라 인덱스 영역을 임의로 분할할 수 있음은 물론이다.Here, the value of salary is 34 <79,

>

It can be seen that the order of the elements in each subsection is preserved, but the order is not preserved among the elements in the other subsections. This depends on how the rearrangement of the subdivisions can be done, thereby enhancing the privacy of the user data. Meanwhile, index area [0,1] = (0, 1/3)

(1/3, 2/3)

[2/3, 1], but it can be allocated to the index area according to the user's selection, and the index area can be arbitrarily divided as necessary.

Next, the index generator 104 transmits the rearranged encrypted data and the corresponding index information to the storage device 300 through the communication network 200 (step 414).

Subsequently, the storage device 300 stores and manages rearranged encrypted data and index information transmitted from the index generator 104 of the data encryption device 100 (step 416).

Therefore, after encrypting the data to be stored, the entire section of the encrypted data is divided into a plurality of detailed sections, randomly rearranged, an index corresponding to the rearranged encrypted data is generated, and the rearranged encrypted data And index information can be stored together.

Next, according to the query of the data to be retrieved with the rearranged encrypted data and its index information stored as described above, the corresponding data corresponding to the index information is searched and extracted and transmitted to the data encryption apparatus, and the detection thereof. The process of demodulating and outputting data will be described.

7 is a flowchart illustrating a process of searching for and outputting encrypted data according to another embodiment of the present invention.

Referring to FIG. 7, in the standby mode of the data storage system (step 702), the encryption unit 102 of the data encryption apparatus 100 checks whether a data search is requested from the user (step 704).

As a result of the check in step 704, if a data search is requested, the encryption unit 102 of the data encryption apparatus 100 stores a query including the index information on the data requested to be searched through the communication network 200. In step 706, the server 300 requests a data retrieval by transmitting to 300.

[50, 60)이 되며, 세부 구간 정보로부터 [40, 50)

I _{1} = [30, 50), [50, 60)

I _{2} = [50, 70)임을 알 수 있고, 세부 구간 정보의 재배치 정보에 따라 세부 구간의 순서가

,

,

임을 알고 있기 때문에, 50, 59

, 40, 49

에 대한 아래의 수학식 3과 같은 인덱스 값을 계산할 수 있다.For example, in FIG. 5, when the salary is to search for data belonging to [40, 60], the interval [40, 60] = [40, 50)

(50, 60), and from the detailed section information (40, 50)

I _ {1} = (30, 50), (50, 60)

I _ {2} = (50, 70), and the order of the detailed sections is determined according to the relocation information of the detailed section information.

,

,

Because I know that, 50, 59

, 40, 49

An index value may be calculated as in Equation 3 below.

Indsalary

3/20 or 5/6

Indsalary

59/60)를 포함하는 질의를 서버에 전송할 수 있다. 여기에서, Indsalary는 도 6에 도시한 바와 같은 salary의 인덱스를 의미한다.Index information according to the index value calculated in the manner as described above, for example, (salary: 0

Indsalary

3/20 or 5/6

Indsalary

59/60) can be sent to the server. Here, Indsalary means the index of salary as shown in FIG.

When the query according to the data search request is transmitted from the data encryption apparatus 100, the storage device 300 searches for and extracts data corresponding to the index information transmitted together (step 708).

Indsalary

3/20 or 5/6

Indsalary

59/60 )를 포함하는 질의가 수신되면, 저장 장치(300)에서는 도 6에 도시한 바와 같은 Indsalary가 전송된 인덱스 정보를 만족하는 1, 5, 7, 8번째 행의 데이터를 검색 및 추출할 수 있다.As an example, index information (salary: 0) from the data encryption apparatus 100 may be used.

Indsalary

3/20 or 5/6

Indsalary

59/60), the storage device 300 searches and extracts data of the first, fifth, seventh and eighth rows that satisfy the index information transmitted by the indsalary as shown in FIG. Can be.

In addition, the storage device 300 transmits the detected and extracted detection data to the data encryption device 100 through the communication network 200 (step 710). That is, the detected data of the first, fifth, seventh and eighth rows retrieved and extracted may be transmitted to the data encryption apparatus 100.

Next, the data encryption apparatus 100 decrypts and outputs the detected data transmitted from the storage device 300 using a secret key corresponding to an encryption scheme (for example, a symmetric key encryption scheme, etc.) (step ( 712).

Accordingly, by searching for, extracting, and transmitting the corresponding data corresponding to the index information according to the query of the data to be searched, the data to be searched can be easily detected and outputted.

In the foregoing description, various embodiments of the present invention have been described and described. However, the present invention is not necessarily limited thereto, and a person having ordinary skill in the art to which the present invention pertains can make various changes without departing from the technical spirit of the present invention. It will be readily appreciated that branch substitutions, modifications and variations are possible.

1 is a block diagram of a data storage system suitable for storing an encrypted data by generating an index for the encrypted data according to an embodiment of the present invention;

2 is a block diagram of a data encryption apparatus suitable for generating an index for encrypted data according to an embodiment of the present invention;

3 is a block diagram of a storage device suitable for storing an index and encrypted data generated according to an embodiment of the present invention;

4 is a flowchart illustrating a process of generating an index for encrypted data and storing encrypted data according to another embodiment of the present invention.

5 and 6 are diagrams for describing storing encrypted data according to an embodiment of the present invention;

7 is a flowchart illustrating a process of searching for and outputting encrypted data according to another embodiment of the present invention.

<Description of the symbols for the main parts of the drawings>

100: data encryption device 102: encryption unit

104: index generator 106: first storage unit

200: communication network 300: storage device

302: management server 304: second storage unit

Claims (10)

An encryption unit for encrypting data to be stored; After dividing the entire section of the encrypted data into a plurality of subdivisions, rearranging the divided plurality of subdivisions, index information corresponding to the rearranged order is generated, and rearranged with the generated index information. An index generator for transmitting the encrypted data to a storage device; Data encryption device. The method of claim 1, The encryption unit transmits a search query including the index information corresponding to the data to be searched to the storage device, and receives, decrypts, and outputs detection data searched and extracted according to the index information through the storage device. Data encryption device. The method according to claim 1 or 2, The index generation unit may include detailed section information including start point information, end point information, and rearrangement information, and the index information including an encrypted data type, an index region, and an index value according to a result of rearranging the divided plurality of detailed sections. To store in response to user information Data encryption device. The method of claim 3, wherein The index generator, when generating the index information, allocates the index of the plurality of detailed sections to an index area according to a user selection. Data encryption device. The method of claim 3, wherein The index generator generates the index information whose order is preserved using the start point information, the end point information, and the index area. Data encryption device. Encrypting the data to be stored; Dividing the entire section of the encrypted data into a plurality of detailed sections; Generating rearranged index information corresponding to the rearranged order; Transmitting the generated index information and the rearranged encrypted data to a storage device; Data encryption method. The method of claim 6, The data encryption method, After the step of transmitting to the storage device, transmitting a search query including the index information corresponding to the data to be searched to the storage device; Receiving the detection data searched and extracted according to the index information through the storage device; And decoding and outputting the received detection data. Data encryption method. 8. The method according to claim 6 or 7, The generating of the index information may include detailed section information including start point information, end point information, and rearrangement information, an encrypted data type, an index region, and an index value according to a result of rearranging the plurality of divided detail sections. The index information is stored corresponding to the user information Data encryption method. The method of claim 8, The generating of the index information may include assigning indexes of the plurality of sub-sections to an index area according to user selection when generating the index information. Data encryption method. The method of claim 8, The generating of the index information may include generating the index information whose order is preserved using the start point information, the end point information, and the index area. Data encryption method.

Images