Homomorphic Searchable Encryption for Encrypted Documents
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current client-server systems face challenges in searching encrypted documents in cloud environments due to high network latency, storage requirements, and security leakage issues, particularly with deterministic encryption strategies and index tables, which are not scalable across multiple cloud platforms.
Innovation Solution
A homomorphic-based searchable encryption scheme using probabilistic trapdoors and the RSA algorithm, which allows direct keyword search over encrypted documents without an index table, enhancing security and scalability by using modular inverses to generate unique trapdoors for each search query, thus preventing statistical information leakage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If all documents are downloaded and decrypted to search for a keyword, then the search can be performed, but network latency increases significantly
Solution Approach 1:
The patent applies preliminary action by pre-processing documents on the client side before uploading to the cloud. Documents are encrypted and processed in advance, allowing the server to perform searches directly on encrypted data without requiring downloads or decryption during search operations, thus reducing network latency while maintaining search accuracy
2Productivity
If an index table is generated to improve search efficiency, then search speed increases, but storage requirements and client-side computations increase significantly
Solution Approach 1:
The patent extracts the indexing functionality from the traditional client-side index table approach and integrates it into the encryption process itself. By embedding searchable encrypted indexes within the encrypted document structure, the system eliminates the need for separate large-scale index tables, reducing storage requirements while maintaining search speed through direct encrypted matching on the server
Solution Approach 2:
The patent merges the index structure with the encrypted document data. Instead of maintaining separate index tables and document storage, the system combines encrypted keywords and their positional information directly within the encrypted document streams, allowing the server to perform searches on the merged encrypted structure without requiring separate index management, thus reducing overall storage requirements
3Reliability
If deterministic encryption is used to generate tokens, then the same token is generated for the same keyword, but statistical information about search patterns leaks
Solution Approach 1:
The patent applies dynamics by introducing randomness and variability into the token generation process. Instead of using deterministic encryption that produces identical tokens for identical keywords, the system uses probabilistic encryption mechanisms where each encryption operation incorporates random elements, causing the same keyword to generate different encrypted tokens each time, thus preventing search pattern leakage while maintaining encryption reliability through consistent cryptographic properties
4Adaptability or versatility
If index tables are replicated across cloud platforms, then cross-platform access is enabled, but network latency and scalability are reduced
Solution Approach 1:
The patent achieves universality by designing an encryption scheme that is platform-agnostic and cloud-agnostic. The encrypted documents and their embedded indexes can be stored and searched on any cloud platform without requiring replication or adaptation to specific platforms. The system's encrypted data structure and search protocol work universally across different cloud environments, enabling cross-platform access without the need for index table replication, thus eliminating the associated network latency and scalability issues
Data Source
AI summary
A client-server computer system (10) for a client (12) to search for a keyword in at least partially homomorphically encrypted documents (18) stored in a server (14) is disclosed. The client-server computer system (10) is configured as follows. The client (12) applies probabilistic symmetric encryption to a keyword to form a probabilistically encrypted keyword to form a first result. The client (12) applies deterministic symmetric encryption to the keyword to form a deterministically encrypted keyword, then computes a modular inverse of the deterministically encrypted keyword, and then applies at least partially homomorphic encryption to the modular inverse deterministically encrypted keyword to form a second result. The client (12) uses a session key to hash the first result to form a hash result. The client (12) combines the first result and second result to form a third result. The client (12) encrypts the third result and the hash result using a private key to generate the search query. The client (12) sends the search query to the server (14). The server (14) receives the search query from the client (12). The server (14) identifies at least one identifier of at least one document of the at least partially homomorphically encrypted documents including the keyword by decrypting, using a public key, a product of the search query and the hash result. The server (14) sends the at least one identifier in encrypted form to the client (12). The client (12) decrypts the at least one identifier.