Encrypted Multi-Map Architecture for Concurrent End-to-End Queries

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Implementing end-to-end encryption in data management systems poses challenges such as data leakage opportunities due to adversarial models and the need for secure data handling across multiple clients and concurrent operations, while maintaining resilience to client failures and server crashes.

Innovation Solution

A system employing encrypted multi-map data structures and encryption schemes that support snapshot security, multiple client support, efficient concurrent operations, and resilience to client failures, using lightweight clients and scalable architecture, with features like snapshot security, efficient search, updates, and deletes, and expressive queries.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If end-to-end encryption is implemented in data management systems, then data security is improved, but data leakage opportunities increase due to adversarial models

Engineering Contradiction:

Improvedata securityVSAvoiddata leakage opportunities

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent segments the encryption system into multiple components: encrypted multi-map data structures for storing encrypted data, separate encryption keys for different clients, and distinct read/write/delete operations. This segmentation allows each component to be optimized for security while maintaining functionality, reducing data leakage opportunities by isolating access paths.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces encrypted multi-map data structures as intermediaries between the client and the underlying storage system. These data structures act as a secure layer that prevents direct access to plaintext data, thereby reducing data leakage opportunities while maintaining end-to-end encryption security.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If end-to-end encryption is implemented with multiple client support, then system versatility is improved, but system complexity increases

Engineering Contradiction:

Improvemultiple client supportVSAvoidsystem complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent implements a universal encrypted multi-map data structure that serves multiple clients simultaneously. The system uses a common encryption scheme that can handle different client keys and operations, allowing one data structure to perform multiple functions for different clients, thereby supporting versatility without proportionally increasing complexity.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The patent manages multiple clients by changing cryptographic parameters (different encryption keys) rather than creating separate data structures for each client. This approach allows the system to support multiple clients while maintaining a unified data structure, reducing overall system complexity.

Inventive Principle:

Principle #35Parameter changes

3Productivity

If end-to-end encryption is implemented with concurrent operation support, then productivity is improved, but reliability challenges arise due to client failures and server crashes

Engineering Contradiction:

Improveconcurrent operation efficiencyVSAvoidresilience to failures

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent implements snapshot security that creates previous versions of the encrypted data before modifications. This cushioning mechanism allows the system to recover from client failures or server crashes by restoring from snapshots, thereby maintaining reliability while supporting concurrent operations.

Inventive Principle:

Principle #11Beforehand cushioning (Prior cushioning)

Solution Approach 2:

The patent uses encrypted metadata to track the state of the encrypted multi-map data structures. This feedback mechanism allows the system to detect and handle concurrent modifications, client failures, and server crashes by monitoring state changes and coordinating operations across multiple clients, maintaining both productivity and reliability.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS12511422B2Systems and methods for end-to end-encryption with encrypted multi-maps

Publication Date: 2025.12.30 MONGODB INC

AI summary

According to some aspects, provided are systems and methods that implement end-to-end encryption, and provide implementation configured to secure information during execution of queries on an encrypted data source. Various embodiments include multiple encrypted multi-map data structures and associated encryption schemes configured to securely read, write, and delete information while supporting any one or more of the following features: snapshot security, multiple client support, efficient execution under concurrent operation, and resilience to client failures. In various embodiments, addressable multi-map data structures enable concurrent access, and allow correct operation under polynomial time constraints.