CN103595730A - Ciphertext cloud storage method and system - Google Patents

Abstract

Translated fromChinese

本发明涉及一种密文云存储方法和系统，在至少一个客户端和云端服务器组成的系统中，存储方法为：1）用户在客户端存放数据中选择采用密文和/或明文进行数据同步，并对密文选择加密算法；2）使用基于用户身份提供的认证参数生成主密钥，在客户端采用主密钥+加解密密钥的两级密钥对密文同步的数据进行加密并对该主密钥进行备份；3）在客户端和云端同步密文及密文索引；或在云端和客户端同步明文同步数据后在云端建立明文索引；4）将明文和/或密文存储在本地私有云存储服务器或者根据用户请求的挂载点，存储在云存储提供商存储服务器。本发明在终端丢失不会丢失数据，且若防护不当仅损失文件的密文形式，同时存储系统可对接多个云服务提供商。

The present invention relates to a ciphertext cloud storage method and system. In a system composed of at least one client and a cloud server, the storage method is as follows: 1) The user chooses to use ciphertext and/or plaintext for data synchronization in the data stored at the client , and select an encryption algorithm for the ciphertext; 2) Use the authentication parameters provided by the user to generate the master key, and use the two-level key of the master key + encryption and decryption key on the client to encrypt the data synchronized with the ciphertext and Back up the master key; 3) Synchronize the ciphertext and ciphertext index between the client and the cloud; or establish a plaintext index on the cloud after synchronizing plaintext synchronization data between the cloud and the client; 4) Store the plaintext and/or ciphertext On the local private cloud storage server or according to the mount point requested by the user, it is stored on the cloud storage provider's storage server. The present invention will not lose data when the terminal is lost, and if the protection is not proper, only the cipher text form of the file will be lost, and at the same time, the storage system can be connected to multiple cloud service providers.

Description

A kind of ciphertext cloud storage means and system

Technical field

The present invention relates to information security field, specifically, relate to the method and system of realizing ciphering user data storage and bright cryptogram search under a kind of cloud storage environment.

Background technology

Along with the appearance of smart mobile phone, network access equipment is diversification day by day.The intelligent terminal of these access networks often also possesses certain data acquisition, Storage and Processing ability.From user's visual angle, have a plurality of intellectual computing devices (as PC, notebook, smart mobile phone, panel computer etc.) has become normality simultaneously, how between a plurality of heterogeneous terminals, to safeguard the demand that a unified user file view necessitates.

Meanwhile, the data that realize on heterogeneous platform for user of day by day popularizing of cloud computing synchronously provide a solution.Cloud computing is a kind of novel computation model, it can be by resource managements such as network, storage, application and service within a configurable shared resource pond, and these resources are offered to user with the form of service, user can be easily from resource pool Gains resources and maintenance and management infrastructure voluntarily.For example: Baidu's cloud dish provides the free online memory space of 1T for user, and user can be uploaded to high in the clouds by the data file of oneself, and in other terminal, obtains the copy of these files.The cloud service of Amazon provides memory space and computing capability simultaneously, and user only needs to pay very low expense can obtain a large amount of calculating and storage resources.

These cloud computing schemes have solved the demand of user ID file to a certain extent, but aspect fail safe, exist significant defect.Due to cloud mode, data owner no longer safeguards the carrier of storage data, and which cloud service user no matter select provide commercial city to trust completely it.But in reality, user's data, are especially used data that intelligent terminal gathers (such as individual photo, communications records etc.) often relevant to privacy, and user does not wish it to entrust to completely stores service business.Lack active data security protection means and become one of most important reason hindering cloud service popularization.The main challenge that existing technical scheme faces comprises:

1) risk of lost terminal.Data are lost with the loss of terminal, even if adopted cloud synchronization scenario, the data that are present in terminal with plaintext form also can produce the risk of divulging a secret.

2) risk of cloud service provider abuse authority.Cloud service provider spies upon and analyzes user data based on commercial object.Such as the analysis engine that the companies such as Google and Baidu generally adopt, may relate to user's the privacy informations such as use habit.

3) cloud service provider protects risk improperly.Cloud service provider does not provide enough security protections, starts a leak or suffer assault in management, and the user data causing leaks.For example: the leakage of a state or party secret that Google DOC occurs, user has seen not one's own data.

4) risk that cloud service provider closes down.Once cloud service provider closes down, whether user can fetch exists the data that are placed on high in the clouds will become a major issue.Yahoo has closed mail service in 2013, if this type of event appears at it cloud service provider, Similar Problems also can highlight.

Published application for a patent for invention; publication number: CN102428686 is for the system and method for the data of safeguard protection cloud, provides a kind of safety can integrated data to store in cloud computing resources and transmitted the secure data parser in any appropriate system of data with cloud computing resources.Then this secure data parser resolution data is a plurality of parts of separate, stored or transmission by this Data Segmentation.In order to increase fail safe, can utilize the part of initial data, data or the encryption of these two.The method mainly provides safe storage and transmission security.The detailed strategy of key management is not provided, and single key does not have secondary key to guarantee data security.Can not retrieve ciphertext, the file operation flow process of client is not provided.Can not effectively solve and the docking of third party cloud storage server.

Published application for a patent for invention, application number: 201010595149.0 1 kinds of document retrieval method and systems towards the storage of ciphertext cloud, the method be take cloud computing as background, use index terms, original generating ciphertext index file and the ciphertext of the symmetric key difference encrypted indexes file of client generation, user's master key encrypted symmetric key generates key ciphertext, is stored in high in the clouds.Wherein, server end is preserved a concordance list, for storing user by the resulting ciphertext of attribute metamessage of its index document that secret key encryption is uploaded; When retrieval, client first obtains the ciphertext of user index key from server end, then utilize user's master key to be decrypted, then with the index key obtaining, attribute metamessage is encrypted and attribute metamessage ciphertext is sent to server end, server end utilizes this attribute metamessage ciphertext to retrieve concordance list, thereby is met the paper trail of condition and returns to client.The method does not provide inquiry expressly, insufficiency; Do not provide to third party cloud provider to connection function, cost is high; Key management functions is weak, can not upgrade user's key, and do not provide client key storage, obtain, upgrade, a series of solutions such as backup; Synchronizing function and the synchronization policy of client are not provided, and user file can only once add Miyun storage, and the file operation flow process based on transparent encryption and decryption functions of client is not provided; And there is leak in the fail safe of this scheme, due to index terms and original text are used to same encryption key, and index terms is all through the simple keyword after participle, according to the cryptanalysis of frequency, can decode it, obtain symmetric key, thereby can obtain the information of original text.

Summary of the invention

For the problems referred to above, the object of the invention is to propose a kind of ciphertext cloud storage means and system, for user provides comparatively complete data security preventive means.This method can promote user's data security protection and secret protection ability effectively.Can give up the misgivings that user selects cloud scheme, for promoting the development of cloud computing, increase information system service efficiency, promote energy-saving and emission-reduction all tool be of great significance.

To achieve these goals, technical scheme of the present invention is: a kind of ciphertext cloud storage means, and in client, set up and be synchronously connected with high in the clouds, the steps include:

1) it is synchronous that in the data that user deposits in client, selection employing ciphertext and/or plaintext carry out data, and described ciphertext is selected to cryptographic algorithm;

2) use the parameters for authentication providing based on user identity to generate master key, and obtain the preset encryption and decryption key of ciphertext or generate corresponding ciphertext encryption and decryption key according to described master key, at the two-stage key of described customer end adopted master key+encryption and decryption key, the synchronous data of ciphertext are encrypted and set up ciphertext index and this master key is backed up;

3) in the synchronous described ciphertext of described client and high in the clouds and ciphertext index ciphertext index and the ciphertext synchronous data of deletion in client; Or after described high in the clouds and the synchronous described plaintext synchrodata of client, in described high in the clouds, set up expressly index; And realize transparent to user of encryption and decryption process:

4) described plaintext and/or ciphertext are stored in to local privately owned cloud storage server or according to the mount point of user's request, are stored in the storage server of cloud storage provider.

Further, the method for synchronous described plaintext comprises uploading, download or deleting of data, by following method, realizes the expressly synchronous and renewal of synchrodata to user:

1) while starting, load data monitoring service, and the data list generation reading according to local data base or service data watch-list;

2), according to the data monitoring list of obtaining, data-driven file-name field and the data path field on server produces the mapping one by one of data and list, and the data in watch-list are associated with local data; If automatic synchronization, data monitoring device is monitored the state of local data, if data mode comprises the up-to-date time that attribute is synchronous, the data modification time, data cryptographic Hash changes, the synchronous event of trigger data; If manually set out simultaneous operation, the direct synchronous event of trigger data;

3) described data monitoring device obtains simultaneous operation, check whether client terminal local data exist, if described local data exists, whether the metadata information that detects local attribute is identical with cloud storage server, the metadata information of described local attribute comprises the data hashed value of data modification time and regular length, and data locks in time;

4), if data do not exist, drive and carry out downloading data attribute metadata and plaintext synchrodata;

5) if described cloud storage server data modification is downloaded through driving, Cloud Server data pull, to local, and is upgraded to local data attributes metadata;

6) if described client terminal local data modification comprise: situation about upload for the first time, service end not having metadata, through driving, upload, client terminal local data, data attribute metadata are uploaded to cloud storage server;

7) if described cloud storage server data and client data are modified simultaneously, according to user, select to comprise through driving: cancellation operation, rewriting data, the additional conflict solution retaining.

Further, the method for synchronous described ciphertext comprises uploading, download or deleting of data, by following method, is realized the synchronous of user's ciphertext synchrodata and is upgraded:

1) while starting, load data monitoring service, and the data list generation reading according to local data base or service data watch-list;

2), according to the data monitoring list of obtaining, data-driven file-name field and the data path field on server produces the mapping one by one of data and list, and the data in watch-list are associated with local data; If automatic synchronization, data monitoring device is monitored the state of local data, if data mode comprises the up-to-date time that attribute is synchronous, the data modification time, data cryptographic Hash changes, the synchronous event of trigger data; If manually set out simultaneous operation, the direct synchronous event of trigger data;

3) described data monitoring device obtains simultaneous operation, check whether client terminal local data exist, if described local data exists, whether the metadata information that detects local attribute is identical with cloud storage server, the metadata information of described local attribute comprises the data hashed value of data modification time and regular length, and data locks in time;

4), if data do not exist, drive and carry out downloading data attribute metadata and plaintext synchrodata;

5) if described cloud storage server data modification is downloaded through driving, Cloud Server data pull, to local, and is upgraded to local data attributes metadata;

6) if described client terminal local data modification comprise: situation about upload for the first time, service end not having metadata, through driving, upload, client terminal local data, data attribute metadata are uploaded to cloud storage server;

7) for uploading, need generating ciphertext index successively, enciphered data generating ciphertext, then uploads to cloud storage server through driving by encrypt data, ciphertext index and ciphertext metadata attributes;

8) for download, because encrypt data can not be realized incremental update, thus when processing, conflict determines whether ciphertext, if ciphertext operates or rewritable paper according to cancelling of user's judgement.

Further, described synchronous bright encrypt data type comprises: file, sqlite database, SharedPreferences.

Further, described two-stage secret key encryption realizes by following method:

1) while moving, from internal memory, read master key and from memory cache or database, read the encryption and decryption key of storage simultaneously,

2), when user uses client for the first time, the corresponding parameters for authentication providing according to user, generates described master key, this master key is backed up simultaneously;

3) user is at every turn when carrying out the storage of ciphertext cloud, according to described parameters for authentication, from stored data base, read the individual event hashed value of regular length of the master key of described storage, the individual event hashed value that the described parameters for authentication providing with user utilizes identical algorithms to generate the regular length of key is compared;

4), when searching described encryption and decryption key, according to data encryption attribute metadata information and user encryption scheme, search the encryption and decryption key of storage, and use master key to decipher the encryption and decryption key of described storage;

5) if do not find the encryption and decryption key of described storage, generate encryption and decryption key, and carry out cipher key backup; By the individual event hashed value of the regular length of master key, and the encryption and decryption cipher key backup after master key is encrypted is to database and cloud server; Encryption and decryption key and data-mapping relation table after encrypting are also backuped to high in the clouds simultaneously.

Further, the parameters for authentication of described master key comprises: the biological characteristic of user password or user fingerprints, sound, iris.

Further, by following method, realize transparent to user of encryption and decryption process:

1) when user uses first, the file of selecting required encryption to upload, now file is uploaded preliminary treatment;

2) obtain key and algorithm, selected file is encrypted, is uploaded and preserves file attribute information to database, the former clear text file of described selected file is deleted after uploading successfully;

3) user to ciphertext request read or during retouching operation, call corresponding abstract encryption device assembly and be decrypted operation, generate expressly temporary file, and preserve expressly temporary file attribute information metadata and arrive temporary file table, and give upper level applications by plaintext temporary file;

4) user uses application program to be all directed to expressly temporary file to the operation of file, carries out temporary file attribute and contrast with the original attribute metadata of storing when carrying out next file operation or synchronous refresh;

5) if file is not modified, delete temporary file, file does not carry out synchronously; If file, through revising, calls encryption device unit described interim clear text file is encrypted to operation, and synchronous, successfully delete afterwards described interim clear text file uploading.

The present invention also proposes a kind of ciphertext cloud storage system, comprising: one or more clients and cloud server, it is characterized in that,

It is synchronous that in the data that user deposits in client, selection employing ciphertext and/or plaintext carry out data;

The parameters for authentication that use provides based on user identity generates master key, and obtain the preset encryption and decryption key of ciphertext or generate corresponding ciphertext encryption and decryption key according to described master key, at the two-stage key of described customer end adopted master key+encryption and decryption key, the synchronous data of ciphertext are encrypted and set up ciphertext index;

In described high in the clouds and the synchronous described ciphertext of client and ciphertext index ciphertext index and the ciphertext synchronous data of deletion in client; After described high in the clouds and the synchronous described plaintext synchrodata of client, set up expressly index simultaneously;

Described plaintext and/or ciphertext are stored in to local privately owned cloud storage server or according to the mount point of user's request, are stored in the storage server of cloud storage provider;

Described client also comprises encryption and decryption module (1) for carrying out encryption and decryption operation, for completing with the master key of personal identification binding with the key management module (2) of the encryption and decryption key two-stage key management of data binding, the index module (3) generating for ciphertext index, in order to realize the retrieval of bright ciphertext, for searching ciphertext, generate participle and the uni-directional hash of respective queries statement, and with mutual enquiry module (4), synchronization module (5) and the administration module (6) in high in the clouds;

Described synchronization module (5) is connected ciphertext and the index for calling and accepting to generate with index module (3) with transparent encryption and decryption module (1), complete the synchronous function of ciphertext and index;

Described administration module (6) and transparent encryption and decryption module (1), key management module (2) is connected to user that operation-interface is provided, and to set ciphertext security strategy, to comprise, obtains described parameters for authentication and enciphering and deciphering algorithm;

After the synchronous described plaintext in described high in the clouds is set up plaintext index or synchronous described ciphertext and ciphertext index beyond the clouds simultaneously, delete the ciphertext index in client and need enciphered data; Described plaintext and/or ciphertext are stored in to local storage server or according to the mount point of user's request, are stored in the stores service interface of cloud storage provider;

Described Cloud Server end also comprises with the synchronization module (7) of client synchronization module (5) connection synchronizes for realizing ciphertext, and ciphertext index is synchronous; In order to creating the index module (8), enquiry module (9) of index expressly, in order to realize and the docking of other cloud platforms, extension storage ability to connection module (10), key management module (11), user management module (12);

Described enquiry module (9) is connected with the enquiry module (4) of client, in order to support the bright cryptogram search of index and the cryptogram search of support sequential scanning, finally returns to Query Result;

Described key management module (11) is connected with the key management module (2) of client, for storage backup user's master key individual event hashed value, the encryption and decryption key that uses master key to encrypt, the metamessage value of user data attribute, adopts database to realize; Provide interface to accept user's request, carry out key recovery;

Described user management module (12) realizes the management of user account number and access control, comprises registered user, safeguards super administrator and domestic consumer.

Further, in described storage system, according to user, set, adopt Priority Control Strategies, for the high data of priority, after user's request, meet with a response immediately obtaining, set up index, enciphered data, the synchronous operation of upgrading; For the low data of priority,, when client access power supply or inactive state, automatically carry out index foundation, enciphered data, the synchronous operation of upgrading.

Further, described extension storage ability to connection module (10), comprise: carry is controlled functional module and data operation modules, wherein carry is controlled increases mount point submodule being mainly divided into of functional module, delete mount point submodule, obtain mount point information submodule, and data operation modules is mainly divided into general operation interface sub-module and exterior storage Interface realization submodule;

Described increase mount point submodule: user increases outside cloud storage mount point, and mount point information is write in corresponding configuration file;

Described deletion mount point submodule: delete the outside cloud storage mount point of carry, and upgrade corresponding configuration file;

Described acquisition mount point information submodule: obtain the current all mount point information of user;

Described general operation interface sub-module: the general access interface that docks and carry out data interaction with all exterior storage cloud platforms is provided.

Further, described extension storage ability also comprises that to connection module (10) Amazon S3, Dropbox, HDFS exterior storage type carry out specific implementation to described general operation interface.

By method and system disclosed by the invention, perfect solution in background technology, mention, the defect of prior art scheme and risk, aspect index, for expressly setting up beyond the clouds index, for ciphertext, in setting up index and be chosen in different environment according to the fail safe of file and index efficiency, client sets up index.At secondary key management aspect, wherein master key and personal identification binding.Isomery cloud platform aspect, has solved Autonomous determination API between a plurality of cloud service provider, causes unifying cooperation, the problem of managerial confusion.Making provides unified management interface for tension management person, and simple operations.And when can guarantee fail safe, reduce carrying cost, beneficial effect of the present invention is as follows:

1. lost terminal can obliterated data.Clear text file and cryptograph files are all synchronized to cloud server after selected, and user selects these files to download after can authenticating (being authentication) by master key in another client.If user is file encryption, no matter in terminal or high in the clouds, sensitive document is all to exist with ciphertext form so, even if lost terminal can leakage information yet, it is identical with the difficulty of attack cryptographic algorithm that assailant obtains difficulty expressly.

2. cloud service provider can't see clear text file.The master key of deciphering decruption key, binds with user by authentication, and cloud service provider cannot decrypted user data, therefore also cannot abuse.

3. protect improper ciphertext form of only losing file.Even if cloud service provider is captured by hacker, hacker can only obtain the ciphertext form of file, and it is identical with the difficulty of attacking cryptographic algorithm that assailant obtains difficulty expressly.

4. can dock a plurality of cloud service provider.Provide connection module, user can be distributed in data in the storage that different cloud service providers provides, and wherein Yi Jia cloud service provider closes down also can not affect the survival of other copies.

Accompanying drawing explanation

Fig. 1 is the structural representation of ciphertext cloud storage system of the present invention;

Fig. 2 is the key management module structure chart of ciphertext cloud storage system of the present invention;

Fig. 3 is that the key management module of ciphertext cloud storage means of the present invention is related to schematic diagram;

Fig. 4 be ciphertext cloud storage means of the present invention key management module obtain cipher key processes figure;

Fig. 5 is the encryption and decryption modular structure figure of ciphertext cloud storage system of the present invention;

Fig. 6 is the encryption flow figure of the encryption and decryption module of ciphertext cloud storage means of the present invention;

Fig. 7 is the exposition flow chart of the encryption and decryption module of ciphertext cloud storage means of the present invention;

Fig. 8 is the client Synchronous Pre processing procedure figure of the synchronization module of ciphertext cloud storage means of the present invention;

Fig. 9 is the client simultaneous operation procedure chart of the synchronization module of ciphertext cloud storage means of the present invention;

Figure 10 is the cloud server simultaneous operation procedure chart of the synchronization module of ciphertext cloud storage means of the present invention;

Figure 11 is the docking modular structure figure of ciphertext cloud storage system of the present invention;

Figure 12 is the isomery cloud platform Middleware implementation procedure chart to connection module of ciphertext cloud storage means of the present invention;

Figure 13 is the ciphertext index submodule work schematic diagram of the index module of ciphertext cloud storage means of the present invention;

Figure 14 is the plaintext index submodule work schematic diagram of the index module of ciphertext cloud storage means of the present invention;

Figure 15 is the client query submodule work schematic diagram of the enquiry module of ciphertext cloud storage means of the present invention;

Figure 16 is the high in the clouds query processing submodule work schematic diagram of the enquiry module of ciphertext cloud storage means of the present invention;

Figure 17 is the ciphertext cloud storage means basic step figure of ciphertext cloud storage means of the present invention;

Figure 18 is the search method figure of the ciphertext cloud storage of ciphertext cloud storage means of the present invention;

Figure 19 is the basic step figure that the client file of ciphertext cloud storage means of the present invention deals with;

Embodiment

Below in conjunction with the drawings and specific embodiments, the present invention will be further described in detail, but the scope not limiting the present invention in any way.

In one embodiment of this invention, to the cloud storage means of ciphertext, be:

A) (user) is encrypted selecting files in client; For the one or more files in one or more clients, user is that data owner can use identical or different encryption device unit, in client, with identical or different key, it is carried out to transparent encryption and decryption; Described client may be various intellectual computing devices, comprises mobile intelligent terminal (such as smart mobile phone, PAD, PDA or other intelligent movable equipment) and conventional internet access device (such as notebook computer, PC or server etc.);

B) select files described in arranging according to expressly or the form of ciphertext be synchronized to high in the clouds or be saved to local client; For data owner provides synchronization policy option, make its can arrange selected file with expressly or the form of ciphertext be synchronized to high in the clouds, or be only kept at client and asynchronous; Synchronizing function assembly is according to the selected synchronization policy of data owner, and plaintext or the ciphertext form of the synchronous file of needs and the metadata of describing its attribute are uploaded to high in the clouds; And in needs, be synchronized to identical or different client;

C) master key and personal identification binding, can only provide operation by this user, as utilize fingerprint characteristic, iris feature etc. to generate fixing master key, and the feature that this master key can not provided by other people generates, thereby realize and personal identification binding.Expressly do not bind with master key, be not expressly encrypted operation, do not need to use master key deciphering encryption and decryption key.Expressly, in client stored in clear, upload to high in the clouds and set up expressly index storage.Master key is provided by user, is used for deciphering obtaining encryption and decryption key.When encryption and decryption key is bound master key with file, use, each file has one to encrypt decryption key, can be different between these encryption and decryption keys.The present invention that propose with master key personal identification binding and with the encryption and decryption key two-stage key management method of file binding, provide: authentication, key produces, key updating, key storage, cipher key backup, key recovery and cipher key destruction function.

D) user sends synchronization request, and encryption and/or clear text file are synchronized to high in the clouds; Data owner asks file synchronization to high in the clouds, the strategy that client is set according to the owner, check whether be to encrypt to upload, if encrypt, upload, operation in accordance with the following steps: create ciphertext index in client, enciphered data, encrypted indexes, upload file and index after encryption, until high in the clouds, return after uploading successful message and delete clear text file and the index in terminal; If not encrypt, upload, the plaintext of upload file, and set up beyond the clouds clear text file index.

E) cloud storage server comprises that an isomery cloud platform, to connected components, is used for connecting one or more cloud memory devices to connected components, realizes carry and controls function and Data Control function; Its medium cloud memory device can be local storage server, can be also cloud storage provider stores service interface (such as: S3 etc.).Described carry is controlled function, comprises increase, deletes mount point, obtains mount point information etc.; Described Data Control function, comprises the file of uploading, download, deleting in exterior storage.Cloud platform by isomery to connected components can provide can compatible extensions data store, user data can leave these cloud stores service business in, but Information Security can not lose, thereby reduce the cost of cloud storage and the risk of maintenance.

F) according to user, set, adopt Priority Control Strategies, for the high file of priority, after user's request, meet with a response immediately obtaining, set up index, encrypt file, the synchronous operation of upgrading; For the low file of priority,, when client access power supply or inactive state, automatically carry out index foundation, encrypt file, the synchronous operation of upgrading.

In this another embodiment of the present invention, a ciphertext cloud storage system, comprising:

One or more clients and cloud server;

Described client comprises transparent encryption and decryption module 1, key management module 2, index module 3, enquiry module 4, synchronization module 5 and administration module 6;

Described transparent encryption and decryption module 1 and index module 3 are used for respectively carrying out encryption and decryption operation and ciphertext index generates;

Described key management module 2 completes and the master key of personal identification binding and the encryption and decryption key two-stage key management of binding with file;

Described enquiry module 4, in order to realize the retrieval of bright ciphertext, generates participle and the uni-directional hash of respective queries statement for searching ciphertext, and mutual with high in the clouds.

Described synchronization module 5 is connected ciphertext and the index for calling and accepting to generate with index module 3 with transparent encryption and decryption module 1, complete the synchronous function of ciphertext and index;

Described administration module 6 with transparent encryption and decryption module 1, key management module 2 is connected to user that operation-interface is provided, and to set ciphertext security strategy, to comprise, obtains described parameters for authentication and enciphering and deciphering algorithm;

Described Cloud Server end comprises synchronization module 7, index module 8, enquiry module 9, toconnection module 10, key management module 11, user management module 12;

Described synchronization module 7 is connected with client synchronization module 5, realizes ciphertext synchronous, ciphertext index synchronizing function;

Described index module 8 is in order to create expressly index;

Described enquiry module 9 is connected with the enquiry module 4 of client, in order to support the bright cryptogram search of index and the cryptogram search of support sequential scanning, finally returns to Query Result.

Described toconnection module 10 in order to realize and the docking of other cloud platforms, extension storage ability.

Described key management module 11 is connected with the key management module 2 of client, and for storage backup user's master key individual event hashed value, the encryption and decryption key that uses master key to encrypt, the metamessage value of user file attribute, adopts database to realize.Provide interface to accept user's request, carry out key recovery.

Described user management module 12 realizes the management of user account number and access control, comprises registered user, safeguards super administrator and domestic consumer etc.

The present embodiment adopts ciphertext cloud storage system structure as shown in Figure 1, comprises that client, high in the clouds storage server, client connect by network and cloud server.

In client, comprise (transparent) encryption and decryption module 1, key management module 2, index module 3, enquiry module 4, synchronization module 5 and administration module 6;

(transparent) encryption and decryption module 1 and index module 3 are used for respectively carrying out encryption and decryption operation and ciphertext index generates;

Key management module 2 has been used for and the master key of personal identification binding and the encryption and decryption key two-stage key management of binding with file;

Enquiry module 4, in order to realize the retrieval of bright ciphertext, generates participle and the uni-directional hash of respective queries statement for searching ciphertext, and mutual with high in the clouds.

Synchronization module 5 is connected ciphertext and the index for calling and accepting to generate with index module 3 with transparent encryption and decryption module 1, complete the synchronous function of ciphertext and index;

Administration module 6 with transparent encryption and decryption module 1, key management module 2 is connected to user that operation-interface is provided, and to set ciphertext security strategy, to comprise, obtains described parameters for authentication and enciphering and deciphering algorithm;

In this concrete embodiment, client is the Android mobile phone that the application of above-mentioned module is installed.

Cloud Server end comprises synchronization module 7, index module 8, enquiry module 9, toconnection module 10, key management module 11, user management module 12;

High in the clouds synchronization module 7 is connected with client synchronization module 5, realizes ciphertext synchronous, ciphertext index synchronizing function;

High in the clouds index module 8 is in order to create expressly index;

High in the clouds enquiry module 9 is connected with the enquiry module 4 of client, in order to support the bright cryptogram search of index and the cryptogram search of support sequential scanning, finally returns to Query Result.

Toconnection module 10 in order to realize and the docking of other cloud platforms, extension storage ability.

High in the clouds key management module 11 is connected with the key management module 2 of client, and for storage backup user's master key individual event hashed value, the encryption and decryption key that uses master key to encrypt, the metamessage value of user file attribute, adopts database to realize.Provide interface to receive user's request, carry out key recovery.

User management module 12 realizes the management of user account number and access control, comprises registered user, safeguards super administrator and domestic consumer etc.

In this concrete embodiment, cloud server is the Linux cloud service platform for Hadoop of building that above-mentioned module is installed.

In ciphertext cloud storage means of the present invention and system, key management module, encryption and decryption module, synchronization module, to connection module, enquiry module, be its important core that realizes.

Step c of the present invention) the key production process in described key management mechanism, comprises that master key produces, encryption and decryption key produces and key obtains.By following method, realize:

1) described key generation module needs as service random start, and during operation, master key reads from internal memory, and the encryption and decryption key of storage reads from memory cache or database;

2) when user uses for the first time, the corresponding parameters for authentication that this module provides according to user, generates described master key, calls cipher key backup module and back up after generation.Described parameters for authentication includes but are not limited to the biological characteristics such as username-password or user fingerprints, sound;

3) when transparent encryption and decryption module request encryption and decryption key, according to file encryption attribute metadata information and user encryption scheme, search the encryption and decryption key of storage, and use master key to decipher the encryption and decryption key of described storage, offer encryption and decryption module; If do not find the encryption and decryption key of described storage, generate the enough random safe and reliable encryption and decryption key of length, offer encryption and decryption module, and use described cipher key backup module to back up

Step c of the present invention) described key management mechanism is as follows,

Verification process: read the individual event hashed value of regular length of the master key of described storage from stored data base, the individual event hashed value value that the described parameters for authentication providing with user utilizes identical algorithms to generate the regular length of key is compared.If identical, by authentication; Otherwise, eject warning, and log off.

Key updating process: when user sends update request, and by after described authentication, utilize new parameters for authentication, key generation module generates new master key described in re invocation, and backs up by described cipher key backup module.

Cipher key backup process: by the individual event hashed value of the regular length of master key, and the encryption and decryption cipher key backup after master key is encrypted is to database and cloud server; Encryption and decryption key and File Mapping relation table after encrypting are also backuped to high in the clouds simultaneously.

Key recovery process: according to the user name and password, by encryption and decryption key and encryption key and the recovery of File Mapping relation table from high in the clouds to client after the individual event hashed value of the regular length of this user's master key, encryption.

Cipher key destruction process: according to user request, by master key and encryption and decryption key simultaneously in the destruction of wiping in database and high in the clouds.

As shown in Figure 2, in the key management of ciphertext cloud storage means of the present invention, realized and the master key of personal identification binding and the encryption and decryption key two-stage key management method of binding with file.Mainly be divided into six major parts, every part is that one or several independent submodule forms, and completes a relatively independent function.As shown in Figure 3, the relation of collaborative work between key management module different piece in this concrete embodiment:

Key generation module: comprise that master key produces, encryption key produces, and key obtains.Mainly complete generation and the encryption and decryption of master key to encryption key of master key, encryption key.

1. user's registered user name and password when using this application for the first time, generates master key KEY by this module according to corresponding parameters for authentication (password+user name, the biological characteristics such as fingerprint)_master.(after producing, calling cipher key backup module preserves)

2. as encryption and decryption module encryption key request KEY_encryptiontime, according to file encryption attribute and user encryption scheme, search respective encrypted key K EY_encryptionand use master key KEY_masterdeciphering offers encryption and decryption module, generates respective encrypted key K EY as do not found_encryption, offer encryption and decryption module and use master key KEY_masterencrypt f_encrypt(KEY_encryption, KEY_master) (calling cipher key backup module backs up).As the main thread of this module, random start in addition, run duration master key reads from internal memory, and encryption key can read from memory cache, or reading database.

Key updating module: mainly completing is to complete the renewal operation of key according to the order of subscriber administration interface.When user sends more newer command, need to input old parameters for authentication, as password or biological characteristic, and new parameters for authentication, invokes authentication module, when old parameters for authentication authentication is passed through, just deciphers all encryption and decryption keys with old master key, and use new parameters for authentication to generate new master key, and encryption and decryption secret key encryption is stored.(calling the double copies that cipher key backup module is carried out client and high in the clouds).

Key authentication module: mainly complete the authentication to user identity.The master key HASH value generating according to user's parameters for authentication stores in the DB in client, and in the time need to verifying, calculates the parameters for authentication generation master key HASH value of user's input and the HASH value comparison in DB.

Cipher key backup module: mainly complete the value by master key HASH, cryptographic key backup is to DB and high in the clouds; And other database files (such as the mapping table of encryption key and file, subscriber's meter etc.) relevant with encryption key are also backuped to high in the clouds.

1. when master key produces, at once backup to DB and the DB table of revising is backuped to high in the clouds;

2. same, after encryption key produces, the ciphertext of encryption key is done to same backup, the encryption key associated with encryption key and the correspondence table of encrypted file are also backuped to high in the clouds simultaneously.

Key recovery module: mainly complete according to user name and user cipher this user's master key HASH value, encryption key and the DB relevant with the encryption key recovery from high in the clouds to client.When user moves to a new cell-phone customer terminal or when mobile phone terminal key loses, can recover from high in the clouds these data, for user, authenticate and encryption and decryption data.

Cipher key destruction module: mainly complete master key and encryption key ciphertext in the destruction in DB and high in the clouds.When user's special requirement, user's key all can be destroyed.

As shown in Figure 4, the concrete embodiment that obtains cipher key processes of key management module is as follows:

Step 1. judges whether encryption and decryption key storage database exists.

If step 2. exists, point out user to input master key KEY_master, use KEY_masterthe encryption and decryption key of storing in deciphers database, and return.

If step 3. does not exist, call key generation module, generate encryption and decryption key, be stored in memory buffer.

The master key KEY of step 4. user input_masterencrypt encryption and decryption key, be stored in database.And call cipher key backup module, database is uploaded in the database of high in the clouds.

As shown in Figure 5, the encryption and decryption module in ciphertext cloud storage method of the present invention is used for carrying out the encryption and decryption operation concrete to file.Mainly be divided into six parts, every part is that one or several independent submodule forms, and completes a relatively independent function.

User application expansion module, the operation in order to supervisory user application program to data, comprises the application programs such as address list, calendar, contact person, photograph album, document, the unfolding mode of control documents;

Abstract encryption and decryption module, in order to connect other assemblies, provides general encryption and decryption interface, and this interface can be realized as openssl etc. by the algorithms library of increasing income, and also can oneself realize enciphering and deciphering algorithm;

Data encapsulation module, in order to shield the impact of different types of data on enciphering and deciphering algorithm, realizes the unified encapsulation to address list, note, file, improves versatility;

Encryption and decryption configuration module, in order to select enciphering and deciphering algorithm as 3DES, AES, Blowfish etc. with user interactions at administration interface, is kept in configuration file.

As shown in Figure 6, in this concrete embodiment, the concrete encryption flow of encryption and decryption module is as follows:

Step 1. obtains needing plaintext and the relevant information of encryption by user application expansion module.

Step 2. is imported plaintext into data encapsulation module by abstract encryption and decryption module.

The cleartext information of the different-format that step 3. pair is imported into, carries out piecemeal and encapsulation, obtains consolidation form.

The enciphering and deciphering algorithm that step 4. is preserved to encryption and decryption configuration module requesting query user by abstract encryption and decryption module.

The configuration file of step 5. encryption and decryption configuration module access cache, as sharedpreference under Android etc., returns to abstract encryption and decryption module by the enciphering and deciphering algorithm inquiring.

Step 6. by abstract encryption and decryption module to key management module acquisition request encryption and decryption key.

The encryption and decryption key of depositing in step 7. key management module access memory buffer memory, is used master key deciphering to return to abstract encryption and decryption module.

Step 8. is called the specific implementation interface of abstract encryption and decryption, and plaintext, algorithm types, encryption and decryption key are imported into as parameter.

The realization of the concrete encryption and decryption of step 9. can be the algorithms library of increasing income, as openssl etc., or user-defined function, to the plain text encryption of piecemeal and return.

The abstract encryption and decryption module ofstep 10. is returned to the ciphertext after encryption to upper strata.

As shown in Figure 7, in this concrete embodiment, the concrete deciphering flow process of encryption and decryption module is as follows:

Step 1. obtains needing the ciphertext of deciphering by user application expansion module, and ciphertext is carried out to piecemeal.

The enciphering and deciphering algorithm that step 2. is preserved to encryption and decryption configuration module requesting query user by abstract encryption and decryption module.

The configuration file of step 3. encryption and decryption configuration module access cache, as sharedpreference under Android etc., returns to abstract encryption and decryption module by the enciphering and deciphering algorithm inquiring.

Step 4. by abstract encryption and decryption module to key management module acquisition request encryption and decryption key.

The encryption and decryption key of depositing in step 5. key management module access memory buffer memory, is used master key deciphering to return to abstract encryption and decryption module.

Step 6. is called the specific implementation interface of abstract encryption and decryption, and ciphertext, algorithm types, encryption and decryption key are imported into as parameter.

The realization of the concrete encryption and decryption of step 7. can be the algorithms library of increasing income, as openssl etc., or user-defined function, to the decrypt ciphertext of piecemeal and return.

Step 8. is imported the plaintext of the encapsulation of deciphering into data encapsulation module by abstract encryption and decryption module.

The plaintext of step 9. data encapsulation module to the encapsulation of deciphering, transfers former clear data to and returns to abstract encryption and decryption module

The abstract encryption and decryption module ofstep 10. is returned to the plaintext after deciphering to upper strata.

Synchronization module in ciphertext cloud storage means embodiment of the present invention, completes terminal data and carries out bi-directional synchronization to cloud server, comprises the upload and download of data, and the renewal of data and deletion.Wherein data type comprises: file, sqlite database, SharedPreferences etc.

Step b of the present invention) described plaintext synchronization mechanism, comprises uploading, download or deleting of file, by following method, is realized the synchronous of user data and is upgraded:

1) in client terminal start-up, startup file monitor service;

2) from database, obtain file monitor list, shine upon and call file monitor device;

3) described file monitor device obtains simultaneous operation, checks that whether client terminal local file exists, if file does not exist, drives downloader module download file attribute metadata and clear text file;

4) if described local file exists, whether the metadata information that detects local attribute is identical with server, comprises the file hash value of file modification time and regular length, and the file synchronization time.Described file individual event hashed value comprises HASH value, SHA-1 value etc.;

5) if described cloud storage server file modification drives downloader module, Cloud Server file is pulled to this locality;

6) if described client terminal local file modification, local file is newer than server file, this situation comprises for the first time to be uploaded, service end does not have the situation of metadata, drives uploader module, by the storage that uploads onto the server of client terminal local file;

7) if described cloud storage server file and client file are modified simultaneously, drive conflict processing module, comprise resolution policies such as cancelling operation, rewritable paper, additional reservation.

Step b) described ciphertext synchronization mechanism, to compare calling of lower floor identical with described plaintext synchronization mechanism, and increasing following method, to solve ciphertext synchronous:

1) for uploading, after obtaining described simultaneous operation, first carry out the synchronous ciphertext preprocessing process of described file, this pretreatment module is obtained user's operation file, calls successively index module, generating ciphertext index; Transparent encryption and decryption module, generating ciphertext file;

2) by described cryptograph files and ciphertext index according to the step of expressly uploading, give lower layer components and carry out upload procedure;

3) for download also synchronize with described plaintext upgrade similar, because ciphertext document can not be realized incremental update, thus in conflict processing module, determine whether ciphertext, if ciphertext is only cancelled and being operated or rewritable paper according to user's judgement.

As shown in Figure 8, as follows in the concrete embodiment step of the client Synchronous Pre processing procedure of synchronization module of the present invention:

Step 1. is load document monitor service file_observation when client terminal start-up, and this service lifecycle is systems life cycle.

Step 2. is file reading list file_list from database file_list.db.This list comprises that the metadata attributes defining in a series of the present invention of file is as follows:

field name	type	field description
			_ id	integer	the id of file
filename	text	filename
			path	text	the path of file on server
parent	integer	the id of file father file
			created	integer	the document creation time
modified	integer	modification time
			content_type	text	file type
content_length	integer	file size
			media_path	text	the local store path of file
file_owner	text	account name
			last_sync_date	text	the up-to-date time that attribute is synchronous
keep_in_sync	integer	whether need synchronous.
			last_sync_date_for_data	text	the up-to-date time that data are synchronous
modified_at_last_sync_for_data	text	the up-to-date time of data change
			hash_value	text	file cryptographic Hash
encrypted	integer	whether file is encrypted

File monitor list file_list in step 3. initialization files monitor service.By file monitor device, be responsible for scheduled maintenance.Listed files is the list of the metadata attributes of the synchronous file wanted deposited in database, and file monitor list is in internal memory, according to the listed files of getting from database read, to generate the listed files of safeguarding by monitor service.

Step 4. file monitor device obtains file monitor list, according to filename field and path field, produces the mapping one by one of file and list, and the file in watch-list is associated with local file.

Step 5. is for automatic synchronization, and file monitor device is monitored the state of local file, if file status comprises the up-to-date time that attribute is synchronous, the file modification time, file cryptographic Hash etc. changes, and triggers the event of file synchronization.For the simultaneous operation of manually setting out, directly trigger the event of file synchronization.

Step 6. event processing mechanism obtains file directory path, and the listed files under this path.Carry out concrete simultaneous operation process.

As shown in Figure 9, the concrete embodiment step of the client simultaneous operation process of the synchronization module proposing in the present invention is as follows: in this concrete embodiment, suppose, manually select synchronous documents test.txt.

Step 1. checks whether local file test.txt exists, if do not exist, to cloud server, sends download command.

If step 2. local file test.txt exists, the database server_filelist.db of cloud server storing documents metadata is downloaded to this locality.

Step 3. judges whether local file test.txt changes, and whether is greater than last_sync_date_for_data lock in time of file content according to the modification time modified of file in local file metadata.

Step 4. further judges whether the test.txt of server changes, and according to the modification time modified of file in server metadata, whether is greater than file content modification last_sync_date_for_data lock in time in local metadata.

If the modified<last_sync_date_for_data of step 5. local file test.txt metadata and the modified<last_sync_date_for_data of server test.txt metadata, represent that local and server file test.txt does not have to change, and does not need synchronous renewal.

If the modified<last_sync_date_for_data of step 6. local file test.txt metadata and the modified>last_sync_date_for_data of server test.txt metadata, represent that server test.txt file changes, to cloud server, send download command get request, by the get process specific implementation of webdav agreement.

If the modified>last_sync_date_for_data of step 7. local file test.txt metadata and the modified>last_sync_date_for_data of server test.txt metadata, expression this locality and server file are all changed, and processing conflicts.Prompting user selects: 1. cancel synchronously, 2. adopt server file to cover local file, 3. both rename retains.

If the modified>last_sync_date_for_data of step 8. local file test.txt metadata and the modified<last_sync_date_for_data of server test.txt metadata, represent that local file changes, need upload to cloud server, to cloud server, send upload command put request, by the put process specific implementation of webdav agreement.

As shown in figure 10, as follows in the concrete embodiment step of the cloud server simultaneous operation process of synchronization module of the present invention: suppose that the final operation that user selects is that local file is uploaded to cloud server operation, down operation and this flow process are similar.

1. receive client synchronization request;

2. judge whether it is put request, if open file, create synchronization object, and synchronous documents is read in; Otherwise carry out other file operation, as deleted file request, transaction file request;

3. the MD5 value of authenticating documents, being verified is file allocation memory location, is defaulted as under active user's master catalogue;

4. call file store method, file fragmentation is write to storage system.

As shown in figure 11, in the concrete embodiment of ciphertext cloud storage means of the present invention, connection module is used for realizing all functions of isomery cloud platform to connected components, realize with other cloud storage platform as with Amazon S3, Dropbox, HDFS dynamically seamlessly to connection function, thereby can realize the extensibility storage of cloud data.Isomery cloud platform docking whole software structure is mainly divided into two parts, first carry is controlled functional module, it two is data operation modules, wherein carry is controlled increases mount point submodule being mainly divided into of functional module, delete mount point submodule, obtain mount point information submodule, and data operation modules is mainly divided into general operation interface sub-module and exterior storage Interface realization submodule.

Increase mount point submodule: user increases outside cloud storage mount point, and mount point information is write in corresponding configuration file.When carrying out outside cloud storage carry, user need to provide corresponding parameter to middleware, as: the information such as the exterior storage type of mount point, institute's carry, user name.Increase after mount point success, user just can operate corresponding exterior storage cloud as the cloud platform of operation oneself.

Delete mount point submodule: delete the outside cloud storage mount point of carry, and upgrade corresponding configuration file.User need to provide the parameter informations such as mount point, user name.Deleted after this mount point, user just can not be stored into row data interaction by privately owned cloud and outside cloud.

Obtain mount point information submodule: obtain the current all mount point information of user.The mount point information that need to know active user when software program initializes or when refreshing, has obtained the file that is placed on exterior storage to be shown to user after these mount point information.

General operation interface sub-module: the general access interface that docks and carry out data interaction with all exterior storage cloud platforms is provided.

Exterior storage Interface realization submodule: this module comprises Amazon S3, Dropbox, the specific implementation of HDFS exterior storage type to general operation interface.When user uses general-purpose interface, will indirectly call the Interface realization of respective external storage class, thereby reach the function that outside is stored into line operate.

Step e of the present invention) described isomery cloud platform docking middleware, by following method, realize:

1) user provides the carry information of service provider to write in configuration file the described outside third party cloud of needs, and described carry information comprises user name, storage class etc.;

2) when user initiates carry request, described docking middleware obtains profile information, constructs corresponding abstract operation interface;

3) described in this, abstract operation interface module provides general data access interface ，Dui lower floor mutual for each cloud service business to upper strata, realizes abstract operation corresponding to different storage classes.Described cloud service business storage class includes but not limited to: Amazon S3, Dropbox, HDFS etc., described abstract operation comprises the directory operation interfaces such as file operation interface, mkdir such as fopen, and can expand dynamically according to demand.

As shown in figure 12, in the concrete embodiment of ciphertext cloud storage means of the present invention, isomery cloud platform Middleware implementation process is as follows:

The request that step 1. user produces to be increased mount point, delete mount point or obtain mount point information.

Whether step 2. generates corresponding basic parameter according to user's respective request, and be that personal user creates corresponding mount point according to user's type.

Step 3. reads mount point information in array $ mountPoints from configuration file mount.json, jumps to corresponding submodule realize according to corresponding request.

Step 4. judges the carry entry that whether has had current group or user in mount point information array mountPoints.

Step 5. writes new mount point information in $ mountPoints array.

Step 6. judges user or the group data that whether have current application in carry entry, if exist, new mount point added to after this user or group, otherwise with regard to newly-built this user.

Step 7. writes all mount point information $ mountPoints arrays of upgrading in configuration file mount.json.

Whether the exterior storage class that step 8. judgement is asked there is or supports operation.

Step 9. creates the processing of mount point failure.

Step 10. creates the example of this storage class, achieves a butt joint with exterior storage.

Step 11. is deleted the mount point information that will delete from $ mountPoints array.

Step 12. Reconfigurations file mount.json.

Step 13. judgement user is with GROUP form carry or with USER form carry.

Step 14. is carried out standardization processing by the information of acquisition, unified display format, as exterior storage is converted into OC Files||Storage class name.

Step 15. is returned to acquisition mount point information.

Index module in ciphertext cloud storage means embodiment of the present invention, sets up the search index of synchronous documents to the demand of document retrieval according to user.In this embodiment, index, based on keyword, is divided into expressly index submodule and ciphertext index submodule.

As shown in figure 13, ciphertext index submodule in ciphertext cloud storage means embodiment of the present invention, because synchronous data are stored in the mode of ciphertext, index building in index beyond the clouds, the index part of ciphertext index submodule creates in client, and the type that can set up the text of index comprises the unstructured datas such as txt, pdf, word.Keyword in index is encrypted and the entity in index is encrypted and adopted two kinds of different cryptographic algorithm, keyword to adopt SHA-1 hash algorithm to carry out uni-directional hash encryption.Then the index of encryption is synchronized to high in the clouds, by synchronization module, is stored under the catalogue of appointment.This module is the nucleus module of client, and it carries out the encryption of index by the external interface that calls encryption and decryption module and key management module, also invoke synchronous module is realized to uploading of ciphertext index file.The concrete embodiment of process that ciphertext index creates is as follows:

Step 1. pair clear text file is carried out preliminary treatment, comprises and removes redundant field, stop words, punctuation mark etc.

Step 2. adopts AKanalyzer Words partition system to carry out word segmentation processing, obtains keyword.

Step 3. is marked to each keyword, adopts IF*IDF algorithm.

Step 4. index writes disk Qian， indexed cache district and calls the keyword fragment in encryption and decryption module SHA-1 algorithm for encryption index.

Step 5. is generating ciphertext index tree in internal memory, creates index.This index index metadata structure is as follows:

Field name	Type	Describe
			Index_ID	int	Index number, automatic increase
Index_name	Char	The name of index
			Index_path	Text	The path that index is deposited
Index_UserID	Bigint	The user ID being associated with index
			Index_length	Bigint	The size of index
Index_time	Datatime	The index creation time
			Index_time	Datatime	The index modification time

Step 6. writes magnetic disc store by the index after encrypting.

Step 7. invoke synchronous module, is synchronized to cloud server by ciphertext index.

As shown in figure 14, plaintext index submodule in ciphertext cloud storage means embodiment of the present invention, because synchronous data are stored in mode expressly, so expressly index creates at server end, this module obtains the data of synchronization module transmission by common interface, data are carried out to preliminary treatment, and index creation is realized by lucene, without it is expanded, then export index stores to assigned catalogue.Because the basis in high in the clouds is hadoop, the MapReduce framework of hadoop can be realized high concurrent parallel computation, so adopt MapRedcue framework when carrying out high in the clouds index module design.The concrete embodiment of process of the plaintext index creation proposing is in the present invention as follows:

After step 1. file synchronization task completes, notice cloud server plaintext index module creates expressly index.

Step 2. is imported expressly text into, and the JobTracker of Hadoop, with the physical location of each the file century storage Key that does, is cut apart file data.

Step 3. is distributed to each TaskTracker by the text data after cutting apart, and each TaskTracker starts 2 Map index process tasks, and monitors Map executing state, generates independent inverted index.

Step 4.Reduce is merged into as a whole by independent inverted index.

Step 5. is kept at plaintext index under the corresponding catalogue of cloud server.The structural information of this plaintext index metadata is as follows:

Field name	Type	Describe
			Index_ID	int	Index number, automatic increase
Index_name	Char	The title of index
			Index_path	Text	Path deposited in index
Index_UserID	int	The user ID being associated with this index
			Index_length	int	The size of index
Index_time	Datatime	The time of index creation
			Index_modify	Datatime	The time of index modification

Enquiry module in ciphertext cloud storage means embodiment of the present invention, plaintext or the cryptograph files index according to index module, set up, carry out the inquiry of bright ciphertext keyword, is divided into client query submodule and high in the clouds inquiry submodule, high in the clouds query processing module.

As shown in figure 15, the concrete embodiment of the process of client query submodule is as follows:

Step 1. is inputted the keyword that will search in client query interface, then selects cryptogram search, expressly inquiry or comprehensive inquiry.

Step 2. is selected according to user, if be chosen as cryptogram search or comprehensive inquiry, key word of the inquiry be encrypted to the SHA-1 algorithm that calls encryption and decryption module keyword is asked to Hash.

Step 3. is according to the cryptographic Hash of keyword, the query statement of generating ciphertext.

Step 4., according to plaintext keyword, generates query statement expressly.

Step 5. client sends the inquiry request of set form to cloud server by http agreement.Form shape is as http: // 192.168.111.83:8080/index.jsp plain=test & encrypt=aJaaaaaaLasaaaaaaaa, and plain represents expressly keyword, encrypt represents ciphertext keyword.

Step 6. cloud server calls high in the clouds query processing module, carries out query processing, obtains listed files.

Step 7. cloud server returns to client by the listed files inquiring, and client shows at Query Result interface.

The similar client query submodule of process of high in the clouds inquiry submodule, the flow process that is about to client query submodule is transplanted to page end, makes user can carry out bright cryptogram search operation can be by web page access high in the clouds data time.

As shown in figure 16, high in the clouds query processing module major function is that server support is carried out bright cryptogram search to generating indexes beyond the clouds, by upper layer module, is called, and unified interface is provided.Use MapReduce structure, at all Slave nodes, all dispose enquiry module.In query script, by Master node, segmentation is carried out in inverted index storehouse, each Slave node is only retrieved a segment index, obtains part matching result collection, after Master gathers sequence, by Web server, to user, presents final Query Result.The concrete embodiment of high in the clouds query processing process is as follows:

Step 1. cloud server receives the inquiry request that client is sent.

Character string parsing generated query request Query in step 2. pair inquiry request, divides expressly inquiry or cryptogram search according to plain or encrypt field, calls respectively corresponding processing module.

Step 3. is set according to plaintext inquiry request generated query, and to each server, looks into (Slave node) and send, each querying server retrieval inverted index, and only complete partial query result, all Query Results draw expressly Query Result after gathering.

Step 4. is set according to cryptogram search request generated query, and to each server, looks into (Slave node) and send, each querying server retrieval inverted index, and only complete partial query result, all Query Results draw cryptogram search result after gathering.

Step 5. merges bright ciphertext result.

Step 6. returns to the listed files of inquiry gained to upper layer application.High in the clouds metadata information is deposited in this document list, and the metadata information that is stored in high in the clouds data by searching can accurately navigate to the file that will search, and the list of file relative address is fed back to client.The major key of this table is path, and its structure is as follows:

Field name	Type	Field description
			fileid	Int	File ID, automatic increase
storage	Int	Storage system type
			path	String	Memory location
path?hash	Text	The cryptographic Hash of store path
			parent	Int	The file at place
name	Char	Filename
			mimetype	Int	File type
mimepart	Int	?
			size	Int	File size
mtime	Text	Last modification time
			encrypted	Bool	Whether encrypt
etag	Text	Version flag

In the present invention, mainly realize the ciphertext cloud storage means to user data, the encrypt data of client encrypt uploads to Cloud Server end.

As shown in figure 17, the basic step of the concrete embodiment of ciphertext cloud storage means of the present invention is:

Step 1. is first when client terminal start-up, and user inputs master key, by key authentication, enters system; If start and enter administration configuration interface first, user, according to enciphering and deciphering algorithm list, selects the algorithm for encryption and decryption, as AES_192_ofb, user is selected to be kept in configuration file, then enters system.

Step 2. user selects the file test.txt that need to upload, and appointment is that ciphertext is uploaded storage.

The file test.txt that step 3. file monitor device is selected user adds file monitor list, after this client this document is being revised through user, delete and wait after operation, file change arrives cloud server by automatic synchronization, or this test.txt file on cloud server is modified, delete, also will be synchronized to client.

Step 4. is called the content creating ciphertext index of index module to the file test.txt of user's selection, and the ciphertext index of generation is stored in the application program sandbox of client.

Step 5. obtains the association attributes metadata of the file test.txt of user's selection, and database list item is stored in local data base.

The file test.txt that step 6. couple user selects calls encryption and decryption module and key management module, at key, produce submodule, user inputs master key deciphering encryption and decryption key or produces random encryption and decryption key, then adopt cryptographic algorithm AES_192_ofb, symmetric block cipher test.txt, obtains ciphertext test.txt and stores under corresponding catalogue.

Step 7. invoke synchronous module, by synchronization policy and the synchronous protocol of its specific implementation, clear text file attribute metadata list item and ciphertext index by the ciphertext test.txt, the test.txt that produce, be synchronized to cloud server, after synchronous success, delete local ciphertext index.

Step 8. cloud server receives the file attribute metadata of test.txt server end file metadata is upgraded, and obtains new listed files.

Step 9. cloud server is to the cryptograph files test.txt burst storage receiving.

The index module ofstep 10. cloud server receives the ciphertext index of uploading, and ciphertext index is stored under corresponding catalogue.

In the present invention, also realize the search method to the ciphertext cloud storage of user data, the encrypt data that client uploads to cloud server to encryption is retrieved.

The unified interface that of the present invention a) described transparent encryption and decryption is provided by abstract encryption device assembly realizes, described abstract encryption device assembly reads user device configuration, obtain enciphering and deciphering algorithm, and obtain encryption and decryption key by key management module, drive encryption device unit to implement encryption and decryption operation.Described encryption device unit, by abstract encryption device assembly management, can be to use hardware encipher equipment or software cryptography equipment to realize, dynamic extending cryptographic algorithm.By following method, realize encryption and decryption process possessory transparent to data:

1) when user uses first, the file of selecting required encryption to upload, now file is uploaded preliminary treatment by Synchronization Component.

2) by abstract encryption device assembly, obtain key and algorithm, selected file is encrypted, is uploaded and preserves file attribute information to database.The former clear text file of described selected file is deleted after uploading successfully.

3) user to ciphertext request read or during retouching operation, call abstract encryption device assembly and be decrypted operation, generate expressly temporary file, and preserve expressly temporary file attribute information metadata to temporary file table.And give upper level applications by plaintext temporary file.

4) user uses application program to be all directed to expressly temporary file to the operation of file.When carrying out next file operation or synchronous refresh, carrying out temporary file attribute contrasts with the original attribute metadata of storing.

5) if file is not modified, delete temporary file, file does not carry out synchronously.If file, through revising, calls encryption device unit described interim clear text file is encrypted to operation, and synchronous.Successfully delete afterwards described interim clear text file uploading.

As shown in figure 18, the basic step of the concrete embodiment of search method of ciphertext cloud storage of the present invention is:

Step 1. user provide master key, by authentication, enters system.

Step 2. user enters query interface input inquiry statement Information Security, selects bright cryptogram search.

Step 3. is called client query submodule, carries out morphological analysis and generates expressly keyword, to each keyword, adopts SHA-1 algorithm to generate the expressly corresponding Hash of keyword, constructs corresponding inquiry request.

Step 4. high in the clouds query processing module receives inquiry request, carry out inquiry request parsing, and call distributed bright ciphertext index inquiry, merge the list of spanned file Query Result, and the cryptograph files test.txt list that this is comprised to keyword is back to client.

The listed files that step 5. client cloud server returns, and the listed files that comprises cryptograph files test.txt in Query Result interface display.

Step 6. user selects to download to the cryptograph files test.txt of client terminal local, the synchronous processing procedure of client carries out sending request to cloud server, and the attribute metadata of cryptograph files test.txt is synchronized to client, carry out collision detection and processing, if desired download this cryptograph files and to service end, send get request.

The synchronization module of step 7. cloud server receives the synchronization request that client is sent, and the cryptograph files test.txt of storage is downloaded to client by network.

Step 8. is when user opens downloaded cryptograph files test.txt by client, request user rs authentication master key, by rear, call key management module and obtain encryption and decryption key, and obtain enciphering and deciphering algorithm AES_192_ofb, the abstract encryption and decryption submodule that calls encryption and decryption module is decrypted cryptograph files test.txt, obtains being stored in clear text file test.txt interim in application program sandbox.

Step 9. client file operation process, client is carried out operational processes to temporary file test.txt expressly, comprises and opens modification etc.

In the present invention, also realize the bright cryptograph files method of operation to the ciphertext cloud storage of user data, be that client is opened the bright ciphertext of storage, revise, the operating process of rename, as shown in figure 19, the basic step of the concrete embodiment of the File Open retouching operation of ciphertext cloud storage of the present invention is as follows:

Step 1. user selects the file that need to open, and this document can be also clear text file for cryptograph files.

Step 2. is searched this document path from file metadata attribute database, judges the information that whether has this document in database.

If there is this document information in step 3. part metadata attributes database, open temporary file information table temp_list from file metadata database, search the meta-attribute information that whether has this document, thereby judge whether this document has been temporary file.

If step 4. file is temporary file, the temporary folder from application program sandbox private room obtains temporary file and directly gives upper level applications as Kingsoft WPS etc., and operations such as opening, edit, close, generates new interim clear text file.

If step 5. file is not temporary file, what expression was opened is another file.By the file modification time modified storing in the contrast modification time modified of temporary file and file metadata attribute database, contrast, judge whether temporary file is the latest document being modified.

Step 6. request user rs authentication master key, by rear, call key management module and obtain encryption and decryption key, and obtain enciphering and deciphering algorithm AES_192_ofb, the abstract encryption and decryption submodule that calls encryption and decryption module is encrypted the temporary file under temporary folder, according to the file path of storing in temporary file information table temp_list in file metadata database, be stored under the corresponding catalogue of client.

The meta-data attribute information that step 7. is obtained the temporary file under temporary folder is updated in file metadata attribute database.

Step 8. is wiped the temporary file under temporary folder.

Step 9. is new file due to what open, opens the database of this document metadata attributes, according to field encryption, judges whether file is ciphertext.

Step 10. is obtained the clear text file of pass, and directly gives upper level applications as Kingsoft WPS etc., and operations such as opening, edit, close, generates new clear text file, and transaction file metadata.

If the file that step 11. is newly opened is ciphertext, ask user rs authentication master key, by rear, call key management module and obtain encryption and decryption key, and obtain enciphering and deciphering algorithm AES_192_ofb, the abstract encryption and decryption submodule that calls encryption and decryption module is decrypted this document, and the temporary file after deciphering leaves under the temporary folder of application program sandbox private room.

Step 12. is obtained the metadata attributes of interim clear text file, is updated in database.

By method and system disclosed by the invention, perfect solution defect and the risk of the prior art scheme mentioned in background technology, make the lost terminal can obliterated data, cloud service provider can not malice the data of spying upon user, cloud service provider is captured only loses file cipher text, and can dock a plurality of cloud service provider.

Claims (11)

Translated fromChinese

1.一种密文云存储方法，在客户端和云端建立同步连接，其步骤为：1. A method for ciphertext cloud storage, establishing a synchronous connection between the client and the cloud, the steps of which are:1）用户在客户端存放的数据中选择采用密文和/或明文进行数据同步，并对所述密文选择加密算法；1) The user chooses to use ciphertext and/or plaintext for data synchronization in the data stored on the client, and selects an encryption algorithm for the ciphertext;2）使用基于用户身份提供的认证参数生成主密钥，并根据所述主密钥获取密文预置加解密密钥或生成对应的密文加解密密钥，在所述客户端采用主密钥+加解密密钥的两级密钥对密文同步的数据进行加密并建立密文索引并对该主密钥进行备份；2) Use the authentication parameters provided based on the user identity to generate a master key, and obtain the ciphertext preset encryption and decryption key or generate the corresponding ciphertext encryption and decryption key according to the master key, and use the master key on the client The two-level key of key + encryption and decryption key encrypts the ciphertext synchronization data and establishes a ciphertext index and backs up the master key;3）在所述客户端和云端同步所述密文及密文索引并删除在客户端上的密文索引和密文同步的数据；或在所述云端和客户端同步所述明文同步数据后在所述云端建立明文索引；并实现加解密过程对用户的透明：3) Synchronize the ciphertext and ciphertext index between the client and the cloud and delete the ciphertext index and ciphertext synchronization data on the client; or after synchronizing the plaintext synchronization data between the cloud and the client Establish a plaintext index on the cloud; and realize the transparency of the encryption and decryption process to the user:4）将所述明文和/或密文存储在本地私有云存储服务器或者根据用户请求的挂载点，存储在云存储提供商的存储服务器。4) Store the plaintext and/or ciphertext in the local private cloud storage server or in the storage server of the cloud storage provider according to the mount point requested by the user.2.如权利要求1所述的密文云存储方法，其特征在于，同步所述明文的方法包括数据的上传、下载或删除，通过下述方法实现对用户明文同步数据的同步和更新：2. The ciphertext cloud storage method as claimed in claim 1, wherein the method for synchronizing the plaintext includes uploading, downloading or deleting of data, and the synchronization and updating of the user's plaintext synchronization data is realized by the following method:1）启动时加载数据监控服务,并根据本地数据库读取到的数据列表生成或维护数据监控列表；1) Load the data monitoring service at startup, and generate or maintain the data monitoring list according to the data list read from the local database;2）根据获取的数据监控列表，依照数据名字段和数据在服务器上的路径字段产生数据和列表的一一映射，将监控列表里的数据与本地数据关联；若是自动同步，则数据监控器监控本地数据的状态，若数据状态包括属性同步的最新时间，数据修改时间，数据哈希值发生改变，则触发数据同步的事件；若是手动出发同步操作，则直接触发数据同步的事件；2) According to the obtained data monitoring list, according to the data name field and the path field of the data on the server, a one-to-one mapping between the data and the list is generated, and the data in the monitoring list is associated with the local data; if it is automatically synchronized, the data monitor monitors The status of the local data. If the data status includes the latest time of attribute synchronization, data modification time, and data hash value changes, the event of data synchronization will be triggered; if the synchronization operation is started manually, the event of data synchronization will be directly triggered;3）所述数据监控器获取同步操作，检查客户端本地数据是否存在，若所述本地数据存在，检测本地属性的元数据信息是否与云存储服务器相同，所述本地属性的元数据信息包括数据修改时间和固定长度的数据散列值，以及数据同步时间；3) The data monitor obtains a synchronization operation, checks whether the client’s local data exists, and if the local data exists, detects whether the metadata information of the local attribute is the same as that of the cloud storage server, and the metadata information of the local attribute includes data Modification time and fixed-length data hash value, as well as data synchronization time;4）若数据不存在，则驱动进行下载数据属性元数据和明文同步数据；4) If the data does not exist, the driver will download the data attribute metadata and plaintext synchronization data;5）若所述云存储服务器数据修改，则经驱动进行下载，将云服务器数据拉取至本地，并更新本地数据属性元数据；5) If the cloud storage server data is modified, it will be downloaded via the driver, the cloud server data will be pulled to the local, and the local data attribute metadata will be updated;6）若所述客户端本地数据修改则包括：初次上传、服务端未有元数据的情况，经驱动进行上传，将客户端本地数据、数据属性元数据上传至云存储服务器；6) If the client’s local data is modified, it includes: uploading for the first time, and the server does not have metadata, uploading through the driver, and uploading the client’s local data and data attribute metadata to the cloud storage server;7）若所述云存储服务器数据和客户端数据同时被修改，则根据用户选择经驱动进行包括：取消操作、重写数据、附加保留的冲突解决。7) If the cloud storage server data and client data are modified at the same time, according to the user's choice, the driver will perform conflict resolution including: cancel operation, rewrite data, and add reservation.3.如权利要求1所述的密文云存储方法，其特征在于，同步所述密文的方法包括数据的上传、下载或删除，通过下述方法实现对用户密文同步数据的同步和更新：3. The ciphertext cloud storage method according to claim 1, wherein the method for synchronizing the ciphertext includes uploading, downloading or deleting data, and the synchronization and updating of user ciphertext synchronization data is realized by the following method :1）启动时加载数据监控服务,并根据本地数据库读取到的数据列表生成或维护数据监控列表；1) Load the data monitoring service at startup, and generate or maintain the data monitoring list according to the data list read from the local database;2）根据获取的数据监控列表，依照数据名字段和数据在服务器上的路径字段产生数据和列表的一一映射，将监控列表里的数据与本地数据关联；若是自动同步，则数据监控器监控本地数据的状态，若数据状态包括属性同步的最新时间，数据修改时间，数据哈希值发生改变，则触发数据同步的事件；若是手动出发同步操作，则直接触发数据同步的事件；2) According to the obtained data monitoring list, according to the data name field and the path field of the data on the server, a one-to-one mapping between the data and the list is generated, and the data in the monitoring list is associated with the local data; if it is automatically synchronized, the data monitor monitors The status of the local data. If the data status includes the latest time of attribute synchronization, data modification time, and data hash value changes, the event of data synchronization will be triggered; if the synchronization operation is started manually, the event of data synchronization will be directly triggered;3）所述数据监控器获取同步操作，检查客户端本地数据是否存在，若所述本地数据存在，检测本地属性的元数据信息是否与云存储服务器相同，所述本地属性的元数据信息包括数据修改时间和固定长度的数据散列值，以及数据同步时间；3) The data monitor obtains a synchronization operation, checks whether the client’s local data exists, and if the local data exists, detects whether the metadata information of the local attribute is the same as that of the cloud storage server, and the metadata information of the local attribute includes data Modification time and fixed-length data hash value, as well as data synchronization time;4）若数据不存在，则驱动进行下载数据属性元数据和明文同步数据；4) If the data does not exist, the driver will download the data attribute metadata and plaintext synchronization data;5）若所述云存储服务器数据修改，则经驱动进行下载，将云服务器数据拉取至本地，并更新本地数据属性元数据；5) If the cloud storage server data is modified, it will be downloaded via the driver, the cloud server data will be pulled to the local, and the local data attribute metadata will be updated;6）若所述客户端本地数据修改则包括：初次上传、服务端未有元数据的情况，经驱动进行上传，将客户端本地数据、数据属性元数据上传至云存储服务器；6) If the client’s local data is modified, it includes: uploading for the first time, and the server does not have metadata, uploading through the driver, and uploading the client’s local data and data attribute metadata to the cloud storage server;7）对于上传，需要依次生成密文索引，加密数据生成密文，然后经驱动将密文数据、密文索引、及密文元数据属性上传到云存储服务器；7) For uploading, it is necessary to generate ciphertext indexes in turn, encrypt data to generate ciphertext, and then upload the ciphertext data, ciphertext index, and ciphertext metadata attributes to the cloud storage server through the drive;8）对于下载，由于密文数据不能实现增量更新，故在冲突处理时判断是否为密文，若为密文，则根据用户判断之进行取消操作或重写文件。8) For downloading, since the ciphertext data cannot be updated incrementally, it is judged whether it is ciphertext when dealing with conflicts. If it is ciphertext, cancel the operation or rewrite the file according to the judgment of the user.4.如权利要求1或3所述的密文云存储方法，其特征在于，所述同步明密文数据类型包括：文件、sqlite数据库、SharedPreferences。4. The ciphertext cloud storage method according to claim 1 or 3, wherein the synchronous plaintext data types include: files, sqlite databases, and SharedPreferences.5.如权利要求1所述的密文云存储方法，其特征在于，所述两级密钥加密通过下述方法实现：5. The ciphertext cloud storage method according to claim 1, wherein said two-level key encryption is realized by the following method:1）运行时从内存读取主密钥同时从内存缓存或者数据库中读取存储的加解密密钥，1) Read the master key from the memory at runtime and read the stored encryption and decryption keys from the memory cache or database,2）在用户第一次使用客户端时，根据用户提供的相应认证参数，生成所述主密钥，同时对该主密钥进行备份；2) When the user uses the client for the first time, the master key is generated according to the corresponding authentication parameters provided by the user, and the master key is backed up at the same time;3）用户每次在进行密文云存储时，根据所述认证参数从存储数据库中读取所述存储的主密钥的固定长度的单项散列值，与用户所提供的所述认证参数利用相同算法生成密钥的固定长度的单项散列值进行比对；3) Each time the user performs ciphertext cloud storage, reads the fixed-length single-item hash value of the stored master key from the storage database according to the authentication parameters, and uses the authentication parameters provided by the user Compare the fixed-length single-item hash values of keys generated by the same algorithm;4）当查找所述加解密密钥时，依据数据加密属性元数据信息和用户加密方案查找存储的加解密密钥，并使用主密钥解密所述存储的加解密密钥；4) When searching for the encryption and decryption key, search for the stored encryption and decryption key according to the data encryption attribute metadata information and the user encryption scheme, and use the master key to decrypt the stored encryption and decryption key;5）若未查找到所述存储的加解密密钥，则生成加解密密钥，并进行密钥备份；将主密钥的固定长度的单项散列值，以及经主密钥加密后的加解密密钥备份到数据库和云端服务器；同时将加密后的加解密密钥和数据映射关系表也备份到云端。5) If the stored encryption and decryption key is not found, generate the encryption and decryption key and perform key backup; the fixed-length single-item hash value of the master key and the encrypted The decryption key is backed up to the database and cloud server; at the same time, the encrypted encryption and decryption key and data mapping table are also backed up to the cloud.6.如权利要求5所述的密文云存储方法，其特征在于，所述主密钥的认证参数包括：用户口令或者用户指纹、声音、虹膜的生物特征。6. The ciphertext cloud storage method according to claim 5, wherein the authentication parameters of the master key include: user password or biological characteristics of user fingerprint, voice, and iris.7.如权利要求1所述的密文云存储方法，其特征在于，通过下述方法实现加解密过程对用户的透明：7. The ciphertext cloud storage method according to claim 1, wherein the encryption and decryption process is transparent to the user through the following methods:1）用户首次使用时，选择所需加密上传的文件，此时文件做上传预处理；1) When the user uses it for the first time, select the file to be encrypted and uploaded, and the file will be uploaded and pre-processed at this time;2）获取密钥和算法，对所选文件进行加密、上传并保存文件属性信息到数据库，所述所选文件的原明文文件在上传成功后被删除；2) Obtain the key and algorithm, encrypt the selected file, upload and save the file attribute information to the database, and the original plaintext file of the selected file will be deleted after the upload is successful;3）用户对密文请求读取或修改操作时，调用相应抽象密码设备组件进行解密操作，生成明文临时文件，并保存明文临时文件属性信息元数据到临时文件表，并将明文临时文件交给上层应用程序；3) When the user requests to read or modify the ciphertext, call the corresponding abstract cryptographic device component to perform the decryption operation, generate a temporary file in plaintext, save the attribute information metadata of the temporary file in plaintext to the temporary file table, and pass the temporary file in plaintext to upper layer application;4）用户使用应用程序对文件的操作均针对于明文临时文件，在进行下一个文件操作或同步刷新时进行临时文件属性与所存储原文件属性元数据进行对比；4) The user's operations on the file using the application are all aimed at the temporary file in clear text, and the temporary file attribute is compared with the stored original file attribute metadata when performing the next file operation or synchronous refresh;5）若文件没有进行修改，则删除临时文件，文件不进行同步；若文件经过修改，则调用密码设备单元对所述临时明文文件进行加密操作，并同步，在上传成功后删除所述临时明文文件。5) If the file has not been modified, the temporary file will be deleted, and the file will not be synchronized; if the file has been modified, the password device unit will be called to encrypt the temporary plaintext file and synchronize it, and delete the temporary plaintext after the upload is successful document.8.一种密文云存储系统，包括：一个或多个客户端和云端服务器，其特征在于，8. A ciphertext cloud storage system, comprising: one or more clients and cloud servers, characterized in that,用户在客户端存放的数据中选择采用密文和/或明文进行数据同步；The user chooses to use ciphertext and/or plaintext for data synchronization in the data stored on the client;使用基于用户身份提供的认证参数生成主密钥，并根据所述主密钥获取密文预置加解密密钥或生成对应的密文加解密密钥，在所述客户端采用主密钥+加解密密钥的两级密钥对密文同步的数据进行加密并建立密文索引；Use the authentication parameters provided based on the user identity to generate a master key, and obtain the ciphertext preset encryption and decryption key according to the master key or generate the corresponding ciphertext encryption and decryption key, and use the master key + The two-level key of the encryption and decryption key encrypts the data synchronized with the ciphertext and establishes a ciphertext index;在所述云端和客户端同步所述密文及密文索引并删除在客户端上的密文索引和密文同步的数据；同时在所述云端和客户端同步所述明文同步数据后建立明文索引；Synchronize the ciphertext and ciphertext index on the cloud and the client and delete the ciphertext index and ciphertext synchronization data on the client; at the same time, create a plaintext after synchronizing the plaintext synchronization data on the cloud and the client index;将所述明文和/或密文存储在本地私有云存储服务器或者根据用户请求的挂载点，存储在云存储提供商的存储服务器；storing the plaintext and/or ciphertext in the local private cloud storage server or in the storage server of the cloud storage provider according to the mount point requested by the user;所述客户端还包括用来进行加解密操作的加解密模块(1)、用于完成与个人身份绑定的主密钥和与数据绑定的加解密密钥两级密钥管理的密钥管理模块(2)、用于密文索引生成的索引模块(3)、用以实现明密文的检索，对于密文检索生成相应查询语句的分词和单向散列，并与云端交互的查询模块(4)、同步模块(5)和管理模块(6)；The client also includes an encryption and decryption module (1) for performing encryption and decryption operations, and a key for two-level key management of a master key bound with personal identity and an encryption and decryption key bound with data Management module (2), index module (3) for ciphertext index generation, used to realize the retrieval of plain ciphertext, generate word segmentation and one-way hash of the corresponding query statement for ciphertext retrieval, and query interactively with the cloud Module (4), synchronization module (5) and management module (6);所述同步模块(5)与透明加解密模块(1)和索引模块(3)连接用于调用和接受生成的密文和索引，完成密文及索引同步的功能；The synchronization module (5) is connected with the transparent encryption and decryption module (1) and the index module (3) for calling and accepting the generated ciphertext and index, and completing the function of ciphertext and index synchronization;所述管理模块(6)与透明加解密模块(1)、密钥管理模块(2)连接为用户提供操作接口，以设定密文安全策略，包括获取所述认证参数和加解密算法；The management module (6) is connected with the transparent encryption and decryption module (1) and the key management module (2) to provide the user with an operation interface to set the ciphertext security policy, including obtaining the authentication parameters and the encryption and decryption algorithm;在所述云端同步所述明文同时在云端建立明文索引或同步所述密文及密文索引后删除在客户端上的密文索引和需要加密数据；将所述明文和/或密文存储在本地的存储服务器或者根据用户请求的挂载点存储在云存储提供商的存储服务接口；Synchronize the plaintext in the cloud and delete the ciphertext index and encrypted data on the client after building a plaintext index in the cloud or synchronizing the ciphertext and ciphertext index; store the plaintext and/or ciphertext in The local storage server or the mount point requested by the user is stored in the storage service interface of the cloud storage provider;所述云服务器端还包括与客户端同步模块(5)连接的同步模块(7)用于实现密文同步，密文索引同步；用以创建明文索引的索引模块(8)、查询模块(9)、用以实现与其他云平台的对接，扩展存储能力的对接模块(10)、密钥管理模块(11)、用户管理模块(12)；Described cloud server end also comprises the synchronization module (7) that is connected with client synchronization module (5) and is used to realize ciphertext synchronization, ciphertext index synchronization; Index module (8), query module (9) in order to create plaintext index ), a docking module (10), a key management module (11), and a user management module (12) for realizing docking with other cloud platforms and expanding storage capacity;所述查询模块(9)与客户端的查询模块(4)连接，用以支持索引的明密文查询和支持顺序扫描的密文查询，最后返回查询结果；The query module (9) is connected with the query module (4) of the client to support the plaintext query of the index and the ciphertext query of the sequential scan, and finally return the query result;所述密钥管理模块(11)与客户端的密钥管理模块(2)连接，用于存储备份用户的主密钥单项散列值、使用主密钥加密的加解密密钥，用户数据属性的元信息值，采用数据库实现；提供接口接受用户请求，进行密钥恢复；The key management module (11) is connected with the key management module (2) of the client, and is used to store the single-item hash value of the master key of the backup user, the encryption and decryption key encrypted with the master key, and the user data attribute The meta-information value is realized by using a database; an interface is provided to accept user requests and perform key recovery;所述用户管理模块(12)实现对用户帐号的管理和访问控制，包括注册用户、维护超级管理员用户和普通用户。The user management module (12) realizes the management and access control of user accounts, including registered users, maintenance super administrator users and ordinary users.9.如权利要求8所述的密文云存储系统，其特征在于，在所述存储系统中根据用户设定，采用优先级控制策略，对于优先级高的数据，在得到用户请求后立即得到响应，进行建立索引、加密数据、同步更新的操作；对于优先级低的数据，则在客户端接入电源或静止状态时，自动进行索引建立、加密数据、同步更新的操作。9. The ciphertext cloud storage system according to claim 8, characterized in that, in the storage system, according to user settings, a priority control strategy is adopted, and for data with high priority, it is obtained immediately after receiving a user request In response, the operations of indexing, data encryption, and synchronous update are performed; for low-priority data, when the client is powered on or in a static state, the operations of index establishment, data encryption, and synchronous update are automatically performed.10.如权利要求8所述的密文云存储系统，其特征在于，所述扩展存储能力的对接模块(10)，包括：挂载控制功能模块和数据操作系统，其中挂载控制功能模块的主要分为增加挂载点子模块、删除挂载点子模块、获得挂载点信息子模块，数据操作模块主要分为通用操作接口子模块及外部存储接口实现子模块；10. The ciphertext cloud storage system according to claim 8, wherein the docking module (10) of the expanded storage capacity includes: a mount control function module and a data operating system, wherein the mount control function module It is mainly divided into sub-modules of adding mount points, deleting mount points, and obtaining mount point information. The data operation module is mainly divided into general operation interface sub-modules and external storage interface implementation sub-modules;所述增加挂载点子模块：用户增加外部云存储挂载点，并将挂载点信息写入相应的配置文件中；The adding mount point sub-module: the user adds an external cloud storage mount point, and writes the mount point information into the corresponding configuration file;所述删除挂载点子模块：删除已挂载的外部云存储挂载点，并更新相应的配置文件；The delete mount point submodule: delete the mounted external cloud storage mount point, and update the corresponding configuration file;所述获得挂载点信息子模块：获得用户当前的所有挂载点信息；The submodule of obtaining mount point information: obtaining all current mount point information of the user;所述通用操作接口子模块：提供与所有外部存储云平台对接并进行数据交互的通用的访问接口。The general operation interface sub-module: provides a general access interface for docking with all external storage cloud platforms and performing data interaction.11.如权利要求10所述的密文云存储系统，其特征在于，所述扩展存储能力的对接模块(10)还包括Amazon S3、Dropbox、HDFS外部存储类型对所述通用操作接口进行具体实现。11. the ciphertext cloud storage system as claimed in claim 10, is characterized in that, the docking module (10) of described expansion storage capacity also comprises Amazon S3, Dropbox, HDFS external storage type and carries out concrete realization to described general operation interface .

Images