Deferred Evaluation for Encrypted Data Query Processing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database systems face challenges in securely and efficiently processing queries on encrypted data due to the limitations of homomorphic and partially homomorphic encryption schemes, which are either extremely slow or restricted in operations, making it difficult to implement secure and efficient query handling on untrusted platforms like cloud servers.
Innovation Solution
The implementation of deferred evaluation, where a data server analyzes queries and designates operations that cannot be performed on encrypted data for evaluation by a trusted client, allowing operations on encrypted data without encryption keys, using a query processor with deferred evaluation and expression determination mechanisms to partition computation between the server and client.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If homomorphic encryption schemes are used to perform operations on encrypted data without encryption keys, then data security is improved, but processing speed deteriorates (several orders of magnitude slower than operations on unencrypted data)
Solution Approach 1:
The query processing is segmented into two parts: (1) operations that can be performed on encrypted data are executed by the server, and (2) operations requiring decryption are deferred to the client. This segmentation allows the system to leverage both encrypted and unencrypted processing without sacrificing security or performance.
Solution Approach 2:
The system dynamically determines which operations to perform on encrypted data versus which to defer to the client based on the specific query requirements. The deferred evaluation mechanism adapts the processing strategy in real-time, switching between encrypted and unencrypted operations as needed.
2Productivity
If partially homomorphic encryption schemes are used to perform limited operations on encrypted data, then processing speed is improved, but operational flexibility deteriorates (restricted in the kinds of operations permitted)
Solution Approach 1:
The system provides universal query processing capability by combining encrypted operations (for supported operations) with deferred evaluation (for unsupported operations). This multi-functional approach allows the same system to handle both PHE-supported operations and other operations that require decryption, making the system versatile across different query types.
3Reliability
If all query operations are performed on encrypted data at the server, then data security is improved, but query complexity increases (difficulty in handling various operations)
Solution Approach 1:
The system extracts operations that cannot be performed on encrypted data from the server-side processing and defers them to the client. This extraction simplifies the server's query processing logic while maintaining security for operations that can be performed on encrypted data.
4Productivity
If encrypted data is stored on untrusted cloud platforms, then centralized data storage is improved, but trust reliability deteriorates (susceptibility to leakage or malicious corruption)
Solution Approach 1:
The client acts as an intermediary between the untrusted cloud server and the encrypted data. The client holds the decryption keys and performs any operations requiring decryption, thereby mediating the trust relationship and protecting data even when stored on untrusted platforms.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods, systems, apparatuses, and computer program products are provided for processing queries. A data server includes a query processor configured to receive a query from a database application, which was received by the database application from a requestor. The query is directed to data stored at the data server. The query processor includes a deferred evaluation determiner and deferred expression determiner. The deferred evaluation determiner is configured to analyze the query, and to designate the query for deferred evaluation by the database application if a predetermined factor is met, such as the query including an operation on encrypted data that is not supported at the data server. The deferred expression determiner is configured to determine expression evaluation information for evaluating at least a portion of the query at the database application. The query processor provides the encrypted data and the expression evaluation information to the database application for evaluation.