Encrypted Data Search Using Client-Side Indexes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The growth of public cloud data centers has made it cost-effective to access storage capacity, but there are concerns about data security, particularly regarding key management and communication security, even when data is encrypted, as the location and management of keys remain unclear, and there is a risk of compromise.
Innovation Solution
A method that encrypts objects and scatters them across multiple storage servers in different cloud service providers, using randomized bit vectors and half-keys to ensure that no single compromise of a data center can access the entire object, with a system that allows secure sharing and searching of encrypted data by using client-maintained indexes and server-supported symmetric search encryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is stored in encrypted form in public cloud data centers, then data security is improved, but key management security deteriorates because the location and management of keys remain unclear and are at risk of compromise
Solution Approach 1:
The encryption key is divided into multiple shards using secret sharing schemes, with each shard stored on different storage servers. This segmentation ensures that no single server or data center has access to the complete key, thereby maintaining data security while improving key management security through distributed storage.
Solution Approach 2:
A key management service acts as an intermediary between clients and storage servers, handling key distribution and management operations. This intermediary layer abstracts the complexity of key management while maintaining security through controlled access mechanisms.
2Reliability
If data is scattered across multiple storage servers in different cloud service providers, then security against single data center compromise is improved, but system complexity increases
Solution Approach 1:
Encrypted data objects are divided into multiple data shards that are distributed across different storage servers and cloud service providers. This segmentation provides security against single data center compromise while the system manages complexity through automated distribution and retrieval mechanisms.
Solution Approach 2:
The system provides multi-functional capabilities including data storage, security against compromise, and automated data retrieval through a unified interface. The search functionality and data reconstruction mechanisms handle the complexity internally while presenting a simple interface to users.
3Reliability
If client-maintained indexes are used for searching encrypted data, then key exposure risk is reduced, but search functionality complexity increases
Solution Approach 1:
Search indexes are extracted and maintained by the client rather than the server, removing the need for the server to have access to encryption keys. This extraction of indexing functionality to the client side reduces key exposure risk while the system manages the complexity of distributed indexing through standardized protocols.
Data Source
AI summary
A method and apparatus of a device searches encrypted objects stored in a secure virtual storage space is described. In an exemplary embodiment, the device receives a search query that includes a set of tokens and encrypts the set of tokens. The device further creates a hashed set of encrypted tokens using a second hash function. In addition, the device sends the hashed set of encrypted tokens to a first search server as a query. Furthermore, the device receives, from the first search server, a first set of encrypted object names as a search result. The device additionally determines a set of client-side indexes to search by hashing at least some of the first set of encrypted object names using a first hash function. The device further decrypts the set of encrypted object names. The additionally searches the set of client-side indexes using the set of decrypted object names.