Encrypted Database Query Optimization via Local Remote Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database systems that process queries on encrypted data rely on order-preserving encryption, which lacks clarity on security against crypto attacks, particularly known plaintext attacks, and requires dynamic adjustment of encryption levels based on queries, making it difficult to ensure optimal security and performance.
Innovation Solution
The method involves generating query plans with local and remote queries, assigning encryption levels to operators, and optimizing the query plan by switching operator positions based on encryption levels to minimize security risks, while using deterministic encryption for client-side operations and order-preserving encryption for server-side operations, thereby avoiding order-preserving encryption where possible and ensuring higher security without performance loss.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If order-preserving encryption is used to enable range queries on encrypted data, then query functionality is improved, but security against crypto attacks deteriorates
Solution Approach 1:
The query processing is segmented into two parts: order-preserving encryption is applied only to the query predicate portion that requires range comparison, while deterministic encryption is used for the data storage and other operations. This segmentation allows the system to maintain query functionality where needed while maximizing security elsewhere in the system.
Solution Approach 2:
Different encryption methods are applied to different parts of the system based on local requirements: order-preserving encryption is used locally where range comparison is needed in the query predicate, while deterministic encryption is used in other areas where security is the priority. This local quality approach optimizes both functionality and security in their respective domains.
2Reliability
If deterministic encryption is used for client-side operations, then security is improved, but query processing flexibility deteriorates
Solution Approach 1:
The system dynamically selects encryption methods based on the specific operation being performed and the query type. Deterministic encryption is used for client-side data preparation and storage, while order-preserving encryption is dynamically applied server-side for range query predicates. This dynamic adaptation allows the system to maintain both security and flexibility.
Solution Approach 2:
The encryption parameter (deterministic vs. order-preserving) is changed based on the operational context. Client-side operations use deterministic encryption parameters, while server-side range query operations switch to order-preserving encryption parameters. This parameter change enables the system to optimize for security in storage and for functionality in query execution.
3Productivity
If encryption levels are dynamically adjusted based on query requirements, then query performance is improved, but system complexity increases
Solution Approach 1:
The system performs preliminary classification of queries to determine which ones require order-preserving encryption and which can use deterministic encryption. Query plans are pre-generated with appropriate encryption levels assigned, avoiding the need for complex real-time adjustments during query execution. This preliminary action reduces runtime complexity while maintaining performance optimization.
Data Source
AI summary
Methods, systems, and computer-readable storage media for optimizing query processing in encrypted databases. In some implementations, actions include receiving a query that is to be used to query an encrypted database, generating a plurality of query plans based on the query, each query plan including a local query and one or more remote queries, the local query being executable at a client-side and the one or more remote queries being executable at a server-side, selecting an optimal query plan from the plurality of query plans, providing one or more remote queries of the optimal query plan to the server-side for execution, receiving one or more remote results, and processing a local query of the optimal query plan and the one or more remote results to provide a final query result.