Confidential Computation Using Searchable Encryption and Key Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud computing technologies face challenges in performing advanced computations on encrypted data while maintaining confidentiality, as existing encryption methods either limit computation capabilities or risk unnecessary information leakage.
Innovation Solution
A confidential computation system comprising a registration machine, analyzer, and provision server, which utilize searchable encryption and secret sharing to encrypt and decrypt data securely, allowing computations only when a certain number of matches are found, thus preserving confidentiality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If searchable encryption is used to enable search operations on encrypted data, then data confidentiality is maintained, but advanced computation capabilities are significantly limited
Solution Approach 1:
The data key is divided into multiple shares using secret sharing technology. Each share alone is insufficient to decrypt data, but a predetermined number of shares can reconstruct the key. This segmentation allows the system to maintain confidentiality while enabling controlled computation when sufficient shares are provided.
Solution Approach 2:
The provision server acts as an intermediary that receives encrypted computation requests, compares them with encrypted data using searchable encryption, and conditionally provides data key shares when matches are found. This intermediary enables computation on encrypted data while maintaining security through the share reconstruction mechanism.
2Reliability
If data is multi-encrypted to enhance security, then confidentiality is improved, but computation that can be performed on cloud is significantly limited
Solution Approach 1:
Data is pre-processed by creating encrypted versions with searchable encryption properties before being stored on the cloud. This preliminary encryption enables future search and computation operations without requiring decryption, maintaining confidentiality while enabling productivity.
Solution Approach 2:
The system changes the encryption parameter state by using searchable encryption schemes that allow specific operations (search, comparison) on encrypted data. This parameter change enables cloud computation on encrypted data while maintaining security, resolving the contradiction between confidentiality and productivity.
3Ease of operation
If encrypted data is stored on cloud for accessibility, then data availability is improved, but risk of information leakage increases
Solution Approach 1:
The data key is segmented into multiple shares distributed in an encrypted state on the cloud. No single entity or attack can access the plaintext key alone, reducing information leakage risk while maintaining data accessibility through encrypted operations.
Solution Approach 2:
The system creates and stores encrypted copies of data and key shares on the cloud instead of plaintext versions. These encrypted copies can be accessed and operated upon remotely, providing accessibility while eliminating the information leakage risk associated with storing plaintext data on distributed systems.
Data Source
AI summary
The registration machine is configured to derive a data key by using a plaintext word representing a word which is not encrypted, create encrypted data obtained by encrypting, by using the derived data key, plaintext data representing data which is not encrypted, distribute the data key to a plurality of shares, and encrypt the plaintext word and the shares with searchable encryption to create an encrypted word. The analyzer is configured to encrypt, with the searchable encryption, a plaintext query representing a query which is not encrypted to create an encrypted query. The provision server is configured to acquire the created encrypted word and the created encrypted data to register the encrypted word and the created encrypted data in a database, acquire the created encrypted query to compare the created encrypted query with the registered encrypted word, and acquire the shares if a comparison result indicates a match.