Encrypted Range Search Index Client Server Overhead
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing encrypted search systems are inefficient for performing range searches in encrypted data, as they require numerous individual searches to cover a range of values, compromising confidentiality and increasing communication overheads.
Innovation Solution
A method and system that utilize a client computing device to identify and generate encrypted search queries for a range of values, allowing efficient range searches by using a local search index and symmetric encryption, reducing the need for individual searches and minimizing communication with an untrusted server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If individual search operations are performed for each value in a range, then complete coverage of the search range is achieved, but the number of search operations and communication overhead increase significantly
Solution Approach 1:
The patent combines multiple individual search operations into a single range search query. Instead of performing separate searches for each value in a range (e.g., 7,501 individual searches for integers 2,500-10,000), the system merges these into one unified search operation that retrieves all matching documents within the specified range, dramatically reducing communication overhead and improving search efficiency
Solution Approach 2:
The system performs preliminary actions by pre-processing and storing range information in the encrypted search index structure. This allows the server to efficiently compute and return results for entire ranges without requiring the client to issue multiple individual queries, as the range search capability is prepared in advance during index construction
2Productivity
If the server performs range search operations on encrypted data, then search efficiency improves, but data confidentiality is compromised
Solution Approach 1:
The patent introduces an intermediary mechanism where the client generates encrypted range search queries that embed search parameters in an encrypted format. The server processes these encrypted queries without being able to decrypt or understand the actual search terms, maintaining confidentiality while enabling efficient range search operations through cryptographic proofs and encrypted comparisons
Solution Approach 2:
The system applies different cryptographic techniques to different parts of the search process. The search index is encrypted using a scheme that allows range comparisons without full decryption, while the search queries use encrypted parameter embedding. This localized application of cryptographic methods enables efficient processing in specific areas while maintaining overall data confidentiality
3Measurement precision
If multiple individual search queries are transmitted to the server, then complete range search is achieved, but communication overhead increases
Solution Approach 1:
The patent merges multiple individual search queries into a single encrypted range search query. Instead of transmitting thousands of separate queries for each value in a range, the system transmits one consolidated query that specifies the range boundaries, reducing communication overhead from O(n) individual queries to O(1) unified query while maintaining complete search coverage
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for searching encrypted data includes identifying, with a client, a plurality of values within a predetermined search range in a search index stored within a memory of the client, each value in the plurality of values being present in a plaintext representation of at least one encrypted file in a plurality of encrypted files stored in a server. The method further includes generating and transmitting at least one search query to the server through a data network, and receiving, with the client, at least one response from the server through the data network, the response including the encrypted keyword corresponding to the value in the plurality of values and an identifier of at least one file in the plurality of encrypted files stored on the server that includes the value.