Role-Based Encryption Contexts for Secure Cloud Data Search
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud computing environments, users face challenges in efficiently searching and querying large datasets while ensuring data security and privacy, particularly when dealing with sensitive or confidential information that requires restricted access.
Innovation Solution
A system and method that implement role-based encryption by configuring different encryption contexts for accessing encrypted fields, allowing users to search both unencrypted and encrypted versions of search terms based on their assigned roles, thereby enabling secure and controlled access to data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted to ensure security and privacy, then data security is improved, but the ability to search and query the data deteriorates
Solution Approach 1:
The patent segments the search process into multiple components: generating encrypted search terms using the user's private key, searching the encrypted data store for matching encrypted terms, and retrieving results only the user can decrypt. This allows the system to maintain encrypted storage while enabling search functionality through cryptographic operations rather than decryption of all data.
Solution Approach 2:
The patent introduces cryptographic intermediaries (encryption keys and decryption keys) that mediate between the encrypted data and the user. The public key encrypts search terms and data, while the private key decrypts both, acting as an intermediary that enables search without requiring the cloud provider to possess decryption capabilities.
2Productivity
If all data is made searchable in unencrypted form, then search efficiency is improved, but data privacy and access control deteriorate
Solution Approach 1:
The patent applies different encryption properties to different aspects of the system: data is encrypted at rest in the cloud, but search terms are encrypted using the user's public key, allowing the user's private key to decrypt both. This local differentiation of encryption approaches enables efficient searching while maintaining privacy - the cloud provider cannot access the data, but the user can search it efficiently.
3Reliability
If encryption is implemented for sensitive data, then access control is improved, but system complexity increases
Solution Approach 1:
The patent implements self-service encryption where each user manages their own cryptographic keys. Users generate their own key pairs, encrypt their data with their public key, and decrypt with their private key. This eliminates the need for a centralized key management system, reducing overall system complexity while maintaining strong access control - each user is their own security administrator.
Data Source
AI summary
Searching encrypted data using encrypted contexts by performing at least the following: configuring a first encryption context that allows access to a first encrypted field, configuring a second encryption context that allows access to a second encrypted field, assigning the first encryption context to a first role and the second encryption context to a second role, assigning the first role to a first user account to allow the first user account to access the first encrypted field, assigning the second role to a second user account to allow the second user to access the second encrypted field, receiving a query request associated with the first user account for a search term, wherein the query request includes instructions to search for an unencrypted version of the search term and a first encrypted value of the search term that is based on the first encryption context.