Encrypted Data Search Using Equivalence Classes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for storing and retrieving encrypted data items in a database lack efficient search mechanisms that preserve confidentiality, as they require direct access to cryptographic keys, compromising data security and efficiency.
Innovation Solution
A computer system comprising a client computer and a server with a database that uses equivalence relations and cryptographic keys to encrypt and decrypt data items, allowing searches on functional values without exposing the cryptographic keys, enabling secure and efficient retrieval of encrypted data items without compromising their confidentiality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encrypted data items are stored directly in the database without equivalence classes, then data confidentiality is preserved, but search functionality is lost
Solution Approach 1:
The data is segmented into two separate encrypted relations: the first relation stores encrypted data items, while the second relation stores encrypted equivalence classes with referential connections. This segmentation allows the database to search using encrypted equivalence classes without exposing cryptographic keys, thus maintaining both confidentiality and search functionality.
Solution Approach 2:
Encrypted equivalence classes serve as an intermediary between the search criterion and the encrypted data items. The equivalence classes contain functional values that can be searched without requiring decryption, acting as a mediator that enables search functionality while preserving the encryption of the actual data items.
2Ease of operation
If cryptographic keys are exposed to enable search on encrypted data, then search functionality is improved, but data security is compromised
Solution Approach 1:
The system segments the encryption mechanism into two distinct cryptographic keys: a first cryptographic key for encrypting data items and a second cryptographic key for encrypting equivalence classes. This segmentation allows the database to operate with only the second key, enabling search functionality without exposing the first cryptographic key that protects the actual data.
Solution Approach 2:
Different parts of the system have different security requirements. The equivalence classes in the second relation are encrypted with a second cryptographic key that can be exposed for search operations, while the data items in the first relation remain encrypted with a first cryptographic key that stays hidden. This local quality approach allows search capability in one area without compromising security in another.
3Productivity
If standard database techniques are used on encrypted data, then query efficiency is maintained, but cryptographic key exposure is required
Solution Approach 1:
Instead of applying standard database techniques directly to encrypted data items, the system creates encrypted copies in the form of equivalence classes. These equivalence class copies contain functional values that can be searched using standard database techniques without requiring decryption, thus maintaining query efficiency while preserving key confidentiality.
Data Source
AI summary
A computer system is disclosed herein for storage and retrieval of encrypted data items, such as for storing encrypted data items in the cloud, as well as a respective client computer, client computer system, computer program product and computer-implemented method. Embodiments of the disclosed computer system allow for searching for encrypted data items stored in a database based on functional values associated with the data items. The retrieval of the data items from the database can be performed without knowledge of a respective cryptographic key by the database.