BACKGROUND

Client-side encryption is a cryptographic technique that encrypts data on a client device or application before transmitting the encrypted data to a data storage service provider, e.g., a cloud-based data storage service provider, for data storage. Client-side encryption allows for the creation of data storage services and applications whose providers cannot access their client's data in plaintext, thus offering a higher level of privacy and security. For example, a client may encrypt its data using a cryptographic key that is not available to the data storage service provider and transmit only the encrypted data to the data storage service provider for storage, making it difficult for the data storage service provider (or an attacker) to decrypt the encrypted data or otherwise access the client's data in plaintext.

There are, however, some security, functionality, and efficiency challenges associated with client-side encryption, particularly with respect to the abilities to provide data searches. For example, a client that encrypts its data and transmits the encrypted data to a data storage service for storage may later wish to use the data storage service to perform a search (e.g., a search for customers who are located within a particular region, a search for customers having a certain name, etc.). The data storage service should therefore provide the ability to search for particular text or content as requested by a client. However, because the data storage service only has access to the encrypted customer data (i.e., unreadable data), the data storage service may not be able to carry out meaningful searches for the client. As a result, technological problems arise because the goals of data security and searchability directly conflict.

There are thus needs for technological solutions to provide, facilitate, and process search requests in data storage services that support client-side encryption without requiring decryption of the encrypted data, accessing the client's data in plaintext, or otherwise compromising the integrity of client-side encryption. As discussed below, technological solutions should be secure, efficient, and promote usability by clients who have encrypted certain data for storage.

SUMMARY

The embodiments described below relate to implementing, as a microservice at a client, a searchable-encryption service. For example, in an example embodiment there may be a non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for implementing, as a microservice at a client, a searchable-encryption service. The operations may comprise executing the microservice at the client to perform operations including: encrypting data based on a cryptographic key accessible to the client; sending the encrypted data to a network storage resource; identifying, at the microservice, a search query in plaintext; encrypting the search query according to the cryptographic key; sending the encrypted search query to the network storage resource; and receiving a response to the encrypted search query from the network storage resource.

According to some embodiments, the microservice operates in a stateless manner on the client.

According to some embodiments, the microservice is deployed at the client as part of a virtualized environment scaling process.

According to some embodiments, the client has exclusive control over the data.

According to some embodiments, the client has exclusive control over destruction of the data, e.g., by destructing the encryption key that only the client has.

According to some embodiments, the data is a concatenation of a plurality of database elements.

According to some embodiments, encrypting the data based on the cryptographic key includes separately encrypting the plurality of database elements.

According to some embodiments, encrypting the data based on the cryptographic key includes encrypting, as a group, the plurality of database elements.

According to some embodiments, the client creates the cryptographic key.

According to some embodiments, the client obtains the cryptographic key from an external key resource. For example, the client may obtain the cryptographic key from an encryption service on the client side that has the capability to generate cryptographic keys.

Additional embodiments relate to a computer-implemented method for implementing, as a microservice at a client, a searchable-encryption service. The method may comprise executing the microservice at the client to perform operations including: encrypting data based on a cryptographic key accessible to the client; sending the encrypted data to a network storage resource; identifying, at the microservice, a search query in plaintext; encrypting the search query according to the cryptographic key; sending the encrypted search query to the network storage resource; and receiving a response to the encrypted search query from the network storage resource.

According to some embodiments, the network storage resource does not have access to the cryptographic key.

According to some embodiments, the network storage resource is configured to query stored encrypted data based on the encrypted search query.

According to some embodiments, the client has exclusive control over the data.

According to some embodiments, the client has exclusive control over destruction of the data.

According to some embodiments, the data is a concatenation of a plurality of database elements.

According to some embodiments, encrypting the data based on the cryptographic key includes separately encrypting the plurality of database elements.

According to some embodiments, encrypting the data based on the cryptographic key includes encrypting, as a group, the plurality of database elements.

According to some embodiments, the client creates the cryptographic key.

According to some embodiments, the client obtains the cryptographic key from an external key resource.

Additional disclosed embodiments relate to dynamically changing an encryption technique for encrypted data to be stored in a searchable database. For example, in an example embodiment there may be a non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for dynamically changing an encryption technique for encrypted data to be stored in a searchable database. The operations may comprise receiving encrypted data for storage in the searchable database, the encrypted data having been encrypted by a client using a cryptographic key based on an encryption alteration scheme; receiving a search query from the client, the search query comprising a plurality of search strings including at least: an encrypted version of a plaintext string that was encrypted by the client using the cryptographic key, and one or more encrypted versions of the plaintext string that were encrypted by the client using one or more other cryptographic keys; processing the search query; and returning a response to the search query to the client.

According to some embodiments, the encryption alteration scheme comprises selecting the cryptographic key from among a set of cryptographic keys including the one or more other cryptographic keys.

According to some embodiments, the cryptographic key was chosen randomly among the set of cryptographic keys.

According to some embodiments, the encryption alteration scheme comprises encrypting the plaintext string with each of the cryptographic key and the one or more other cryptographic keys.

According to some embodiments, the search query from the client includes versions of the plaintext string encrypted with each of the cryptographic key and the one or more other cryptographic keys.

According to some embodiments, processing the search query comprises querying the searchable database based on each of the versions.

Additional embodiments relate to dynamically changing an encryption technique for encrypted data to be stored in a searchable database. For example, in some embodiments there may be a computer-implemented method for dynamically changing an encryption technique for encrypted data to be stored in a searchable database, the method comprising: receiving encrypted data for storage in the searchable database, the encrypted data having been encrypted by a client using a cryptographic key based on an encryption alteration scheme; receiving a search query from the client, the search query comprising a plurality of search strings including at least: an encrypted version of a plaintext string that was encrypted by the client using the cryptographic key, and one or more encrypted versions of the plaintext string that were encrypted by the client using one or more other cryptographic keys; processing the search query; and returning a response to the search query to the client.

According to some embodiments, the client creates the cryptographic key.

According to some embodiments, the client obtains the cryptographic key from an external key resource.

According to some embodiments, different portions of the received encrypted data for storage in the searchable database have been encrypted using at least two of: the cryptographic key and the one or more other cryptographic keys.

According to some embodiments, the response returned to the client includes encrypted data stored in the searchable database matching at least a portion of the search query.

According to some embodiments, the client is configured to decrypt the response returned to the client using at least one of: the cryptographic key or the one or more other cryptographic keys.

Additional disclosed embodiments relate to dynamically changing an encryption technique for encrypted data to be stored in a searchable database. For example, in some embodiments there may be a non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for dynamically changing an encryption technique for encrypted data to be stored in a searchable database, the operations comprising: sending encrypted data for storage in the searchable database, the encrypted data having been encrypted by a client using a cryptographic key based on an encryption alteration scheme; formulating a search query, the search query comprising a plurality of search strings including at least: an encrypted version of a plaintext string that was encrypted by the client using the cryptographic key, and one or more encrypted versions of the plaintext string that were encrypted by the client using one or more other cryptographic keys; sending the search query to the searchable database; and receiving a response to the search query from the searchable database.

According to some embodiments, the encryption alteration scheme comprises selecting the cryptographic key from among a set of cryptographic keys including the one or more other cryptographic keys.

According to some embodiments, the cryptographic key was chosen randomly among the set of cryptographic keys.

According to some embodiments, the encryption alteration scheme comprises encrypting the plaintext string with each of the cryptographic key and the one or more other cryptographic keys.

According to some embodiments, the search query includes versions of the plaintext string encrypted with each of the cryptographic key and the one or more other cryptographic keys.

According to some embodiments, the searchable database is configured to perform a query based on each of the versions.

According to some embodiments, different portions of the encrypted data sent to the searchable database have been encrypted using at least two of: the cryptographic key and the one or more other cryptographic keys.

According to some embodiments, the client is configured to decrypt the response to the search query using at least one of: the cryptographic key or the one or more other cryptographic keys.

According to additional disclosed embodiments, techniques are described for performing secure and flexible searches of encrypted data. For example, according to some embodiments, there may be a non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for performing secure and flexible searches of encrypted data. The operations may comprise maintaining a database of a plurality of sets of encrypted data; receiving a transformed search query for the database, the transformed search query having undergone a transformation process at a client including: identifying a plaintext string in a search query at the client, applying the plaintext string to a language dictionary accessible to the client, receiving, based on the language dictionary, one or more plaintext search strings, and encrypting, at the client, the one or more plaintext search strings; and returning a result based on the transformed search query, the result being based on the encrypted one or more plaintext search strings.

According to some embodiments, the plaintext string applied to the client-side language dictionary is a search prefix.

According to some embodiments, the applying of the plaintext string to the client-side language dictionary is a similarity-based search.

According to some embodiments, the receiving includes receiving a plurality of plaintext search strings and the encrypting includes encrypting each of the plurality of plaintext search strings.

According to some embodiments, the language dictionary is at least one of: a definitional dictionary, a synonym dictionary, or a database schema dictionary.

According to some embodiments, the receiving includes receiving a plurality of plaintext search strings based on the plaintext string in the search query.

According to some embodiments, the plurality of plaintext search strings are presented to a user as selectable recommendations.

Additional disclosed embodiments relate to performing secure and flexible searches of encrypted data. For example, according to some embodiments there may be a computer-implemented method for performing secure and flexible searches of encrypted data. The method may comprise maintaining a database of a plurality of sets of encrypted data; receiving a transformed search query for the database, the transformed search query having undergone a transformation process at a client including: identifying a plaintext string in a search query at the client, applying the plaintext string to a language dictionary accessible to the client, receiving, based on the language dictionary, one or more plaintext search strings, and encrypting, at the client, the one or more plaintext search strings; and returning a result based on the transformed search query, the result being based on the encrypted one or more plaintext search strings.

According to some embodiments, the encrypting includes individually encrypting each of the one or more plaintext search strings.

According to some embodiments, the method further comprises concatenating database schema information together with at least one of the plaintext search strings.

According to some embodiments, the method further comprises returning a plurality of results based on the transformed search query.

Additional disclosed embodiments relate to performing secure and flexible searches of encrypted data. For example, according to some disclosed embodiments there may be a non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for performing secure and flexible searches of encrypted data. The operations may comprise sending encrypted data from a client to a database for storage at the database; formulating a transformed search query for the database, the formulating including: identifying a plaintext string in a search query, applying the plaintext string to a language dictionary accessible to the client, receiving, based on the language dictionary, one or more plaintext search strings, and encrypting, at the client, the one or more plaintext search strings; sending the transformed search query to the database for querying; and receiving a result based on the transformed search query.

According to some embodiments, the operations further comprise receiving a plurality of plaintext search strings based on the language dictionary.

According to some embodiments, the operations further comprise encrypting each of the plurality of plaintext search strings.

According to some embodiments, the transformed search query includes each of the encrypted plurality of plaintext search strings.

According to some embodiments, the operations further comprise receiving a plurality of results from the database based on the encrypted plurality of plaintext search strings.

According to some embodiments, the plaintext string applied to the client-side language dictionary is a search prefix.

According to some embodiments, the applying of the plaintext string to the client-side language dictionary is a similarity-based search.

According to some embodiments, the operations further comprise concatenating database schema information together with at least one of the plaintext search strings.

According to some embodiments, the operations further comprise encrypting the concatenated database schema information and the at least one of the plaintext search strings.

