Structured Encryption for Secure SQL Query Processing

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing database management systems face challenges in securely processing SQL queries on encrypted relational databases without relying on property-preserving encryption (PPE), which can leak substantial information, and require trusted hardware, limiting their efficiency and security.

Innovation Solution

The system employs structured encryption to generate and process secure queries in a conjunctive query form, using encrypted tokens with arity and dimension values, allowing secure query execution on an encrypted database without decrypting the query or multi-maps, thus avoiding PPE and trusted hardware.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If property-preserving encryption (PPE) is used to enable SQL query processing on encrypted databases, then query execution capability is improved, but information leakage increases substantially

Engineering Contradiction:

Improvequery execution capabilityVSAvoidinformation leakage

Core Design Contradiction:

Ease of operationVSLoss of information

Solution Approach 1:

The patent introduces encrypted multi-maps as an intermediary data structure that enables query processing without requiring PPE. The multi-maps store encrypted relationships between database entities, allowing the system to perform joins and queries on encrypted data while maintaining confidentiality. This intermediary structure bridges the gap between encrypted storage and query capability without the information leakage problems of PPE

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent replaces the mechanical PPE system with a structured encryption approach using encrypted multi-maps and tokens. Instead of relying on PPE's deterministic encryption properties that leak information, the system uses probabilistic encryption with carefully designed multi-map structures that enable query processing while preventing information leakage about the underlying data distribution

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Reliability

If trusted hardware is used to ensure security in encrypted database systems, then security reliability is improved, but device complexity and hardware requirements increase

Engineering Contradiction:

Improvesecurity reliabilityVSAvoidhardware requirements

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent implements self-service security where the encrypted multi-map data structures inherently protect data confidentiality without requiring external trusted hardware. The encryption scheme is designed so that the data structures themselves enforce security properties, eliminating the need for specialized hardware modules like TPMs or HSMs. The system secures itself through cryptographic design rather than hardware enforcement

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent extracts the security function from hardware dependencies and embeds it directly in the software-based encrypted multi-map structure. By removing the trusted hardware requirement and implementing security through the encryption scheme and multi-map design, the system achieves comparable security reliability without the complexity of hardware integration

Inventive Principle:

Principle #2Taking out (Extraction)

3Loss of information

If conventional encryption methods are used to protect database data, then data confidentiality is improved, but query processing efficiency deteriorates

Engineering Contradiction:

Improvedata confidentialityVSAvoidquery processing efficiency

Core Design Contradiction:

Loss of informationVSProductivity

Solution Approach 1:

The patent segments the encrypted database into structured multi-map components that organize encrypted data by relationship types and query patterns. This segmentation allows the system to pre-compute and store encrypted join results in the multi-maps, enabling efficient query processing without decrypting the underlying data. The segmented structure transforms complex full-table scans into targeted lookups in the encrypted multi-map indices

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent performs preliminary actions by pre-building encrypted multi-map structures during database setup and maintenance operations. These pre-computed encrypted relationships enable fast query execution later without requiring real-time decryption or complex computations. The system prepares the encrypted data structures in advance so that query processing becomes a matter of navigating pre-established encrypted paths rather than computing relationships on-the-fly

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentEP3417397B1Searchable encryption of conjunctive SQL statements

Publication Date: 2022.12.07 MICROSOFT TECHNOLOGY LICENSING LLC

Figure 1
Figure 2A
Figure 2B

AI summary

A security controller controls secure processing of queries in an encrypted relational database. A query controller receives, from a client device, a secure query in a format of an encrypted token generated using a structured query language (SQL) query in a conjunctive query form, and sends an encrypted response to the secure query to the client device. A search engine generates the encrypted response to the secure query by initiating a search on the encrypted relational database, without decrypting the secure query and without decrypting the encrypted multi-maps. The encrypted relational database includes encrypted multi-maps corresponding to a relational database hosted at the client device, and an encrypted dictionary, based on structured encryption, using structured encryption, in lieu of using property-preserving encryption (PPE), and in lieu of using fully homomorphic encryption (FHE).