Back to results
US 11,601,258 B2Granted
Selector derived encryption systems and methods
AssigneeEnveil, Inc.
InventorRyan Carr
Life of this patent
Estimating the term…
Abstract
Example selector derived encryption methods and systems include creating a hashed and encrypted database, as well as performing a query against the hashed and encrypted database using an encrypted selector exchange protocol to prevent the exposure of extraneous data from the hashed and encrypted database.
Claims20
A method, comprising:
- generating, by a responder, a hashed and encrypted database from a cleartext database by:
- encrypting selectors of the cleartext database using a responder key of a commutative encryption scheme, each selector being assigned a bucket identifier;
- encrypting rows of the cleartext database with responder derived keys generated from the encrypted selectors;
- grouping the encrypted rows, by the responder, according to bucket identifiers;
- determining, by the responder, a hash bucket identifier of a query based on a requested selector of a query;
- and
- returning at least two encrypted rows corresponding to the hash bucket identifier, the at least two encrypted rows comprising at least one encrypted row that does not correspond to the requested selector, but was based on a bucket identifier collision, and at least one encrypted row that does correspond to the requested selector;
- and
- performing an encrypted selector exchange protocol between a querier and the responder that comprises:
- encrypting the requested selector a first time, by the querier, using a querier key;
- encrypting the requested selector a second time, by the responder, using the responder key to create a twice encrypted selector;
- receiving, by the querier, the twice encrypted selector;
- decrypting, by the querier, the twice encrypted selector using the querier key to obtain the requested selector that was encrypted with the responder key;
- and
- deriving, by the querier, the responder derived key used to encrypt the at least one encrypted row that does correspond to the requested selector to recover cleartext corresponding to the at least one encrypted row, the querier being unable to decrypt the at least one encrypted row that does not correspond to the requested selector.
12 more elements
A method, comprising:
- determining, by a responder, a hash bucket identifier from a requested selector of a query;
- obtaining at least two encrypted rows from a hashed and encrypted database that correspond to the hash bucket identifier, the at least two encrypted rows comprising at least one encrypted row that does not correspond to the requested selector, but was based on a bucket identifier collision, and at least one encrypted row that does correspond to the requested selector;
- and
- performing an encrypted selector exchange protocol between a querier and the responder that comprises:
- encrypting the requested selector a first time using a querier key;
- encrypting the requested selector a second time using a responder key to create a twice encrypted selector;
- decrypting the twice encrypted selector using the querier key to obtain the requested selector that was encrypted with the responder key;
- deriving a responder derived key used to encrypt the at least one encrypted row that does correspond to the requested selector;
- and
- recovering cleartext corresponding to the at least one encrypted row using the responder derived key, wherein the at least one encrypted row that does not correspond to the requested selector cannot be decrypted using the responder derived key.
7 more elements
A system, comprising:
- a responder comprising a processor;
- and memory for storing instructions, the processor executing the instructions to:
- generate a hashed and encrypted database from a cleartext database as the responder:
- encrypts selectors of the cleartext database using a responder key, each selector being assigned a bucket identifier;
- encrypts rows of the cleartext database with responder derived keys generated from the encrypted selectors;
- groups the encrypted rows, by the responder, according to bucket identifiers;
- determines, by the responder, a hash bucket identifier of a query based on a requested selector of a query;
- and
- returns at least one encrypted row that does correspond to the requested selector.
6 more elements
Dependencies are inferred from the claim text.