CN105678189B - Data file encryption storage and retrieval system and method - Google Patents

Abstract

The invention discloses an encrypted data file storage and retrieval method, comprising: extracting content metadata from the data file and then encrypting to generate an encrypted data file and storing it in a storage device of a cloud storage system; adding content metadata to the file global identifier of the data file in an encrypted state Afterwards, it is stored in the content metadata database of the cloud storage system; when retrieving encrypted data files stored in the cloud storage system, the content metadata database is searched through the inverted index method to obtain the global identifier of the file matching the search keyword, and the global identifier of the file is listed The attribute information and content information of the encrypted data file corresponding to the symbol are used as the retrieval results. The invention extracts content metadata before data file encryption, adds the file global identifier of the file in the encrypted state to the content metadata, retrieves the encrypted data file stored in the cloud storage system through the file global identifier, and ensures that the data file is stored in the cloud Security and privacy in the environment while ensuring the convenience of data file retrieval.

Description

Encrypted data file storage and retrieval system and method

technical field

The invention relates to the technical field of information security, in particular to a system and method for storing and retrieving encrypted data files based on a cloud storage system.

Background technique

Compared with traditional data file storage methods, cloud storage technology has many advantages:

(1) The cost is low. In the traditional way, users need to purchase a large number of basic equipment such as servers and hard disks, and also need to upgrade the equipment regularly. In the cloud storage environment, users no longer need to purchase these basic equipment. On the one hand, it saves The cost of purchasing basic equipment is reduced, and the cost of maintenance is also reduced on the other hand;

(2) Good scalability. For small and medium-sized enterprises, it is difficult to estimate the required storage capacity in the early stage, but cloud storage can solve this problem very well. In the early stage, you can purchase storage capacity that meets the demand according to the current needs. When the business grows , when the amount of data increases, the storage capacity can be dynamically increased without affecting the previous data;

(3) Data is automatically backed up. For data security, many users will back up data, but backup is often cumbersome and there are problems with backup data security and integrity protection. Cloud storage providers generally provide data files with two or more The copy of the data file fully guarantees the high availability of data files, thus freeing users from the trouble of data backup;

(4) Automatic failover. When a traditional storage system is upgraded, data needs to be migrated from the old storage to another storage server. After the new storage server goes online, the data will be migrated back. On the one hand, it will cause service disruption. Interruption, on the other hand, will also bring the risk of data loss, and these problems will no longer exist in the cloud storage environment. When the system detects an abnormality, it will automatically switch the service to an available redundant storage cluster instead of Affect normal services, not to mention data loss.

Although cloud storage has many advantages, it also has some disadvantages. The most prominent point is that more and more users worry that their data is stored in the cloud storage system environment managed and controlled by others, and the content of the data may be leaked. , bringing losses to individuals and companies. The current solution to such problems is to store data in encrypted form in cloud storage systems.

Although encrypting and storing data files can protect the privacy and security of data files, it also brings a problem: in many scenarios, users need to retrieve data files based on some specific content. If the data files are encrypted, As a result, it cannot be retrieved, or the retrieval speed is slow.

Contents of the invention

The invention provides a system and method for storing and retrieving encrypted data files, which solves the problems of difficult retrieval of encrypted data files and slow retrieval speed, and can quickly retrieve the required encrypted data file information on the basis that the data files are in an encrypted state .

In order to achieve the above object, the present invention provides a system for storing and retrieving encrypted data files, which is characterized in that the system includes:

The cloud storage system includes a server and a storage device; the server includes a user identity authentication module, a content metadata extraction module, a metadata management system, a data file encryption module, and an information retrieval module; the metadata management system downloads and manages content metadata Databases, system metadata databases and storage metadata databases; storage devices for storing data files, including encrypted data files and plaintext data files;

The client includes a content metadata extraction module and a data file encryption module.

A method for storing and retrieving encrypted data files is characterized in that the method includes:

The client or cloud storage system server extracts the content metadata of the data file and then encrypts it to generate an encrypted data file. The encrypted data file and the corresponding content metadata are stored in the storage device of the cloud storage system and the content metadata database on the server side respectively; The content metadata includes the attribute information and content information of the data file, as well as the file global identifier of the data file in the encrypted state;

When retrieving encrypted data files stored in the cloud storage system, the encrypted data file retrieval module on the server side uses the inverted index method to search in the content metadata database on the server side to obtain the file global identifier of the data file in the encrypted state that matches the search keyword character, list the attribute information and content information of the encrypted data file corresponding to the global identifier of the file and return it as the retrieval result.

The method for the client to extract the content metadata of the data file and then encrypt to generate the encrypted data file includes:

The client extracts the content metadata of the data file;

The client encrypts the data file of the extracted content metadata to generate an encrypted data file;

The client uploads the encrypted data file and the corresponding content metadata to the cloud storage system server.

The above cloud storage system server end extracts the content metadata of the data file and then encrypts the method for generating the encrypted data file comprising:

The client uploads the data file to the cloud storage system server;

The cloud storage system server side extracts the content metadata of the data file;

The server side of the cloud storage system encrypts the data file of the extracted content metadata to generate an encrypted data file.

The content metadata of the above-mentioned extracted data files includes: the content metadata extraction module on the client side or the cloud storage system server side conducts a preliminary analysis on the content of the data file according to the characteristics of the data file, and extracts attribute information and content information that can reflect the characteristics of the data file , and add the encrypted file global identifier of the data file to the content metadata.

After extracting the content metadata of the data file, the client can modify the content metadata stored in the content metadata database on the server side of the cloud storage system.

The server side of the above cloud storage system stores the encrypted data files in a distributed manner in the storage device of the cloud storage system, and stores the content metadata in the content metadata database of the cloud storage system.

The encrypted data files stored in the server end of the above retrieval cloud storage system include:

The client sends a retrieval request containing retrieval keywords, and the cloud storage system analyzes the retrieval request to determine the validity of the retrieval keyword content in the retrieval request;

The information retrieval module of the cloud storage system performs a matching query on the content metadata database through the inverted index method, and obtains the file global identifier in the encrypted state of the data file matching the retrieval keyword and the attribute information of the data file corresponding to the file global identifier and content information as search results;

The information retrieval module sorts the retrieval results and sends them to the client.

According to the search result, the above client can choose to download the encrypted data file corresponding to the file global identifier listed in the search result;

If the encrypted data file is encrypted on the client side, the cloud storage system will directly transmit the encrypted data file to the user client, and the client will decrypt it;

If the encrypted data file is encrypted at the server side of the cloud storage system, the server side of the cloud storage system decrypts the encrypted data file and then transmits it to the client.

The retrieval method of the above-mentioned encrypted data file also includes an optimization method of the inverted index method, and the optimization method of the inverted index method includes:

After vertical division and horizontal movement, the zero elements of the inverted index matrix of the data file content metadata are moved to the bottom and right of the matrix;

After block clustering, the original high-dimensional sparse matrix is transformed into several low-dimensional dense matrices;

When retrieving content metadata, several low-dimensional matrices in the optimized sparse matrix are sent to different processing units in the cloud storage system for parallel processing.

Compared with the encryption data file storage and retrieval technology of the prior art, the encrypted data file storage and retrieval system and method of the present invention have the advantage that the present invention establishes a new type of content metadata structure to ensure that users Fangwei's retrieval of encrypted data files ensures the security and privacy of data files in the cloud storage environment and at the same time ensures the convenience of data file retrieval;

In the present invention, the data files are stored in the cloud storage system in an encrypted manner, even if the encrypted data files are obtained, the data files will not be leaked without the decryption key;

The present invention designs a new type of inverted index method suitable for content metadata retrieval, which can quickly retrieve the corresponding encrypted data files in the cloud storage system according to the keyword information provided by the user on the client end, ensuring the user's encrypted data file retrieval High efficiency and precision, which solves the problem of difficult or slow retrieval of encrypted data files in big data environments such as cloud storage;

The invention is equally applicable to the retrieval of encrypted data files and plaintext data files in the cloud storage system, and both can achieve the purpose of fast retrieval and return of retrieval results.

Description of drawings

Fig. 1 is the schematic flow chart of encrypted data file storage and retrieval method of the present invention;

Figure 2 is a relationship diagram of three kinds of metadata;

FIG. 3 is a structure diagram of content metadata;

FIG. 4 is a structural diagram of storage metadata;

Fig. 5 is a method flowchart of an embodiment of an encrypted data file storage and retrieval method based on a cloud storage system;

Fig. 6 is the retrieval model figure of encrypted data file;

FIG. 7 is a schematic diagram of an inverted index of content metadata;

FIG. 8 is a schematic representation of a matrix representation of an inverted index of content metadata;

FIG. 9 is a schematic diagram of inverted index matrix segmentation and parallel processing of content metadata.

Detailed ways

Specific embodiments of the present invention will be further described below in conjunction with the accompanying drawings.

The invention discloses an encrypted data file storage and retrieval system and method based on a cloud storage system. The attribute information and content information of the original data file and the file global identifier of the encrypted data file are stored in the content metadata database to realize The retrieval operation of the encrypted data file is completed without decrypting the original data file.

The technical principle of the present invention: (1) By designing a special data file content metadata structure, the content metadata contains the file global identifier (FGID) of the data file in the encrypted state, and the client or cloud storage system server end (i.e. cloud storage system) before encrypting the data files, automatically extract the content metadata of the data files and store them in the content metadata database on the server side of the cloud storage system Retrieval provides evidence; (2) Data files can be encrypted on the client side or on the server side of the cloud storage system, and then stored in the storage device of the cloud storage system in a distributed manner to ensure the security and privacy of the data files (3) Through a new inverted index method, the retrieval speed of massive content metadata in the cloud storage system is guaranteed, thereby realizing the fast retrieval of encrypted data files. The invention overcomes the defect of difficult retrieval of traditional encrypted data files or slow retrieval speed after decryption.

The encrypted data file storage and retrieval system based on the cloud storage system disclosed by the present invention includes: a cloud storage system and a client.

The cloud storage system includes a server end and a storage device; the server end includes a user identity authentication module, a content metadata extraction module, a metadata management system, a data file encryption module, and an information retrieval module; the metadata management system downloads and manages content A metadata database, a system metadata database and a storage metadata database; a storage device used to store data files, and the data files include encrypted data files and plaintext data files. The client includes a content metadata extraction module and a data file encryption module.

As shown in Figure 1, a method for storing and retrieving encrypted data files based on a cloud storage system is disclosed, and the method includes the following steps:

S100. The client authenticates the identity of the user through the identity authentication interface.

User authentication includes access control and user identity information provision; access control: restricts the access of illegal users, and is the first line of defense for building data security in a cloud storage environment; user information provision: in subsequent data file content metadata extraction, Obtaining user-related information and data access permission settings need to be obtained from user authentication information.

The user identity authentication of the cloud storage system controls the access of illegal users, rejects the operation of illegal users, ensures the security of the cloud storage system, realizes the security protection of the cloud storage system, keeps illegal users out, and provides information for the subsequent related metadata. Extracting or generating provides corresponding attributes and also provides necessary information for access control of data files. In addition, it is possible to determine the identity of legitimate users and limit the scope of their data access.

While performing identity authentication, it is determined to perform a file storage process or a file retrieval process, if it is a file storage process, then jump to S200, if it is a file retrieval process, then jump to S300.

S200, performing a file storage process on the user data file, encrypting the user data file and storing it in the cloud storage system.

S300. Perform a file retrieval process on the encrypted data file, and directly retrieve the encrypted data file in the cloud storage system without decryption.

Wherein, the data files include structured data files, semi-structured data files and unstructured data files. Structured data files refer to various traditional database files; unstructured data files refer to various document files, picture files, audio files and video files, etc.; semi-structured data files are a kind of irregular database files, which are A data file with unstructured data information embedded in a database file.

As shown in FIG. 2 , the present invention divides the metadata in the cloud storage environment into three types of metadata, namely: system metadata, storage metadata and content metadata. The three types of metadata are stored in different metadata databases in the cloud, and the three types of metadata of each encrypted data file are associated through the FGID of the data file. FGID is not only the primary key of the table where the three types of metadata are located, but also a foreign key. It is used to uniquely identify the encrypted data file. It is determined by the content of the encrypted data file. FGID can be used to retrieve the data integrity of the encrypted data file. The length of each FGID is ¹²⁸ bits, that is to say, it can represent 2128 files.

System metadata, including directory information and directory path names of the cloud storage system, data file names in each directory, file global identifiers (FGIDs) of encrypted data files, and attributes of data files and directories, are encrypted by users It is automatically generated by the system after the data file is stored.

As shown in Figure 3, content metadata is the key content to realize data file retrieval, which can reflect the characteristics of data files, including the attribute information and content information surface of stored data files in plain text state, as well as the file information of data files in encrypted state. Global Identifier (FGID). Attribute information includes: file name, creation time, file creator, modification time, modifier, version information, file type, etc. Through attribute information, you can have an overall cognition of the data file. Content information includes: data file content introduction, keywords, file aliases, file labels, remarks, usage, content organization structure, compression method, encoding format, and content characteristic information of data files. Here, the file global identifier (FGID) item of the data file in the encrypted state is automatically added by the cloud storage system after the encrypted data file is stored.

As shown in Figure 4, storage metadata includes basic information and storage information of encrypted data files, and file global identifiers (FGIDs) of encrypted data files. Basic information includes data file size, user ID, operable type, replication factor, security attributes, etc.; storage information includes content address list corresponding to encrypted data file block ID, block size list, block physical address and content address mapping table base address. The user ID is the ID of the owner of the file, and the operable types include reading, writing, modifying, etc., the replication factor refers to the number of backup copies of the data file, and the content address is the hash function value of the data block. Storage metadata is automatically generated by the system after user encrypted data files are stored.

In the metadata management system on the server side of the cloud storage system, the three types of metadata are connected together through the file global identifier (FGID) of the data file. The relevant information of the content metadata is automatically extracted by the system, and authorized users can manually modify the content metadata in the content metadata database on the client side through the network.

Among them, the encryption of data files: according to the physical location where the data files are encrypted, it is divided into: client-side encryption and server-side encryption. The two encryption methods are used in different scenarios: cloud storage system server-side encryption can be selected for data files with high security requirements, and client-side encryption can be selected for data files with very high security requirements.

Among them, the storage and management of metadata: system metadata, storage metadata and content metadata are stored in three specific metadata databases in the cloud storage system, which can realize massive data storage and efficient Retrieval, which can meet the concurrent requests of a large number of users, and has the functions of automatic fault recovery and data backup, ensuring the security and high availability of metadata;

Among them, the storage and management of encrypted data files: the encrypted data files are stored on the storage device allocated by the cloud storage system for the user virtual machine by the cloud storage system using distributed storage technology; the cloud storage system is based on distributed high availability The storage system can horizontally expand the total capacity of the cloud storage system by increasing the number of nodes; reduce data management overhead by merging several physical data blocks into a larger logical storage space;

Retrieval of encrypted data files based on content metadata requires a preliminary analysis of the user's input information, narrowing the scope of retrieval, and determining the metadata files that may be involved in the retrieval, so that it can be accelerated in the massive content metadata database in the cloud storage system. Retrieval speed; the retrieval operation does not need to decrypt encrypted data files, and the final retrieval result is encrypted data files or a list of encrypted data files.

As shown in Figure 5, it is an embodiment of an encrypted data file storage and retrieval method based on a cloud storage system, wherein the file storage process (S200) specifically includes the following steps:

S201. After the client completes the identity authentication of the user, the client judges whether to encrypt the data file on the client. If yes, perform client-side encryption, then jump to S202. If not, perform server (cloud storage system server) encryption , jump to S205.

S202. The content metadata extraction module of the client automatically extracts the content metadata of the data file. The extraction of content metadata includes: automatic extraction and manual modification.

Automatic extraction: The content metadata extraction module of the client side conducts a preliminary analysis on the file content according to the characteristics of the file, and extracts the above-mentioned attribute information and content information that can reflect the characteristics of the data file.

Manual modification: the user is the owner of the data file, and has a relatively comprehensive understanding of the type, attribute, purpose, and characteristics of the data file. For some special data files, the user can check the content metadata automatically extracted by the system on the client side through the network Manual modification can more accurately describe the characteristics of the data file and improve the accuracy and efficiency of retrieval.

Here, the content metadata extraction of the data file is automatically extracted by the content metadata extraction module of the client before the data file is encrypted and sent to the content metadata database on the server side of the cloud storage system for storage. Edit and revise the content metadata in the middle to make the content metadata more in line with the user's retrieval habits, which can improve the accuracy and efficiency of the user's retrieval.

S203. The encryption module of the client encrypts the data file, and encrypts the data file after extracting the content metadata with the user private key, or symmetric key encryption, or other encryption algorithms to generate an encrypted data file.

S204. The client uploads the encrypted data file and the corresponding content metadata to the server of the cloud storage system, and jumps to S208.

S205. The client uploads the data file to the server of the cloud storage system in plain text.

S206. The content metadata extraction module at the server side of the cloud storage system automatically extracts the content metadata of the data file. The extraction of content metadata includes: automatic extraction and manual modification.

Automatic extraction: The content metadata extraction module on the client side conducts a preliminary analysis on the file content according to the characteristics of the file, and extracts the attribute information and content information that can reflect the characteristics of the data file.

Manual modification: the user is the owner of the data file, and has a relatively comprehensive understanding of the type, attribute, purpose, and characteristics of the data file. For some special data files, the user can check the content metadata automatically extracted by the system on the client side through the network Manual modification can more accurately describe the characteristics of the data file and improve the accuracy and efficiency of retrieval.

Here, the content metadata extraction of the data file is automatically extracted by the content metadata extraction module on the server side of the cloud storage system before the data file is encrypted and stored in the content metadata database on the server side of the cloud storage system. In the content metadata database, the content elements are edited and modified to make the content metadata more in line with the user's retrieval habits, which can improve the accuracy and efficiency of the user's retrieval.

S207. The encryption module at the server end of the cloud storage system encrypts the data file after extracting the content metadata using the user's private key, or symmetric key encryption, or other encryption algorithms to generate an encrypted data file. Data file encryption ensures the security of the data file, and jumps to S208.

S208. The server side of the cloud storage system stores the encrypted data file generated through client-side encryption or server-side encryption, and stores it in a corresponding storage device in the cloud storage system.

After the server side of the cloud storage system obtains the user's encrypted data file, it stores the encrypted data file in a storage device corresponding to the user's virtual machine.

Each cloud tenant (user) uses the cloud storage system as a unit of user virtual machine.

At the same time, the encryption module of the cloud storage system uses the MD5 algorithm to generate the file global identifier (FGID) of the encrypted data file, and sends it to the content metadata of the data file. The file global identifier (FGID) is the unique identifier of the encrypted data file, and the data integrity of the encrypted data file can also be checked according to the file global identifier (FGID).

After the encrypted data file is stored, the cloud storage system generates system metadata and storage metadata, and the cloud storage system automatically generates the system metadata of the encrypted data file according to the directory information, storage location information and file global identifier FGID stored in the encrypted data file and store metadata.

S209. Store the content metadata extracted before encryption into the content metadata database of the cloud storage system.

Further, after the content metadata is stored in the content metadata database of the cloud storage system, the content metadata database can be updated, and authorized users can update the content in the content metadata database of the cloud storage system through the network at the client end. The metadata is modified to facilitate more accurate retrieval of encrypted data files by users.

In the storage process of encrypted data files based on S200, the retrieval operation of encrypted data files can be realized. As shown in Figure 6, it is an encrypted data file retrieval model based on content metadata. The general process is as follows: ①The client uploads the retrieval content to The information retrieval module of the cloud storage system; ②The information retrieval module queries and retrieves the information matching the retrieved content in the content metadata database managed by the metadata management system through the method of reverse sorting; ③The metadata management system combines the retrieved and retrieved The file global identifier FGID and the corresponding content metadata of the encrypted data file with matching content are sent to the information retrieval module; ④ The information retrieval module sorts the results returned by the retrieval in the metadata management system, and then sends the sorted retrieval result list to to the client; ⑤ The user selects the file to be downloaded from the search result list on the client, and sends the File Global Identifier (FGID) of the selected file to the information retrieval module; In the storage metadata database managed by the management system, search for the corresponding encrypted data file storage location information; ⑦The metadata management system sends ⑥ the encrypted data file storage location information obtained from the search to the distributed storage system; ⑧The distributed storage system according to the encryption The location information of the data file is stored, and the encrypted data file is taken out and sent to the encryption and decryption module; (9) the encryption and decryption module decrypts the encrypted data file and transmits it to the client, and the retrieval of the entire encrypted data file is completed.

In Figure 6, if the encrypted data file is encrypted on the server side, the encryption and decryption module in the model is located on the server side of the cloud storage system; if the encrypted data file is encrypted on the client side, the encryption and decryption module in the model is located on the client side.

As shown in Figure 5, it is an embodiment of an encrypted data file storage and retrieval method based on a cloud storage system, wherein the file retrieval process (S300) specifically includes the following steps:

S301. The client receives a query request through a query interface, and the query request includes search keywords. The client uploads the query request containing the search keywords to the cloud storage system.

The information retrieval module of the cloud storage system analyzes the query request submitted by the client, and determines the legality of the content contained in the search keyword in the query request.

S302. Data retrieval: the information retrieval module of the cloud storage system performs a matching query on the content metadata database through a new type of inverted index algorithm, and returns the file global identifier (FGID) and part of the content metadata of the encrypted data files that meet the requirements information.

The new inverted index method is an improved inverted index method, which is suitable for the rapid retrieval of massive content metadata information in the content metadata database of the cloud storage system.

As shown in FIG. 7 in conjunction with FIG. 8 , it is the inverted index and its matrix representation of the data file content metadata disclosed in the present invention. Among them, keyword 1, keyword 2, ... represent the content metadata items in the content metadata database, ID1, ID2, ..., IDn represent the file global identifier FGID of the encrypted data file, and the row and column intersection items in Fig. 8 represent The number of times a keyword appears in a data file. It can be seen from Figure 8 that the inverted index matrix of the data file content metadata is a sparse matrix. In order to improve the keyword retrieval speed in the massive content metadata database in the cloud storage system, the inverted index matrix of the data file content metadata is The optimization is as follows: through vertical division and horizontal movement, the zero elements of the matrix are moved to the bottom and right of the matrix, and then through block clustering, the original high-dimensional sparse matrix is transformed into a low-dimensional dense matrix. When retrieving content metadata, each low-dimensional matrix in the optimized sparse matrix is sent to different processing units in the cloud storage system for parallel processing, which can greatly improve the keyword retrieval speed in the massive content metadata database. The principle is shown in Figure 9, where M1, M2, ..., Mn represent low-dimensional dense matrices, and P1, P2, ..., Pn represent parallel processing units in the cloud storage system.

S303. The cloud storage system judges whether the retrieval is successful. If yes, skip to step S304. If not, output information that there is no retrieval result corresponding to the encrypted data file and send it to the client, and skip to S305.

S304. The cloud storage system locates the corresponding encrypted data file according to the file global identifier (FGID) of the encrypted data file.

At the same time, the information retrieval module of the cloud storage system sorts the results returned by the retrieval in S302, and sends the sorted retrieval results to the client.

S305. The client receives the search result, and the client outputs the search result to the user. If the search result of the file global identifier containing the encrypted data file matching the search content is obtained, it means that there is a search result matching the search content. According to the search result, the required encrypted data file information can be obtained.

In addition, the client may also choose to download the encrypted data file corresponding to the file global identifier listed in the search result according to the search result.

If the encrypted data file is originally encrypted on the client side, the cloud storage system will directly transmit the encrypted data file to the user client side, and the client side will decrypt it. If the encrypted data file is originally encrypted on the server side of the cloud storage system, the encrypted data file will be decrypted by the cloud storage system and then transmitted to the client.

Although the content of the present invention has been described in detail through the above preferred embodiments, it should be understood that the above description should not be considered as limiting the present invention. Various modifications and alterations to the present invention will become apparent to those skilled in the art upon reading the above disclosure. Therefore, the protection scope of the present invention should be defined by the appended claims.

Claims (10)

1. a kind of data file encryption storage and retrieval system, which is characterized in that the system includes：

Cloud storage system, it includes server ends and storage device；It is the Server Side Include authenticating user identification module, interior Hold metadata extraction module, metadata management system, data file encrypting module, information searching module；The metadata pipe Content metadata library, system metadata library and storage metadatabase are connect and managed under reason system；The storage device, is used for Data file is stored, data file includes data file encryption and plaintext data file；

Client, it includes content metadata extraction modules and data file encryption module；

Generation encryption is encrypted after the content metadata of the client or cloud storage system server end extraction data file Data file, data file encryption and corresponding content metadata are stored respectively in the storage device and server of cloud storage system In the content metadata library at end；Attribute information of the content metadata comprising data file and content information and data file exist File global identifier under encrypted state；When the data file encryption stored in retrieval cloud storage system, the encryption of server-side Data file retrieval module is by inverted index method, and retrieval obtains in the content metadata library of server end and retrieval is crucial The file global identifier of the matched data file of word in an encrypted state lists the corresponding encryption number of this document global identifier It is returned as retrieval result according to the attribute information and content information of file.

2. a kind of storage of data file encryption and search method, which is characterized in that this method includes：

Generation encryption data is encrypted after the content metadata of client or cloud storage system server end extraction data file File, data file encryption and corresponding content metadata are stored respectively in the storage device and server end of cloud storage system In content metadata library；Attribute information of the content metadata comprising data file and content information and data file are being encrypted File global identifier under state；

When the data file encryption stored in retrieval cloud storage system, the data file encryption retrieval module of server-side passes through the row of falling Indexing means, retrieval is obtained in the content metadata library of server end is encrypting shape with the matched data file of search key File global identifier under state lists the attribute information and content letter of the corresponding data file encryption of this document global identifier Breath is returned as retrieval result.

3. data file encryption storage as claimed in claim 2 and search method, which is characterized in that the client extracts data The method for generating data file encryption is encrypted after the content metadata of file includes：

Client extracts the content metadata of data file；

Client encrypts the data file for having extracted content metadata, generates data file encryption；

Data file encryption and corresponding content metadata are uploaded to cloud storage system server end by client.

4. data file encryption storage as claimed in claim 2 and search method, which is characterized in that the cloud storage system service The method for generating data file encryption, which is encrypted, after the content metadata of device end extraction data file includes：

Data file is uploaded to cloud storage system server end by client；

Cloud storage system server end extracts the content metadata of data file；

Cloud storage system server end encrypts the data file for having extracted content metadata, generates data file encryption.

5. data file encryption storage and search method as described in Claims 2 or 3 or 4, which is characterized in that the extraction data The content metadata of file includes：The content metadata extraction module of client or cloud storage system server end is according to data text The characteristic of part, does content data file preliminary analysis, and extraction can embody the attribute information and content letter of data file characteristics Breath, and the encrypted file global identifier of data file is added in content metadata.

6. data file encryption storage and search method as described in Claims 2 or 3 or 4, which is characterized in that the extraction data After the content metadata of file, client can be to the content member number that is stored in cloud storage system server end content metadata library According to modifying.

7. data file encryption storage and search method as described in Claims 2 or 3 or 4, which is characterized in that the cloud storage system Unite server end by data file encryption distributed storage in the storage device of cloud storage system, and content metadata is stored in In the content metadata library of cloud storage system.

8. data file encryption storage as claimed in claim 2 and search method, which is characterized in that the retrieval cloud storage system The data file encryption stored in server end includes：

Client sends the retrieval request for including search key, and cloud storage system analysis retrieval request, which determines in retrieval request, to be examined The legitimacy of rope key words content；

The information searching module of cloud storage system by inverted index method to content metadatabase carry out matching inquiry, obtain with The matched data file of search key file global identifier in an encrypted state and the corresponding number of file global identifier According to the attribute information and content information of file as retrieval result；

Information searching module is sent to client after being ranked up retrieval result.

9. data file encryption storage as claimed in claim 8 and search method, which is characterized in that the client is according to retrieval As a result, may be selected to download the corresponding data file encryption of file global identifier listed in retrieval result；

It is that data file encryption is directly passed to subscription client by cloud storage system if client is encrypted if data file encryption, It is decrypted by client；

If data file encryption is encrypted in cloud storage system server end, by cloud storage system server end by encryption data Client is passed to after file decryption.

10. data file encryption storage and search method as described in claim 2 or 8 or 9, which is characterized in that the encryption number Also include the optimization method of inverted index method according to the search method of file, the optimization method of the inverted index method includes：

It by vertical segmentation and moves horizontally, the neutral element of the inverted index matrix of content data file metadata is made to move on to matrix Bottom and right part；

Using Block Cluster, original higher-dimension sparse matrix is changed into several low-dimensional dense matrix；

When to content metadata retrieval, the low-dimensional matrix of several in the sparse matrix of optimization is sent in cloud storage system respectively Different processing units carry out parallel processing.