Data storage server and client device for securely storing data

Abstract

The invention relates to a client device (110) for storing data (125a) in a database (125) of a data storage server (120). The data comprises data elements, each data element being within a sub-range of a range, identified by a sub-range identifier. The client device is configured to encrypt the data elements and to send the data comprising the encrypted data elements to the server. The client device is further configured to, for each sub-range, encrypt a sub-range data bucket, wherein each sub-range data bucket comprises the data elements within the respective sub-range and the corresponding encrypted data elements. Furthermore, the client device is configured to, for each sub-range, send a respective encrypted sub-range data bucket and a message digest of the respective sub-range identifier or a message authentication code (MAC) of the respective encrypted sub-range data bucket and the respective sub-range identifier to the server for storage in the database.

Description

TECHNICAL FIELD

[0001] The present invention relates to a data storage system. More specifically, the present invention relates to a client device and a data storage server for securely storing security sensitive data (including numerical data and / or textual data) and enabling range queries of the security sensitive data. BACKGROUND

[0002] Remote data storage (e.g. cloud data storage) is increasingly popular since it enables user client devices (which typically can only store limited data) to save data and files in one or more remote data storage servers that can be accessed over the public Internet or a dedicated private network. Cloud storage providers host, protect, manage and maintain the data storage servers and associated infrastructure and ensure access to the data by the user client devices. One of the main advantages of cloud storage is that user data can be recovered from the remote data storage servers when the data has been deleted, corrupted or is otherwise inaccessible on the user client devices. However, since the cloud storage provider is responsible for protecting the user data that is transmitted to the remote data storage servers, the cloud storage provider can potentially access security sensitive user data which the user does not want to see and / or which is in violation of laws and regulations. Typically, the security sensitive data to be stored in the remote data storage servers includes security sensitive data such as numerical data or textual data which can be queried in plain text but which cannot be conveniently queried by range queries etc. if encrypted. SUMMARY

[0003] It is an object of the present invention to provide an improved client device and an improved data storage server to enable secure cloud storage of security sensitive data (e.g. numerical data and / or textual data) and to enable range queries of the security sensitive data.

[0004] The above and other objects are achieved by the subject-matter claimed by the independent claims. Other implementations are apparent from the dependent claims, the description and the drawings.

[0005] According to a first aspect, a client device comprising a processor is provided. The processor is configured to obtain, e.g. from an application running on the client device or another communication device, security sensitive data. The security sensitive data comprises a plurality of plain text data elements, each data element of the plurality of plain text data elements being within one of a plurality of sub-ranges of a range (e.g. a range of values), each sub-range of the plurality of sub-ranges being identified by a sub-range identifier. The plurality of plain text data elements can be queried in plain text and can comprise, e.g. numerical and / or textual data, i.e. a string of letters.

[0006] The processor in the client device is configured to encrypt the plurality of plaintext data elements using a first encryption key to obtain a plurality of ciphertext data elements. Further, the processor in the client device is configured to send the data comprising the plurality of ciphertext data elements to a data storage server for storing the data in a database of the data storage server, in particular in a first table of the database. The processor in the client device is further configured to, for each of the plurality of sub-ranges, encrypt a sub-range data bucket using a second encryption key, wherein each sub-range data bucket comprises plaintext data elements and corresponding ciphertext data elements within the respective sub-range. Further, the processor in the client device is configured to, for each of the plurality of sub-ranges, send a respective encrypted sub-range data bucket and a message digest of the respective sub-range identifier or a message authentication code (MAC) based on a MAC key of the respective encrypted sub-range data bucket and the respective sub-range identifier to the data storage server for storing the plurality of encrypted sub-range data buckets and the plurality of message digests or the plurality of MACs of the sub-range identifiers in the database of the data storage server, in particular in a second table of the database. The client device can be one of a plurality of client devices for storing security sensitive data in a remote storage server.

[0007] In a further possible implementation form of the first aspect, the database is a relational database, the data comprising the plurality of ciphertext data elements is stored in a first table of the relational database, and the plurality of encrypted sub-range data buckets and the plurality of message digests or MACs of the sub-range identifiers are stored in a second table of the database.

[0008] In a further possible implementation form of the first aspect, the plurality of ciphertext data elements are stored in one or more columns of the first table of the relational database. In an implementation form, one or more encrypted columns of the first table of the relational database can comprise column elements encrypted using different encryption keys. For example, a first column element can be encrypted using an encryption key of a first client device, while a second column element can be encrypted using an encryption key of a second client device.

[0009] In a further possible implementation form of the first aspect, the processor in the client device is further configured to send an identifier of the first encryption key together with the data comprising the plurality of ciphertext data elements to the data storage server for storing the data in the database of the data storage server according to the identifier of the first encryption key, in particular in the first table of the database. In other words, according to the identifier of the first encryption key, the remote database server is configured to determine a location in the database where encryption security sensitive data is stored.

[0010] In a further possible implementation form of the first aspect, the processor in the client device is further configured to obtain an encrypted version of at least one of the first encryption key, the second encryption key and the MAC key from a remote key management server, wherein the encrypted first encryption key, the encrypted second encryption key and the encrypted MAC key are encrypted using a client device master key. In a further implementation form, the processor in the client device can be configured to receive the client device master key from the remote key management server. In a further implementation form, the client device is configured to generate at least one of the first encryption key, the second encryption key and the MAC key.

[0011] In a further possible implementation form of the first aspect, the processor in the client device is further configured to send at least one of the encrypted first encryption key, the encrypted second encryption key and the encrypted MAC key to the data storage server. In an implementation form, the encrypted first encryption key can be used as the identifier of the first encryption key for storing the data comprising the plurality of ciphertext data elements in the database of the data storage server according to the first identifier, in particular in the first table of the database.

[0012] In a further possible implementation form of the first aspect, for processing a selection query on the data stored in the database of the data storage server comprising the plurality of ciphertext data elements, the processor in the client device is configured to determine sub-range identifiers of sub-ranges covered by a query value range (e.g. a query value range defined by the selection query) to obtain a subset of the plurality of sub-range identifiers, obtain one or more data buckets of the plurality of encrypted data buckets from the second table of the database of the data storage server according to a message digest or a MAC of one or more sub-range identifiers within the subset of the plurality of sub-range identifiers, decrypt the one or more encrypted data buckets using the second encryption key to obtain one or more pairs of plaintext data elements and ciphertext data elements per encrypted data bucket, and obtain the data stored in the database of the data storage server according to the one or more ciphertext data elements, i.e. query the data stored in the database of the data storage server using the one or more ciphertext data elements to obtain at least a part of the data associated with the one or more ciphertext data elements.

[0013] In a further possible implementation form of the first aspect, the processor in the client device is further configured to check according to the plaintext data elements whether the respective data element is within the query range.

[0014] In a further possible implementation form of the first aspect, the processor in the client device is further configured to encrypt the plaintext data elements according to a random encryption scheme or a deterministic encryption scheme using the first encryption key.

[0015] In a further possible implementation form of the first aspect, the first encryption key and the second encryption key are the same symmetric encryption key, i.e. the same encryption key.

[0016] In a further possible implementation form of the first aspect, the MAC is a hash-based message authentication code (HMAC).

[0017] According to a second aspect, a method for operating a client device is provided. The method comprises the following steps: obtaining data comprising a plurality of plaintext data elements, wherein each data element of the plurality of plaintext data elements is within one of a plurality of sub-ranges of a range (e.g. a range of values), each sub-range of the plurality of sub-ranges being identified by a sub-range identifier; encrypting the plurality of plaintext data elements using a first encryption key to obtain a plurality of ciphertext data elements; sending the data comprising the plurality of ciphertext data elements to a data storage server for storing the data in a database of the data storage server, in particular in a first table of the database of the data storage server; for each sub-range of the plurality of sub-ranges, encrypting a sub-range data bucket using a second encryption key, wherein each sub-range data bucket comprises plaintext data elements within the respective sub-range and corresponding ciphertext data elements; for each sub-range of the plurality of sub-ranges, sending a message digest of the respective encrypted sub-range data bucket and the respective sub-range identifier or a message authentication code (MAC) based on a MAC key of the respective encrypted sub-range data bucket and the respective sub-range identifier to the data storage server for storing the plurality of encrypted sub-range data buckets and the plurality of message digests or MACs of the sub-range identifiers in the database, in particular in a second table of the database of the data storage server.

[0018] The method according to the second aspect of the application can be performed by the client device according to the first aspect of the application. Therefore, further features of the method according to the second aspect of the application are directly derived from the functionality of the client device according to the first aspect of the application and its different implementations described in the foregoing and hereinafter.

[0019] According to a third aspect, a data storage server comprising a processor is provided. The processor in the data storage server is configured to receive data from a client device. The data comprises a plurality of ciphertext data elements encrypted using a first encryption key from a plurality of plaintext data elements, each data element in the plurality of plaintext data elements being within one of a plurality of sub-ranges of a range (e.g. a range of values), each sub-range in the plurality of sub-ranges being identified by a sub-range identifier. Further, the processor in the data storage server is configured to, for each sub-range in the plurality of sub-ranges, receive a message digest of an encrypted sub-range data bucket and the respective sub-range identifier encrypted using a second encryption key or a message authentication code (MAC) based on a MAC key of an encrypted sub-range data bucket and the respective sub-range identifier encrypted using the second encryption key. The processor in the data storage server is further configured to store the plurality of encrypted sub-range data buckets and the plurality of message digests or MACs of the sub-range identifiers in a database of the data storage server. Each encrypted sub-range data bucket comprises plaintext data elements within the respective sub-range and corresponding ciphertext data elements.

[0020] In a further possible implementation form of the third aspect, the database is a relational database, and the processor in the data storage server is further configured to store the data comprising the plurality of ciphertext data elements in a first table of the database and the plurality of encrypted sub-range data buckets and the plurality of message digests or MACs of the sub-range identifiers in a second table of the database.

[0021] In a further possible implementation form of the third aspect, the processor in the data storage server is further configured to store the plurality of ciphertext data elements in one or more columns of the first table of the database. In an implementation form, one or more encrypted columns in the first table of the relational database can comprise column elements encrypted using different encryption keys. For example, a first column element can be encrypted using an encryption key of a first client device, while a second column element can be encrypted using an encryption key of a second client device.

[0022] In a further possible implementation form of the third aspect, the processor in the data storage server is further configured to receive, from the client device, the encrypted first encryption key, the encrypted second encryption key, and the encrypted MAC key. In an implementation form, the encrypted first encryption key can be used as the identifier of the first encryption key for storing the data comprising the plurality of ciphertext data elements in the database of the data storage server, in particular in the first table of the database, according to the first identifier.

[0023] In a further possible implementation form of the third aspect, the processor in the data storage server is further configured to receive, from the client device, the encrypted first encryption key, the encrypted second encryption key, and the encrypted MAC key. In an implementation form, the encrypted first encryption key can be used as the identifier of the first encryption key for storing the data comprising the plurality of ciphertext data elements in the database of the data storage server, in particular in the first table of the database, according to the first identifier.

[0024] In a further possible implementation form of the third aspect, for processing a selection query on the data comprising the plurality of ciphertext data elements stored in the database, in particular in the first table of the database, the processor in the data storage server is further configured to select one or more data buckets from a plurality of encrypted data buckets stored in the database, in particular in the second table of the database, according to one or more message digests or MACs of one or more sub-range identifiers received from the client device. The processor in the data storage server is further configured to send the one or more data buckets selected from the plurality of encrypted data buckets to the client device. Furthermore, the processor in the data storage server is configured to query the data stored in the database, in particular in the first table of the database, according to one or more ciphertext data elements received from the client device.

[0025] In a further possible implementation form of the third aspect, the first encryption key and the second encryption key are the same symmetric encryption key, i.e. the same encryption key.

[0026] In a further possible implementation form of the third aspect, the MAC is a hash-based message authentication code (HMAC).

[0027] According to a fourth aspect, a method of operating a data storage server is provided. The method comprises the following steps: receiving data from a client device, wherein the data comprises a plurality of ciphertext data elements encrypted using a first encryption key from a plurality of plaintext data elements, each data element of the plurality of plaintext data elements being within one of a plurality of sub-ranges of a range (e.g. a range of values), each sub-range of the plurality of sub-ranges being identified by a sub-range identifier; for each sub-range of the plurality of sub-ranges, receiving a message digest of an encrypted sub-range data bucket and the corresponding sub-range identifier encrypted using a second encryption key or a message authentication code (MAC) based on a MAC key of an encrypted sub-range data bucket and the corresponding sub-range identifier encrypted using the second encryption key; storing the plurality of encrypted sub-range data buckets and the plurality of message digests or MACs of the sub-range identifiers in a database of the data storage server, wherein each encrypted sub-range data bucket comprises plaintext data elements within the respective sub-range and corresponding ciphertext data elements.

[0028] The method according to the fourth aspect of the present application can be performed by the data storage server according to the third aspect of the present application. Therefore, further features of the method according to the fourth aspect of the present application are directly derived from the functionality of the data storage server according to the third aspect of the present application and its different implementations described hereinbefore and hereinafter.

[0029] According to a fifth aspect, a computer program product comprising a non-transitory computer readable storage medium is provided. The non-transitory computer readable storage medium is configured to store program code which, when executed by a computer or a processor, causes the computer or the processor to perform the method according to the second aspect or the method according to the fourth aspect.

[0030] The details of one or more embodiments are set forth in the accompanying drawings and the description below. Other features, objects, and advantages will be apparent from the description and drawings, and from the claims. BRIEF DESCRIPTION OF DRAWINGS

[0031] Embodiments of the present application will be described below in detail with reference to the accompanying drawings, in which:

[0032] Figure 1 is a schematic diagram of a data storage system according to an embodiment, the data storage system comprising a plurality of client devices according to an embodiment and a data storage server according to an embodiment operating a database;

[0033] Figure 2a , Figure 2b and Figure 2cThe illustration shows a table used by a client device provided in one embodiment and a data storage server provided in another embodiment to store security-sensitive data.

[0034] Figure 3 This is a sequence diagram showing the interaction between a client device provided in one embodiment, a data storage server provided in another embodiment, and a key management server in order to generate a column of encrypted data in the database of the data storage server;

[0035] Figure 4 This is a timing diagram showing the interaction between a client device provided in one embodiment, a data storage server provided in another embodiment, and a key management server in order to retrieve data from the database of the data storage server;

[0036] Figure 5 This is a sequence diagram showing the interaction between a client device provided in one embodiment, a data storage server provided in another embodiment, and a key management server in order to add data to the database of the data storage server;

[0037] Figure 6 This is a sequence diagram showing the interaction between a client device provided in one embodiment, a data storage server provided in another embodiment, and a key management server in order to update data in the database of the data storage server;

[0038] Figure 7 This is a flowchart illustrating a method for storing client device data in a database of a remote data storage server, as provided in one embodiment.

[0039] Figure 8 This is a flowchart illustrating a method for operating a data storage server including a database, as provided in one embodiment.

[0040] In the following text, the same reference numerals refer to the same or at least functionally equivalent features. Detailed Implementation

[0041] In the following description, reference is made to the accompanying drawings, which form part of this invention, which illustrate specific aspects of embodiments of the invention or aspects in which embodiments of the invention may be used by way of illustration. It should be understood that embodiments of the invention can be used in other aspects and include structural or logical variations not depicted in the drawings. Therefore, the following detailed description should not be construed as limiting, and the scope of the invention is defined by the appended claims.

[0042] For example, it will be understood that disclosure in connection with a described method can also hold true for a corresponding device or system configured to perform the method and vice versa. For example, if one or more specific method steps are described, a corresponding device can include one or more units (e.g., functionality units) to perform the described one or more method steps (e.g., one unit performing the one or more steps, or

[0043] Figure 1 FIG. 1 is a schematic diagram of a data storage system 100 provided in accordance with an embodiment. As described in detail below, the data storage system 100 includes a plurality of client or user devices 110 (e.g., smartphones, smartwatches, tablets, laptops, desktop computers, or other types of IoT devices), one or more remote data storage servers 120 that operate a database 125, and a key management server 130. Embodiments of the client devices 110 and the data storage servers 120 are described in detail below, where the database 125 is implemented as a relational database 125, e.g., a SQL-based relational database 125. In these embodiments, as described in detail below, the data storage servers 120 are configured to store security-sensitive data in one or more encrypted columns of one or more tables of the relational database 125. As used herein, an encrypted column of a table of the relational database 125 includes column elements that are encrypted using one or more encryption keys. In one embodiment, the one or more encrypted columns of a table of the relational database 125 can include column elements that are encrypted using different encryption keys. For example, a first column element can be encrypted using an encryption key of a first client device 110, while a second column element can be encrypted using an encryption key of a second client device 110.

[0044] However, it should be understood that data storage server 120 may include a non-relational database 125, and client device 110 may be used to operate with it, wherein security-sensitive data is stored in an encrypted data structure other than encrypted columns of tables. For example, in one embodiment, database 125 may be implemented as a MongoDB database (DB) 125. In this embodiment, data storage server 120 may be used to store security-sensitive data in one or more encrypted fields of MongoDB 125.

[0045] like Figure 1 As shown in Figure a, multiple client devices 110, one or more remote data storage servers 120, and a key management server 130 can be used to communicate with each other via a wireless (e.g., cellular) and / or wired communication network 140. In one embodiment, one or more remote data storage servers 120 can be one or more cloud storage servers 120 used to communicate with client devices 110 via the Internet.

[0046] like Figure 1 As shown, client device 110 may include a processor 111 for processing and generating data, a communication interface 113 (including an antenna, etc.) for exchanging data with other components in data storage system 100, and a non-transient memory 115 for storing data. The processor 111 in client device 110 may be implemented in hardware and software. The hardware may include digital circuitry, or both analog and digital circuitry. The digital circuitry may include components such as application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), or general-purpose processors. The non-transient memory 115 may store data, such as electronic keys and executable program code, which, when executed by processor 111, causes client device 110 to perform the functions, operations, and methods described herein. The communication interface 113 may include a wired or wireless communication interface 113. Similarly, the data storage server 120 may include a processor 121 for processing and generating data, a communication interface 123 for exchanging data with other components in the data storage system 100, and a database 125 for storing data.

[0047] The client device 110 is configured to store data 125a in a database 125 of the remote data storage server 120. The data 125a includes a plurality of security-sensitive plaintext data elements. The plurality of plaintext data elements can be queried in plaintext and can include, for example, numeric values (e.g., integer values, real values, floating point values, etc.) and / or textual data (e.g., strings of letters). While the following detailed embodiments are described in the context of plaintext data elements in the form of numeric values in plaintext, it should be understood that these embodiments are also applicable to other types of plaintext data elements that can be queried, such as textual data.

[0048] For example, the plurality of security-sensitive plaintext data elements can include Figure 2a The salary values 200b (each salary value is associated with the name 200c of the person who earned the salary) in the table 200 shown. Each data element in the plurality of plaintext data elements (e.g., the numeric values 200b) is within one of a plurality of sub-ranges of a range (e.g., a range of values), where each sub-range is identified by a sub-range identifier 200a (e.g., the sub-range identifiers 200a shown in the table 200).

[0049] The client device 110 is configured to encrypt the plurality of plaintext numeric values 200b using a first symmetric encryption key 115a to obtain a plurality of ciphertext numeric values 210a (shown in the table 210 shown). In addition, the client device 110 is configured to send the data 125a including the plurality of ciphertext numeric values 210a and the plaintext names 200c of the people who earned the corresponding salaries to the data storage server 120 to store the data 125a in the first table 210 of the database 125 of the data storage server 120, e.g., in the exemplary first table 210 shown. Figure 2b Figure 2b The client device 110 is configured to encrypt the plurality of plaintext numeric values 200b using a first symmetric encryption key 115a to obtain a plurality of ciphertext numeric values 210a (shown in the table 210 shown). In addition, the client device 110 is configured to send the data 125a including the plurality of ciphertext numeric values 210a and the plaintext names 200c of the people who earned the corresponding salaries to the data storage server 120 to store the data 125a in the first table 210 of the database 125 of the data storage server 120, e.g., in the exemplary first table 210 shown.

[0050] In addition, the client device 110 is configured to, for each sub-range, encrypt a sub-range data bucket using a second encryption key 115a. In one embodiment, the first encryption key 115a and the second encryption key 115a can be the same symmetric encryption key 115a. In another embodiment, the first encryption key and the second encryption key can be different symmetric encryption keys. Each sub-range data bucket includes the plaintext numeric values 200b and the corresponding ciphertext numeric values 210a within the respective sub-range. In one embodiment, the client device 110 is configured to sort the plurality of pairs of plaintext numeric values and ciphertext numeric values within the respective data bucket according to the plaintext numeric values 200b.

[0051] The client device 110 is also configured to, for each sub-range, store a respective encrypted sub-range data bucket 220b (shown in the table 220 shown) in the database 125 of the data storage server 120. In one embodiment, the client device 110 is configured to store the encrypted sub-range data bucket 220b in the database 125 of the data storage server 120 using the first symmetric encryption key 115a. Figure 2c ​The message digest (e.g., hash value) of the respective sub-range data bucket 220b and the respective sub-range identifier or the MAC 220a of the respective sub-range data bucket 220b and the respective sub-range identifier based on the MAC key 115b is sent to the data storage server 120 to store the plurality of message digests or the plurality of MACs 220a of the plurality of encrypted sub-range data buckets 220b and the sub-range identifiers in a second table 220 of the database 125 of the data storage server 120, e.g., in the second table 220 of the database 125 of the data storage server 120. Figure 2c The exemplary table 220 is shown in FIG. 2B.

[0052] In addition to the client device 110, the data storage server 120 is configured to store data 125a in a relational database 125 of the data storage server 120. The data storage server 120 is configured to receive, from the client device 110, data 125a comprising a plurality of ciphertext values 210a and plaintext data 200c associated therewith, to store the data 125a in a first table 210 of the database 125, wherein the plurality of ciphertext values 210a are encrypted using a first encryption key 115a. Further, the data storage server 120 is configured to receive, for each of a plurality of sub-ranges, a respective message digest (e.g., hash value) of a respective sub-range data bucket 220b and a respective sub-range identifier encrypted using a second encryption key 115a or a respective MAC 220a of the respective sub-range data bucket 220b and the respective sub-range identifier based on a MAC key 115b, to store the plurality of message digests or the plurality of MACs 220a of the plurality of encrypted sub-range data buckets 220b and the sub-range identifiers in a second table 220 of the database 125. As described above, each sub-range data bucket 220b comprises plaintext values 200b and corresponding ciphertext values 210a within the respective sub-range.

[0053] In one embodiment, the client device is further configured to obtain, from the data storage server 120, an encrypted version of the first encryption key 115a, an encrypted version of the second encryption key 115a, and / or an encrypted version of the MAC key 115b. The encrypted first encryption key 115a, the encrypted second encryption key 115a, and / or the encrypted MAC key 115b can be encrypted using a client device master key. In one embodiment, the client device 110 is configured to receive the client device master key from a remote key management server 130. In one embodiment, the client device 110 is configured to encrypt the plaintext values 200b using the first encryption key 115a according to a random encryption scheme or a deterministic encryption scheme. In one embodiment, the MAC is an HMAC.

[0054] In one embodiment, the client device 110 is further configured to send an identifier of the first encryption key 115a to the data storage server 120 together with the data 125a comprising the plurality of ciphertext values 210a. In turn, the data storage server 120 is configured to store the data 125a in the database 125 according to the first identifier. Thus, according to the identifier of the first encryption key 115a, the data storage server 120 can be configured to determine a location in the database 125 where the data 125a comprising the plurality of ciphertext values 210a is stored.

[0055] In one embodiment, the client device 110 is further configured to send the encrypted first encryption key 115a, the encrypted second encryption key 115a and / or the encrypted MAC key 115b to the data storage server 120. In one embodiment, the encrypted first encryption key 115a can be used as an identifier of the first encryption key 115a to store the data 125a comprising the plurality of ciphertext values 210 in the database 125 of the data storage server 120 according to the identifier, in particular in the first table 210 of the database 125.

[0056] In one embodiment, database configuration information for identifying rows and / or columns of the relational database 125 that are encrypted using a respective encryption key can be stored in the memory 115 of the client device 110. In one embodiment, the database configuration information can comprise one or more metadata tables. In one embodiment, such metadata tables can use a first value (e.g. "1") to indicate each encrypted row and / or column in the relational database 125 and a second value (e.g. "0") different from the first value to indicate each non-encrypted row and / or column in the relational database 125. Alternatively or additionally, the database configuration information can comprise a column of encrypted rows and / or columns in the relational database and their respective encryption keys. For example, a first column element of a table of the relational database 125 can be encrypted using an encryption key of a first client device 110, while a second column element can be encrypted using an encryption key of a second client device 110. For the case of encrypted columns, the data storage server 120 is configured to determine a row of the encrypted column 127b to store the encrypted security sensitive data according to an identifier of the encryption key.

[0057] According to the database configuration information, the client device 110 is configured to identify encrypted rows and / or columns in the first table 210 of the relational database 125, thereby determining whether the data to be stored in the relational database 125 comprises security sensitive data to be stored in one of the encrypted rows and / or columns 127b of the first table 210 of the relational database 125, wherein the encrypted rows and / or columns are identified by the database configuration information.

[0058] In one embodiment, the client device 101 can be configured to periodically poll the database configuration information from the remote data storage server 120. In the event that the relational database 125 changes, for example in the event that there are new or changed encrypted rows and / or columns of the relational database 125, the data storage server 120 can be configured to provide updates to the database configuration information to the client device 110.

[0059] In one embodiment, to process a select query on the data 125a comprising a plurality of ciphertext values 210a stored in the first table 210 of the database 125 of the data storage server 120, the client device 110 is configured to determine a subset of the plurality of sub-range identifiers 200a that are covered by the query value range defined by the select query. For example, in the illustrated example, to process the example select query on all salaries within the query value range 1500-2500, the client device 110 can determine the sub-range identifiers “2” and “3”. Figure 2a In the illustrated example, to process the example select query on all salaries within the query value range 1500-2500, the client device 110 can determine the sub-range identifiers “2” and “3”. From the MAC of at least one of the determined sub-range identifiers (i.e., the subset of the plurality of sub-range identifiers 200a), the client device 110 is further configured to retrieve one or more data buckets of the plurality of encrypted data buckets 220b from the second table 220 of the database 125 of the data storage server 120. For example, to process the example select query on all salaries within the query value range 1500-2500, the client device 110 can retrieve the data buckets associated with MAC(2) and MAC(3) from the second table 220. The retrieved encrypted data buckets from the database 125 are decrypted by the client device 110 using the second encryption key 115a to obtain one or more pairs of plaintext values and ciphertext values for each encrypted data bucket. From the one or more ciphertext values, the client device 100 is further configured to retrieve the data 125a stored in the first table 210 of the database 125 of the data storage server 120, i.e., query the data 125a stored in the first table 210 of the database 125 of the data storage server 120 using the one or more ciphertext values, to obtain a portion of the data 125a associated with the one or more ciphertext values.

[0060] In one embodiment, the client device 110 is further configured to check whether the corresponding value is within the query value range according to the plaintext value 200b.

[0061] In addition to the present embodiments of the client device 110, according to one embodiment, the data storage server 120 for processing a select query on data stored in the first table 210 of the database 125 that includes a plurality of ciphertext values 210a is configured to send one or more data buckets of a plurality of encrypted data buckets 220b stored in the second table 220 of the database 125 to the client device 110. The data storage server 120 is configured to select the one or more data buckets of the plurality of encrypted data buckets 220b according to one or more MACs 220a of one or more sub-range identifiers received from the client device 110. In addition, the data storage server 120 can be configured to query the data stored in the first table 210 of the database 125 according to one or more ciphertext values received from the client device 110.

[0062] Figure 3 FIG. 4 is a timing diagram illustrating the interaction of the client device 110, the remote data storage server (referred to as the database server) 120, and the remote key management server (KMS) 130 in the process of creating an encrypted column (i.e., a column of ciphertext values 210a in the first table 210 of the relational database 125 of the remote data storage server 120) according to one embodiment.

[0063] Step 301 : The client driver 111a (which can be software executed by the processor 111 in the client device 110) in the client device 110 generates a first encryption key 115a. The encryption key 115a can be, for example, a nonce generated by the client driver 111a.

[0064] Step 303: The client driver 111a in the client device 110 requests the KMS 130 to encrypt the encryption key 115a. In one embodiment, the KMS 130 can encrypt the encryption key 115a using a client master key associated with the client device 110. In one embodiment, the KMS 130 can generate the client master key in real-time in response to the request by the client device 110 to encrypt the encryption key 115a, or the client master key can already be available on the KMS 130 (e.g., due to a previous request).

[0065] Step 305: The KMS 130 returns the encrypted encryption key 115a to the client device 110.

[0066] Step 307: The client driver 111a in the client device 110 generates a range HMAC key 115b. The range HMAC key 115b can be, for example, a random number generated by the client driver 111a. It should be appreciated that step 307, as well as later steps 309 and 311, can be performed prior to or substantially contemporaneously with the above-described steps 301, 303, and 305.

[0067] Step 309: The client driver 111a in the client device 110 requests the KMS 130 to encrypt the range HMAC key 115b. In one embodiment, the KMS 130 can encrypt the range HMAC key 115b using a client master key associated with the client device 110.

[0068] Step 311: The KMS 130 returns the encrypted range HMAC key 115b to the client device 110.

[0069] Step 313: The client driver 111a in the client device 110 sends the encrypted encryption key 115a and the encrypted range HMAC key 115b to the remote data storage server 120. In one embodiment, the client driver 111a can send the encrypted encryption key 115a and the encrypted range HMAC key 115b to the remote data storage server 120 as part of the database configuration information.

[0070] Step 315: In response to an acknowledgement message from the remote data storage server that the encrypted encryption key 115a and the encrypted range HMAC key 115b were received, the client driver 111a in the client device 110 instructs the remote data storage server 120 to create a table 210 that includes the security-sensitive numerical values 210a of the encrypted column.

[0071] Step 317: The client driver 111a in the client device 110 instructs the remote data storage server 120 to create a second table 220, i.e., a range table 220 that includes a range column 220a and encrypted data buckets 220b. It should be appreciated that step 317 can be performed prior to or substantially contemporaneously with the above-described step 315.

[0072] Step 319: The client driver 111a in the client device 110 instructs the remote data storage server 120 to add a row in the metadata table to update the database configuration information.

[0073] The remote data storage server 120 reports to the client device 110 that the operation was successful.

[0074] Figure 4 One embodiment is shown in which the client device 110, a remote data store server (referred to as a database server) 120, and a remote key management server (KMS) 130 interact in the process of extracting (i.e., retrieving) an encrypted security sensitive value 210a (and data 210b associated therewith) from the remote data store server 120. For example, in Figure 4 In the embodiment shown, the extraction of data is illustrated in the context of a select query.

[0075] Step 401 : The application 111b running on the client device 110 instructs the client driver 111a to execute a select query to extract the value 210a and data 210b associated therewith from the relational database 125 of the remote data store server 120.

[0076] Step 403: In response to step 401, the client driver 111a parses the select query of the application 111b to obtain the column names associated with the values to be extracted from the relational database 125 of the remote data store server 120. The client driver 111a identifies the column names of the table 210 stored in the memory 115 of the client device 110 in accordance with the parsed select query.

[0077] Step 405: The client driver 111a in the client device 110 requests the KMS 130 to decrypt the respective range HMAC key 115b for each column of the relational database 125 storing the encrypted security sensitive value 210a identified in step 403. If the respective range HMAC key(s) 115b are cached in the memory 115 of the client device 110, then this step and the following step 407 can be omitted.

[0078] Step 407: The KMS 130 returns the requested decrypted range HMAC key(s) 115b to the client device 110.

[0079] Step 409: The client driver 111a in the client device 110 requests the KMS 130 to decrypt the respective encryption key 115a for each column of the relational database 125 storing the encrypted security sensitive value 210a identified in step 403. If the respective encryption key(s) 115a are cached in the memory 115 of the client device 110, then this step and the following step 411 can be omitted.

[0080] Step 411: The KMS 130 returns the requested one or more decrypted encryption keys 115a to the client device 110. It will be appreciated that steps 409 and 411 can be performed before or substantially contemporaneously with steps 405 and 407 described above.

[0081] Step 413: The client driver 111a in the client device 110 generates a range of values.

[0082] Step 415: The client driver 111a in the client device 110 determines an HMAC range.

[0083] Step 417: In accordance with the HMAC range determined in step 415, the client driver 111a in the client device 110 queries the range 220a of the second table, i.e. the range table 220 stored in the relational database 125 of the data storage server 120.

[0084] Step 419: In response to the query in step 417, the data storage server 120 returns a matching encryption data bucket 220b to the client driver 111a in the client device 110.

[0085] Step 421: The client driver 111a in the client device 110 decrypts the encryption data bucket 220b received from the data storage server 120 and the ciphertext contained therein.

[0086] Step 423: The client driver 111a in the client device 110 filters out irrelevant ciphertexts in accordance with the actual values of the ciphertexts.

[0087] Step 425: The client driver 111a in the client device 110 sends a query to the data storage server 120 to query the relational database 125 using the ciphertext numerical values 210a obtained in step 423.

[0088] Step 427: In response to the query of step 425, the data storage server 120 returns the queried table rows.

[0089] Step 429: The client driver 111a in the client device 110 forwards the table rows provided by the data storage server 120 to the application 111b in the client device 110.

[0090] Figure 5 One embodiment is shown in which the client device 110, the remote data storage server (referred to as the database server) 120 and the remote key management server (KMS) 130 interact in the process of inserting (i.e. adding) a security sensitive numerical value to obtain a new numerical value range (i.e. a numerical value range that has not been defined yet).

[0091] Step 501 : The application program 111b running on the client device 110 instructs the client driver 111a to execute a query that inserts other values into the relational database 125 of the remote data store server 120.

[0092] Step 503: In response to step 501, the client driver 111a parses the query of the application program 111b to obtain column names associated with data to be stored in the relational database 125 of the remote data store server 120.

[0093] Step 505: The client driver 111a identifies the column names stored in the memory 115 of the client device 110 in accordance with the parsed query.

[0094] Step 507: The client driver 111a in the client device 110 requests the KMS 130 to decrypt the respective encryption key 115a for each column of the relational database 125 storing encryption security sensitive values identified in step 505. If the respective encryption key(s) 115a is cached in the memory 115 of the client device 110, then this step and the following step 509 can be omitted.

[0095] Step 509: The KMS 130 returns the requested decrypted encryption key(s) 115a to the client device 110.

[0096] Step 511 : The client driver 111a in the client device 110 requests the KMS 130 to decrypt the respective range HMAC key 115b for each column of the relational database 125 storing encryption security sensitive values identified in step 505. If the respective range HMAC key(s) 115b is cached in the memory 115 of the client device 110, then this step and the following step 513 can be omitted.

[0097] Step 513: The KMS 130 returns the requested decrypted range HMAC key(s) 115b to the client device 110. It should be appreciated that steps 511 and 513 can be performed prior to or substantially concurrently with steps 509 and 511 described above.

[0098] Step 515: The client driver 111a in the client device 110 encrypts the security sensitive values of the other data to be inserted into the relational database 125 using the encryption key(s) 115a.

[0099] Step 517: The client driver 111a in the client device 110 instructs the remote data storage server 120 to create a new row in the first table 210 stored in the relational database 125 that includes the encrypted security sensitive numeric value.

[0100] Step 519: The client driver 111a in the client device 110 generates a range of values and determines an HMAC for the range using an HMAC function according to the range HMAC key 115b.

[0101] Step 521: The client driver 111a in the client device 110 checks with the data storage server 120 whether a new HMAC value corresponding to the new range already exists in the second table, i.e. the range table 220 of the relational database 125.

[0102] Step 523: The data storage server 120 informs the client driver 111a in the client device 110 that a new HMAC value corresponding to the new range does not yet exist in the range table 220 of the relational database 125.

[0103] Steps 525, 527 and 529: The client driver 111a in the client device 110 creates a new data bucket, adds the encrypted numeric value to the new data bucket, and encrypts the new data bucket.

[0104] Step 531: The client driver 111a in the client device 110 instructs the data storage server 120 to add a new row in the range table 220 stored in the relational database 125. In one embodiment, the data storage server 120 is used to add the HMAC, i.e. the HMAC value 220a, and the encrypted data bucket 220b to the new row of the range table 220.

[0105] Step 533: In response to the data storage server 120 confirming that the new row has been added to the range table 220 stored in the relational database 125, the client driver 111a in the client device 110 deletes the column encryption key 115a from the memory 115.

[0106] Step 535: The client driver 111a in the client device 110 deletes the range HMAC key 115b from the memory 115. It is to be understood that step 535 can be performed before or substantially simultaneously with step 533 described above.

[0107] In response to the data storage server 120 confirming that the new row has been added to the range table 220 stored in the relational database 125, the client driver 111a can report the confirmation message to the application 111b in the client device 110 that issued the original insert query request.

[0108] Figure 6 One embodiment is shown in which the client device 110, the remote data storage server (referred to as the database server) 120, and the remote key management server (KMS) 130 interact in the process of updating the security-sensitive values in the first table 210 according to the already used range of values.

[0109] Step 601 : The application program 111b running on the client device 110 instructs the client driver 111a to execute a query that inserts other values into the relational database 125 of the remote data storage server 120, where the other values are within the already used range of values.

[0110] Step 603: In response to step 601, the client driver 111a parses the query of the application program 111b to obtain the column names associated with the data to be stored in the relational database 125 of the remote data storage server 120.

[0111] Step 605: The client driver 111a identifies the column names of the first table 210 stored in the memory 115 of the client device 110 according to the parsed query.

[0112] Step 607: The client driver 111a in the client device 110 requests the KMS 130 to decrypt the respective encryption key 115a for each column of the relational database 125 storing encrypted security-sensitive values identified in step 605. If the respective encryption key(s) 115a is / are cached in the memory 115 of the client device 110, then this step and the following step 609 can be omitted.

[0113] Step 609: The KMS 130 returns the requested decrypted column encryption key(s) 115a to the client device 110.

[0114] Step 611 : The client driver 111a in the client device 110 requests the KMS 130 to decrypt the respective range HMAC key 115b for each column of the relational database 125 storing encrypted security-sensitive values 210a identified in step 605. If the respective range HMAC key(s) 115b is / are cached in the memory 115 of the client device 110, then this step and the following step 613 can be omitted.

[0115] Step 613: The KMS 130 returns the requested one or more decrypted range HMAC keys 115b to the client device 110. It will be appreciated that steps 611 and 613 can be performed prior to, or substantially contemporaneously with, steps 609 and 611 described above.

[0116] Step 615: The client driver 111a in the client device 110 encrypts the security sensitive value of other data to be inserted into the relational database 125 using the one or more encryption keys 115a.

[0117] Step 617: The client driver 111a in the client device 110 instructs the remote data storage server 120 to create a new row in the first table 210 stored in the relational database 125 that includes the encrypted security sensitive value.

[0118] Step 619: The client driver 111a in the client device 110 generates a range of values and determines a key hash value, i.e. HMAC value, for the range using an HMAC function according to the range HMAC key 115b.

[0119] Step 621: The client driver 111a in the client device 110 checks with the data storage server 120 whether the HMAC value corresponding to the range already exists in the second table 220, i.e. the range table 220 of the relational database 125.

[0120] Step 623: The data storage server 120 informs the client driver 111a in the client device 110 that the HMAC value corresponding to the range already exists in the range table of the relational database 125 by returning the corresponding encrypted data bucket 220b to the client driver 111a in the client device 110.

[0121] Step 625: The client driver 111a in the client device 110 decrypts the data bucket 220b, adds the encrypted value to the decrypted data bucket, and encrypts the modified data bucket.

[0122] Step 627: The client driver 111a in the client device 110 sends the encrypted modified data bucket 220b to the data storage server 120 so that the data storage server 120 can store the encrypted modified data bucket 220b in the second table 220 of the relational database 125 together with data buckets for other ranges of values. The client driver 111a is reported that the encrypted modified data bucket is successfully stored in the relational database 125.

[0123] Step 629: In response to the data storage server 120 confirming that the modified data bucket has been stored in the relational database 125, the client driver 111a in the client device 110 deletes the column encryption key 115a from the memory 115.

[0124] Step 631: The client driver 111a in the client device 110 deletes the range HMAC key 115b from the memory 115. It should be appreciated that step 631 can be performed before or substantially simultaneously with step 629 described above.

[0125] In response to the data storage server 120 confirming that the modified data bucket has been stored in the relational database 125, the client driver 111a can report the confirmation message to the application 111b in the client device 110 that issued the original insert query request.

[0126] Figure 7 FIG. 7 is a flowchart of a method 700 for operating the client device 110, according to an embodiment. The method 700 includes the following steps:

[0127] Step 701: Obtain data 125a including a plurality of plaintext data elements (e.g., numeric values 200b), wherein each data element of the plurality of plaintext data elements 200b is within one of a plurality of sub-ranges of a range (e.g., a range of values), each sub-range of the plurality of sub-ranges being identified by a sub-range identifier 200a.

[0128] Step 703: Encrypt the plurality of plaintext data elements 200b using a first encryption key 115a to obtain a plurality of ciphertext data elements 210a.

[0129] Step 705: Transmit the data 125a including the plurality of ciphertext data elements 210a to the data storage server 120 for storing the data 125a in a database 125 of the data storage server 120.

[0130] Step 707: For each sub-range of the plurality of sub-ranges, encrypt a sub-range data bucket 220b using a second encryption key 115a, wherein each sub-range data bucket 220b includes plaintext data elements within the respective sub-range and corresponding ciphertext data elements.

[0131] Step 709: For each of the plurality of sub-ranges, send the respective encrypted sub-range data bucket 220b and a message authentication code (MAC) 220a (or a message digest such as a hash value of the respective sub-range identifier) based on a MAC key 115b of the respective sub-range identifier 200a to the data storage server 120 to store the plurality of encrypted sub-range data buckets 220b and the plurality of MACs 220a (or message digests) of the sub-range identifiers 200a in the database 125 of the data storage server 120.

[0132] Figure 8 Figure 8 is a flow chart of a method 800 for operating a data storage server 120 according to an embodiment. The method 800 comprises the following steps:

[0133] Step 801 : Receive data 125a from a client device 110, wherein the data 125a comprises a plurality of ciphertext data elements, e.g. a plurality of ciphertext ciphertext values 210a encrypted from a plurality of plaintext data elements (e.g. numerical values 200b) using a first encryption key 115a, each data element of the plurality of plaintext data elements 200b being within one of a plurality of sub-ranges of a range of values, each of the plurality of sub-ranges being identified by a sub-range identifier 200a.

[0134] Step 803: For each of the plurality of sub-ranges, receive an encrypted sub-range data bucket 220b encrypted using a second encryption key 115a and a message authentication code (MAC) 220a (or a message digest such as a hash value) of the respective sub-range identifier 200a based on a MAC key 115b.

[0135] Step 805: Store the plurality of encrypted sub-range data buckets 220b and the plurality of MACs 220a (or message digests) of the sub-range identifiers 200a in a database 125 of the data storage server 120, wherein each encrypted sub-range data bucket 220b comprises plaintext data elements 200b within the respective sub-range and corresponding ciphertext data elements 210a.

[0136] Those skilled in the art will appreciate that the "blocks" ("units") in the various figures (method and apparatus) represent or describe a functionality (not necessarily a hardware or software in a separate "unit") of the embodiments of the application, and thus equally describe the functionality or features (units = steps) of the apparatus embodiments as well as the method embodiments.

[0137] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other manners. For example, the described embodiments of the device are merely exemplary. For example, the unit division is merely a logical function division, and other division manners can be adopted during actual implementation. For example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections can be implemented by using some interfaces. The indirect couplings or communication connections between the devices or units can be implemented in electronic, mechanical or other forms.

[0138] The units described as separated components can or can not be physically separated, and the components displayed as units can or can not be physical units, can be located in one position, or can be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purposes of the embodiments.

[0139] In addition, the function units in the embodiments of the present application can be integrated into a processing unit, or each unit can exist physically as a separate entity, or two or more units can be integrated into a unit.

Claims

1. A client device, comprising: The client device includes a processor, the processor being used for: Acquire data comprising multiple plaintext data elements, wherein each of the multiple plaintext data elements is within one of multiple sub-ranges of a range, and each of the multiple sub-ranges is identified by a sub-range identifier; The first encryption key is used to encrypt the plurality of plaintext data elements to obtain a plurality of ciphertext data elements; The data, including the plurality of encrypted data elements, is sent to the data storage server to store the data in the database of the data storage server; For each of the plurality of sub-ranges, the sub-range data bucket is encrypted using a second encryption key, wherein each sub-range data bucket includes plaintext data elements and corresponding ciphertext data elements within the corresponding sub-range; For each of the plurality of sub-ranges, the message digest of the corresponding encrypted sub-range data bucket and the corresponding sub-range identifier, or the MAC of the corresponding encrypted sub-range data bucket and the corresponding sub-range identifier based on the message verification code key, is sent to the data storage server to store the plurality of message digests or MACs of the plurality of encrypted sub-range data buckets and the sub-range identifier in the database of the data storage server.

2. The client device of claim 1, wherein, The processor is further configured to obtain an encrypted version of at least one of the first encryption key, the second encryption key, and the MAC key from a remote key management server, wherein at least one of the encrypted first encryption key, the encrypted second encryption key, and the encrypted MAC key is encrypted using a client device master key.

3. The client device of claim 1 or 2, wherein, The processor is further configured to send the identifier of the first encryption key together with the data including the plurality of ciphertext data elements to the data storage server, so as to store the data in the database of the data storage server according to the identifier of the first encryption key.

4. The client device according to claim 3, characterized in that, The processor is also configured to send at least one of the encrypted first encryption key, the encrypted second encryption key, and the encrypted MAC key to the data storage server.

5. The client device according to any one of claims 1-2 and 4, characterized in that, In order to process queries for data including the plurality of encrypted data elements stored in the database of the data storage server, the processor is configured to: Determine the subrange identifiers of the subranges covered by the query range defined by the query, so as to obtain a subset of the plurality of subrange identifiers; Based on the message digest or MAC of one or more sub-range identifiers within a subset of the plurality of sub-range identifiers, obtain one or more data buckets from the database of the data storage server among the plurality of encrypted data buckets; The second encryption key is used to decrypt the one or more encrypted data buckets to obtain one or more pairs of plaintext data elements and ciphertext data elements in each encrypted data bucket; Based on the one or more encrypted data elements, the data stored in the database of the data storage server is obtained.

6. The client device according to claim 5, characterized in that, The processor is also configured to check whether the corresponding data element is within the query range based on the plaintext data element.

7. The client device according to any one of claims 1-2, 4, and 6, characterized in that, The processor is further configured to encrypt the plaintext data element using the first encryption key according to a random encryption scheme or a deterministic encryption scheme.

8. The client device according to any one of claims 1-2, 4, and 6, characterized in that, The first encryption key and the second encryption key are the same encryption key.

9. The client device according to any one of claims 1-2, 4, and 6, characterized in that, The MAC is a hash-based message verification code.

10. A method for operating a client device, characterized in that, The method includes: Acquire data comprising multiple plaintext data elements, wherein each of the multiple plaintext data elements is within one of multiple sub-ranges of a range, and each of the multiple sub-ranges is identified by a sub-range identifier; The first encryption key is used to encrypt the plurality of plaintext data elements to obtain a plurality of ciphertext data elements; The data, including the plurality of encrypted data elements, is sent to the data storage server to store the data in the database of the data storage server; For each of the plurality of sub-ranges, the sub-range data bucket is encrypted using a second encryption key, wherein each sub-range data bucket includes plaintext data elements and corresponding ciphertext data elements within the corresponding sub-range; For each of the plurality of sub-ranges, the message digest of the corresponding encrypted sub-range data bucket and the corresponding sub-range identifier, or the MAC of the corresponding encrypted sub-range data bucket and the corresponding sub-range identifier based on the message verification code key, is sent to the data storage server to store the plurality of message digests or MACs of the plurality of encrypted sub-range data buckets and the sub-range identifier in the database of the data storage server.

11. A data storage server, characterized in that, The data storage server includes a processor, the processor being used for: Data is received from a client device, wherein the data includes a plurality of ciphertext data elements encrypted using a first encryption key based on a plurality of plaintext data elements, each of the plurality of plaintext data elements being in a subrange of a plurality of subranges of a range, each of the plurality of subranges being identified by a subrange identifier; For each of the plurality of sub-ranges, receive a message digest of the encrypted sub-range data bucket and the corresponding sub-range identifier encrypted with the second encryption key, or a MAC based on the message verification code key of the encrypted sub-range data bucket and the corresponding sub-range identifier encrypted with the second encryption key; The plurality of encrypted sub-range data buckets and the plurality of message digests or MACs of the sub-range identifiers are stored in the database of the data storage server, wherein each encrypted sub-range data bucket includes plaintext data elements and corresponding ciphertext data elements within the corresponding sub-range.

12. The data storage server according to claim 11, characterized in that, The processor is also configured to store the data including the plurality of ciphertext data elements in a first table of the database, and to store the plurality of encrypted subrange data buckets and the plurality of message digests or MACs of the subrange identifiers in a second table of the database.

13. The data storage server according to claim 12, characterized in that, The processor is also configured to store the plurality of encrypted data elements in a column of the first table of the database.

14. The data storage server according to any one of claims 11 to 13, characterized in that, The processor is further configured to receive from the client device an identifier of the first encryption key and the data including the plurality of ciphertext data elements, and to store the data in the database according to the identifier of the first encryption key.

15. The data storage server according to any one of claims 11 to 13, characterized in that, The processor is also configured to receive from the client device at least one of the encrypted first encryption key, the encrypted second encryption key, and the encrypted MAC key.

16. The data storage server according to any one of claims 11 to 13, characterized in that, In order to process queries for data including the plurality of encrypted data elements stored in the database, the processor is further configured to: Based on one or more message digests or MACs of one or more subrange identifiers received from the client device, select one or more data buckets from a plurality of encrypted data buckets stored in the database; One or more data buckets selected from the plurality of encrypted data buckets will be sent to the client device; The data stored in the database is queried based on one or more encrypted data elements received from the client device.

17. The data storage server according to any one of claims 11 to 13, characterized in that, The first encryption key and the second encryption key are the same encryption key.

18. The data storage server according to any one of claims 11 to 13, characterized in that, The MAC is a hash-based message authentication code.

19. A method for operating a data storage server, characterized in that, The method includes: Data is received from a client device, wherein the data includes a plurality of ciphertext data elements encrypted using a first encryption key based on a plurality of plaintext data elements, each of the plurality of plaintext data elements being in a subrange of a plurality of subranges of a range, each of the plurality of subranges being identified by a subrange identifier; For each of the plurality of sub-ranges, receive a message digest of the encrypted sub-range data bucket and the corresponding sub-range identifier encrypted with the second encryption key, or a MAC based on the message verification code key of the encrypted sub-range data bucket and the corresponding sub-range identifier encrypted with the second encryption key; The plurality of encrypted sub-range data buckets and the plurality of message digests or MACs of the sub-range identifiers are stored in the database of the data storage server, wherein each encrypted sub-range data bucket includes plaintext data elements and corresponding ciphertext data elements within the corresponding sub-range.

20. A computer program product including a computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store program code that, when executed by a computer or processor, causes the computer or processor to perform the method according to claim 10.

21. A computer program product including a computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store program code that, when executed by a computer or processor, causes the computer or processor to perform the method according to claim 19.

Images