Secure Substring Search on Encrypted Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The challenge in cloud computing environments is the ability to securely filter outsourced encrypted data, particularly due to limited computational power and storage of mobile client devices, and the need to address both external and internal malicious actors, while existing encryption schemes like AES render data computation difficult.
Innovation Solution
The implementation of secure substring searching on encrypted data using Frequency-Hiding Order Preserving Encryption (FHOPE) schemes, where plaintext strings are fragmented into overlapping substrings, encrypted with position information, and a search index is created to enable secure querying and filtering within an unsecure server environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If standard randomized encryption schemes such as AES are used, then security against malicious actors is improved, but the ability to perform computation on encrypted data deteriorates
Solution Approach 1:
The patent transforms the encryption scheme parameters from standard AES to FHOPE (Frequency-Hiding Order-Preserving Encryption), which preserves order relationships in encrypted data. This allows the server to perform range queries and filtering operations on encrypted substrings without decryption, while still providing security against frequency analysis attacks through the hiding mechanism.
Solution Approach 2:
The patent divides the encrypted data into substrings and creates an index structure where each substring is independently encrypted and indexed. This segmentation allows the server to efficiently search for specific substrings within the encrypted data without needing to decrypt or process the entire dataset, enabling selective computation on encrypted data.
2Reliability
If data is encrypted for security, then protection against external and internal attackers is improved, but the ability to filter and search the data deteriorates
Solution Approach 1:
The patent introduces an intermediary indexing mechanism that operates on encrypted substrings. The index stores encrypted substring representations along with their position information, allowing the server to perform filtering and search operations by comparing encrypted values directly. This intermediary structure enables detection and measurement operations on encrypted data without compromising security.
Solution Approach 2:
The patent performs preliminary encryption and indexing of substrings before the actual search operation. By pre-processing the data into an indexed format with encrypted substrings and position information, the system enables efficient filtering and search operations to be performed later without requiring real-time encryption/decryption cycles, thus maintaining both security and filtering capability.
3Reliability
If substring search is performed on encrypted data, then security is maintained, but computational overhead and communication costs increase
Solution Approach 1:
The patent implements partial action by performing search operations only on the encrypted substring index rather than the entire encrypted dataset. The server can quickly filter candidates using the index and then engage in selective verification only for promising matches, reducing the overall computational overhead and communication requirements compared to exhaustive search methods.
Solution Approach 2:
By segmenting the data into substrings and creating a separate index structure, the patent enables the server to perform targeted searches on specific portions of the encrypted data. This segmentation allows for efficient filtering operations that reduce the amount of data that needs to be processed and communicated, thereby improving computational efficiency while maintaining security.
4Reliability
If mobile client devices store encrypted data locally, then security is improved, but storage capacity and computational resources are insufficient
Solution Approach 1:
The patent extracts only the essential components needed for secure search functionality from the full encrypted dataset. The client stores a compressed index structure containing encrypted substrings and position information, while the bulk of the encrypted data resides on the server. This extraction approach significantly reduces the storage requirements on mobile devices while maintaining security through the preserved index structure.
Solution Approach 2:
The patent transitions from storing only complete encrypted records on client devices to a distributed architecture where the index structure (one dimension) is stored on the client and the full encrypted data (another dimension) is stored on the server. This dimensional separation allows mobile devices to maintain security-critical indexing information without being burdened by the full data volume, effectively solving the storage constraint.
Data Source
AI summary
Secure substring searching on encrypted data may involve a first preprocessing comprising fragmenting a plaintext string slated for remote secure storage, in a plurality of overlapping plaintext substrings. A second preprocessing encrypts these substrings into ciphertexts (e.g., utilizing Frequency-Hiding Order Preserving Encryption) further including position information of the substring. A search index and a secret state result from the first and second preprocessing. The ciphertexts and search index are outsourced to a database within an unsecure server. An engine within the server determines candidate ciphertexts matching a query request received from a secure client. The engine returns ciphertexts to the client for decryption according to the secret state. Preprocessing may be delegated to a third party for outsourcing search index/ciphertexts to the server, and the secret state to the client. Filtering of candidate ciphertexts on the server-side, can eliminate false positives and reduce the volume of communication with remote clients.