TWI585608B - Keyword searching method applied to cloud storage service - Google Patents

Description

Keyword search method applied to cloud storage service

The present invention relates to a keyword search method applied to a cloud storage service, in particular, a method for opening a specific data receiving end to receive data through multiple verification programs, and quickly searching for a location according to keywords transmitted by the data receiving end. Information required.

The Republic of China Invention Patent Gazette No. I474189 "Cloud File Automatic Encryption and Decryption System" mainly includes the information security module directly in the cloud service platform system, and uses the interception system command to enable the virtual host to be turned on, off, and operated. When the action of changing data is performed, the information security module verifies the operation behavior of the system and performs instant data encryption and decryption in the process of reading and writing the storage device or file.

Although the above predecessor provides the verification of the above operation behavior and the instant encryption/decryption data when the data is changed, the above operation behavior only uses the method of intercepting the system I/O to judge whether to perform data encryption, and if the unauthorized authorized user obtains the authorization. In the case of data transmitted through the network without using I/O (in an idle state), the above case cannot effectively perform data encryption.

In order to solve the deficiencies of the foregoing patents, the present invention provides a keyword search method applied to a cloud storage service, which includes the following steps: A. A data transmission end uploads a transmission key to a cloud storage platform for performing a first verification procedure, When the first verification procedure is correct, the data transmission end uploads at least one first data encrypted by a first encryption program to the cloud storage platform for storage. B. A data receiving end uploads a receiving key to the cloud storage platform for performing a second verification process. C. The second test When the verification procedure is correct, the data receiving end uploads a secure receiving value to the data transmission end via the cloud storage platform, and performs a third verification procedure of a secure transmission value of the data transmission end and the secure receiving value. D. When the third verification procedure is correct, the data transmission end opens the permission of the data receiving end to receive the first data through the cloud storage platform. E. The data receiving end transmits a keyword to the cloud storage platform, and the cloud storage platform searches for a second data in the first data according to the keyword, and transmits the second data to the data receiving end.

Further, the secure transmission value and the secure reception value are one value corresponding to each other, and the value changes the content of the value after being encrypted by a random number algorithm.

In the foregoing step A, when the first verification procedure is incorrect, the cloud storage platform rejects the data transmission of the data transmission end.

In the foregoing step B, when the second verification procedure is incorrect, the cloud storage platform rejects the data receiving of the data receiving end.

The cloud storage platform has a cloud key for performing the first verification procedure and the second verification procedure.

Further, the keyword is encrypted into a keyword encryption file by a second encryption program, and the cloud storage platform performs step E according to the content of the keyword encryption file.

Further, if the step F is included, the data transmission end rejects the permission of the data receiving end to receive the first data through the cloud storage platform.

According to the above technical features, the following effects can be achieved:

1. The first data encrypted by the first encryption program and the value calculated by the random number algorithm, that is, the function of data encryption is achieved, and the non-legally authorized user does not obtain the authorization authorized by the cloud storage platform. The key, the non-legally authorized user can not enter the cloud storage platform to retrieve the required data.

2. If the non-legally authorized user can download the first data or the value but fails to unlock the first data or the secure receiving value of the value, the unauthorized authorized user cannot know the first The data or the content of the value.

3. After the safe transmission value and the value in the security reception value are calculated by the random number algorithm, the content of the value is changed, and the non-legally authorized user cannot know the data transmission end or the data receiving end. Whether the data transmitted/received is the same data enables the non-legally authorized user to obtain only the piecemeal information, and it is more difficult to crack the encryption program of the present invention.

4. The secure transmission value and the numerical content of the secure reception value are only known to the data transmission end and the data receiving end authorized by each other, and in the process of network transmission, the secure transmission value and the secure reception value are After the value is calculated by the random number algorithm, each time a different value is generated. The user who is not legally authorized cannot know whether the value transmitted on the network is correct and complete, so the non-legally authorized user cannot pass the legal authorization. The data receiving end downloads the data.

5. When the authorized data transmission terminal only needs to select the data to be uploaded and fill in the value of the transmission key and the security transmission value, the data transmission terminal can upload the data to the cloud storage platform, and use it. Very convenient.

6. The authorized receiving end of the data must pass the second verification procedure and the third verification procedure to obtain complete protection in safe use before receiving the data.

(1)‧‧‧"Connect to upload encrypted file page" button

(1A)‧‧‧"Connect to upload encrypted file page" button

(11)‧‧‧"Select File" button

(12)‧‧‧"Upload File" button

(2) ‧‧‧"Connect to download encrypted file page" button

(2A)‧‧‧"Connect to download encrypted file page" button

(21A)‧‧‧"Send Download Request" button

[First figure] is a schematic flowchart of the present invention, illustrating a verification procedure between the data transmission end, the cloud storage platform, and the data receiving end.

[Second figure] is a schematic diagram 1 used for the operation of the first embodiment of the present invention, and when the user logs in to the system of the present invention, the data to be uploaded can be selected.

[Third Figure] is a schematic diagram 2 of the operation of the first embodiment of the present invention, illustrating a system page after the user of the data transmission end selects to upload the data.

[Fourth figure] is a schematic diagram 3 for the operation of the first embodiment of the present invention, which illustrates which file the user of the data transmission end selects to upload (the file of the TR file name is uploaded file).

[Fifth Figure] is a schematic diagram of the operation of the first embodiment of the present invention. The user of the data transmission end selects the file and inputs the transmission key and the security transmission value is completed, and then presses the file upload button.

[Sixth Diagram] FIG. 5 is a schematic diagram of the operation of the first embodiment of the present invention, illustrating that the TR file is uploaded to the cloud storage platform.

[Seventh figure] is a schematic diagram of another operation of the present invention. When the user logs in to the system of the present invention, the data can be downloaded.

[Eighth figure] is another operation of the present invention. FIG. 2 illustrates the user input receiving key and the secure receiving value of the data receiving end.

[Ninth aspect] is another operation of the present invention. FIG. 3 illustrates that the user at the receiving end of the data enters the cloud storage platform and selects the file to be downloaded (the present invention downloads the file with the TR file name). file).

In summary of the above technical features, the main functions of the keyword search method applied to the cloud storage service of the present invention will be clearly shown in the following embodiments.

Referring to the first figure, first, a user of a data transmission terminal uploads a transmission key to a cloud storage platform to perform a first verification process, wherein the first verification program is a cloud key in the cloud storage platform. The transfer key is compared.

If the verification result of the first verification program is incorrect, the cloud storage platform regards the user of the data transmission end as a non-legally authorized user, and the cloud storage platform rejects the data transmission of the data transmission end.

When the verification result of the first verification program is correct, the cloud storage platform regards the user of the data transmission end as a legally authorized user, and the data transmission end encrypts at least one first data by using a first encryption program, and The encrypted first data is uploaded to the cloud storage platform for storage.

The first encryption program is known according to the following algorithm.

The encrypted first data is uploaded to the cloud storage platform for storage, and is learned according to the following algorithm.

When the user of the data receiving end downloads the first data uploaded by the data transmission end user, the data receiving end uploads a receiving key to the cloud storage platform for a second verification process. The second verification program compares the cloud key in the cloud storage platform with the receiving key.

The transmission key, the cloud key, and the receiving key are calculated according to the following algorithm: _S K _D is the transmission key, _S K _S is the cloud key, and _S K _R is The receiving key.

If the verification result of the second verification program is incorrect, the cloud storage platform regards the user of the data receiving end as a non-legally authorized user, and the cloud storage platform rejects the data receiving of the data receiving end. Therefore, the above description has achieved the following effects: 1. Unauthorized authorized users cannot access the cloud storage platform to retrieve the required information. 2. The user who is not legally authorized cannot know the content of the first data or the value. 3. A user who is not legally authorized cannot know whether the data transmission end or the data receiving end is transmitting/receiving data for the same data. 4. A user who is not legally authorized cannot know whether the value transmitted on the network is correct or complete. Therefore, a user who is not legally authorized cannot download the data through the legally authorized data receiving end.

When the verification result of the second verification program is correct, the data receiving end performs a third verification procedure with the data transmission end.

The third verification program compares a secure transmission value of the data transmission end with the security reception value, and first uploads a secure reception value to the cloud storage platform through the data receiving end, and the cloud storage platform performs the security again. The received value is transmitted to the data transmission end, and the secure transmission value or the secure reception value is not stored in the cloud storage platform. And the secure transmission value and the secure reception value The values are corresponding to each other, and the value changes the content of the value after being encrypted by a random number algorithm.

When the third verification procedure is incorrect, the data transmission end rejects the permission of the data receiving end to receive the first data through the cloud storage platform.

When the third verification program is correct, the data transmission end opens the permission of the data receiving end to receive the first data through the cloud storage platform, and the data receiving end can encrypt a keyword into a second through a second encryption program. After the keyword encryption file is transmitted, the data receiving end transmits a keyword encryption file to the cloud storage platform, and the cloud storage platform searches for a second data in the first data according to the keyword encryption file, and the first data is The second data is transmitted to the data receiving end. Therefore, this paragraph indicates that the authorized data receiving end must pass the second verification procedure and the third verification procedure to obtain safe and complete protection in use before receiving the data.

The second verification program and the third verification program used by the cloud storage platform and the data receiving end are performed by using the following algorithm.

If the second verification program and the third verification program are verified to be correct, and the user of the data receiving end starts to download the second data, the download encryption algorithm of the second data is as follows.

Cloud server Data receiver

Send specify encerypted data

Referring to the embodiments shown in FIG. 2 to FIG. 6 , this embodiment describes how the user of the data transmission end uploads the encrypted first data. First, the second figure is that the data transmission end user uses the present invention. The page of the system, you can choose to upload data to the cloud storage platform / download data from the cloud storage platform, just select the individual button ["Connect to upload encrypted file page" button (1) or "Connect to download encrypted file" Page "Button (2)], you can enter the individual operation page.

After the user clicks the "Connect to upload encrypted file page" button (1), the system of the present invention is connected to the page shown in the third figure, and the user of the data transmission end can click the "Select File" button (11). ) Select the first data you want to upload.

The fourth figure is that the user of the data transmission end selects the first data to be uploaded. In this embodiment, the file named TR is the uploaded first data. After the first data is selected, the first encryption program immediately encrypts the first data of the TR file, and the encrypted first data is still on the user's computer of the data transmission end. The network is transmitted to the cloud storage platform (this embodiment first performs the first authentication procedure for the first data, but is only one of the embodiments that can be covered by the present invention).

The fifth picture is that the data transmission end user selects to upload the encrypted TR file, and relatively inputs the transmission key and the password of the security transmission value, and then presses the "Upload File" button (12) Thereafter, the system of the present invention is connected to the page as shown in FIG. 6, and the TR file uploaded by the user of the data transmission end has been uploaded.

According to the above description, the data transmission end user only needs to select the file to be uploaded and input the transmission key and the password of the security transmission value, and then upload the data to the cloud storage platform, which is convenient in use. .

Continuing to refer to another embodiment of the present invention, this embodiment describes how the user of the data receiving end downloads the encrypted first data, as shown in the seventh to ninth figures, firstly, the user of the data receiving end After clicking the "Connect to Download Encrypted Archive Page" button (2A), the system of the present invention is connected to the page as shown in the eighth figure, and the user of the data receiving end inputs the corresponding receiving key and the secure transmission. After the password of the value, click the "send download request" button (21A), and the present invention executes the second verification program and the third verification program.

As shown in the ninth figure, after the figure has been verified by the second verification process and the third verification process, the user of the data receiving end selects to download the TR file from the cloud storage platform, and then archives the file. The file is stored to the location where the user at the receiving end of the data wants to store.

In view of the above description of the embodiments, the operation, use, and effects of the present invention can be fully understood. However, the above-mentioned embodiments are merely preferred embodiments of the present invention, and are not intended to limit the scope of the present invention, that is, simple equivalent changes and modifications according to the scope of the present invention and the description of the invention are It is within the scope of the invention.

Claims (7)

A keyword search method applied to a cloud storage service includes the following steps: A. A data transmission terminal uploads a transmission key to a cloud storage platform for performing a first verification procedure, and when the first verification program is correct, the The data transmission end uploads at least one first data encrypted by a first encryption program to the cloud storage platform for storage; if the first verification program is incorrect, the cloud storage platform regards the data transmission end as non-legally authorized The usage end, the cloud storage platform closes the permission of the user end, and prevents the cloud storage platform from being subjected to the non-legally authorized user to download the transmission key and the first data; B. a data receiving end uploads a receiving key to The cloud storage platform performs a second verification process; C. when the second verification program is correct, the data receiving end uploads a secure receiving value to the data transmission end via the cloud storage platform, and performs a security of the data transmission end. a third verification program of the transmission value and the security reception value; if the second verification program is incorrect, the cloud storage platform will The receiving end is regarded as a non-legally authorized user, and the cloud storage platform closes the right of the user to prevent the cloud storage platform from being illegally authorized by the user to download the secure receiving value; D. the third verification program is When the data transmission end is correct, the data transmission end enables the data receiving end to receive the first data permission; if the third verification program is incorrect, the cloud storage platform closes the usage end to receive the first data. E. The data receiving end transmits a keyword to the cloud storage platform, and the cloud storage platform searches for a second data in the first data according to the keyword, and transmits the second data to The data receiving end; F. if one or more of the first verification program, the second verification program, or the third verification program is incorrect, the cloud storage platform closes the permission of the user terminal, and the user terminal cannot obtain the Knowing whether the first data and the second data are the same information, only the piecemeal information can be obtained. For example, in the keyword search method applied to the cloud storage service according to claim 1, the secure transmission value and the secure reception value are one value corresponding to each other, and the value is encrypted after each random number algorithm. Change the content of this value. The keyword search method applied to the cloud storage service according to the first aspect of the patent application, in the foregoing step A, when the first verification program is incorrect, the cloud storage platform rejects the data transmission of the data transmission end. The keyword search method applied to the cloud storage service according to the first aspect of the patent application, in the foregoing step B, when the second verification program is incorrect, the cloud storage platform rejects the data receiving of the data receiving end. The keyword search method for the cloud storage service, as described in claim 1, wherein the cloud storage platform has a cloud key for performing the first verification procedure and the second verification procedure. The keyword search method applied to the cloud storage service according to claim 1, wherein the keyword is encrypted into a keyword encrypted file by a second encryption program, and the cloud storage platform encrypts the file according to the keyword. The content is performed in step E. The keyword search method applied to the cloud storage service according to claim 1 further includes the step F. when the third verification program is incorrect, the data transmission end rejects the data receiving through the cloud storage platform. The terminal receives the permission of the first data.