Encrypted Data Search Indexing Structure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database systems face challenges in searching encrypted data without decrypting all data, especially with deterministic encryption methods that reveal data patterns, compromising privacy and compliance with regulations.
Innovation Solution
Implementing non-deterministic encryption methods, such as block ciphers in CBC mode with a random initialization vector, and using indexing structures like B-trees with Message Authentication Codes (MACs) or Hashed Message Authentication Codes (HMACs) to enable secure and efficient searching of encrypted data without revealing plaintext patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If deterministic encryption is used to protect data, then data privacy is improved, but search efficiency deteriorates because all data must be decrypted and linearly searched
Solution Approach 1:
The patent segments encrypted data into fixed-size blocks and processes each block independently through the encryption function. This allows the encryption system to handle large datasets by dividing them into manageable units, enabling efficient processing and indexing of encrypted data without requiring full decryption for search operations.
Solution Approach 2:
The patent introduces an intermediary indexing structure that stores encrypted data blocks along with their corresponding encrypted search terms. This intermediary layer enables search operations to be performed on encrypted data without decrypting the entire dataset, thus maintaining both privacy and search efficiency.
2Stability of the object's composition
If deterministic encryption is used, then encryption consistency is improved, but information leakage worsens due to recognizable data patterns
Solution Approach 1:
The patent employs a dynamic approach by using a cryptographic hash function that processes each data block independently. While the encryption function itself remains deterministic, the overall system achieves dynamic behavior through block-by-block processing, preventing pattern recognition across the entire dataset while maintaining encryption consistency within each block.
Solution Approach 2:
The patent changes the parameter of data representation by converting variable-length data into fixed-size blocks before encryption. This parameter change ensures that even if the original data has recognizable patterns, the encrypted blocks will have uniform size and structure, making pattern recognition difficult while maintaining deterministic encryption properties.
3Reliability
If encrypted data is stored in database, then data security is improved, but access complexity worsens due to decryption requirements
Solution Approach 1:
The patent performs preliminary action by pre-processing data into fixed-size blocks and encrypting them before storage. This preliminary encryption and blocking operation simplifies subsequent access operations, as the database can directly store and retrieve encrypted blocks without requiring complex decryption logic during access operations.
Solution Approach 2:
The patent creates copies of data in different formats: the original plaintext data and its corresponding encrypted block representation. This copying approach allows the system to maintain both the secure encrypted version for storage and the ability to process search queries efficiently without compromising the security of the stored data.
Data Source
AI summary
An indexing value may be determined, transparently with respect to a requester, based on a desired plaintext item of data and a cryptographic key. The indexing value may be used to access an entry in an indexing structure to obtain a corresponding database entry which includes a non-deterministically encrypted ciphertext item. In another embodiment, an indexing structure for a database may be accessed. Positions of items of the indexing structure may be based on corresponding plaintext items. References related to the corresponding plaintext items in the indexing structure may be encrypted and other information in the indexing structure may be unencrypted. A portion of the indexing structure may be loaded into a memory and at least one of the encrypted references related to one of the plaintext items may be decrypted. The decrypted reference may be used to access a corresponding non-deterministically encrypted data item from the database.