Cryptographic Sharing for Encrypted Document Search
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprises and individuals using distributed storage systems face challenges in performing search queries on encrypted data without providing plaintext access, which can be a barrier for sensitive sectors due to concerns about data privacy and access patterns revealing sensitive information.
Innovation Solution
A method for sharing read and write access to encrypted documents stored on a distributed system, using cryptographic sharing and access tokens to authorize access without revealing the underlying keys, allowing for secure search and modification operations without plaintext access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption is applied to stored data, then data privacy is improved, but search functionality deteriorates because plaintext access is required
Solution Approach 1:
The search process is segmented into multiple cryptographic operations: generating search tokens from encrypted queries, matching tokens against encrypted indexes, and retrieving results without decrypting the full dataset. This allows search functionality to operate on encrypted data through distributed computational steps.
Solution Approach 2:
Cryptographic tokens and indexes serve as intermediaries between the search query and the encrypted data. The system uses encrypted search tokens that match against encrypted document indexes, enabling search without exposing plaintext data to the cloud service provider.
2Ease of operation
If plaintext access is provided for search queries, then search functionality is improved, but data security deteriorates because access patterns reveal sensitive information
Solution Approach 1:
The system segments the search operation so that the cloud service provider only handles cryptographic token matching against encrypted indexes, while the client performs local decryption of results. This prevents the provider from observing plaintext queries or access patterns.
Solution Approach 2:
The traditional mechanical approach of sending plaintext queries to the cloud is replaced with cryptographic token-based search. The system substitutes cryptographic operations for direct text processing, eliminating the need for plaintext transmission and preventing access pattern analysis.
3Reliability
If cryptographic sharing is implemented, then access control security is improved, but system complexity deteriorates due to multiple key management operations
Solution Approach 1:
The cryptographic token generation mechanism serves multiple functions: it enables search functionality, enforces access control policies, and manages key distribution. The same token-based approach handles both authentication and authorization, reducing overall system complexity despite the cryptographic operations.
Data Source
AI summary
A method for sharing read access to a document stored on memory hardware. The method includes receiving a shared read access command from a sharor sharing read access to a sharee for a document stored on memory hardware in communication with the data processing hardware, and receiving a shared read access request from the sharee. The shared read access command includes an encrypted value and a first cryptographic share value based on a write key, a read key, a document identifier, and a sharee identifier. The method also includes multiplying the first and second cryptographic share values to determine a cryptographic read access value. The cryptographic read access value authorizes read access to the sharee for the document. The method also includes storing a read access token for the sharee including the cryptographic read access value and the encrypted value in a user read set of the memory hardware.