Searchable Encryption Key Revocation via Segmented Auxiliary Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing searchable encryption systems face challenges in controlling data encryption and registration using divided keys, as they struggle to manage key updates and revocations, leading to issues with searchable-encryption searches and data re-encryption without decrypting encrypted data.
Innovation Solution
A registration request device that generates and transforms encrypted data using a registration key and public parameter, allowing for secure key management and re-encryption without decrypting the data, by dividing and distributing keys for secure key revocation and re-encryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If keys are simply replaced with new keys in searchable encryption, then key security is improved, but data encrypted with old keys cannot be retrieved and old keys cannot be discarded
Solution Approach 1:
The patent divides a single key into multiple divided keys (first divided key and second divided key). The registration secret key is segmented into a registration key and registration auxiliary key. This segmentation allows the system to maintain security while enabling controlled access and revocation, as the segmented keys can be managed independently yet still function together for encryption and decryption operations.
Solution Approach 2:
The patent introduces a data management device as an intermediary that holds the registration auxiliary key and performs transformation operations on encrypted data. This intermediary enables the system to control access and facilitate key updates without requiring direct access to all original keys, solving the problem of key revocation and retrieval while maintaining security.
2Ease of operation
If divided keys are distributed to control searcher access, then search control is improved, but registrant cannot control encryption and registration
Solution Approach 1:
The registration secret key is segmented into a registration key (held by registrant) and registration auxiliary key (held by data management device). This segmentation enables both the registrant to control encryption operations and the system to control access through the auxiliary key, resolving the contradiction between search control and registrant flexibility.
Solution Approach 2:
The patent implements dynamic key management where the registration auxiliary key can be updated and revoked by the data management device without affecting the registrant's ability to encrypt new data. The system adapts to different operational requirements by allowing flexible key updates while maintaining both search control and registrant autonomy.
3Adaptability or versatility
If proxy re-encryption is used to re-encrypt data with new keys, then key updates are enabled, but searchable-encryption searches cannot be performed on re-encrypted data
Solution Approach 1:
The data management device acts as an intermediary that performs transformation operations on encrypted data using the registration auxiliary key. This transformation enables key updates while preserving the searchable encryption properties, allowing the system to re-encrypt data with new keys while maintaining search functionality without requiring decryption.
Solution Approach 2:
The patent changes the parameters of encrypted data through transformation operations rather than simple re-encryption. The transformation unit modifies the encrypted data structure to accommodate new keys while preserving the ability to perform searchable encryption searches, solving the contradiction between key updates and search functionality.
4Manufacturing precision
If encrypted data is generated with same value for same data, then deterministic encryption is achieved, but cryptographic security is reduced
Solution Approach 1:
The patent introduces dynamic randomness into the encryption process through the use of random values in transformation operations. Each transformation of encrypted data incorporates random elements, ensuring that even identical plaintext data produces different encrypted results while maintaining cryptographic security and preventing pattern analysis.
Data Source
AI summary
A registration request device (400) includes a generation unit (420) and a request unit (430). The generation unit (420) acquires a registration key of a registration secret key composed of the registration key and a registration auxiliary key, plaintext data, and a public parameter, and encrypts the plaintext data using the registration key and the public parameter so as to generate encrypted data. The registration secret key is generated using a master key and the public parameter, and is composed of the registration key used for encrypting data and the registration auxiliary key used for transforming encrypted data. The request unit (430) transmits the encrypted data to a data management device. The data management device transforms the encrypted data using the registration auxiliary key and the public parameter, and registers transformed encrypted data obtained by transformation in a registration database in association with an identifier that identifies the plaintext data.