Encrypted Data Search Using Binary Tree Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Searching encrypted data is challenging due to encryption obfuscation, which requires decryption for search queries, exposing data to potential disclosure and being resource-intensive, and storing unencrypted data risks unauthorized access.
Innovation Solution
Implementing a binary tree data structure to store encrypted key-value pairs, allowing a search engine to request and decrypt individual nodes from a storage host, enabling efficient searching of encrypted data without exposing the content to the storage host.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If encrypted data is decrypted for searching, then search capability is improved, but data security deteriorates due to potential disclosure and resource-intensive processing
Solution Approach 1:
The patent segments the encrypted dataset into individual encrypted records stored in a binary tree structure. The search engine can request and decrypt only specific individual records needed for the search query, rather than decrypting the entire dataset. This segmentation enables selective decryption that maintains security while providing search capability.
Solution Approach 2:
The patent introduces an intermediary search engine that acts as a mediator between the storage host and the user. The search engine requests individual encrypted records from the storage host, decrypts them locally, performs search operations, and returns results without exposing the entire decrypted dataset to the storage host. This intermediary structure enables search functionality while maintaining data confidentiality.
2Loss of information
If entire encrypted dataset is decrypted for searching, then search completeness is improved, but resource consumption deteriorates
Solution Approach 1:
The patent divides the encrypted dataset into discrete individual records organized in a binary tree structure. This segmentation allows the search engine to request only the specific records relevant to the search query rather than loading and decrypting the entire dataset, significantly reducing computational resources and energy consumption while maintaining search completeness for the queried data.
Solution Approach 2:
The patent implements partial decryption by requesting and decrypting only the specific individual records needed for the current search query rather than decrypting the entire dataset. This partial action approach maintains search completeness for the relevant data while avoiding the excessive resource consumption of full dataset decryption.
3Reliability
If cryptographic salts are used to obfuscate encrypted data, then data security is improved, but search difficulty deteriorates
Solution Approach 1:
The patent segments the data into individual encrypted records, each with its own cryptographic salt. This segmentation allows the search engine to handle each record independently with its own salt-based encryption, maintaining the security benefits of salted encryption while simplifying the search process by working with discrete units rather than a monolithic encrypted structure.
Solution Approach 2:
The search engine acts as an intermediary that handles the complexity of salted encryption by requesting individual encrypted records, managing the decryption process with their respective salts, and performing search operations. This intermediary approach maintains the security provided by cryptographic salts while managing search complexity centrally rather than requiring complex distributed search mechanisms.
Data Source
AI summary
Disclosed are various embodiments for searching encrypted data. A search query containing a plaintext key can be received from a client device or other application. A request can then be sent to a storage engine for a ciphertext key of a node of a binary tree, the node representing an encrypted key-value pair that includes the ciphertext key. The ciphertext key can be decrypted using a cryptographic key to generate a decrypted ciphertext key. Then, the decrypted ciphertext key can be compared to the plaintext key. A determination can then be made as to whether the encrypted key-value pair represented by the node of the binary tree satisfies the search query based at least in part on a comparison of the decrypted ciphertext key to the plaintext key.