Searchable Encryption Key Update via Difference Mask

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In a cloud-based information system, updating a secret key to prevent unauthorized data leaks is challenging because direct key changes expose plaintext information, requiring users to decrypt and re-encrypt all data, which is computationally intensive and burdensome.

Innovation Solution

A searchable encryption processing system generates a difference key mask using two secret keys, allowing encrypted data to be updated without decrypting it, maintaining confidentiality and reducing user-side load.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If the secret key is updated by passing it to the management server for direct re-encryption, then the secret key can be changed, but plaintext information is exposed and confidentiality of encrypted data cannot be kept

Engineering Contradiction:

Improvesecret key update capabilityVSAvoiddata confidentiality

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent introduces a key update mechanism where the user generates a key update request locally without exposing the secret key to the management server. The server processes the key update by receiving only the encrypted data and generating updated encrypted data through a key update processing unit, acting as an intermediary that enables key changes while maintaining confidentiality through cryptographic operations rather than direct key transmission.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If the user downloads all encrypted data, decrypts and re-encrypts them by the new secret key, then the encrypted data can be updated, but the calculation amount is proportional to quantity of encrypted data and load on user's side is large

Engineering Contradiction:

Improvesecret key update capabilityVSAvoiduser-side computational load

Core Design Contradiction:

Adaptability or versatilityVSUse of energy by moving object

Solution Approach 1:

The patent extracts the computationally intensive key update operation from the user's device and relocates it to the management server. The user's terminal only needs to send a lightweight key update request, while the server's key update processing unit performs the actual re-encryption of all stored encrypted data using the new secret key, thereby extracting the heavy computational burden from the user's system.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

Instead of the traditional approach where the user actively downloads and re-encrypts data, the patent inverts the process by having the server automatically perform the re-encryption operation in response to a simple key update request. This inversion changes the user's role from active participant in heavy computation to passive initiator of the update process.

Inventive Principle:

Principle #13The other way round (Inversion)

Data Source

PatentUS10733317B2Searchable encryption processing system

Publication Date: 2020.08.04 HITACHI LTD

AI summary

In this searchable encryption processing system in which a registered client and a management server are connected via a network, the registered client is provided with a registered client processing unit that generates, on the basis of the difference between a first secret key for encrypting plaintext data and a second secret key for newly encrypting the plaintext data, a difference key mask for updating, by using the second secret key, confidential data encrypted by the first secret key.