Client-Server Encrypted Data Storage for Range Queries
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud storage systems face challenges in securely storing security-sensitive data, such as numerical and textual data, while enabling range queries, as the data becomes accessible to cloud providers and may violate legal regulations.
Innovation Solution
A client device and data storage server system that uses message authentication codes (MAC) to encrypt and decrypt data, allowing range queries on encrypted data without revealing the plaintext, by splitting binary representations into significant and least significant bits, and using these bits to index and retrieve data securely.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is stored in plaintext in remote data storage servers, then data can be easily queried, but security sensitive data becomes accessible to cloud storage providers which may violate legal regulations
Solution Approach 1:
The patent segments data into two parts: significant bits (stored encrypted in the database) and least significant bits (stored in an encrypted index structure). This segmentation allows the system to maintain security while enabling range queries, as the index structure can be searched without exposing the full plaintext data to the cloud provider.
Solution Approach 2:
The patent introduces an intermediary index structure that acts as a mediator between the encrypted data and query operations. The index contains encrypted least significant bits and MACs that enable range queries without requiring the cloud provider to access or decrypt the actual sensitive data, thus maintaining both security and query functionality.
2Reliability
If data is encrypted in remote data storage servers, then data security is improved, but range queries cannot be performed on the encrypted data
Solution Approach 1:
By dividing data into significant bits (for security) and least significant bits (for indexing), the patent enables range queries on encrypted data. The index structure stores encrypted least significant bits that can be efficiently searched, while the significant bits remain securely encrypted in the main database.
Solution Approach 2:
The patent changes the parameter of encryption from full-data encryption to selective encryption of only the significant bits portion. This parameter change allows the least significant bits to be stored in an accessible index structure, enabling range queries while maintaining security for the critical portions of the data.
3Reliability
If only encrypted data is stored in cloud, then privacy and legal compliance are maintained, but the cloud provider cannot perform queries on the data
Solution Approach 1:
The patent segments data storage into two locations with different security levels: encrypted significant bits in the cloud database and encrypted least significant bits in an index structure. This allows the cloud provider to access and search the index for range queries while the sensitive significant bits remain securely encrypted and inaccessible to the cloud provider.
Solution Approach 2:
The index structure serves as an intermediary that enables query operations without exposing sensitive data to the cloud provider. The index contains encrypted least significant bits and MACs that allow the cloud provider to perform range queries and return results to the client, who then decrypts and processes the final data.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The disclosure relates to a client device (110) for storing data (125a) comprising data elements, for instance numerical values in a database (125) of a server (120). The client device is configured to generate with a MAC key (115b) a first MAC of a first portion of a binary representation of each data element. The first portion comprises the most significant bits of the binary representation of the data element, wherein the binary representation further comprises a complementary remainder portion defined by the remaining least significant bits. Moreover, the client device is configured to store the remainder portion in encrypted form in a data bucket in the database, wherein the data bucket is identified by the first MAC. Advantageously, the client device and the server allow storing security sensitive data in encrypted form in the database, while enabling range queries of the data.