Ciphertext Comparison via Derived Key Intermediary
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques for comparing encrypted numerical values fail to adequately reduce the risk of information leakage, as they either reveal the magnitude of plaintexts directly or require unnecessary information disclosure, increasing the risk of data exposure in database operations.
Innovation Solution
A ciphertext generation apparatus and method that generates a derived key and auxiliary derived key based on a main key and document, using these to create identifier-specific and relative value ciphertexts, allowing for magnitude comparison while maintaining confidentiality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If order-preserving encryption is used to enable magnitude comparison of encrypted numerical values, then the magnitude relationship between plaintexts can be determined from ciphertexts, but the risk of information leakage increases as the approximate magnitude of plaintexts becomes known
Solution Approach 1:
The patent introduces an intermediary encryption scheme that acts as a mediator between the plaintext and ciphertext. Instead of directly preserving the order relationship, the encryption scheme transforms the data into a form that allows controlled comparison through cryptographic operations without directly exposing the magnitude relationship. This intermediary layer enables the database to perform comparisons while preventing direct inference of plaintext magnitudes from ciphertext patterns.
Solution Approach 2:
The patent changes the cryptographic parameters and encryption approach from order-preserving encryption to a different cryptographic scheme that achieves the same functional goal (enabling magnitude comparison) but with different security characteristics. By changing the encryption parameters and methodology, the system maintains comparison capability while reducing information leakage risk through fundamentally different cryptographic mechanisms.
2Productivity
If the database determines magnitudes of numerical values continuously (even without user requests), then query performance is improved, but unnecessary information processing increases the risk of information leakage
Solution Approach 1:
The patent applies preliminary action by pre-processing and encrypting data with the specialized encryption scheme before it is stored in the database. This preliminary encryption ensures that when queries are executed, the database can perform efficient comparisons on the already-encrypted data without needing to continuously determine magnitudes. The comparison operations are designed to work directly on the encrypted form, eliminating the need for continuous magnitude determination while maintaining query performance.
3Ease of operation
If prefix-matching encryption is used to enable partial plaintext matching in ciphertext form, then matching capability is improved, but the risk of information leakage increases as matching patterns become visible without a key
Solution Approach 1:
The patent uses an intermediary encryption scheme that enables partial matching capability while preventing direct pattern recognition. The encryption method transforms the data in a way that allows the database to perform matching operations on encrypted data without exposing the underlying patterns. The cryptographic design ensures that matching operations can be performed through cryptographic comparisons rather than direct pattern matching, thereby maintaining functionality while reducing information leakage.
Data Source
AI summary
A ciphertext generation apparatus that can compare the magnitudes of encrypted numerical values and largely reduce the risk of information leakage while maintaining the confidentiality. This apparatus includes a derived key generator that generates a derived key based on a main key and a document, an auxiliary derived key generator that generates an auxiliary derived key based on the main key, the document, and the derived key, an identifier-specific ciphertext generator that generates, based on an identifier of the document, the derived key, and the auxiliary derived key, an identifier-specific ciphertext in which the identifier is encrypted, and a relative value ciphertext generator that generates, based on the identifier and the derived key, a relative value ciphertext. A character string including the identifier-specific ciphertext and the relative value ciphertext is generated as a ciphertext for the document.