Concealed Search Server Using Hybrid Encryption for Speed and Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Concealed search systems face a trade-off between high-speed search performance and security, as existing methods using deterministic encryption are vulnerable to frequency analysis attacks when the server is malicious, while probabilistic encryption methods are slow due to the need for complex computations.
Innovation Solution
A server device that receives a trapdoor and deterministic encrypted keyword, stores search history, and checks if the deterministic encrypted keyword matches in the search history storage; if it does, it performs a high-speed search using deterministic encryption, otherwise it uses probabilistic encryption, maintaining security against malicious servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If deterministic encryption is used for concealed search, then search speed is improved, but security against frequency analysis attacks deteriorates
Solution Approach 1:
The encrypted keyword is segmented into two distinct parts: a first encrypted keyword generated by probabilistic encryption and a second encrypted keyword generated by deterministic encryption. This segmentation allows the system to leverage the security properties of probabilistic encryption while utilizing the speed advantages of deterministic encryption, resolving the contradiction between search speed and security.
Solution Approach 2:
Different encryption methods are applied to different parts of the keyword representation. The first encrypted keyword uses probabilistic encryption to maintain security, while the second encrypted keyword uses deterministic encryption to enable fast matching. This local differentiation of encryption quality allows the system to optimize both security and performance in their respective domains.
2Reliability
If probabilistic encryption is used for concealed search, then security against frequency analysis attacks is improved, but search speed deteriorates
Solution Approach 1:
The encrypted keyword is segmented into two distinct parts: a first encrypted keyword generated by probabilistic encryption and a second encrypted keyword generated by deterministic encryption. This segmentation allows the system to leverage the security properties of probabilistic encryption while utilizing the speed advantages of deterministic encryption, resolving the contradiction between search speed and security.
Solution Approach 2:
Different encryption methods are applied to different parts of the keyword representation. The first encrypted keyword uses probabilistic encryption to maintain security, while the second encrypted keyword uses deterministic encryption to enable fast matching. This local differentiation of encryption quality allows the system to optimize both security and performance in their respective domains.
3Speed
If both probabilistic and deterministic encryption values are transmitted to server, then search speed is improved, but data security deteriorates if data leaks to external attacker
Solution Approach 1:
An intermediary encryption layer is introduced where the first encrypted keyword (probabilistic) acts as a mediator between the original keyword and the second encrypted keyword (deterministic). This intermediary structure ensures that even if the second encrypted keyword leaks, the original keyword remains protected by the probabilistic encryption layer, preventing external attackers from deriving meaningful information.
Solution Approach 2:
The system uses a composite encryption structure combining two different encryption schemes (probabilistic and deterministic) to create a hybrid encrypted keyword. This composite approach leverages the security strengths of probabilistic encryption while incorporating the performance benefits of deterministic encryption, achieving both security and speed objectives simultaneously.
Data Source
AI summary
A server device 201 comprises a communication part 231, a search history storage region 213, a data storage part 210, and a checking part 220. The communication part receives a set of a trapdoor and a deterministic encrypted keyword from a search device 401. The search history storage region 213 stores the set of the trapdoor and the deterministic encrypted keyword. The data storage part 210 stores keyword information in which search target data and an encrypted keyword are associated with each other. If the deterministic encrypted keyword is obvious, a deterministic encrypted keyword corresponding to the encrypted keyword is additionally associated with the search target data and the encrypted keyword in the keyword information. The checking part 220 checks whether or not a deterministic encrypted keyword which matches the received deterministic encrypted keyword exists in the search history storage region 213. If the deterministic encrypted keyword exists, the checking part 220 executes a concealed search targeting the data storage part 210, based on a deterministic encryption scheme using the deterministic encrypted keyword existing in the search history storage region 213. If the deterministic encrypted keyword does not exist, the checking part 220 executes the concealed search targeting the data storage part 210, based on a probabilistic encryption scheme using the received trapdoor and the encrypted keyword stored in the data storage part 210.