Encrypted Ordered Key-Value Store for Secure Document Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing document data stores often require a tradeoff between manageability and security, with solutions using trusted hardware increasing security but introducing challenges like reduced flexibility and limited geo-distribution, and existing encryption methods not adequately addressing the need for secure storage of sensitive data without trusted hardware.
Innovation Solution
Building an encrypted ordered key-value store that uses an order-preserving encryption scheme for sensitive keys and a semantically secure encryption scheme for values, allowing for dynamic data modeling and transaction management to ensure ACID compliance and secure storage of sensitive data without trusted hardware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If trusted hardware is used to secure document data stores, then security is improved, but flexibility and geo-distribution are reduced
Solution Approach 1:
The patent replaces the mechanical/trusted hardware system with a cryptographic software-based system. Instead of relying on physical security modules or trusted execution environments, the invention uses order-preserving encryption and semantically secure encryption schemes implemented in software, allowing the same security functions to be performed without physical hardware constraints.
Solution Approach 2:
The patent introduces encryption schemes as intermediary layers between the data and storage system. The order-preserving encryption scheme acts as a mediator that maintains the ability to perform range queries and comparisons on encrypted data, while the semantically secure encryption scheme mediates the protection of actual data values, eliminating the need for direct trusted hardware access.
2Reliability
If trusted hardware is used to secure document data stores, then security is improved, but geo-distribution is limited
Solution Approach 1:
The patent replaces the mechanical/trusted hardware system with a cryptographic software-based system. Instead of relying on physical security modules or trusted execution environments, the invention uses order-preserving encryption and semantically secure encryption schemes implemented in software, allowing the same security functions to be performed without physical hardware constraints.
Solution Approach 2:
The encryption system described in the patent is designed to be universally applicable across different geographic locations and infrastructure configurations. The cryptographic schemes can be deployed in distributed environments without requiring specific hardware trust anchors at each location, enabling flexible geo-distribution while maintaining security consistency across all nodes.
3Reliability
If encryption is applied to sensitive data, then security is improved, but manageability and query capability are reduced
Solution Approach 1:
The patent applies different encryption schemes to different parts of the data structure based on their specific requirements. Order-preserving encryption is applied to keys that require range queries and comparisons, while semantically secure encryption is applied to values that require strong confidentiality. This localized application of encryption methods maintains both security and the ability to perform appropriate operations on each data element.
Solution Approach 2:
The patent changes the cryptographic parameters and encryption schemes based on the operational requirements of different data elements. By selecting appropriate encryption modes and parameters for different data types and access patterns, the system maintains security while preserving necessary query and management capabilities.
Data Source
AI summary
Methods, systems, and computer program products for building an encrypted document store are provided herein. A computer-implemented method includes building an encrypted ordered key-value store; encrypting one or more sensitive keys to be stored in the ordered key-value store using an order preserving encryption scheme; storing a state of the order preserving encryption scheme in the ordered key-value store; and encrypting one or more values corresponding to the one or more sensitive keys using a semantically secure encryption scheme.