Oblivious Dynamic Symmetric Searchable Encryption Index Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing searchable encryption systems fail to provide efficient and practical solutions for oblivious keyword search and file update operations in large encrypted search indices, as they require the client to decrypt and re-encrypt entire datasets, leading to inefficiencies and data leakage patterns that can compromise user privacy.
Innovation Solution
The method involves a trusted client generating and transmitting encrypted search and file update requests to multiple untrusted servers, decrypting and re-encrypting the responses using different cryptographic keys, and swapping the re-encrypted data between servers to maintain obliviousness, ensuring that the servers cannot track search and update patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing ORAM solutions are used to achieve oblivious access to encrypted data, then server cannot determine client operations, but client must retrieve and re-encrypt entire datasets leading to inefficiency
Solution Approach 1:
The patent segments the large encrypted search index into multiple smaller encrypted search indices distributed across multiple untrusted servers. The client performs oblivious access operations on these smaller indices rather than retrieving and processing entire datasets, significantly improving efficiency while maintaining obliviousness. Each server stores a portion of the segmented index, and the client interacts with multiple servers in parallel or sequence to complete search operations.
2Measurement precision
If client decrypts and re-encrypts entire datasets for search operations, then search results are obtained, but large amounts of data are processed leading to time consumption
Solution Approach 1:
The patent extracts only the necessary portions of encrypted data from the search index that are relevant to the search query, rather than decrypting and processing entire datasets. The client sends encrypted search queries to multiple servers, each returning only the specific encrypted entries matching the query. This extraction approach minimizes data processing time while maintaining search accuracy, as only relevant data segments are retrieved and decrypted.
3Ease of operation
If server stores encrypted search index, then search functionality is provided, but server can track search patterns and update frequencies compromising privacy
Solution Approach 1:
The patent introduces a new dimension of security by distributing the encrypted search index across multiple untrusted servers instead of storing it on a single server. This dimensional change from centralized to distributed storage prevents any single server from tracking complete search patterns. The client interacts with multiple servers using oblivious transfer techniques, ensuring that no individual server can correlate search queries across the entire index, thereby protecting privacy while maintaining full search functionality.
Data Source
AI summary
An oblivious encrypted search and update method includes transmitting encrypted search queries and encrypted file update requests from a trusted client to at least two different untrusted servers, receiving encrypted search entries and encrypted file entries from the untrusted servers, and decrypting the encrypted search entries and encrypted file entries with the trusted client. The trusted client re-encrypts the decrypted entries and transmits re-encrypted entries that were received from a first untrusted server to a second untrusted server and vice versa to provide obliviousness for encrypted keyword searches and encrypted file updates from the trusted client.