Encrypted Data Search via Identity-Based Key Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data storage systems face performance degradation due to full table scans for wildcard-based text searches, lack of access control leading to unauthorized data access, and trust issues when decrypting data, especially with increasing data volumes and search requests, violating the 'Trust No One' philosophy.
Innovation Solution
Implementing a system where data is stored as encrypted records, with individual decryption keys associated with user identities, processed without decrypting all records, and all non-encrypted data and keys are overwritten after each search request to maintain access control and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If all data is decrypted for search requests, then search capability is improved, but security and performance deteriorate due to full table scans and trust violations
Solution Approach 1:
The patent segments data into encrypted records with individual decryption keys associated with user identities. Instead of decrypting all data for search, the system divides data access into discrete key-based segments, allowing selective decryption of only relevant records based on user authorization, thus maintaining security while enabling search functionality.
Solution Approach 2:
The patent introduces an intermediary mechanism where decryption keys act as mediators between user identities and encrypted data. The system uses identity-based key management where keys are generated and stored without being revealed to owners, serving as an intermediary layer that enables controlled access without compromising security or requiring full decryption.
2Reliability
If data is encrypted for security, then security is improved, but search performance deteriorates due to inability to search encrypted data efficiently
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing encrypted indexes alongside encrypted records. The system performs indexing operations on encrypted data before search requests arrive, creating searchable structures that enable efficient query processing without requiring decryption of all data, thus maintaining both security and performance.
Solution Approach 2:
The patent replaces the mechanical approach of decrypting data for search with a cryptographic substitution method. Instead of converting encrypted data to plaintext for searching, the system uses identity-based cryptography to enable direct search operations on encrypted records through mathematical operations on ciphertext, eliminating the need for decryption while maintaining search capability.
3Ease of manufacture
If superuser key is used for encryption, then ease of implementation is improved, but trust is violated as control falls to superuser instead of data owners
Solution Approach 1:
The patent inverts the traditional encryption model where a central authority controls keys. Instead of superuser-controlled encryption, the system implements owner-controlled encryption where each data owner has exclusive control over their decryption key. The inversion shifts power from the system administrator to the data owner, establishing trust by ensuring only authorized owners can access their data.
Solution Approach 2:
The patent enables self-service through identity-based key management where data owners independently control their own decryption keys without requiring superuser intervention. The system automatically generates and manages keys associated with user identities, allowing owners to control their own data access and share permissions without exposing master keys, thus maintaining trust and security.
4Ease of operation
If password authentication is used for access control, then ease of operation is improved, but trust is compromised when passwords are shared for data access
Solution Approach 1:
The patent uses copying by generating derived decryption keys from the original owner key without exposing the master key. When data owners need to share access, the system creates cryptographic copies or derivatives of the decryption key that grant access to specific data or operations. These copied keys can be distributed safely without compromising the original owner's trust or security, as the master key remains secure.
Data Source
AI summary
The present invention is directed to methods and systems in which data are stored as encrypted records on a computer usable medium, and search requests are processed based on user identities to retrieve the data without decrypting all the stored records. Individual decryption keys are associated with identities of respective owners, without being revealed to the owners and are kept internal inside a computer. Finally, all keys are overwritten from the computer usable medium upon completion of each search request to take access away from a superuser or any unauthorized access to the system.