SYSTEMS AND METHODS FOR ENABLING SEARCHABLE ENCRYPTION

• US 20140359282A1
• Filed: 05/31/2013
• Published: 12/04/2014
• Est. Priority Date: 05/31/2013
• Status: Active Grant

• Current Assignee: Alcatel-Lucent SA (Nokia Corporation)
• Original Assignee: Alcatel-Lucent SA (Nokia Corporation)
• Inventors: Shikfa, Abdullatif, Papillon, Serge
• Granted Patent: US 9,135,454 B2
• Time in Patent Office: Days
• US Class Current: 713/165
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries

Abstract

A system and method for enabling searchable encryption of encrypted documents stored by a client on one or more storage providers includes a broker server in communication with the client and the one or more storage providers. The broker server is adapted to transfer the encrypted documents between the client and the one or more storage providers and to maintain information indicating where the encrypted documents are transferred. The broker server further stores information for at least one encrypted index for the encrypted documents and a test function for a searchable encryption mechanism used to encrypt the at least one encrypted index.

Claims

1. A broker system enabling searchable encryption of encrypted documents stored by a client on one or more storage providers, the broker system comprising:

a broker server in communication with the client and the one or more storage providers, the broker server adapted to transfer the encrypted documents between the client and the one or more storage providers and to maintain a first translation table indicating the encrypted documents that are transferred to each storage provider;

wherein the broker server stores information for at least one encrypted index for the encrypted documents; and

wherein the broker server stores a test function for a searchable encryption mechanism used to encrypt the at least one encrypted index.

2. The broker system according to claim 1, wherein the information for the at least one encrypted index is the encrypted index.

3. The broker system according to claim 1, wherein the broker server transfers the at least one encrypted index to the one or more storage providers;

and

wherein the information for the at least one encrypted index is a second translation table indicating the encrypted indexes that are transferred to each storage provider.

4. The broker system according to claim 1, wherein the broker server is in communication with a plurality of clients.

5. The broker system according to claim 1, wherein the broker server is adapted to send a particular encrypted document to at least two storage providers to provide redundancy.

6. The broker system according to claim 1, wherein the broker server executes the test function upon receipt of an encrypted query from the client.

7. The broker system according to claim 6, wherein the broker server uses the encrypted query and the encrypted index as input for the test function.

8. A computerized method for enabling searchable encryption of encrypted documents stored on at least one storage provider by a client, the computerized method comprising the steps of:

receiving, at a broker server, the encrypted documents, at least one encrypted index for the encrypted documents, the encrypted index being encrypted by a searchable encryption mechanism, and identification of the searchable encryption mechanism used to encrypt the encrypted index;

sending the encrypted documents to the at least one storage provider;

maintaining, at the broker server, a translation table indicating the encrypted documents that are transferred to each storage provider; and

storing, at the broker server, information relating to the at least one encrypted index and a test function for the searchable encryption mechanism used to encrypt the encrypted index.

9. The computerized method according to claim 8, additionally comprising the steps of:

sending the at least one encrypted index to the storage provider; and

maintaining, at the broker server, a second translation table indicating the encrypted indexes that are transferred to each storage provider.

10. The computerized method according to claim 8, additionally comprising the steps of:

receiving, at the broker server, an encrypted query from the client to be searched;

executing, at the broker server, the test function for the searchable encryption mechanism using the encrypted query and the encrypted index; and

transferring, by the broker server, encrypted documents returned from the test function as satisfying the encrypted query from the at least one storage provider to the client.

11. The computerized method according to claim 10, additionally comprising the steps of:

sending the at least one encrypted index to the storage provider; and

maintaining, at the broker server, a second translation table indicating the encrypted indexes that are transferred to each storage provider; and

retrieving the at least one encrypted index from the at least one storage provider.

12. The computerized method according to claim 8, wherein the broker server is in communication with a plurality of storage providers.

13. The computerized method according to claim 8, wherein the broker server is in communication with a plurality of clients.

14. The computerized method according to claim 8, wherein the step of sending the encrypted documents to the storage provider includes sending a particular encrypted document to at least two storage providers to provide redundancy.

20. The non-transitory, tangible computer-readable medium of claim 14, wherein the step of sending the encrypted documents to the storage provider includes sending a particular encrypted document to at least two storage providers to provide redundancy.

15. A non-transitory, tangible computer-readable medium storing instructions adapted to be executed by a computer processor at a broker server to enable searchable encryption of encrypted documents stored on a storage provider by a client to perform a method comprising the steps of:

receiving, at a broker server, the encrypted documents, at least one encrypted index for the encrypted documents, the encrypted index being encrypted by a searchable encryption mechanism, and identification of the searchable encryption mechanism used to encrypt the encrypted index;

sending the encrypted documents to the storage provider;

maintaining, at the broker server, a translation table indicating the encrypted documents that are transferred to each storage provider; and

storing, at the broker server, information relating to the at least one encrypted index and a test function for the searchable encryption mechanism used to encrypt the encrypted index.

16. The non-transitory, tangible computer-readable medium of claim 15, wherein the method further comprises the steps of:

sending the at least one encrypted index to the storage provider; and

maintaining, at the broker server, a second translation table indicating the encrypted indexes that are transferred to each storage provider.

17. The non-transitory, tangible computer-readable medium of claim 15, wherein the method further comprises the steps of:

receiving, at the broker server, an encrypted query from the client to be searched;

executing, at the broker server, the test function for the searchable encryption mechanism using the encrypted query and the encrypted index; and

transferring, by the broker server, encrypted documents returned from the test function as satisfying the encrypted query from the at least one storage provider to the client.

18. The non-transitory, tangible computer-readable medium of claim 17, wherein the method further comprises the steps of:

sending the at least one encrypted index to the storage provider; and

maintaining, at the broker server, a second translation table indicating the encrypted indexes that are transferred to each storage provider; and

retrieving the at least one encrypted index from the at least one storage provider.

19. The non-transitory, tangible computer-readable medium of claim 15, wherein the broker server is in communication with a plurality of storage providers.