Encrypted Data Sharing via Logical Block Index Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for sharing and searching encrypted data face challenges in securely allowing users to search within encrypted documents while maintaining data secrecy, as known methods either do not support searching or compromise security by exposing non-encrypted searchable data.
Innovation Solution
An encrypted sharing system that generates and manages logical block identifiers for index data, enabling secure sharing and searching by identifying and sending subsets of index entries to authorized devices, ensuring that only encrypted data is accessed and processed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If encrypted data is shared with multiple users, then data accessibility and collaboration are improved, but system complexity and key management overhead increase
Solution Approach 1:
The patent segments encrypted data into multiple logical blocks and creates separate index entries for each block. This segmentation allows the system to manage complexity by breaking down large encrypted datasets into smaller, individually addressable units while maintaining overall data accessibility through the index structure.
Solution Approach 2:
The patent introduces an intermediary index structure that mediates between the encrypted data blocks and the users. The index contains logical block identifiers that map to physical storage locations without exposing the actual encrypted content, thus reducing key management overhead while maintaining accessibility.
2Ease of operation
If searchable data is made accessible for searching, then search functionality is improved, but security is compromised due to exposure of unencrypted data
Solution Approach 1:
The patent inverts the traditional approach by making the index searchable rather than the data itself. The index contains encrypted or obfuscated entries that can be searched without exposing the actual encrypted data content, thus maintaining security while enabling search functionality.
Solution Approach 2:
The patent creates a copy of the data structure (the index) that separates the searchable metadata from the actual encrypted data. This copying allows search operations to be performed on the index without compromising the security of the original encrypted data blocks.
3Loss of information
If all index entries are sent to user devices for decryption, then complete search results are provided, but network bandwidth and transmission time are excessive
Solution Approach 1:
The patent extracts only the necessary index entries that match the search criteria and sends only those specific entries to user devices. This extraction eliminates the need to transmit entire datasets or irrelevant index blocks, thus maintaining search result completeness while significantly reducing transmission time and bandwidth usage.
Solution Approach 2:
The patent implements partial action by sending only the subset of index entries needed for the specific search query rather than all index entries. This partial transmission approach provides sufficient search results without the excessive time and bandwidth costs of complete data transmission.
4Object-affected harmful factors
If fine-grained access control is implemented for shared data, then data security is improved, but system complexity and overhead increase
Solution Approach 1:
The patent segments access control permissions at the logical block level rather than requiring complex permissions for entire datasets. Each logical block in the index can have independent access controls, simplifying the overall system by breaking down complex access control requirements into manageable granular units.
Data Source
AI summary
In some embodiments, a method includes receiving, at an encrypted sharing server and from a source compute device, a share request to share first encrypted index data with a destination compute device. The method includes defining a data record including (1) information identifying the destination compute device and (2) a first set of logical block identifiers. The first set of logical block identifiers is generated based on unencrypted index data associated with the first encrypted index data and associated with a first set of storage locations. Each storage location from the first set of storage locations stores at least one index entry from a first set of index entries of the first encrypted index data. The method further includes receiving a search request associated with a search string and sending a signal to cause a subset of index entries to be sent to a destination compute device.