Searchable Encryption Microservice for Secure Data Search
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Client-side encryption in data storage services poses challenges in providing search functionality without compromising data security, as the data storage service cannot decrypt encrypted data, leading to a conflict between data security and searchability.
Innovation Solution
Implementing a searchable-encryption microservice at the client that encrypts and processes search queries using the same cryptographic key, allowing the client to search encrypted data without decrypting it, ensuring data integrity and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If client-side encryption is implemented to protect data security, then data security is improved, but search functionality deteriorates because the storage service cannot decrypt encrypted data
Solution Approach 1:
A proxy service is introduced as an intermediary between the client and storage service. The proxy receives search queries from the client, decrypts them using stored credentials, translates them into storage service query language, executes the queries on encrypted data, and returns results to the client. This mediator enables search functionality without requiring the storage service to have decryption capabilities.
Solution Approach 2:
The system is divided into distinct functional components: the client that encrypts data, the storage service that stores encrypted data without decryption capabilities, and the proxy service that handles search operations. This segmentation allows each component to perform its specialized function while maintaining overall system security and functionality.
2Reliability
If the storage service stores encrypted data without access to decryption keys, then data security is improved, but the ability to perform meaningful searches deteriorates
Solution Approach 1:
The client performs preliminary encryption of data before storing it with the storage service. The storage service stores only the encrypted data without needing decryption keys. When search is needed, the proxy service handles the decryption and query execution, allowing the storage service to maintain its security model while still enabling search functionality through pre-encrypted data storage.
3Reliability
If the client encrypts data before transmission to storage service, then data security is improved, but the complexity of managing encryption keys and search queries increases
Solution Approach 1:
The complexity of encryption key management and search query translation is extracted from the storage service and placed in the proxy service. The storage service only handles simple storage and retrieval of encrypted data, while the proxy service manages the complex tasks of key management, query decryption, and query translation. This extraction reduces the complexity burden on the storage service.
4Reliability
If the storage service attempts to search encrypted data without decryption, then data security is maintained, but search accuracy deteriorates
Solution Approach 1:
The proxy service acts as an intermediary that ensures search accuracy by decrypting queries and translating them into appropriate storage service queries. This intermediary layer guarantees that searches are performed accurately on the encrypted data while maintaining security, as the proxy can precisely control the decryption and query execution process.
Data Source
AI summary
Disclosed embodiments relate to implementing, as a microservice at a client, a searchable-encryption service. Operations may include executing the microservice at the client to perform operations including: encrypting data based on a cryptographic key accessible to the client; sending the encrypted data to a network storage resource; identifying, at the microservice, a search query in plaintext; encrypting the search query according to the cryptographic key; sending the encrypted search query to the network storage resource; and receiving a response to the encrypted search query from the network storage resource.