基于访问代理体系结构的密文搜索关键技术研究

The division of data ownership and data management is regarded as the key characteristics of cloud computing. How to protect mission-critical data or privacy-sensitive data increases in importance. A promising solution is encryption, providing only encrypted data to the cloud. However, there exists a conflict between encryption and the full functionality in the cloud applications. Thus Searchable Encryption will become a commodity in future cloud era, and in fact it has received intensive attentions from the industry and capital in recent years. However, at present most of the ciphertext search schemes in academia lose some query expressiveness and should modify current cloud Application Programming Interface (API). This project presents a CASB based searchable encryption. And on this basis, it studies the key technologies, including user sensitive data extraction and understanding, data encryption and decryption and key management executed by access broker, index building and advanced query request analysis, data sharing across brokers. Combined with typical cloud applications, this project will develop a prototype system and analysis the security and performance of the system. And we will endeavor to use this prototype system in practical, face to the Cloud Access Security Broker which has a huge market value, break through the common key technologies of BESE, and finally support for converting the Searchable Encryption into product in China.

云计算模式下数据所有权和管理权发生分离，如何保护用户敏感和隐私数据，至关重要。可行的思路是数据加密后再上传云端。但是数据加密和云服务功能保全本身是一对矛盾，所以以密文搜索为代表的密文管理及计算，在云和大数据时代将变得愈发重要，近年来也受到工业界和资本的大力追捧。本项目针对目前密文搜索方案需要修改云服务商的接口，且搜索功能有较大退化的问题，提出一种由访问代理执行的密文搜索BESE体系结构，并在此基础上深入研究支撑关键技术，包括:用户敏感数据提取和理解，访问代理执行的数据加解密与密钥管理，索引构建和复杂搜索请求解析，跨访问代理的数据分享等。结合典型的云服务，研发原型系统，进行安全性分析和性能评价。并争取将该原型系统用于实际SaaS应用中，面向云时代有巨量市场价值的云访问安全代理CASB，突破BESE共性关键技术，为国产密文搜索产品化提供支撑。

云计算模式下数据所有权和管理权发生分离，如何保护用户敏感和隐私数据，至关重要。本项目针对目前密文搜索方案需要修改云服务商的接口，且搜索功能有较大退化的问题，提出一种由访问代理执行的密文搜索BESE体系结构， 并在此基础上深入研究支撑关键技术，包括:用户敏感数据提取和理解，访问代理执行的数据加解密与密钥管理，索引构建和复杂搜索请求解析，跨访问代理的数据分享等。结合典型的云服务，研发原型系统，进行安全性分析和性能评价。本项目发表论文20篇，授权专利6项，共获得省部级奖项6项，取得了3项关键成果应用转化，为国产密文搜索产品化提供支撑。