Database Server Semi-Homomorphic Encryption Query Obfuscation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional database systems lack sufficient concealment of queries, as both the information provider and the database server administrator can potentially detect the content of user queries, compromising user privacy and data security.
Innovation Solution
A database server system that encrypts data using semi-homomorphic encryption, allowing only the information provider to decrypt, and obfuscates queries to prevent detection by the administrator and user, using a combination of encryption and obfuscation techniques to maintain query secrecy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If data is stored in a database server managed by a cloud service provider, then data storage and accessibility are improved, but the risk of data leakage increases because the cloud service provider can directly access the data
Solution Approach 1:
The patent applies preliminary action by encrypting data before storing it in the database server. The information provider encrypts data using their private key before upload, and the database server stores only the encrypted ciphertext. This preliminary encryption action ensures that even though the cloud service provider manages the server and can access the stored data, they cannot decrypt or read the actual data content without the information provider's private key.
Solution Approach 2:
The patent introduces encryption as an intermediary layer between the data and the database server. The encrypted ciphertext acts as a mediator that the database server can store and the cloud service provider can manage, but which remains unintelligible to them. The decryption key held by the information provider serves as another intermediary that controls access to the actual data, creating a trusted bridge that enables secure cloud storage.
2Ease of operation
If the cloud service provider manages the database server, then infrastructure management is simplified for the information provider, but the information provider may hesitate to provide valuable data due to security concerns
Solution Approach 1:
The patent enables self-service by allowing the information provider to independently encrypt their own data using their private key before uploading to the cloud. The information provider maintains control over their data through their private key, while the cloud service provider simply provides storage infrastructure without needing to trust or manage the actual data content. This self-encrypting approach eliminates the need for the information provider to trust the cloud provider with their data.
3Productivity
If query content is visible to the database server administrator, then query processing can be optimized, but user privacy is compromised as the administrator can detect query intentions
Solution Approach 1:
The patent applies preliminary action by pre-processing queries into encrypted form before they reach the database server. The client device encrypts the query using the public key and performs preliminary decryption calculations locally. This preliminary encryption action ensures that the database server receives and processes encrypted queries, maintaining user privacy while still enabling the server to perform necessary operations on the encrypted data.
Solution Approach 2:
The patent replaces the traditional mechanical system of plaintext query processing with a cryptographic system. Instead of the database server directly reading and interpreting plaintext queries, the system uses public key encryption and decryption mathematics to process queries. The server performs calculations on encrypted data using cryptographic operations rather than traditional text-based query processing, substituting cryptographic mechanics for conventional query mechanics.
Data Source
AI summary
A database server stores encrypted vector data in which each of a plurality of elements is encrypted by encryption maintaining semi-homomorphism between calculation before encryption and calculation after encryption. The database server receives an obfuscated query (N-randomized query) from a terminal device, performs calculation for each of a plurality of segments of vectors of the obfuscated query with a segment of the encrypted vector data, and transmits the calculation to the terminal device in reply. The terminal device may acquire a result of decryption calculation transmitted in reply by a decryption device.