Searchable Symmetric Encryption Using Single-Use Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Dynamic Symmetric Searchable Encryption (DSSE) schemes leak 'size pattern' information and are computationally intensive, requiring extensive data storage capacity, which compromises client data privacy and system performance.
Innovation Solution
A method that generates and uses single-use cryptographic keys and counter values to create a searchable symmetric encryption system, where the client computes and transmits search index identifiers and keys to the server, allowing the server to decrypt and re-encrypt search table entries without revealing search terms, thus preventing attackers from identifying updated entries and reducing storage overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If existing DSSE schemes are used to enable searchable encryption, then clients can search encrypted files on remote servers, but the schemes leak size pattern information and require extensive data storage capacity
Solution Approach 1:
The search table is divided into multiple segments or partitions, each stored separately on the server. This segmentation prevents the server from observing the complete size pattern of the search table, as each segment appears independently sized. The client can search across segmented data without revealing the overall structure to the server.
Solution Approach 2:
The patent introduces a new dimensional approach by using homomorphic encryption to operate on encrypted search terms directly. Instead of decrypting search terms to search, the system performs search operations in the encrypted domain, adding a cryptographic dimension that prevents information leakage while maintaining search functionality.
2Ease of operation
If existing DSSE schemes are used to enable searchable encryption, then clients can search encrypted files on remote servers, but the schemes are computationally intensive
Solution Approach 1:
The patent replaces traditional cryptographic mechanisms with homomorphic encryption, which allows computational operations to be performed directly on encrypted data. This substitution eliminates the need for complex key management and decryption/ re-encryption cycles, significantly reducing computational overhead while maintaining security.
Solution Approach 2:
The system changes the cryptographic parameter space by using homomorphic encryption schemes that support efficient operations on ciphertexts. This parameter change enables search operations to be performed with fewer computational steps, reducing the overall processing time and resource requirements compared to traditional DSSE approaches.
3Reliability
If traditional encryption is used to protect client data on remote servers, then data privacy is maintained, but the client cannot search the encrypted files without divulging contents to the server
Solution Approach 1:
Homomorphic encryption acts as an intermediary mechanism that enables the server to perform search operations on encrypted data without having access to the plaintext. This intermediary cryptographic layer allows the server to process encrypted search terms and compare them against encrypted file contents, returning match results without ever revealing the actual search terms or file contents to the server.
Solution Approach 2:
The encrypted data structure is designed to be self-searchable, meaning the encrypted files contain embedded encrypted search terms and indexes that enable direct search operations on the encrypted data. The system serves itself by allowing search operations to be performed directly on the encrypted representation without external decryption, maintaining both privacy and searchability.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method of searching encrypted data includes generating with a client computing device device a search index identifier corresponding to a search term in an encrypted search table and transmitting the search index identifier, a first single use key and a second single use key to a server. The method includes generating a set of decrypted data with the server for a set of data in an encrypted search table corresponding to the search index identifier using the first single use key to decrypt a first portion of the data and the second single use key to decrypt a second portion of the data. The method further includes identifying one or more encrypted files stored on the server that include the encrypted search term based on the decrypted data from the search table, and transmitting the encrypted files or encrypted file identifiers to the client computing device.