TWI638271B - Cloud server system with encrypted file keyword fuzzy search function - Google Patents

Abstract

The invention provides a cloud server system with an encrypted file keyword fuzzy search function, which can support the correctness of the search result when the wrong keyword is input by the messenger. In addition, it also supports the online permission update module and effective deduplication mechanism, which overcomes the problems of the prior art and improves the practicability of the system, allowing users to have more flexible use and a larger amount of data storage in the same cloud space. Reduce the cost of using cloud storage space for users.

Description

Cloud server system with encrypted file keyword fuzzy search function

The technology of the present invention relates to the field of cloud data storage, and particularly relates to a cloud server system capable of supporting multi-keyword search of encrypted files, online authority update, and efficient removal of duplicate files.

Today's cloud storage systems have become a hot trend. Cloud services can effectively reduce the storage load on the local end and reduce the cost of hardware devices. However, how to protect data from being vulnerable to attacks on the cloud is a very important issue.

In order to protect the user's data from the cloud server, the common solution is to encrypt the file and create a search tree before uploading the file to the cloud, and leave a hidden door for all encrypted files (trapdoor) ), let users find the corresponding file by typing the correct keyword when querying in the cloud. However, in reality, the administrator will limit the encrypted files that each user can access, so it is appropriate to give all users appropriate attributes and develop a suitable access strategy for the cloud server to identify the user identity during the operation. , restrict users to search only under the scope of authorization.

In addition, keyword input errors and permission update problems are often the case in reality. When a user accidentally enters a typo or a malformed keyword, the correct ciphertext file cannot be found, and when the attribute encryption is revoked, All access formulas must be re-constructed, which are issues that are currently being solved by the cloud storage system.

The main purpose of the present invention is to improve the shortcomings of the current cloud server access, management, etc., and propose a cloud server system.

In order to achieve the above object, the present invention is achieved by the following technical means, wherein the cloud server system with the encrypted file keyword fuzzy search function of the present invention comprises: a cloud server, a file encryption device and a query device. . The cloud server includes a storage module for storing files, and the fuzzy search module for performing a multi-keyword search for multiple keywords. A multi-key set synthesized by the group, and all the search results retrieved using the multi-key set are fed back. The file encryption device is configured to perform an encryption operation on the at least one file, generate an encrypted file of the file and an index, and upload the encrypted file and the index to the storage module for storage. The query device is configured to generate a hidden door to enter the cloud server for performing a file retrieval operation, and the hidden door includes at least one of the file encryption device and a keyword set. Wherein, when the cloud server receives the hidden door, the multi-keyword search is performed based on the index and the keyword set, and all files that meet the search result are fed back to the query device.

In a preferred embodiment of the present invention, the cloud server further includes an online rights update module for generating a permission update list for the encrypted file, the permission update list for recording the permission change in a short period.

In a preferred embodiment of the invention, the encryption operation utilizes Attribute-Based Encryption to perform Fine-Grained Access Control on the file.

In a preferred embodiment of the invention, the authentication includes a function for generating an encryption function, the function for generating the encryption function for confirming whether the authority of the query device is sufficient to enter the cloud server.

In a preferred embodiment of the invention, the index includes a set of fuzzy keywords for the multi-keyword search.

In a preferred embodiment of the present invention, the cloud server further includes a deduplication file module, and the deduplication file module uses a file segmentation method to give each file a dynamic sliding frame, and decomposes the files into multiple files. The cell block compares the data repetition of each cell block to remove duplicate files.

In the preferred embodiment of the present invention, the file segmentation method uses dynamic data cutting to decompose each file into a plurality of cell blocks.

1‧‧‧Cloud Server

11‧‧‧ Storage Module

12‧‧‧Fuzzy search module

13‧‧‧Remove duplicate file module

14‧‧‧Online permission update module

2‧‧‧File Encryption Device

21‧‧‧Files

21a, 21b‧‧‧ encrypted files

22‧‧‧ Index

23‧‧‧ Certification

3‧‧‧ inquiry device

31‧‧‧Search requirements

32‧‧‧ hidden door

1 is a schematic structural view of a system according to a preferred embodiment of the present invention.

2 is a schematic diagram of an index generation process according to a preferred embodiment of the present invention.

FIG. 3 is a schematic diagram of a process of generating a hidden door according to a preferred embodiment of the present invention.

4 is a schematic diagram of online authority update according to a preferred embodiment of the present invention.

In order to achieve the above objects and effects, the technical means and constructions of the present invention are described in detail with reference to the preferred embodiments of the present invention. The features and functions are as follows, and the benefits are fully understood, but it should be noted that the contents are not It constitutes a limitation of the present invention.

Please refer to FIG. 1 , FIG. 2 , FIG. 3 and FIG. 4 , which are a schematic diagram of a system structure, an index generation flow diagram, and a hidden door of a preferred embodiment of the cloud server system with the encrypted file keyword fuzzy search function. Generate a schematic diagram of the process and an online update of the permissions. The cloud server system with the encrypted file keyword fuzzy search function of the present invention comprises: a cloud server 1, a file encryption device 2 and a query device 3.

The cloud server 1 includes at least one storage module 11, a fuzzy search module 12, and a deduplication file module 13.

The storage module 11 is configured to store files, which may be a database module common to the cloud storage system. The fuzzy search module 12 is configured to perform a multi-keyword search for all the search results retrieved by the multiple keyword set for a plurality of keyword sets combined by a plurality of keywords.

The deduplication file module 13 uses a file segmentation method to give each of the file dynamic sliding frames, finds the most appropriate location for data segmentation, and decomposes the files into a plurality of cell blocks. The data overlap of each block is then compared to remove duplicate files.

In an embodiment of the present invention, the file segmentation method uses dynamic data cutting to decompose each file into a plurality of cell blocks. Even if characters are inserted in the front end or the middle of the file data, all subsequent data will be moved. The most appropriate location can be found for data segmentation, which can increase the number of cell blocks with the same content, and the efficiency of the system in comparing the cell block data and removing the duplicates is greatly improved. Compared with the existing fixed data cutting, it can effectively improve the deduplication effect.

The file encryption device 2 is configured to perform an encryption operation on at least one file 21 to generate an encrypted file 21a and an index 22 of the file 21, and upload the encrypted file 21a and the index 22 to the storage module 11 for storage. When a file owner wants to upload the file 21 held by him to the cloud for storage, the file owner needs to use the file encryption device before uploading. 2. The file 21 to be uploaded is subjected to an encryption operation to generate an encrypted file 21a of the file 21 and an index 22 that can be retrieved after encryption. After the index 22 is established, the file encryption device 2 is uploaded to the cloud server 1 for storage along with the index 22 and the encrypted file 21a.

In an embodiment of the invention, the encryption operation uses Attribute-Based Encryption to perform Fine-Grained Access Control on the file.

In an embodiment of the invention, the index 22 includes a set of fuzzy keywords for the multi-keyword search.

The process of generating an index according to the present invention is as shown in FIG. 2. The index 22 is generated by first extracting the keyword (Keyword) in the file. Second, you need to create a Fuzzy Keyword Set, and then encrypt the keyword (Encrypt). Finally, after compressing the encrypted keyword using the hash function (Hash), the result from the 0th power to the dth power is calculated. Where d is the maximum number of keywords that can be entered.

The query device 3 is configured to generate a hidden door 32 to enter the cloud server 1 for performing a file retrieval operation. The hidden door 32 includes at least a keyword set and the file encryption device 2 gives one of the authentications 23, the key The word set is a combination of a plurality of keywords that are input by the user, and the user can input a plurality of keywords, and the cloud server 1 generates a multi-key set of the keywords through the fuzzy search module 12 to perform the search. . When a user wants to retrieve the file 21a uploaded by the file owner to the cloud database, it must first issue a search request 31 to the file encryption device 2. After obtaining the file owner's consent, the file encryption device 2 will Returning an authentication 23 to the querying device 3, the authentication 23 may include a function for generating an encryption function and a function for generating a hash function, the function for generating the encryption function for confirming the query device 3 Is the permission sufficient to enter the cloud server 1. When the user obtains the authentication 23 of the file owner, the query device 3 can be used to create a valid hidden door 32 to enter the cloud server 1.

The flow of generating a hidden door according to the present invention is as shown in FIG. 3, and firstly, an input algorithm is used to generate a set of fuzzy keywords (Build Fuzzy Keyword Set). Secondly, if the total number of keywords (fuzzysize()) is less than a preset number d, the preset number is added minus the total number of keywords (dummyword) to fill the remaining blank positions. Virtual keywords are composed of random letters and numbers, not real text, so they don't appear in the file. Finally, after encrypting the fuzzy keyword set (Encrypt) and compressing it with hash function (Hash), the coefficients of the polynomial are generated and the flow is terminated.

In the above manner, when the cloud server 1 receives the hidden door 32, the multi-keyword search can be performed based on the index 22 and the keyword set, and all or a relatively high complex number that matches the search result is fed back. Encrypted files 21b to the query device 3.

Referring to FIG. 4, in an embodiment of the present invention, the cloud server 1 further includes an online rights update module 14 for generating a permission update list for the encrypted file 21a. This permission update list is used to record permission changes in the short term. In FIG. 4, the online rights update module 14 adds an additional node to the original encrypted file. This node stores the revocation list. On the other hand, the file owner also inserts the personal key. The personal identifier, if this personal key (for example, ID=Bob) is registered in this list, even if the access subtree is met, it is still unable to enter the cloud server 1.

In general, encrypted file attribute encryption usually includes the steps of initializing settings, generating a personal key, encrypting and decrypting. The file owner can use the file encryption device to create a personal key and then authorize the personal key to the user. The user can define the access policy binding in the secret door when encrypting, and only the personal key whose attribute meets the access policy can successfully enter the cloud server 1. And because the real-time access rights are very common, if you change the access formula of all files every time you change, the system service will be suspended. Therefore, the online rights update module 14 additionally adds a set of permission update lists for each encrypted file 21a to record the short-term permission changes and cooperate with the original access formula to ensure that the result is equivalent to the updated access. Formulas, and the task of updating the access formula can achieve the purpose of suspension, avoiding the occurrence of service interruptions with each update.

Therefore, referring to all the drawings, when using the present invention, compared with the conventional technology, the following advantages exist:

(1) The present invention provides a cloud server system with an encrypted file keyword fuzzy search function. When a keyword is input with a typo when a user searches, as long as it is still within a reasonable error range, the encrypted file query can still be ensured. Correctness.

(2) The system of the present invention can still perform flexible ciphertext data sharing and control and reduce the storage cost by using deduplication technology in a third-party cloud storage environment that is not fully trusted.

(3) The present invention adds an attribute encryption access formula and an online rights management mechanism, and can perform flexible and fine access control, and change the access formula according to the authority setting.

Through the above detailed description, it can fully demonstrate that the object and effect of the present invention are both progressive in implementation, highly industrially usable, and are new inventions not previously seen on the market, and fully comply with the invention patent requirements. , 提出 apply in accordance with the law. The above is only the preferred embodiment of the present invention, and is not intended to limit the scope of the embodiments and the scope of the present invention. Those skilled in the art should be able to Combinations of equivalent substitutions and obvious variations are intended to be included within the scope of the invention.

Claims (5)

A cloud server system with an encrypted file keyword fuzzy search function includes: a cloud server, including a storage module, a fuzzy search module, a deduplication file module, and an online permission update module, the storage The module is configured to store a file, and the fuzzy search module is configured to perform a multi-keyword search, and the multi-keyword search is performed by using a multi-keyword set for a plurality of keyword sets combined by the plurality of keywords. For all the search results, the deduplication file module uses a file segmentation method to give each file a dynamic sliding frame, and decomposes each file into a plurality of cell blocks, and then compares the data repetition of each cell block to repeat The file removal module is configured to generate a permission update list for an encrypted file, the permission update list is used to record the permission change in a short period; and a file encryption device is configured to perform an encryption operation on the at least one file. Generating the encrypted file of the at least one file and an index, and uploading the encrypted file and the index to the storage module for storage; Querying means for generating a secret door to enter the cloud server for performing a file retrieval operation, the hidden door including at least one of the file encryption device and a keyword set; wherein, when the cloud server receives the The hidden door performs the multi-keyword search based on the index and the keyword set, and feeds back all the files that match the search result to the querying device. The cloud server system with the encrypted file keyword fuzzy search function described in claim 1, wherein the encryption operation uses Attribute-Based Encryption to perform finer access control on the file (Fine- Grained Access Control). The cloud server system with the encrypted file keyword fuzzy search function according to claim 1, wherein the authentication includes a function for generating an encryption function, and the function for generating the encryption function is used to confirm the query device. Is the permission sufficient to enter the cloud server. The cloud server system with the encrypted file keyword fuzzy search function according to claim 1, wherein the index includes a fuzzy keyword set for the multi-keyword search. The cloud server system with the encrypted file keyword fuzzy search function described in claim 1, wherein the file segmentation method uses dynamic data cutting to decompose each file into a plurality of cell blocks.