Encrypted Query Processing via Homomorphic Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data breaches and compliance issues in cloud services necessitate secure handling of queries on untrusted platforms, where conventional encryption schemes restrict computations on encrypted data, limiting the benefits of hosting applications on cloud platforms.
Innovation Solution
A method where a data server analyzes parameterized queries to determine an encryption configuration for transforming user queries, enabling secure execution on encrypted data, with the data server providing encryption configurations to the database application, which then encrypts and decrypts query results, while the data server stores encryption keys encrypted with a master key.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional encryption schemes are used to protect data on untrusted platforms, then data security is improved, but the ability to perform computations on encrypted data deteriorates
Solution Approach 1:
The patent transforms the encryption scheme from conventional encryption to homomorphic encryption, changing the mathematical parameters and properties of the encryption system. This allows computations to be performed on encrypted data by leveraging the homomorphic properties that preserve algebraic structures through encryption, thereby enabling computation capability while maintaining security
Solution Approach 2:
The patent introduces a trusted third party (TTP) as an intermediary that generates key pairs and distributes public keys to untrusted servers. The TTP mediates between the need for security and the need for computation by providing a cryptographic infrastructure where encrypted data can be processed without exposing plaintext to untrusted parties
2Reliability
If the database server processes queries directly on encrypted data, then data security is improved, but query processing efficiency and functionality deteriorate
Solution Approach 1:
The patent applies preliminary action by pre-processing queries at the client side before encryption. The client transforms the original query into a form that can be efficiently evaluated on encrypted data, performing necessary algebraic manipulations in advance so that the server only needs to execute straightforward homomorphic operations without complex query optimization
Solution Approach 2:
The patent changes the operational parameters of query processing by transitioning from standard SQL operations to homomorphic operations. This involves mapping conventional query operators to their homomorphic equivalents, changing the computational parameters to work within the constraints of encrypted data while maintaining query functionality
3Reliability
If the database application performs extensive query compilation and transformation, then secure query execution is improved, but the complexity and resource requirements of the database application deteriorate
Solution Approach 1:
The patent extracts the complex query compilation and transformation logic from the database application and relocates it to the client side. This separation allows the database application to remain thin and simple, while the client handles the intellectually demanding tasks of query analysis, transformation, and encryption configuration
4Speed
If encryption keys are stored on the data server for efficient decryption, then decryption speed is improved, but data security deteriorates due to potential key exposure
Solution Approach 1:
The patent introduces a trusted third party as an intermediary for key management. The TTP generates key pairs and securely distributes public keys to servers and private keys to clients, acting as a mediator that enables efficient decryption while preventing key exposure on untrusted servers. The TTP's involvement ensures that no single untrusted party has access to both encryption and decryption capabilities
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods, systems, apparatuses, and computer program products are provided for secure handling of queries by a data server (DS) and a database application (DA). A parameterized query is received by the DS from the DA based on a user query received from a requestor. The DS analyzes the parameterized query to attempt to determine an encryption configuration for a transformed version of the user query capable of being evaluated by the DS on encrypted data values. The DS responds to the DA with either a failure to determine the encryption configuration, or by providing the determined encryption configuration to the DA. The DA generates the transformed version of the user query, and provides the transformed version to the DS. The DS evaluates the transformed version of the user query, and provides results to the DA. The DA decrypts the results, and provides the decrypted results to the requestor.