SEARCHABLE ENCRYPTION FOR OUTSOURCING DATA ANALYTICS

• US 20100106980A1
• Filed: 10/17/2008
• Published: 04/29/2010
• Est. Priority Date: 10/17/2008
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP AG (SAP SE)
• Inventors: Vayssiere, Julien Jean-Pierre, Kerschbaum, Florian
• Granted Patent: US 9,425,960 B2
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: H04L 2209/16 Obfuscation or hiding, e.g. involving white box
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 67/54 Presence management, e.g. monitoring or registration for receipt of user log-on information, or the connection status of the users
• CPC Class Codes: H04L 9/002 Countermeasures against attacks on cryptographic mechanisms network architectures or network communication protocols for protection against malicious traffic H04L63/1441
• CPC Class Codes: H04L 9/3013 involving the discrete logarithm problem, e.g. ElGamal or Diffie-Hellman systems
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807

Abstract

A method for performing data analytics on outsourced data may include receiving, at a data analyst, cipher text representing data from a data owner such that the data remains hidden from the data analyst, generating a query token using a constant provided by the data analyst such that the constant remains hidden from the data owner, and analyzing the cipher text using the query token.

Claims

1. A method for performing data analytics on outsourced data, the method comprising:

receiving, at a data analyst, cipher text representing data from a data owner such that the data remains hidden from the data analyst;

generating a query token using a constant provided by the data analyst such that the constant remains hidden from the data owner; and

analyzing the cipher text using the query token.

2. The method as in claim 1 further comprising outputting one or more identity query tokens as a result of analyzing the cipher text.

3. The method as in claim 2 further comprising:

analyzing the cipher text using the outputted identity query tokens; and

outputting additional identity query tokens.

4. The method as in claim 1 wherein:

the data comprises one or more tuples; and

the cipher text is generated by the data owner encrypting the tuples using a secret key and a corresponding public security parameter such that the cipher text is unique for each of the tuples.

5. The method as in claim 1 wherein generating the query token comprises:

inputting the constant and a public security parameter by the data analyst such that the constant remains hidden from the data owner;

inputting a secret key by the data owner such that the secret key remains hidden from the data analyst; and

outputting the query token to the data analyst.

6. The method as in claim 1 wherein:

generating the query token comprises generating a set of range query tokens using constants provided by the data analyst such that the constants remain hidden from the data owner; and

analyzing the cipher text comprises analyzing the cipher text using the set of range query tokens.

7. The method as in claim 6 further comprising:

outputting one or more identity query tokens as a result of analyzing the cipher text;

analyzing the cipher text using the outputted identity query tokens; and

outputting additional identity query tokens.

8. A system for performing data analytics on outsourced data, comprising:

an encryption generator that is arranged and configured to encrypt data from a data owner, output a cipher text and communicate the cipher text to a data analyst such that the data remains hidden from the data analyst;

a query generator that is arranged and configured to generate a query token using a constant provided by the data analyst such that the constant remains hidden from the data owner; and

an analysis engine that is arranged and configured to analyze the cipher text using the query token.

9. The system of claim 8 wherein the analysis engine is arranged and configured to output one or more identity query tokens as a result of analyzing the cipher text.

10. The system of claim 9 wherein the analysis engine is further arranged and configured to:

analyze the cipher text using the outputted identity query tokens; and

output additional identity query tokens.

11. The system of claim 8 wherein:

the data comprises one or more tuples; and

the encryption generator encrypts the tuples using a secret key and a corresponding public security parameter such that the cipher text is unique for each of the tuples.

12. The system of claim 8 wherein the query generator is arranged and configured to generate the query token by:

receiving the constant and a public security parameter from the data analyst such that the constant remains hidden from the data owner;

receiving a secret key from the data owner such that the secret key remains hidden from the data analyst; and

outputting the query token to the data analyst.

13. The system of claim 8 wherein:

the query generator is arranged and configured to generate a set of range query tokens using constants provided by the data analyst such that the constants remain hidden from the data owner; and

the analysis engine is arranged and configured to analyze the cipher text using the set of range query tokens.

14. The system of claim 13 wherein the analysis engine is further arranged and configured to:

output one or more identity query tokens as a result of analyzing the cipher text;

analyze the cipher text using the outputted identity query tokens; and

output additional identity query tokens.

15. A computer program product for performing data analytics on outsourced data, the computer program product being tangibly embodied on a computer-readable medium and including executable code that, when executed, is configured to cause a data processing apparatus to:

encrypt data from a data owner, output a cipher text and communicate the cipher text to a data analyst such that the data remains hidden from the data analyst;

generate a query token using a constant provided by the data analyst such that the constant remains hidden from the data owner; and

analyze the cipher text using the query token.

16. The computer program product of claim 15 wherein the executable code that, when executed, causes the data processing engine to output one or more identity query tokens as a result of analyzing the cipher text.

17. The computer program product of claim 16 further including executable code that, when executed, causes the data processing engine to:

analyze the cipher text using the outputted identity query tokens; and

output additional identity query tokens.

18. The computer program product of claim 15 wherein the executable code that, when executed, causes the data processing engine to generate the query token by:

receiving the constant and a public security parameter from the data analyst such that the constant remains hidden from the data owner;

receiving a secret key from the data owner such that the secret key remains hidden from the data analyst; and

outputting the query token to the data analyst.

19. The computer program product of claim 15 wherein the executable code that, when executed, causes the data processing engine to:

generate a set of range query tokens using constants provided by the data analyst such that the constants remain hidden from the data owner; and

analyze the cipher text using the set of range query tokens.

20. The computer program product of claim 19 further comprising executable code that, when executed, causes the data processing engine to:

output one or more identity query tokens as a result of analyzing the cipher text;

analyze the cipher text using the outputted identity query tokens; and

output additional identity query tokens.