Threshold Searchable Symmetric Encryption Key Distribution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing searchable symmetric encryption systems face limitations when a single data owner possesses the cryptographic key, leading to security risks and inefficiencies due to the need for the data owner to remain constantly online to handle queries from multiple clients.
Innovation Solution
Implementing a threshold searchable symmetric encryption system where the cryptographic key is split into shares stored across N key servers, allowing clients to encrypt and decrypt queries using a subset of these servers, thereby distributing the key possession and enabling decentralized query handling.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a single data owner possesses the cryptographic key for searchable symmetric encryption, then query encryption and decryption can be performed centrally, but security risks increase and the data owner must remain constantly online to handle client queries
Solution Approach 1:
The cryptographic key is segmented into multiple key shares distributed across different key servers. Instead of one central data owner holding the complete key, the key is divided such that a threshold number of key shares are required to perform cryptographic operations. This segmentation eliminates the single point of failure and reduces security risks associated with centralized key management.
Solution Approach 2:
Key servers act as intermediaries between clients and the encrypted data. Rather than clients directly communicating with a central data owner for query encryption/decryption, they interact with distributed key servers that hold key shares. This intermediary layer distributes the operational burden and eliminates the need for the data owner to remain constantly online.
2Speed
If the data owner must remain constantly online to handle queries from multiple clients, then query processing can be performed immediately, but system availability and scalability are limited
Solution Approach 1:
The system segments the key management functionality across multiple independent key servers. Each key server can process queries independently using its key share, allowing parallel query processing without requiring a single central data owner to be online. This enables the system to scale to multiple clients simultaneously.
Solution Approach 2:
Key servers are designed to perform multiple functions: storing key shares, processing query encryption, and handling query decryption. This multi-functionality allows the same distributed infrastructure to serve multiple clients with different queries without requiring additional centralized coordination, improving both scalability and adaptability.
3Reliability
If the cryptographic key is distributed across multiple key servers, then security is enhanced and constant online presence is reduced, but system complexity increases
Solution Approach 1:
While segmentation of the key increases distribution complexity, it simplifies security management by eliminating the need for a single secure centralized key storage system. Each key server independently manages its key share, and the threshold mechanism provides built-in redundancy and fault tolerance, reducing operational complexity in maintaining security.
Solution Approach 2:
The key servers operate autonomously using their respective key shares to perform cryptographic operations. They self-manage query processing without requiring centralized coordination or intervention from the data owner. This self-service capability reduces operational complexity and eliminates the need for constant online presence of the data owner.
4Adaptability or versatility
If multiple clients need to perform encrypted searches, then search capability is enhanced, but the data owner's workload and online presence requirement increase
Solution Approach 1:
The key management functionality is segmented and distributed across multiple key servers, allowing each client to independently interact with the system through different key servers. This eliminates the bottleneck where a single data owner must personally handle each client's query encryption and decryption operations.
Solution Approach 2:
Key servers serve as intermediaries that handle all cryptographic operations for multiple clients. Clients communicate with key servers rather than directly with the data owner, transferring the workload from the data owner to the distributed key server infrastructure. This enables multi-client support without increasing the data owner's operational burden.
Data Source
AI summary
A data owner can provide shares of a cryptographic key to N key servers. The N key servers can store the shares of a cryptographic key from the data owner such that T shares of the cryptographic key can be used to reconstruct the cryptographic key. A client computer can send a blinded query to T key servers of the N key severs, wherein the T key servers can encrypt a blinded query of a client computer using the share of the cryptographic key to determine a partial encryption. The client computer can receive T partial encryptions, assemble T partial encryptions to form an encrypted blinded query, and deblind the encrypted blinded query. The client computer can then use the encrypted query to perform a search on encrypted data of a remote database server using a searchable symmetric encryption scheme.