Encrypted Database Search via Segmented Tables
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Encrypted data in databases is difficult to search using wildcards or partial matches, as existing solutions require exact matches, which conflicts with business needs for full-text searches in applications handling personally identifiable information.
Innovation Solution
A searchable encrypted database scheme is implemented by separating encrypted data into multiple tables, where plaintext versions of encrypted columns are stored in searchable tables with encrypted foreign keys, allowing for decryption and querying without linking to other sensitive data, enabling full-text searches using wildcards.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encrypted data is stored in a database, then security and privacy protection are improved, but the ability to search the data using wildcards or partial matches deteriorates
Solution Approach 1:
The patent segments the database into multiple tables: a source table storing encrypted data with encrypted foreign keys, and separate searchable tables storing plaintext versions of specific columns. This segmentation allows the encrypted data to remain secure while enabling wildcard searches on the plaintext copies without exposing the actual encrypted values or their direct associations.
2Ease of operation
If hashing function is used to enable search on encrypted data, then search capability is improved, but the ability to perform wildcard or partial match searches deteriorates
Solution Approach 1:
The patent performs preliminary action by creating and storing plaintext copies of encrypted columns in separate searchable tables before any search operations occur. These pre-prepared plaintext tables enable both exact match and wildcard searches without requiring hashing operations during query execution, thus maintaining full search flexibility.
3Adaptability or versatility
If plaintext data is stored to enable full-text searches, then search flexibility is improved, but security and privacy protection deteriorate
Solution Approach 1:
The patent extracts only the specific columns that need to be searchable from the encrypted source table and stores them as plaintext in separate searchable tables. This extraction allows full-text search flexibility on those specific columns while the main encrypted data remains protected. The searchable tables contain only what is necessary for search operations.
Solution Approach 2:
The patent introduces searchable tables as intermediary structures between the encrypted source data and the search query interface. These intermediary tables provide the flexibility needed for wildcard and partial match searches without exposing the encrypted data structure or enabling direct attacks on the encryption scheme, as they contain only plaintext copies of specific columns without associated encrypted foreign keys.
4Reliability
If encrypted foreign keys are used to link data, then security is improved, but the ability to decrypt and query data efficiently deteriorates
Solution Approach 1:
The patent extracts the decryption functionality and performs decryption only when necessary for retrieving specific records, rather than maintaining continuous decrypted states. The searchable tables are designed to return encrypted foreign keys that are decrypted only for the specific records matched by the search, improving efficiency by minimizing decryption operations while maintaining security.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Techniques are provided to allow full search for encrypted data within a database. In some embodiments, searchable data may be separated into different searchable tables in a database in such a way that encrypted data is stored as plaintext but has no usable link to other data within the source database. In some embodiments, performing a query on a particular user data may result in the retrieval of an encrypted identifier, which may then be decrypted via an encryption module. A second search based on the decrypted identifier may produce a set of relevant search results from a source table.