Searchable Encryption Microservice for Secure Data Search
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Client-side encryption in data storage services poses challenges in search functionality, as data storage providers cannot perform meaningful searches on encrypted data without decrypting it, conflicting with data security and searchability needs.
Innovation Solution
Implementing a searchable-encryption microservice at the client that encrypts and processes search queries using the same cryptographic key, allowing the client to search encrypted data without decrypting it, and dynamically changing encryption techniques for enhanced security and flexibility.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted using client-side encryption, then data security is improved, but search functionality deteriorates because the data storage service cannot perform meaningful searches on encrypted data
Solution Approach 1:
The patent applies preliminary action by pre-processing the plaintext search query into an encrypted search query using the client's cryptographic key before transmission to the data storage service. This allows the search to be performed on encrypted data without requiring the service provider to decrypt the data, thus maintaining data security while enabling search functionality. The encrypted search query is constructed in advance based on the encryption scheme used for the stored data.
Solution Approach 2:
The patent introduces an intermediary mechanism in the form of an encrypted search query that mediates between the client's search request and the encrypted data stored at the service provider. The encrypted search query acts as a bridge that allows the data storage service to perform searches on encrypted data without accessing the plaintext, thus resolving the contradiction between maintaining encryption and enabling search functionality.
2Ease of operation
If the data storage service decrypts the encrypted data to enable searches, then search functionality is improved, but data security deteriorates because the service provider gains access to plaintext data
Solution Approach 1:
The patent uses an encrypted search query as an intermediary that enables the data storage service to perform searches without decrypting the stored data. The service provider processes the encrypted search query against the encrypted data using the encryption scheme, returning encrypted search results that the client can decrypt. This intermediary mechanism allows search functionality while maintaining data security by preventing the service provider from accessing plaintext data.
Solution Approach 2:
The patent implements self-service by enabling the client to autonomously encrypt search queries using their own cryptographic key and decrypt the search results without involving the service provider in the decryption process. The client maintains full control over their encryption keys and plaintext data, performing encryption and decryption operations locally while the service provider only handles encrypted data processing.
3Productivity
If deterministic encryption is used to enable efficient searches, then search efficiency is improved, but security deteriorates because identical plaintext values always produce identical ciphertext values, revealing patterns
Solution Approach 1:
The patent applies dynamics by transitioning from static deterministic encryption to dynamic probabilistic encryption, where the same plaintext value can produce different ciphertext values across different encryptions. This is achieved by incorporating randomization elements into the encryption process while maintaining the ability to perform efficient searches through the use of encryption schemes that support searchable encryption operations on probabilistically encrypted data.
Solution Approach 2:
The patent changes the encryption parameter from deterministic to probabilistic encryption, allowing the encryption function to produce different outputs for the same input under certain conditions. This parameter change enables the system to maintain search efficiency while improving security by preventing pattern recognition, as identical plaintext values no longer consistently produce identical ciphertext values.
Data Source
AI summary
Disclosed embodiments relate to dynamically changing an encryption technique for encrypted data to be stored in a searchable database. Operations may include receiving encrypted data for storage in the searchable database, the encrypted data having been encrypted by a client using a cryptographic key based on an encryption alteration scheme; receiving a search query from the client, the search query comprising a plurality of search strings including at least: an encrypted version of a plaintext string that was encrypted by the client using the cryptographic key, and one or more encrypted versions of the plaintext string that were encrypted by the client using one or more other cryptographic keys; processing the search query; and returning a response to the search query to the client.