Client Computer Postfix Search Encrypted Database
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database systems face challenges in securely querying and updating encrypted data items without compromising confidentiality, especially when performing postfix searches on encrypted data stored in a networked environment.
Innovation Solution
A client computer system that encrypts and decrypts data items using cryptographic keys, where suffix items are used to facilitate postfix searches without revealing the cryptographic keys to the database, allowing for secure and efficient retrieval and updating of encrypted data items while maintaining confidentiality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encrypted data items are stored in the database with cryptographic keys, then data confidentiality is improved, but the ability to perform postfix searches on encrypted data deteriorates
Solution Approach 1:
The data item is segmented into a prefix part and a suffix part. The prefix is encrypted and stored in the database, while the suffix is stored in plaintext in a separate suffix table. This segmentation allows the database to perform efficient postfix searches on the plaintext suffix while the encrypted prefix maintains data confidentiality.
Solution Approach 2:
A suffix table acts as an intermediary between the encrypted data and the search function. The suffix table stores plaintext suffixes that enable postfix searches without requiring the database to decrypt or understand the encrypted data, thus maintaining both confidentiality and searchability.
2Reliability
If the database stores encrypted data items, then data security is improved, but the complexity of data retrieval and updating operations increases
Solution Approach 1:
The data retrieval and updating processes are segmented into distinct steps: searching the plaintext suffix table, retrieving the corresponding encrypted prefix from the main table, and performing decryption only on the client side. This segmentation simplifies database operations while maintaining security.
Solution Approach 2:
The client computer performs the decryption operation itself using its local cryptographic key, rather than requiring the database to handle decryption. This self-service approach reduces the complexity of database operations and maintains data security.
3Ease of operation
If cryptographic keys are transmitted between client and database, then data decryption capability is improved, but the risk of key compromise increases
Solution Approach 1:
The cryptographic key is extracted from the database system and stored only on the client computer. This extraction eliminates the risk of key compromise at the database level, as the key never resides on or is transmitted to the database server.
Solution Approach 2:
The encrypted suffix table serves as an intermediary that enables the database to assist in the retrieval process without having access to or transmitting cryptographic keys. The database operates solely on encrypted data and plaintext suffixes, maintaining a security boundary.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a client computer (10) for querying a database (30) stored on a server (22) via a network (48), the server (22) being coupled to the client computer (10) via the network (48), wherein the database (30) comprises first data items and suffix items, wherein each suffix item describes a suffix of at least one first data item of the first data items, wherein for each suffix item a first referential connection exists in the database (30) assigning said suffix item to the at least one first data item comprising the suffix of said suffix item, wherein each suffix item is encrypted with a suffix cryptographic key in the database (30), wherein each first data item is encrypted with a first cryptographic key in the database (30), wherein the client computer (10) has installed thereon an application program (17), the application program (17) being operational to: - receiving a search request, the search request specifying a postfix search on a search criterion (19), - determining the suffix item matching the search criterion (19), - providing to the database (30) a request for providing the one or more encrypted first data items being assigned via the first referential connection to the determined suffix item matching the search criterion (19), - receiving from the database (30) the requested encrypted first data items and decrypting said received first data items.