CN104036050A - Complex query method for encrypted cloud data - Google Patents

Abstract

The complex query method of ciphertext cloud data includes: the data owner constructs a binary vector index for its file set, encrypts the file set using a symmetric cryptographic mechanism, and then sends the encrypted file set to the cloud. When a user requests to access files containing certain keywords, he applies for a query token from the data owner, and the query token contains the keyword set and the binary vector indexes of all files. The user constructs the query binary vector according to the query keyword and the keyword set, and calculates the inner product of the query binary vector and the index binary vector of each file to determine whether the file contains the user's query keyword. If the file contains query keywords, a new index binary vector corresponding to the query keywords is further constructed. The user generates the LSSS matrix based on the query keywords according to the logical expression, and calculates the inner product of the new index binary vector and the LSSS matrix to further judge whether the file satisfies the query logical expression. The invention can realize precise and complicated query, and can realize higher query efficiency than the widely used inverted index at present.

Description

A complex query method for ciphertext cloud data

technical field

The invention belongs to the field of cloud storage and information retrieval, and in particular relates to a complex query method for ciphertext cloud data.

Background technique

In the cloud storage environment, encryption is a common method to protect user data confidentiality and privacy, but after data encryption, the problem of ciphertext data retrieval needs to be solved urgently.

In order to solve the problem of ciphertext cloud data retrieval, there are currently two typical methods: one is to directly perform a linear search on the ciphertext, that is, to compare the words in the ciphertext one by one to confirm whether the keyword exists and the number of times it appears; The two methods are based on a secure index, that is, first establish a keyword index for the document, then encrypt the document and the index and upload it to the cloud, and check whether the keyword exists in a certain document from the index when searching. The disadvantage of the method of directly searching the ciphertext linearly is that the search efficiency is not high, and it cannot cope with the search scenario of massive data. The index-based ciphertext retrieval method is the mainstream of current research because it has better query efficiency and higher security performance, and is suitable for large-scale cloud storage ciphertext retrieval systems.

In the existing research work, all schemes use the inverted index mechanism, and there is no scheme using binary vector index. Moreover, there are relatively few solutions for complex queries at present, and the accuracy of query results needs to be improved urgently.

Using the binary vector index only needs to retain less information on the data owner side to achieve efficient and secure ciphertext data retrieval. Precise and complex queries can be achieved by using the LSSS matrix.

Ciphertext cloud data query is a key technology to ensure the confidentiality and retrievability of data in cloud storage, and it has important theoretical significance and practical value for promoting the rapid development of cloud storage.

Contents of the invention

In view of the defects of the prior art, the purpose of the present invention is to provide a complex query method for ciphertext cloud data, aiming at improving the accuracy, efficiency and security of data query.

In order to achieve the above object, the present invention provides a complex query method for ciphertext cloud data, comprising the following steps:

Step 1. The data owner builds an index for its file set, using a binary vector index, that is, each bit in the index represents a keyword, and 0 and 1 indicate whether the corresponding keyword exists in this file;

Step 2. The data owner encrypts the file set using a symmetric encryption mechanism based on a single file or data block;

Step 3. The data owner sends the encrypted file set to the cloud;

Step 4. When the user requests to access files containing certain keywords, apply for a query token from the data owner. The query token contains the keyword set and the binary vector index of all files;

Step 5. The user constructs a query binary vector according to the query keyword and the keyword set, and calculates the inner product of the query binary vector and the index binary vector of each file to determine whether the file contains the user's query keyword;

Step 6. If the file contains query keywords, then further construct a new index binary vector corresponding to query keywords;

Step 7. The user generates the LSSS (Linear Secret Sharing Scheme) matrix based on the query keywords according to the logical expression, and calculates the inner product of the new index binary vector and the LSSS matrix to further determine whether the file satisfies the query logical expression .

Step 1 specifically includes the following sub-steps:

1.1 The data owner uses the existing word segmentation algorithm to extract keywords from its file set and build a keyword set;

1.2 The data owner builds a binary vector index based on whether each file contains the corresponding keyword in the keyword set, with 1 indicating that the corresponding keyword exists in the file, and 0 indicating that the corresponding keyword does not exist in the file.

In step 2, if the encryption is based on a single file, the data owner uses the symmetric encryption mechanism to randomly generate a corresponding number of symmetric keys according to the number of files in the file set, and uses the symmetric key to encrypt the file to generate ciphertext. The encryption keys are all different; if it is based on data block encryption, the data owner divides the files in the file set into blocks according to the set data block size, uses the symmetric encryption mechanism to randomly generate a corresponding number of symmetric keys, and uses the symmetric key to encrypt the data. Each block is encrypted to generate ciphertext, and the encryption key is different for each data block.

Step 4 specifically includes the following sub-steps:

4.1 The user sends a query authorization application to the data owner, and the data owner decides whether to issue an authorization token to the user and for which file sets according to its security policy. The token contains the keyword set of the authorized file set and the binary vector of the authorized file index;

4.2 The data owner sends the token to the user using a common secure transmission mechanism.

Step 5 specifically includes the following sub-steps:

5.1 First construct the query binary vector, the method is as follows: the user constructs the query binary vector according to whether the query keyword is in the keyword set, and 1 indicates that the corresponding keyword exists in the keyword set, and 0 indicates that the corresponding keyword does not exist in the keyword set. word set.

5.2 Calculate the inner product of the query binary vector and the index binary vector of each file. When the inner product calculation result is non-zero, it indicates that the file contains the query keyword. When the inner product calculation result is 0, it indicates that the file does not contain Query keywords. And the larger the value of the inner product calculation result, the more keywords are included.

Suppose r _i is the binary index vector of document F _i , where r _i [j]∈{0,1} indicates whether the keyword w _i exists in the document; Q is a query vector, where Q[j]∈{0 , 1} indicates whether the keyword w _j is in the query keyword set W. The similarity score between the document F _i and the query keyword set W is calculated by the inner product, that is, rQ.

In step 6, the method of constructing a new index binary vector corresponding to the query keyword is as follows: in the index binary vector of the file, the binary bits corresponding to the query keywords are reserved, and the bits corresponding to other non-query keywords are removed.

Step 7 specifically includes the following sub-steps:

7.1 First construct the LSSS matrix according to the query logic expression, the method is as follows: first set the root node vector to (1), the vector length is 1, and the variable c is initialized to 1, and the parent node is marked with the vector v. If the parent node is an OR gate, the child node is marked by v; if the parent node is an AND gate, the left child node is v||1, and the right child node is (0,...0)||-1, 0 The number is c, and c=c+1. After marking the entire tree, the leaf nodes form the rows of the LSSS matrix M, and if the lengths are not equal, fill them with 0.

7.2 Calculate the inner product of the new index binary vector and the LSSS matrix. If and only if the calculation result is (1,0,0,...,0), it indicates that the file meets the query condition, otherwise it does not meet the query condition.

A complex query method for ciphertext cloud data, including data owners, users, and the cloud. Data owners use existing word segmentation algorithms to extract keywords from their file sets and build binary vector indexes for all files; data owners also It is used to encrypt files using a symmetric cipher mechanism. If it is based on data blocks, the file must be divided into blocks according to the set data block size, then encrypted using a symmetric cipher mechanism, and then the encrypted files are sent to the cloud; users use It is used to request query authorization from the data owner; the data owner is also used to issue an authorization token to the user according to the specified security policy; the user is also used to use the token information to construct the query binary vector; the user is also used to use the query binary vector with all files Inner product calculation of the index binary vector to determine whether the file contains the query keyword; the user is also used to construct a new index binary vector corresponding to the query keyword; the user is also used to generate the LSSS matrix based on the query keyword according to the logical expression, and Calculate the inner product of the new index binary vector and the LSSS matrix; the user is also used to request the ciphertext of the file containing the query keyword from the cloud, and use the file key contained in the token to decrypt the file; the cloud is used to store the data and respond The user's read and write requests.

Through the above technical solutions conceived by the present invention, compared with the prior art, the present invention has the following advantages:

1. The query accuracy is high, the query logic expression can be used to express complex query conditions, and the LSSS matrix can be used to obtain query results that completely match the query logic expression.

2. The data update is convenient. The indexing process is completed by the data owner, and the keyword set information is kept by the data owner. When a file needs to be updated, the data owner only needs to update the binary vector index of the file and re-encrypt the file. The encrypted file is then sent to the cloud.

3. The calculation of the inner product of binary vectors is very efficient, and only a small amount of storage needs to be added on the user side to achieve efficient retrieval.

Description of drawings

FIG. 1 is a relationship diagram of various entities involved in the present invention.

Fig. 2 is a flow chart of the method of the present invention.

Fig. 3 is a binary vector index diagram of the present invention.

Fig. 4 is a structure diagram of the LSSS matrix of the present invention.

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present invention, not to limit the present invention.

Below at first explain and illustrate with regard to the technical terms of the present invention:

Data owner: refers to the owner of the file, who needs to store the file in the cloud and formulate access control policies for the file;

User: need to read the files released by the data owner;

Cloud or cloud storage: store the files of the data owner, and will faithfully execute the operation requests issued by the data owner and legitimate users, but will peek at the contents of the file when conditions permit;

File: the data that the data owner needs to upload to the cloud;

File blocks: file blocks, data owners use different encryption keys for different blocks of the same file;

Symmetric encryption mechanism: it is a traditional encryption mechanism, the same key is used for encryption and decryption, and the efficiency is high. This mechanism is used in the present invention to encrypt files or file blocks;

Symmetric key: Randomly generated binary data in a symmetric encryption mechanism;

LSSS: Linear Secret Sharing Scheme, which is the abbreviation of its full English name, Linear Secret Sharing Scheme.

The present invention is further described below in conjunction with embodiment and accompanying drawing.

As shown in FIG. 1 , the complex query method for ciphertext cloud data of the present invention is applied in an encrypted cloud storage system, which includes data owners, users and the cloud.

In this embodiment, the data owner is the secretary of a scientific research unit, and the data transmitted to the cloud is the scientific research project file of the unit, which is mainly used for data sharing in the process of project application and development by personnel in the unit, including those who are on business trips .

As shown in Figure 2, the complex query method of ciphertext cloud data of the present invention comprises the following steps:

Step 1. The data owner constructs an index for its file set, using a binary vector index, that is, each bit in the index represents a keyword, and 0 and 1 indicate whether the corresponding keyword exists in the file, as shown in Figure 3. This step specifically includes the following sub-steps:

1.1 The data owner uses the existing word segmentation algorithm to extract keywords from its file set, and builds a keyword set; for example, as shown in Figure 3, the keyword set {cloud computing, cloud storage, encryption, data retrieval, binary vector }.

1.2 The data owner builds a binary vector index based on whether each file contains the corresponding keyword in the keyword set, with 1 indicating that the corresponding keyword exists in the file, and 0 indicating that the corresponding keyword does not exist in the file.

For example, as shown in Figure 3, file 1 contains keywords {cloud computing, encryption}, its index binary vector is f ₁ =(1,0,1,0,0), and file 2 contains keywords {cloud storage , encryption, data retrieval, binary vector}, its index binary vector is f ₂ =(0,1,1,1,1).

Step 2. The data owner uses a symmetric encryption mechanism to encrypt the file set (can be based on a single file or data block);

Step 3. The data owner sends the encrypted file set to the cloud;

Step 4. When the user requests to access files containing certain keywords, apply for a query token from the data owner. The query token contains the keyword set and the binary vector indexes of all files. This step specifically includes the following sub-steps:

4.1 The user sends a query authorization application to the data owner, and the data owner decides whether to issue an authorization token to the user and for which file sets according to its security policy. The token contains the keyword set of the authorized file set and the binary vector of the authorized file index;

4.2 The data owner sends the token to the user using a common secure transmission mechanism.

Step 5. The user constructs a query binary vector based on the query keyword and the keyword set, and calculates the inner product of the query binary vector and the index binary vector of each file to determine whether the file contains the user's query keyword. This step specifically includes the following sub-steps:

5.1 First construct the query binary vector, the method is as follows: the user constructs the query binary vector according to whether the query keyword is in the keyword set, and 1 indicates that the corresponding keyword exists in the keyword set, and 0 indicates that the corresponding keyword does not exist in the keyword set. word set.

5.2 Calculate the inner product of the query binary vector and the index binary vector of each file. When the inner product calculation result is non-zero, it indicates that the file contains the query keyword. When the inner product calculation result is 0, it indicates that the file does not contain Query keywords. And the larger the value of the inner product calculation result, the more keywords are included.

For example, suppose the query keywords are: w ₁ = "cloud computing", w ₂ = "cloud storage", w ₃ = "encryption", w ₄ = "data retrieval", and the query expression is: (w ₁ or w ₂ )and w ₃ and w ₄ , then the query binary vector is q=(1,1,1,1,0).

For example, as shown in Figure 3, file 1 contains keywords {cloud computing, encryption}, its index binary vector is f ₁ =(1,0,1,0,0), and file 2 contains keywords {cloud storage , encryption, data retrieval, binary vector}, its index binary vector is f ₂ =(0,1,1,1,1). Calculate the inner product of the query vector and the index vector of file 1: q·f ₁ =(1,1,1,1,0)·(1,0,1,0,0) ^-1 =2, the query vector Inner product calculation with the index vector of file 2: q·f ₂ =(1,1,1,1,0)·(0,1,1,1,1) ⁻¹ =3.

Step 6. If the file contains query keywords, then further construct a new index binary vector corresponding to query keywords;

In step 6, the method of constructing a new index binary vector corresponding to the query keyword is as follows: in the index binary vector of the file, the binary bits corresponding to the query keywords are reserved, and the bits corresponding to other non-query keywords are removed.

For example, the new index binary vector of file 1 is f ₁ ′=(1,0,1,0), and the new index binary vector of file 2 is f ₂ ′=(0,1,1,1).

Step 7. The user generates an LSSS matrix based on the query keywords according to the logical expression, and calculates the inner product of the new index binary vector and the LSSS matrix to further determine whether the file satisfies the query logical expression. This step specifically includes the following sub-steps:

7.1 First construct the LSSS matrix according to the query logic expression, the method is as follows: first set the root node vector to (1), the vector length is 1, and the variable c is initialized to 1, and the parent node is marked with the vector v. If the parent node is an OR gate, the child node is marked by v; if the parent node is an AND gate, the left child node is v||1, and the right child node is (0,...0)||-1, 0 The number is c, and c=c+1. After marking the entire tree, the leaf nodes form the rows of the LSSS matrix M, and if the lengths are not equal, fill them with 0.

7.2 Calculate the inner product of the new index binary vector and the LSSS matrix. If and only if the calculation result is (1,0,0,...,0), it indicates that the file meets the query condition, otherwise it does not meet the query condition.

For example, to find the files satisfying the query conditions, first construct the LSSS matrix, as shown in Figure 4. The construction method is as follows: first, set the root node vector to (1), and its vector length is 1, and initialize the variable c to 1, and the parent node is marked with the vector v. If the parent node is an OR gate, the child node is marked by v; if the parent node is an AND gate, the left child node is v||1, and the right child node is (0,...0)||-1, 0 The number is c, and c=c+1. After marking the entire tree, the leaf nodes form the rows of the LSSS matrix M, and if the lengths are not equal, fill them with 0.

After the matrix M is constructed, query the index vector of each file one by one. The new index binary vector of file 1 is f ₁ '=(1,0,1,0), and calculate f ₁ 'M=(1,0,1) , so file 1 does not satisfy the query condition. The new index binary vector of file 2 is f ₂ '=(0,1,1,1), and f ₂ 'M=(1,0,0) is calculated, so file 2 satisfies the query condition.

${{\mathrm{<span\; class="notranslate">\; f</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}}^{<span\; class="notranslate">\; \&prime;</span>}\mathrm{<span\; class="notranslate">\; m</span>}<span\; class="notranslate">\; =</span>{\left[\begin{array}{c}\mathrm{<span\; class="notranslate">\; 1</span>}\\ \mathrm{<span\; class="notranslate">\; 0</span>}\\ \mathrm{<span\; class="notranslate">\; 1</span>}\\ \mathrm{<span\; class="notranslate">\; 0</span>}\end{array}\right]}^{\mathrm{<span\; class="notranslate">\; T</span>}}\left[\begin{array}{ccc}\mathrm{<span\; class="notranslate">\; 1</span>}& \mathrm{<span\; class="notranslate">\; 1</span>}& \mathrm{<span\; class="notranslate">\; 0</span>}\\ \mathrm{<span\; class="notranslate">\; 1</span>}& \mathrm{<span\; class="notranslate">\; 1</span>}& \mathrm{<span\; class="notranslate">\; 0</span>}\\ \mathrm{<span\; class="notranslate">\; 0</span>}& <span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}& \mathrm{<span\; class="notranslate">\; 1</span>}\\ \mathrm{<span\; class="notranslate">\; 0</span>}& \mathrm{<span\; class="notranslate">\; 0</span>}& <span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}\end{array}\right]<span\; class="notranslate">\; =</span><span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 1,0,1</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; ,</span>{{\mathrm{<span\; class="notranslate">\; f</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}}^{<span\; class="notranslate">\; \&prime;</span>}\mathrm{<span\; class="notranslate">\; m</span>}{\left[\begin{array}{c}\mathrm{<span\; class="notranslate">\; 0</span>}\\ \mathrm{<span\; class="notranslate">\; 1</span>}\\ \mathrm{<span\; class="notranslate">\; 1</span>}\\ \mathrm{<span\; class="notranslate">\; 1</span>}\end{array}\right]}^{\mathrm{<span\; class="notranslate">\; T</span>}}\left[\begin{array}{ccc}\mathrm{<span\; class="notranslate">\; 1</span>}& \mathrm{<span\; class="notranslate">\; 1</span>}& \mathrm{<span\; class="notranslate">\; 0</span>}\\ \mathrm{<span\; class="notranslate">\; 1</span>}& \mathrm{<span\; class="notranslate">\; 1</span>}& \mathrm{<span\; class="notranslate">\; 0</span>}\\ \mathrm{<span\; class="notranslate">\; 0</span>}& <span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}& \mathrm{<span\; class="notranslate">\; 1</span>}\\ \mathrm{<span\; class="notranslate">\; 0</span>}& \mathrm{<span\; class="notranslate">\; 0</span>}& <span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}\end{array}\right.=<span\; class="notranslate">\; ]</span><span\; class="notranslate">\; =</span><span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 1,0,0</span>}<span\; class="notranslate">\; )</span>$

It is assumed that a Chinese character occupies 2 bytes, and a keyword is set to be a maximum of 5 Chinese characters, occupying 10 bytes. Assuming that there are 1000 keywords, only 10K bytes of storage space are required to store the keyword set. The binary vector index size of each file is 1000 bits, about 12 bytes, and 1000 files only need 12K bytes of index storage space.

Those skilled in the art can easily understand that the above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present invention , should be included within the protection scope of the present invention.

Claims (8)

1. a ciphertext cloud data complex query method, is characterized in that, comprises the following steps:

Step 1. data owner, to its file set index building, uses binary vector index, and in index, each represents a keyword, represents with 0 and 1 whether corresponding keyword is present in this file;

Step 2. data owner uses Symmetric Cryptography encrypt file collection based on Single document or data block;

Encrypt file collection is sent to high in the clouds by step 3. data owner;

When step 4. user requires to access the file that comprises some keyword, apply for query token to data owner, in query token, include the binary vector index of keyword set and All Files;

Step 5. user builds inquiry binary vector according to searching keyword and keyword set, and inquiry binary vector and the index binary vector of each file are carried out to inner product calculating judges whether this file comprises user's searching keyword;

If this file of step 6. includes searching keyword, further build the new index binary vector corresponding with searching keyword;

Step 7. user generates LSSS matrix by searching keyword according to logical expression, and new index binary vector and LSSS matrix are carried out to inner product calculating further to judge whether this file meets query logic expression formula.

2. ciphertext cloud data complex query method according to claim 1, is characterized in that, step 1 specifically comprises following sub-step:

1.1 data owners use existing point of word algorithm to extract keyword to its file set, build keyword set;

1.2 data owner builds binary vector index according to the corresponding keyword whether comprising in each file in keyword set, represents that with 1 corresponding keyword is present in this file, represents that with 0 corresponding keyword is not present in this file.

3. ciphertext cloud data complex query method according to claim 1, it is characterized in that, in step 2, if encrypt based on Single document, data owner is according to quantity of documents in file set, utilize Symmetric Cryptography to generate at random the symmetric key of corresponding number, and utilize symmetric key to be encrypted generating ciphertext to file, the encryption key of each file is all different; If based on encryption of blocks of data, data owner carries out piecemeal according to setting data block size by file centralized documentation, utilize Symmetric Cryptography to generate at random the symmetric key of corresponding number, and utilizing symmetric key to be encrypted generating ciphertext to data block, the encryption key of each data block is all different.

4. ciphertext cloud data complex query method according to claim 1, is characterized in that, step 4 specifically comprises following sub-step:

1.1 users send inquiry authorized application to data owner, data owner determines whether issue authorization token to user and for which file set according to its security strategy, includes the binary vector index of keyword set and the authority of authority collection in token;

1.2 data owners use general secure transport mechanism that token is sent to user.

5. ciphertext cloud data complex query method according to claim 1, is characterized in that, step 5 specifically comprises following sub-step:

First 1.1 build inquiry binary vector, its method is as follows: whether user builds inquiry binary vector according to searching keyword in keyword set, represent that with 1 corresponding keyword is present in keyword set, represent that with 0 corresponding keyword is not present in keyword set;

The index binary vector of inquiry binary vector and each file is carried out inner product calculating by 1.2, when inner product result of calculation is while being non-zero, show this file including searching keyword, in the time that inner product result of calculation is 0, show that this file does not comprise searching keyword, and the value of inner product result of calculation is larger, show that the keyword comprising is more.

6. ciphertext cloud data complex query method according to claim 1, it is characterized in that, in step 6, build the new index binary vector method corresponding with searching keyword as follows: in the index binary vector of file, the binary digit of searching keyword correspondence position is retained, corresponding other non-searching keyword position is removed.

7. ciphertext cloud data complex query method according to claim 1, is characterized in that, step 7 specifically comprises following sub-step:

First 1.1 build LSSS matrix according to query logic expression formula, and its method is as follows: first root node vector is made as (1), its vector length is 1, and by variable cbe initialized as 1, father node uses vector v mark; If father node is OR door, child nodes by v mark; If father node is AND door, left child nodes is v || 1, right child nodes is (0 ... 0)|| -1, 0 number is c, and c= c+ 1; Complete after the mark of whole tree leaf node composition LSSS matrix m row, if length not etc., does not fill 0;

New index binary vector and LSSS matrix are carried out inner product calculating by 1.2, and result of calculation that and if only if is (1,0,0 ..., 0)time, show that file meets querying condition, otherwise do not meet querying condition.

8. a ciphertext cloud data complex query method, comprises data owner, user and high in the clouds, it is characterized in that,

Data owner is used for using existing point word algorithm to extract keyword to its file set, and builds the binary vector index of All Files;

Data owner also, for using Symmetric Cryptography to be encrypted to file, if based on data block, also will carry out piecemeal by setting data block size by file, then uses Symmetric Cryptography to be encrypted, and then the file of encryption is sent to high in the clouds;

User is used for to the mandate of data owner's requesting query;

Data owner is also for providing authorization token according to appointment security strategy to user;

User is also for using token information to build inquiry binary vector;

User also carries out inner product calculating to judge whether file comprises searching keyword for the index binary vector that uses inquiry binary vector and All Files;

User is also for building the new index binary vector corresponding with searching keyword;

User is also for searching keyword is generated to LSSS matrix according to logical expression, and new index binary vector and LSSS matrix are carried out to inner product calculating;

User is the file cipher text for comprising searching keyword to high in the clouds request also, and uses the file secret key decryption file comprising in token;

High in the clouds is used for store data, and responds user's read-write requests.