可信云存储高效密文全文检索模型及关键技术研究

Cloud storage applications save users' construction and maintenance costs significantly and provide powerful storage capabilities. However, cloud storage service providers are not fully trusted, so users' privacy data must be encrypted prior to outsourcing on cloud storage servers. To research an efficient privacy-preserved encrypted data full-text retrieval method for users' privacy data in cloud storage server has become a key technical issue for trusted cloud storage applications to be resolved immediately. We propose a trusted cloud storage architecture with service domain separation based on a trusted front-end, and define a cloud storage security threat model. Previously, we research a ciphertext full-text index structure based on hierarchical bloom filters and design an efficient ciphertext full-text retrieval algorithm is independent on token offset position information. Secondly, to achieve the efficient privacy-preserved ciphertext full-text retrieval service in trusted cloud storage applications, we research a rank algorithm without token frequency based on degree model of membership and introduce the membership degree entropy to optimize the rank results. Finally, we build model of potential security risk in ciphertext full-text retrieval services and research the security risk detecting mothod based on subgraph isomorphism testing. Moreover, we design a security enhancement mechanism to further enhance the security of ciphertext full-text retrieval service in cloud storage applications. This project tries to make a theoretical breakthrough in encrypted privacy data full-text retrieval methods for trusted cloud storage applications. Our researches will be a theoretical basis for promoting the development of cloud storage industry in our country and provide necessary technical support.

云存储大大节约了用户的建设和维护成本，同时提供了强大的存储能力，然而云存储服务提供商并不完全可信，用户隐私数据必须加密存储在云端。研究云存储加密隐私数据的安全、高效密文全文检索服务模型成为构建可信云存储应用亟待研究解决的核心技术难题。项目提出基于可信前端的服务域分离可信云存储服务体系架构，定义云存储安全威胁模型，研究基于分层布隆过滤器的密文全文索引结构，设计不依赖索引词位置信息的高效密文全文检索算法，探索基于隶属度模型的安全结果排序策略，引入隶属度熵对排序结果进行优化校正，实现安全、高效的可信云存储密文全文检索服务。项目对密文全文检索服务中的潜在安全隐患进行安全建模，研究基于子图同构检测的安全风险探测方法，设计安全增强机制，进一步提升可信云存储密文全文检索服务的安全性。本项目力求在可信云存储加密隐私数据的密文全文检索研究方面取得理论突破，为推动我国云存储产业发展奠定理论基础，提供技术支持。

本项目力图研究外包云存储环境下用户隐私数据的安全、可靠服务机制，提供可信云存储服务。课题组在充分调研国内外研究现状的基础上，构建可信云存储服务框架，并在此基础上开展了云存储环境下的可信数据管理研究。项目研究了基于倒排索引的可信云存储安全查询方法，提供云端加密数据的高效查询服务；针对云存储平台海量数据的服务特点，研究了一种面向加密数据的布隆过滤器排序查询算法；针对字符子串匹配问题，研究了基于多项式因式分解的密文高效查询方法。在基金项目的支持下，课题研究成果在INFOCOM、Security and Communication Networks, Science China, 计算机学报，计算机研究与发展等国内外高水平学术期刊和会议上发表十余篇。基于项目研究成果，课题组开发了原型系统可信Web电子邮件系统、可信云存储服务系统，并已申请国家发明专利三项、软件著作权2项。课题研究成果对于云存储应用的发展具有非常重大的理论和现实意义。