Searchable Encryption Index for Cloud Data Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud data storage systems face challenges in securely searching encrypted data without decrypting the entire data store, which affects efficiency and security, and require resilient access control measures across multiple sites.
Innovation Solution
Implementing an index-based searchable encryption scheme that uses a server index and a client index to allow authorized data access requests by hashing queries and expected results, with verification by the cloud service provider using a server-side index, and storing the server index in a separate system like IPFS with IPNS for location identification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted for storage in the cloud, then security is improved, but the data must be entirely decrypted before it can be effectively searched
Solution Approach 1:
The patent segments the encryption system into two distinct indexes: a server index stored with encrypted data that enables search operations without decryption, and a client index stored locally that verifies search results. This segmentation allows the server to perform searches on encrypted data while the client maintains security control, resolving the contradiction between security and search efficiency.
Solution Approach 2:
The patent introduces cryptographic hash functions as an intermediary mechanism between the encrypted data and the search process. The server index contains hash values of encrypted data, allowing the server to perform searches without decrypting the actual data. This intermediary enables search efficiency while maintaining security, as the hash comparisons can be performed on encrypted representations.
2Ease of operation
If the entire data store is decrypted to search data, then search capability is improved, but security and time consumption worsen
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing the server index containing hash values of encrypted data items before any search operations. This pre-computed index allows the server to perform searches by comparing query hashes against the pre-stored index hashes, eliminating the need to decrypt the entire data store during search operations. This significantly reduces time consumption while maintaining full search capability.
3Reliability
If data is encrypted using traditional schemes, then security is improved, but the complexity of search operations increases
Solution Approach 1:
The patent replaces the mechanical decryption process with a cryptographic hash-based comparison system. Instead of mechanically decrypting data to perform searches, the system uses hash function computations and comparisons on encrypted representations. This substitution maintains security while simplifying the search operation complexity, as hash comparisons are computationally simpler than full decryption and re-encryption cycles.
Data Source
AI summary
A computer implemented method of a network connected data storage system, the method including receiving, via the network, and storing a data set including a plurality of data items encrypted using an index-based searchable encryption scheme, wherein the searchable encryption scheme has associated a server index and a client index; receiving, via the network, and storing a set of hashed information for each of a plurality of queries of the data set, each item of hashed information including a hash of a query and a hash of an expected result of executing the query using the server index; receiving, via the network, a query from a data requester to retrieve a set of data items from the data store and a hash of an expected result of executing the received query using the server index; generating a result of the received query for the data set based on the server index; and responsive to a comparison of a hash of the generated result, the received hash of the expected result, and the hashes of expected results in the set of hashed information, granting access for the requester to the data set.