Encrypted Database Architecture for Privacy-Preserving SQL Queries
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current encrypted databases lack a robust architecture for supporting privacy by design in data analytics, particularly in handling conditional queries without leaking sensitive information, as existing cryptosystems like CryptDB may reveal additional information during SQL queries.
Innovation Solution
A system and method for generating and managing an encrypted database using semantically secure additively homomorphic cryptosystems, allowing conditional queries to be executed on encrypted data without decryption, with a three-tiered architecture including a DB server, computation server, and web server, and key management using a Key Authority to ensure privacy-preserving data analytics.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If deterministic encryption is used to support SQL WHERE queries, then query functionality is improved, but information leakage increases
Solution Approach 1:
The patent introduces an intermediary mechanism (encrypted index structure with trapdoors) that mediates between the need for efficient conditional queries and the requirement for information security. The trapdoor mechanism allows the system to verify encrypted values without exposing the actual plaintext data, thus enabling query functionality while preventing information leakage to the database server.
Solution Approach 2:
The patent applies different encryption strategies to different parts of the data structure. Specifically, it uses deterministic encryption only for index structures that require efficient querying, while maintaining semantic security for the actual data storage. This local differentiation allows the system to optimize query performance in specific areas without compromising overall information security.
2Reliability
If encrypted data is stored to protect privacy, then security is improved, but query processing capability deteriorates
Solution Approach 1:
The patent segments the encryption approach into multiple layers: public-key encryption for data confidentiality, deterministic encryption for index structures, and trapdoor mechanisms for conditional query support. This segmentation allows each layer to serve its specific function, maintaining both security and query processing capability without requiring a single encryption scheme to accomplish all tasks.
Solution Approach 2:
The patent performs preliminary actions by pre-processing data into encrypted index structures during data loading. These pre-computed encrypted indexes enable efficient conditional queries later without requiring decryption or complex computations during query execution, thus maintaining both security and operational ease.
3Adaptability or versatility
If multiple encryption layers are applied to support various queries, then query versatility is improved, but system complexity increases
Solution Approach 1:
The patent implements a universal encrypted index structure that can support multiple types of conditional queries (equality, range, prefix queries) through a single unified mechanism. The trapdoor-based encrypted index serves multiple query functions without requiring separate encryption schemes for each query type, thus improving versatility while controlling system complexity.
4Reliability
If encrypted data structures are used, then privacy protection is improved, but computational efficiency deteriorates
Solution Approach 1:
The patent introduces encrypted index structures as intermediaries that enable efficient query processing on encrypted data. These indexes allow the database server to perform search operations on encrypted values without decryption, maintaining privacy protection while significantly improving computational efficiency compared to linear scanning of encrypted data.
Solution Approach 2:
The patent performs preliminary encryption and index construction during data loading, transforming plaintext data into optimized encrypted index structures in advance. This pre-processing enables fast query execution later without requiring complex computations during actual query operations, thus improving computational efficiency while maintaining privacy.
Data Source
AI summary
A method is provided for generating an encrypted database. The method includes: receiving a plaintext database having plaintext data entries therein; and generating an encrypted database using the plaintext database, the encrypted database including encrypted data entries therein. The encrypted database is configured to support at least one form of conditional query such that the at least one form of conditional query returns a correct encrypted result when the query is computed on the encrypted data entries without the decryption thereof.