【作者】 陈丽；

【导师】 刘琦； 夏志华；

【作者基本信息】 南京信息工程大学 ， 软件工程， 2015， 硕士

【摘要】 随着云计算技术的迅速发展,越来越多的企业和个人用户将自己的数据外源到云服务端。云服务商减轻了用户的存储管理负担,使用户能够随时随地地访问数据,为用户提供灵活的高质量存储访问。在云存储模式中,用户数据需要被外包给云服务商进行存储和管理。但作为一个第三方平台,云存储具有不可信赖性,云服务商能够轻易获得用户存储的数据。为了保护数据隐私,在外源数据之前需要对敏感数据加密,加密后的数据能被有效地访问变成一个难题。因而,数据安全成为制约云计算发展的重要因素。在云计算中,数据拥有者将与很多的授权用户共享他的数据,而这些用户只想找在某个特定场景下他感兴趣的那些文件。目前比较受欢迎的方法是基于关键词搜索方法。基于关键词的查询方法允许用户选择返回的感兴趣文件,这类方法广泛应用与明文检索场景。然而,数据加密限制用户执行关键词检索的能力,并且不能对加密的云数据使用传统明文检索方法。当存储在云端的加密数据形成一定规模时,用户将不能高效利用数据,从而违背了云计算中实现数据共享使用的初衷。密文高效检索成为需要迫切解决的问题。因此,研究密文检索技术具有重要意义。已有的密文检索技术只能利用用户查询关键词的精确匹配或者模糊匹配实现检索,一些包含语义相关词的文档被忽略。一般用户缺乏对相关领域知识的了解,提交的关键词有限,不能全面地表达用户的实际查询意图,造成检索结果不全问题。针对该不足之处,本文提出了基于语义的密文检索方案。本文的主要贡献包括：1) 将语义查询技术引入密文检索领域。当用户提交查询关键词进行检索时,支持语义检索,使检索结果更加满足用户的意图。本文提出了两种语义检索方案：一种是基于潜在语义分析的多关键词排序检索方案,另外一种是基于语义扩展的多关键词排序检索方案。这两种设计方案实现对云数据支持语义的多关键词排序检索方案,并用真实文档集进行性能测试评估。2) 为了更好的保护密文数据隐私,数据拥有者将加密后的数据提交给云服务商之后,使用安全k近邻对数据进行分割转换,即使攻击者得到了数据,也不是原始数据。本文深入分析提出两种方案在风险模型中是安全的。在方案设计过程中,发现并提出一种新的攻击,该攻击存在隐私泄露问题,并证明我们提出的方案可以有效地抵抗攻击。更多还原

【Abstract】 With the emergence of cloud computing, more and more companies and individuals choose to store their data in the cloud. Cloud server reduces the burden of storage management on the user’s side, and allows the users to access data anywhere for high quality data storage services. With cloud storage mode, the user’s data needs to be outsourced to cloud server for storage and management. However, cloud is a third-party platform, and can easily access the data stored by the user. For the protection of data privacy, sensitive data has to be encrypted before outsourcing, which makes effective data utilization a challenging task. Thus, security problem becomes a fundamental problem which have hindered the development of cloud computing.In cloud computing, data owners may share their outsourced data with a large number of users, who might want to only retrieve certain specific data files they are interested in during a given session. One of the most popular ways is through keyword-based search. Such keyword search techniques allow users to selectively retrieve files of interest and have been widely applied in plaintext search. Unfortunately, data encryption, which restricts user’s ability to perform keyword search and further demands the protection of keyword privacy, makes the traditional plaintext search methods fail to encrypted cloud data. However, considering the large scale of data files stored in the cloud, it is not an efficient way to retrieve the specific files. If the encrypted data files couldn’t be searched and utilized easily, it violates the goal of data sharing in the cloud computing. Efficient search over encrypted data which has been an urgent problem needs to be addressed. Therefore, the study of search over encrypted cloud data is important.Existing techniques only support exact search, namely the search keyword should exactly match the words in the index. Some documents which contain semantically related words are ignored. For the reason that users has limited knowledge of some domain, the query keywords they provide are limited, which can’t fully express the actual query intent of users. Thus, the search results are incomplete. For the deficiencies, we have proposed two solutions which support semantic search over encrypted cloud data. The main contributions are described below.1) The paper introduces semantic search technology into the domain of ciphertext retrieval. When query keywords are submitted by data users, the scheme supports semantically search to make the results meet the need of users. This paper has proposed two semantic search schemes:one is an efficient and privacy-preserving semantic multi-keyword ranked search over encrypted cloud data, another is multi-keyword semantic ranked search over encrypted cloud data. These approaches support both the multi-keyword ranked search and the semantic search.2) For the protection of data privacy, before their data are submitted by data owners to the cloud server, the secure "k-nearest neighbor (k-NN)" is applied to split and transform their data. Even if the attacker obtains these data, these data are not the original data, so the data can be played a better protection. In the design process of scheme, we have discovered and proposed a new attack. We have conducted experiments to reveal the existence of this attack. And, it is proved that our proposed scheme can resist this attack effectively.更多还原