Confidential Database Querying With Reduced Encrypted Search Load
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database query methods for sensitive data are resource-intensive or have insufficient processing capabilities, preventing their commercial-scale implementation, and there is a need for flexible, cost-effective solutions that maintain confidentiality from database operators and third parties.
Innovation Solution
A method for confidential querying using a database structured with encrypted filter and identification fields, allowing for reduced database extraction and computation on encrypted data with different cryptographic systems to ensure confidentiality and efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If fully homomorphic encryption (FHE) is used for storing and querying encrypted data, then data confidentiality is improved, but computational resource consumption increases significantly
Solution Approach 1:
The patent divides the database into two separate encrypted databases: a filtering database storing encrypted filter data with searchable encryption, and an identification database storing encrypted identification data with homomorphic encryption. This segmentation allows different cryptographic operations to be applied to different data types, reducing overall computational resource consumption while maintaining data confidentiality.
Solution Approach 2:
The patent applies different encryption qualities to different parts of the database: searchable encryption (lower computational overhead) is applied to filtering data that requires frequent access and filtering operations, while fully homomorphic encryption (higher computational overhead) is applied only to identification data that requires confidential computation. This local differentiation optimizes the balance between security and computational efficiency.
2Speed
If searchable public key encryption (PEKS) is used for searching encrypted data, then processing speed is improved, but processing capabilities on encrypted data become insufficient
Solution Approach 1:
The patent segments the query processing into two distinct phases using two different encryption systems: PEKS is used for the filtering phase to achieve fast search processing, while FHE is used for the identification phase to enable sophisticated computations on encrypted data. This segmentation allows each encryption system to operate in its optimal performance range.
Solution Approach 2:
The patent merges two different cryptographic approaches (PEKS and FHE) into a unified query processing framework. The filtering database uses PEKS for efficient keyword-based search, while the identification database uses FHE for confidential computation. The combination of these two systems provides both fast search capability and versatile processing capability on encrypted data.
3Loss of information
If the complete database is queried without extraction, then query completeness is improved, but computational load increases
Solution Approach 1:
The patent performs preliminary extraction of the filtering database before the main query processing. By first extracting and filtering data based on searchable encryption criteria, the system reduces the volume of data that subsequently requires resource-intensive homomorphic computation. This preliminary action maintains query completeness while significantly reducing the computational load on the identification database.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for confidentially querying a database (DB) ((DF,DI,DA)) comprising encrypted filtering data (DF) and identification data (DI) under encryption that allows computation on encrypted data. The method comprises the following steps: S10) a client defines a query (m,c) comprising an index (m) and a condition (c); a retrieval backdoor (T(m)) is then computed for this index (m); S20) the server (SP) extracts a reduced filtering database (RDBF) of the filtering data corresponding to the index; S30) the server (SP) extracts a reduced identification database (RDBI) of the identification data corresponding to the reduced filtering database; S40) by confidential querying, the server identifies the identification data satisfying condition (c); S50) the server sends the client a result ([res]FHE) deduced from the identification data, which the client decrypts (S60).