Client-Side Encrypted Indexes for Distributed Key-Value Store Confidentiality
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional distributed key-value stores lack strong protection for data confidentiality, relying on access control and server-side encryption that do not adequately safeguard against data theft, especially in large-scale applications.
Innovation Solution
A method for operating a distributed key-value store that uses a private key at a client device to encrypt data records and build encrypted indexes based on query types, enabling secure query protocols across multiple server nodes, employing searchable symmetric encryption and order-revealing encryption to protect data confidentiality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional access control and server-side encryption are used, then data storage and retrieval are simple and efficient, but data confidentiality is not adequately protected against data theft
Solution Approach 1:
The patent applies preliminary action by pre-processing data into encrypted identifier-value pairs before storage. The client device encrypts data using a private key and builds encrypted indexes beforehand, so that when data is stored on server nodes, it is already in an encrypted and query-ready format. This eliminates the need for complex real-time encryption during storage operations while maintaining strong confidentiality protection.
Solution Approach 2:
The patent introduces an intermediary mechanism through the use of encrypted indexes and query tokens. Instead of direct access to encrypted data, the system uses intermediate encrypted indexes that map query conditions to stored data locations. The query protocol acts as an intermediary layer that enables secure data retrieval without exposing the underlying encrypted data or requiring the server to possess decryption keys.
2Reliability
If data is encrypted for secure storage, then data confidentiality is improved, but query processing becomes more complex and slower
Solution Approach 1:
The system performs preliminary actions by pre-building encrypted indexes on the client device before data is distributed to server nodes. These indexes are constructed using the private key and stored in an encrypted format that preserves query capability. During query processing, the server can efficiently search these pre-built encrypted indexes without needing to decrypt the actual data, significantly reducing query processing time while maintaining confidentiality.
Solution Approach 2:
The encrypted index structure enables self-service query processing where the encrypted data itself contains the necessary information for efficient searching. The encrypted indexes are designed to support direct comparison and matching operations on encrypted values, allowing the server to perform query operations on encrypted data without external decryption assistance, thus maintaining both security and performance.
3Reliability
If encrypted indexes are built on the client device, then query security is enhanced, but client device computational load increases
Solution Approach 1:
The system applies preliminary action by concentrating the computationally intensive encrypted index building operation as a one-time or periodic task performed on the client device. Once built, these encrypted indexes are distributed to server nodes for storage. During normal query operations, the heavy computational burden shifts to the server nodes which simply search the pre-built encrypted indexes, dramatically reducing the energy consumption of frequent query operations on the client device.
Data Source
AI summary
A method for operating a distributed key-value store includes processing a data set comprised of data records each associated with a unique identifier and having one or more values associated with one or more attributes using a private key provided at a client device, thereby partitioning each of the data records based on the identifier and forming a plurality of encrypted identifier-value pairs for distributed storage across a plurality of server nodes operably connectable to the client device. The method also includes building, at the client device, encrypted indexes based on the type of query; and executing a query protocol in response to receiving a query from the client device so as to identify, using the built encrypted indexes, data distributively stored in the server nodes which matches the query. The invention also provides a related system for operating a distributed key-value store.