Range-Safe Encryption for Cloud Database Query Processing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud computing databases face challenges in securely processing range predicates due to encryption limitations, which restrict their ability to function as data processing engines, as encryption often prevents direct query processing in the encrypted domain, forcing clients to download and decrypt data for queries.
Innovation Solution
The method involves separately encrypting plain text data using range-safe and brute-force safe encryption functions, splitting the data into distinct encrypted groups, and converting range queries into queries over these groups to generate a final encrypted result, allowing secure processing of range predicates on cloud databases.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted before uploading to cloud infrastructure, then security of sensitive data is improved, but query processing capability deteriorates
Solution Approach 1:
The patent segments the encryption process into multiple distinct encryption functions (e.g., first encryption function and second encryption function) applied to different portions or aspects of the data. This segmentation allows the system to maintain security while enabling specific query operations on encrypted data without requiring full decryption, thus resolving the contradiction between security and query processing capability.
Solution Approach 2:
The patent changes the encryption parameters by using different encryption functions for different data elements or portions, allowing certain cryptographic properties to be preserved that enable range query processing. This parameter variation allows the encrypted data to maintain both security and limited query processing capabilities.
2Reliability
If encryption is applied to data in cloud database, then data security is improved, but cloud infrastructure's data processing engine potential deteriorates
Solution Approach 1:
The patent implements an encryption scheme that serves multiple functions simultaneously: it provides security protection while also enabling range query processing on encrypted data. The multi-functional encryption approach allows the cloud infrastructure to act as both a secure storage repository and an active data processing engine, resolving the contradiction between security and processing versatility.
Solution Approach 2:
The patent introduces encrypted data structures and transformation methods as intermediaries that allow query processing to occur on encrypted data without full decryption. These intermediary mechanisms enable the cloud infrastructure to process queries on encrypted data, maintaining both security and processing capability.
3Device complexity
If single encryption function is used, then encryption simplicity is improved, but security against different attack types deteriorates
Solution Approach 1:
The patent divides the encryption system into multiple encryption functions (first encryption function, second encryption function, etc.) that can address different security requirements and attack vectors. This segmentation increases security against various attack types while keeping each individual encryption function relatively simple and manageable.
Solution Approach 2:
The patent uses a composite encryption approach combining multiple encryption functions to create a more robust security system. Just as composite materials combine different materials to achieve superior properties, the composite encryption scheme combines multiple encryption functions to achieve superior security against different attack types while maintaining manageable complexity.
Data Source
AI summary
Methods, systems, and computer program products for securely processing range predicates on cloud databases are provided herein. A computer-implemented method includes separately encrypting a set of plain text data using two or more encryption functions, thereby producing an encrypted domain comprising at least two distinct groups of encrypted data items; converting a range query over plain text data items into a query over at least one of the distinct groups of encrypted data items; and combining results from the query over the distinct groups of encrypted data items, thereby generating a final encrypted result to the range query.