Dynamic Searchable Symmetric Encryption Hash Chain Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing dynamic searchable symmetric encryption (DSSE) schemes face scalability issues due to increased communication size and computational overhead in achieving forward privacy, particularly with the need to generate new search tokens for each update operation, which limits their practical application.
Innovation Solution
The use of multiple hash chains with efficient computation and traversal techniques addresses the scalability issues by generating new hash chains after a predetermined number of update operations, enabling forward privacy without storing additional information, thus reducing the payload size and supporting parallel searches.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a new search token is generated after each update operation to achieve forward privacy, then forward privacy is improved, but communication size increases
Solution Approach 1:
The patent segments the counter value into multiple components by using multiple hash chains (H1, H2, H3, H4) instead of a single counter. Each hash chain processes a portion of the counter increments, dividing the large counter value into manageable segments that can be transmitted separately, thereby reducing the overall communication size while maintaining forward privacy.
Solution Approach 2:
The patent transitions from a one-dimensional counter approach to a multi-dimensional structure by introducing multiple hash chains (H1 through H4). This dimensional expansion allows the system to distribute counter information across multiple independent chains, enabling more efficient representation and transmission of update information without sacrificing security.
2Reliability
If a counter is incremented for each update operation to maintain forward privacy, then forward privacy is improved, but computational overhead increases
Solution Approach 1:
The patent divides the computational workload of counter management into multiple independent hash chains (H1, H2, H3, H4). Each chain handles a subset of counter increments, allowing parallel computation and reducing the overall computational overhead compared to a single counter that must be incremented sequentially for every update.
Solution Approach 2:
The patent creates multiple copies of the hash chain structure (H1 through H4) to distribute the computational burden. Instead of performing complex operations on a single counter, the system uses simpler hash operations replicated across multiple chains, reducing the computational complexity of each individual update operation.
3Quantity of substance
If multiple hash chains are used to reduce communication size, then communication efficiency is improved, but device complexity increases
Solution Approach 1:
The patent uses simple replicated structures (multiple identical hash chains H1-H4) to reduce communication size. Each chain follows the same straightforward hash function pattern, making the system easier to implement and maintain despite having multiple components, as the replication uses identical simple logic rather than complex differentiated structures.
Solution Approach 2:
The patent changes the parameter of hash chain quantity from one to multiple (H1 through H4) to optimize communication efficiency. This parameter adjustment allows the system to trade a manageable increase in structural complexity for significant reductions in communication overhead, as the additional chains use the same simple hash function logic.
Data Source
AI summary
A database is stored on a first cloud server to store encrypted files. A table stored at a second cloud server is a key value store, wherein the keys are unique secret values and the values are encrypted database values. The unique secret values relate to a specific instance of an update operation of a specific keyword. An update operation may be adding a new file to the database or deleting a file from the database. Each unique secret value is associated with an encrypted database value. A file identifier can be extracted from the encrypted database value. A file identifier identifies the location of a file in the database in the first cloud server. Each time a file containing a keyword is added or deleted from the database, a new unique secret value is generated and added to the table along with its associated encrypted database value.