Dynamic Searchable Encryption Token Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing dynamic searchable symmetric encryption (DSSE) schemes face challenges in achieving forward privacy while maintaining efficient communication between clients and servers, particularly due to the large communication overhead caused by frequent updates and the need to prevent adaptive file-injection attacks.
Innovation Solution
A method is introduced that uses a client device to compute unique secret values and encrypted database values for each keyword update, which are then stored on a cloud server, allowing for efficient forward privacy and scalable multi-keyword searches without exposing search keywords to the server. This involves generating hash chains and using a modified OXT protocol to facilitate secure and efficient searches.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a new search token H(c|w|K) is generated after each update operation to achieve forward privacy, then forward privacy is improved, but the communication size between client and server increases significantly
Solution Approach 1:
The patent segments the search token into two parts: a static component H(w|K) that remains unchanged across updates, and a dynamic component c that captures update information. This segmentation allows the static part to be reused while only the dynamic part needs to be updated, reducing communication overhead while maintaining forward privacy.
Solution Approach 2:
The patent precomputes and stores the static search token component H(w|K) in an encrypted index table before updates occur. This preliminary action eliminates the need to retransmit this portion during updates, as it can be retrieved directly from storage, thereby reducing communication size while preserving forward privacy through the dynamic counter component.
2Reliability
If all search tokens H(i|w|K) where 0≤i≤c are sent to the server for keyword searching, then complete search coverage is achieved, but the communication overhead increases with the frequency of the keyword
Solution Approach 1:
The patent extracts the static component H(w|K) from the sequence of search tokens and separates it from the dynamic counter component. By taking out the static part and storing it independently in the encrypted index table, the system only needs to communicate the dynamic counter information during searches, significantly reducing communication size while maintaining complete search coverage.
Solution Approach 2:
The system pre-stores the static search token component in the encrypted index table during setup. This preliminary action allows the client to retrieve only the necessary dynamic counter information during searches rather than transmitting entire token sequences, reducing communication overhead proportional to the keyword frequency while preserving search completeness.
3Reliability
If the counter c is stored at the client or server to track update frequency, then forward privacy is maintained, but the system complexity increases due to synchronization requirements
Solution Approach 1:
The patent introduces an encrypted index table as an intermediary structure that stores the counter information in encrypted form on the server. This intermediary eliminates the need for complex client-server synchronization protocols, as the server independently maintains the encrypted counter state without requiring real-time coordination with the client, thereby reducing system complexity while preserving forward privacy.
4Reliability
If encrypted documents are stored on the cloud server, then data security is improved, but the ability to search without decryption is limited
Solution Approach 1:
The patent segments the search process into two independent parts: encrypted document storage on the server and encrypted keyword matching using precomputed tokens. This segmentation allows documents to remain encrypted while searches are performed by matching encrypted keywords against encrypted index entries, maintaining data security while enabling efficient search capability without requiring document decryption.
Solution Approach 2:
The patent creates encrypted copies of keyword information (search tokens) and stores them in an encrypted index table on the server. These encrypted copies enable search operations to be performed on the server without accessing or decrypting the actual document contents, thus preserving data security while providing full search functionality.
Data Source
AI summary
A database is stored on a first cloud server to store encrypted files. A table stored at a second cloud server is a key value store, wherein the keys are unique secret values and the values are encrypted database values. The unique secret values relate to a specific instance of an update operation of a specific keyword. An update operation may be adding a new file to the database or deleting a file from the database. Each unique secret value is associated with an encrypted database value. A file identifier can be extracted from the encrypted database value. A file identifier identifies the location of a file in the database in the first cloud server. Each time a file containing a keyword is added or deleted from the database, a new unique secret value is generated and added to the table along with its associated encrypted database value.