Encrypted Index for Range-Based Queries in SSE
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Searchable Symmetric Encryption (SSE) techniques fail to support complex queries, particularly range-based queries, limiting their utility in encrypted document storage systems.
Innovation Solution
Implementing a system with an encrypted index that maps bucketized terms to encrypted documents, allowing clients to perform range-based queries by generating and sending tokens to a server, which returns encrypted documents satisfying the search criteria, while preventing the server from accessing plaintext data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If documents are encrypted at the client device and stored at the remote repository, then data security is improved, but the user cannot perform operations on the stored documents
Solution Approach 1:
The patent introduces an encrypted index as an intermediary structure that enables search operations on encrypted documents. The index contains encrypted terms and their mappings to document identifiers, allowing the server to perform searches without decrypting the documents. This intermediary structure resolves the contradiction by providing search capability while maintaining encryption security.
Solution Approach 2:
The patent creates a copy of the index structure in encrypted form, storing encrypted terms and their relationships at the remote repository. This encrypted index copy allows the server to perform search operations using the same structural relationships as the plaintext index would provide, without exposing the actual document content or terms to the server.
2Adaptability or versatility
If existing SSE techniques are used, then simple search queries are supported, but complex queries such as range-based queries fail
Solution Approach 1:
The patent segments the index structure into multiple levels: a first level mapping terms to buckets of values, and a second level mapping bucketized terms to document identifiers. This segmentation enables the system to handle complex range-based queries by navigating through the bucketized structure, while keeping each individual mapping relationship relatively simple.
Solution Approach 2:
The patent adds an additional dimension to the index structure by introducing bucketized terms that map to ranges of values rather than single terms. This dimensional extension from term-to-document direct mapping to term-to-bucket-to-document indirect mapping enables range-based queries while maintaining manageable complexity through the bucketization approach.
3Ease of operation
If the user downloads all documents to perform searches, then search capability is restored, but time consumption increases
Solution Approach 1:
The patent extracts the search functionality from the document data itself and places it in the encrypted index structure. By storing encrypted terms and their mappings in the index at the remote repository, the system can perform searches without extracting (downloading) the actual document content, thereby maintaining search capability while avoiding the time consumption of transferring all documents.
Data Source
AI summary
Techniques enable range-based queries in searchable symmetric encryption (SSE) systems. A server device includes or provides access to a database that stores encrypted documents along with an encrypted index that maps bucketized terms (e.g., a term coupled with a value range associated with that term) to encrypted documents. Search is performed through a two-step process in which the client first sends a first search token to request the bucketization for a term, then sends one or more second search tokens each specifying a particular bucket in which to search for the term. In response to the second tokens, the server sends information corresponding to encrypted documents that satisfy the search. Embodiments further provide for incremental addition and deletion of particular values for a term, and rebucketization at the client when a rate of false positive search results exceeds a threshold.