Secure Graph Query Processing via Embedding Bucketization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Graph databases stored on untrusted servers, such as cloud-based servers, face challenges in performing parameter-based queries on encrypted data due to computational overhead and slow response times, as the server cannot decrypt the encrypted database, leading to inefficient query processing.
Innovation Solution
The method involves creating an embedding for encrypted sensitive information in a graph database, bucketizing it based on shared data graph features, and processing queries on the embedding graph to retrieve and decrypt relevant information, reducing server hops and improving query efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the graph database is stored in an encrypted state on the untrusted server, then data security is improved, but query processing becomes impossible without returning the entire database
Solution Approach 1:
The patent segments the encrypted graph database into multiple encrypted shards distributed across different storage locations. Each shard contains a portion of the encrypted data, allowing the system to query specific segments without retrieving the entire database. This segmentation enables efficient partial data access while maintaining encryption security.
Solution Approach 2:
The patent introduces an intermediary trusted execution environment (TEE) that acts as a mediator between the untrusted server and the client. The TEE decrypts and processes queries on encrypted data without exposing plaintext to the untrusted server, enabling efficient query processing while maintaining data security. The intermediary resolves the contradiction by providing a secure processing layer.
2Measurement precision
If the entire graph database is returned for decryption and searching, then query accuracy is improved, but computational overhead and response time become unacceptable
Solution Approach 1:
The patent performs preliminary actions by pre-computing and storing encrypted indexes and metadata structures on the untrusted server. These pre-processed encrypted structures enable the system to quickly locate and retrieve only the relevant encrypted data portions needed for specific queries, rather than returning the entire database. This preliminary preparation significantly reduces query response time while maintaining accuracy.
Solution Approach 2:
The patent applies local quality by optimizing specific parts of the database structure for query efficiency. Encrypted indexes and metadata are organized with local optimizations that enable targeted data retrieval. The system maintains different encryption and organization strategies for different data portions based on their access patterns, improving overall query performance without compromising security.
3Reliability
If encryption is applied to the graph database, then data security is improved, but parameter-based queries become difficult or impossible to conduct
Solution Approach 1:
The patent changes the parameters of encryption by using homomorphic encryption or searchable encryption schemes that allow mathematical operations on encrypted data. These specialized encryption methods enable parameter-based queries to be performed directly on encrypted data without decryption, maintaining both security and query functionality. The encryption parameters are specifically chosen to support the required query operations.
Solution Approach 2:
The patent replaces the traditional mechanical approach of decrypting data for querying with a cryptographic substitution approach. Instead of mechanically decrypting and then searching, the system uses cryptographic primitives that allow search operations to be performed in the encrypted domain. This substitution eliminates the need to expose plaintext during query processing.
Data Source
AI summary
A processor-implemented method securely responds to a query for information from a data graph. One or more processors create an embedding for encrypted sensitive information in vertices in a data graph; and bucketize embedded encrypted sensitive information on an embedding graph, where bucketizing the embedded encrypted sensitive information clusters vertices from the graph database that have shared data graph features. The processor(s) receive a query of the data graph from a requester, where the query is for information related to the shared data graph features. The processor(s) retrieve a bucket from the embedding graph that contains the information related to the shared data graph features; and extract encrypted sensitive information from the retrieved bucket.