Asymmetric Private Set Intersection Matching With Encrypted Prefix Groups
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing contact discovery implementations in online communication platforms risk user privacy due to plaintext contact list access and vulnerabilities in hashing-based encryptions, particularly susceptible to brute-force attacks.
Innovation Solution
Implementing multiple layers of encryption, including SHA256 and client-server specific keys, along with probabilistic data structures like bloom filters, to ensure secure and efficient asymmetric private set intersection matching, ensuring data privacy during contact discovery.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hashing-based encryption is used for contact lists, then data privacy is improved, but vulnerability to brute-force attacks increases
Solution Approach 1:
The patent combines multiple encryption techniques (hashing with salting, symmetric encryption with AES, and asymmetric encryption with RSA) to create a composite security system. This multi-layered approach ensures that if one encryption method is compromised, other layers remain intact, thereby maintaining data privacy while eliminating brute-force vulnerability through cryptographic strength and key management.
Solution Approach 2:
The patent implements dynamic key management where encryption parameters (keys, salts, ivectors) are continuously updated and changed. The system uses client-specific keys that are generated and rotated, changing the encryption parameters over time to prevent brute-force attacks while maintaining strong data privacy protection.
2Ease of operation
If contact lists are stored in plaintext for easy access, then ease of operation is improved, but data privacy protection deteriorates
Solution Approach 1:
The patent introduces an intermediary encryption layer where contact lists are encrypted before storage and transmission. The system uses a key management intermediary that handles decryption operations securely, allowing easy access to contacts for authorized users while maintaining strong privacy protection. The intermediary layer abstracts the complexity of encryption from the user interface.
Solution Approach 2:
The patent creates encrypted copies of contact lists that can be securely stored and transmitted. Instead of storing plaintext, the system stores encrypted representations that can be decrypted only with the proper keys, maintaining ease of operation for authorized access while ensuring data privacy remains intact.
3Reliability
If multiple layers of encryption are implemented, then data privacy protection is improved, but device complexity increases
Solution Approach 1:
The patent segments the encryption system into distinct functional layers: hashing layer for input validation, symmetric encryption layer for data confidentiality, and asymmetric encryption layer for key exchange. Each layer handles a specific security function independently, making the overall complex system more manageable and maintainable while achieving strong data privacy protection.
Solution Approach 2:
The patent designs a universal key management framework that handles multiple encryption operations through a single cohesive system. The key management module serves multiple functions including key generation, key exchange, encryption, and decryption, reducing the practical complexity despite the theoretical multi-layered encryption architecture.
4Productivity
If contact discovery implementations access contact lists directly, then productivity is improved, but harmful factors (privacy risks) increase
Solution Approach 1:
The patent introduces an encrypted intermediary layer between the contact discovery system and the contact lists. The system encrypts contact lists before making them available for discovery operations, allowing efficient productivity while preventing direct access that would expose privacy information. The intermediary encryption layer enables secure contact matching without plaintext exposure.
Data Source
AI summary
A server computer is programmed to: generate a first plurality of encrypted records partitioned into groups, each including encrypted records whose corresponding input records share a prefix; receive, from a client device, a second plurality of encrypted records, each accompanied by a prefix; encrypt the second plurality of encrypted records to create a second plurality of doubly encrypted records, query, using the prefix, a data warehouse to fetch a group of encrypted records; generate a data structure encoded to indicate a presence of each encrypted record of the group fetched from the data warehouse; and transmit the second plurality of doubly encrypted records and the data structure to the second device, the second device using the second plurality of doubly encrypted records and the data structure to determine whether at least one of the second plurality of encrypted records is included in one group of encrypted records.