Deterministic Encryption Index for Secure Database Search
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Database as a Service (DaaS) systems face challenges in maintaining high security while enabling efficient search operations on encrypted data, particularly for numerical data, due to the need for clients to decrypt and process data locally, which increases burden and reduces search performance.
Innovation Solution
A data management system that encrypts numerical data and generates index values using character string elements, allowing the server to perform search operations directly on encrypted data, while the client converts query expressions and decrypts results as needed, optimizing search performance and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted on the client side before transfer to the server, then security is improved, but search capability deteriorates
Solution Approach 1:
The patent segments data into two parts: encrypted data for security and index data for searchability. The index data is generated from the encrypted data using deterministic encryption, allowing the server to perform searches on the encrypted data without decrypting it, thus maintaining both security and search capability
Solution Approach 2:
The patent introduces an intermediary mechanism (deterministic encryption function) that acts as a mediator between the encrypted data and search operations. This intermediary allows the server to perform search operations on encrypted data by using the deterministic encryption function to generate consistent index values from encrypted data, enabling search without decryption
2Reliability
If conventional encryption methods are used on the server, then security is improved, but range search efficiency deteriorates
Solution Approach 1:
The patent changes the encryption parameter from random encryption to deterministic encryption. This parameter change allows the same plaintext to always produce the same ciphertext, enabling the server to perform range searches and other operations on encrypted numerical data by comparing ciphertext values directly, thus maintaining security while improving range search efficiency
3Measurement precision
If data is decrypted on the client side for search, then search accuracy is improved, but processing time increases
Solution Approach 1:
The patent performs preliminary encryption on the client side using deterministic encryption before transferring data to the server. This preliminary action creates encrypted data with preserved numerical relationships, eliminating the need for decryption during search operations on the server, thus maintaining search accuracy while reducing processing time
Data Source
AI summary
According to an embodiment, a data processor includes a storage unit that stores a set of character strings that is a set of character string elements of which magnitude correlation is uniquely identifiable; a data converter that encrypts numerical data included in data to be managed, generates an index value corresponding to the numerical data using the character string elements included in the set of character strings, and generates converted data including the encrypted numerical data and the index value; a first transmitting unit transmits the converted data to a server; a query expression converter that converts a condition part including a numerical value of a query expression into a condition part including the character string elements to generate a converted query expression; a second transmitting unit that transmits the converted query expression to the server; and a receiving unit that receives, from the server, a result of query.