Encrypted Data Search in Cloud Storage via Hidden Datum Packages
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud storage systems face challenges in securely storing and searching privacy-sensitive data from Internet of Things (IoT) devices, as existing encryption methods often protect data in transit but not at rest, making it vulnerable to leaks and unauthorized access.
Innovation Solution
A method involving the use of public and secret key encryption to create a hidden datum package for data transmission and search queries, allowing encrypted data to be stored and searched without revealing the actual data or keys to the remote storage system, ensuring secure storage and retrieval while maintaining data confidentiality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If data is stored in cleartext in cloud storage, then search functionality is easy to implement, but data security and confidentiality are compromised
Solution Approach 1:
The patent changes the state of data from cleartext to encrypted form, transforming the parameter of data representation. By encrypting data before storage while maintaining the ability to perform searches on encrypted data, the system achieves both security and searchability. The encryption transforms data into an unreadable format for unauthorized users while preserving structural information needed for search operations.
Solution Approach 2:
The patent introduces an intermediary encryption layer between the data and storage system. This intermediary (encryption algorithm) mediates between the need for data security and search functionality by allowing the cloud storage system to operate on encrypted data without needing to understand or decrypt it, thus maintaining security while enabling search operations through encrypted metadata and indexes.
2Reliability
If data is encrypted in cloud storage, then data security is improved, but search functionality becomes more complex
Solution Approach 1:
The patent applies preliminary action by pre-processing data with encryption before storage, and pre-computing encrypted indexes and metadata structures. This allows the search system to work with pre-prepared encrypted representations of data, avoiding the need for complex real-time decryption and search operations. The search complexity is reduced by having encrypted search structures ready in advance.
Solution Approach 2:
The patent creates copies of data in encrypted form for storage while maintaining the ability to work with these encrypted copies for search operations. Instead of manipulating the original cleartext data during searches, the system operates on encrypted copies, preserving security while enabling search functionality through the use of encrypted metadata and index structures that mirror the organization of the original data.
3Reliability
If public key encryption is used for data protection, then data confidentiality is maintained, but processing and searching operations become more computationally intensive
Solution Approach 1:
The patent segments the encryption and search operations into distinct layers: data encryption using public key cryptography for confidentiality, and search operations using encrypted metadata and indexes. This segmentation allows computationally intensive encryption to be performed once during data ingestion, while subsequent search operations work with pre-processed encrypted structures, reducing the computational energy required for repeated search operations.
Solution Approach 2:
The patent applies partial action by encrypting only the necessary portions of data (using selective encryption on metadata and indexes) rather than requiring full decryption for search operations. This allows the system to perform search operations on encrypted data without the excessive computational cost of decrypting entire data sets, achieving a balance between security and computational efficiency.
Data Source
AI summary
Methods may be provided to transmit encrypted data from a communication device to a remote storage system. A data value and information related to the data value may be provided, where the information related to the data value includes an identifier associated with the communication device and a time-value associated with the data value. A combination of the time-value and the identifier may be encrypted using a public key to provide a first encrypted value. The data value may be encrypted using the public key to provide a second encrypted value, and a hidden datum package may be generated including the time-value, the first encrypted value, and the second encrypted value. The hidden datum package including the time-value, the first encrypted value, and the second encrypted value may be transmitted to the remote storage system.