Oblivious Random Access Memory Data Permutation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud storage systems fail to effectively conceal client access patterns to encrypted data, making them unsuitable for sensitive sectors due to the need for plaintext access and inadequate protection of data privacy, even with encryption.
Innovation Solution
Implementing Oblivious Random Access Memory (O-RAM) to randomly permute and re-assign data blocks across multiple memory locations, ensuring that access patterns remain hidden from untrusted cloud service providers while allowing for search functionalities, using a client-side encryption and decryption process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If encryption is applied to data before uploading to cloud storage, then data confidentiality is improved, but data access patterns become visible and can leak information
Solution Approach 1:
The system performs preliminary encryption of data blocks before uploading to cloud storage, and pre-allocates memory locations for permuted data. This advance preparation ensures that when data is accessed, the access patterns are already obscured through the pre-established permutation structure, preventing leakage of information about which data blocks are being accessed.
Solution Approach 2:
The patent introduces an intermediary permutation layer between the encrypted data and its storage locations. This permutation mechanism acts as a mediator that randomizes the mapping between data blocks and memory locations, so that even though encrypted data is stored in the cloud, the access patterns to these permuted locations do not reveal which actual data blocks are being accessed.
2Ease of operation
If plaintext access is provided to cloud storage services for search functionality, then search capability is improved, but data privacy is compromised
Solution Approach 1:
The system segments data into fixed-size blocks and applies separate permutation operations to each block. This segmentation allows the cloud storage service to perform search operations on individual encrypted blocks without needing access to plaintext, while the permutation ensures that access patterns to these segments do not reveal which segments are actually being searched.
Solution Approach 2:
The patent changes the parameter of data representation by applying permutation transformations to encrypted data blocks. Instead of storing encrypted data at fixed locations, the system dynamically permutes the locations where encrypted blocks are stored, allowing search functionality to operate on encrypted data while the permutation parameters prevent inference of which data is being accessed.
3Productivity
If data blocks are stored at fixed memory locations, then storage efficiency is improved, but access patterns reveal information about data usage
Solution Approach 1:
The system implements dynamic memory location assignment through permutation operations. Instead of fixed storage locations, data blocks are mapped to memory locations that change based on permutation functions. This dynamic allocation maintains storage efficiency while ensuring that access patterns to these dynamically assigned locations do not reveal which data blocks are being accessed.
Solution Approach 2:
The patent changes the location parameter of stored data blocks by applying permutation transformations. The memory location parameter becomes a function of the data block identifier and a permutation key, rather than a fixed value. This parameter transformation allows efficient storage while concealing access patterns, as the same data block will map to different locations under different permutation operations.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
A method (700) for obliviously moving N data blocks (102) stored in memory hardware (114) includes organizing memory locations (118) of the memory hardware into substantially formula (I) data buckets (350) each containing formula (I) data blocks, and allocating substantially formula (I) buffer buckets (360) associated with new memory locations in the memory hardware. Each buffer bucket is associated with a corresponding cache slot (370) allocated at the client (104) for storing cached permutated data blocks. The method further includes iteratively providing the substantially formula (I) data blocks to the client. The client is configured to apply a random permutation on the substantially formula (I) data blocks within each corresponding received data bucket to generate permutated data blocks and determine a corresponding buffer bucket and a corresponding cache slot for each permutated data block.