# US 2016/0366113 A1 · Wildcard search in encrypted text > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2016/0366113 A1 - Document ID: US20160366113A1 - Status: Published application - Kind: A1 - Application number: 14/808,850 - Filed: 2015-07-24 - Published: 2016-12-15 - Earliest claimed: 2015-06-09 - Assignees: Skyhigh Networks, Inc. - Applicants: Skyhigh Networks, Inc. - Inventors: Hani T. Dawoud - Web page: https://patentgrep.com/patent/US20160366113A1 ## CPC - H04L 63/0471: {applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding} - G06F 16/14: Details of searching files based on file metadata - G06F 16/31: Indexing; Data structures therefor; Storage structures - G06F 16/33: Querying - G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries} - H04L 9/0637: {Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]} - H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - G06F 2221/2107: File encryption - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A wildcard searchable encryption method enables wildcard search of encrypted text in a cloud-stored encrypted document. In some embodiments, the wildcard searchable encryption method is implemented in a network intermediary, such as a proxy server. The network intermediary encrypts documents on behalf of a user or an enterprise destined to be stored on a cloud service provider. The wildcard searchable encryption method performs keyword pre-processing of the document to be encrypted to generate a set of keyword-wildcard combinations in plaintext for some or all of the keywords in the document. The processed document is encrypted using an exact match searchable encryption algorithm. As a result of the encryption process, a search index is generated to include the keyword-wildcard combinations. As thus configured, the wildcard searchable encryption method enables wildcard search of the encrypted text, such as searches for prefixes or suffixes of the keywords. ## Claims ### Claim 1 A method for wildcard searchable encryption of cloud stored data, comprising: receiving, at a network intermediary, a document destined for a cloud service provider; processing, at the network intermediary, the content of the document to generate a plurality of keyword-wildcard combinations in plaintext for some or all of the keywords in the document; generating a processed document including the original document content and the keyword-wildcard combinations in plaintext appended to the original document; encrypting the processed document using an exact match searchable encryption algorithm; generating one or more entries in a search index stored in the network intermediary, the one or more entries including a mapping of encrypted keyword labels to an encrypted document index identifying the document being encrypted, the encrypted keyword labels being generated using at least some keywords of the original document content and at least some keyword-wildcard combinations appended to processed document; encrypting the original document using a second encryption algorithm; and transmitting the encrypted document to the cloud service provider. ### Claim 2 (depends on 1) The method of claim 1, wherein processing, at the network intermediary, the content of the document to generate a plurality of keyword-wildcard combinations in plaintext for some or all of the keywords in the document comprises: processing, at the network intermediary, the content of the document to generate the plurality of keyword-wildcard combinations in plaintext for some or all of the words in the document, each of the words in the document including one or more characters of the uppercase and lower case English alphabet, numbers 0-9, punctuation symbols, alphabet and symbols of languages other than English, and other ASCII characters. ### Claim 3 (depends on 1) The method of claim 1, wherein processing, at the network intermediary, the content of the document to generate a plurality of keyword-wildcard combinations in plaintext for some or all of the keywords in the document comprises: processing the content of the document to generate a plurality of prefix combinations in plaintext for some or all of the keywords in the document. ### Claim 4 (depends on 3) The method of claim 3, wherein processing the content of the document to generate a plurality of prefix combinations in plaintext for some or all of the keywords in the document comprises: processing the content of the document to generate the plurality of prefix combinations for a keyword including one or more leading characters of the keyword forming prefixes of the keyword, one or more remaining characters being a wildcard. ### Claim 5 (depends on 1) The method of claim 1, wherein processing, at the network intermediary, the content of the document to generate a plurality of keyword-wildcard combinations in plaintext for some or all of the keywords in the document comprises: processing the content of the document to generate a plurality of suffix combinations in plaintext for some or all of the keywords in the document. ### Claim 6 (depends on 5) The method of claim 5, wherein processing the content of the document to generate a plurality of suffix combinations in plaintext for some or all of the keywords in the document comprises: processing the content of the document to generate the plurality of suffix combinations for a keyword including one or more trailing characters of the keyword forming suffixes of the keyword, one or more remaining characters being a wildcard. ### Claim 7 (depends on 1) The method of claim 1, wherein generating a processed document including the original document content and the keyword-wildcard combinations in plaintext appended to the original document comprises: appending the keyword-wildcard combinations in plaintext to the tail of the original document content. ### Claim 8 (depends on 1) The method of claim 1, wherein encrypting the original document using the second encryption algorithm comprises: encrypting the original document using a bulk encryption algorithm. ### Claim 9 (depends on 1) The method of claim 1, further comprising: receiving, at the network intermediary, a search request with a search term; generating a search term label using the search term in the search request being applied to the exact match searchable encryption algorithm; searching for the search term label in the search index; in response to the search term label matching an encrypted keyword label in the search index, retrieving from the search index the encrypted document index mapped to the matching encrypted keyword label; decrypting the retrieved encrypted document index; retrieving the encrypted document from the cloud service provider using the decrypted document index; decrypting the retrieved document; and providing the decrypted document as the search result. ### Claim 10 (depends on 1) The method of claim 1, wherein receiving, at the network intermediary, the document destined for the cloud service provider comprises: receiving, at the network intermediary, the document destined for the cloud service provider, the document comprising one of a file, a data record, a data field, a data with structured data format, or a data with unstructured data format. ### Claim 11 A system for wildcard searchable encryption of cloud stored data, comprising: a network proxy server configured as a network intermediary to receive a document destined for a cloud service provider, the network proxy server being configured to process the content of the document to generate a plurality of keyword-wildcard combinations in plaintext for some or all of the keywords in the document, to generate a processed document including the original document content and the keyword-wildcard combinations in plaintext appended to the original document, to encrypt the processed document using an exact match searchable encryption algorithm, to generate one or more entries in a search index stored in the network intermediary, the one or more entries including a mapping of encrypted keyword labels to an encrypted document index identifying the document being encrypted where the encrypted keyword labels are generated using at least some keywords of the original document content and at least some keyword-wildcard combinations appended to processed document, to encrypt the original document using a second encryption algorithm, and to transmit the encrypted document to the cloud service provider. ### Claim 12 (depends on 11) The system of claim 11, wherein the network proxy server is further configured to process the content of the document to generate a plurality of keyword-wildcard combinations in plaintext for some or all of the words in the document, each of the words in the document including one or more characters of the uppercase and lower case English alphabet, numbers 0-9, punctuation symbols, alphabet and symbols of languages other than English, and other ASCII characters. ### Claim 13 (depends on 11) The system of claim 11, wherein the network proxy server is further configured to process the content of the document to generate a plurality of prefix combinations in plaintext for some or all of the keywords in the document. ### Claim 14 (depends on 13) The system of claim 13, wherein the network proxy server is further configured to process the content of the document to generate the plurality of prefix combinations in plaintext for a keyword including one or more leading characters of the keyword forming prefixes of the keyword, one or more remaining characters being a wildcard. ### Claim 15 (depends on 11) The system of claim 11, wherein the network proxy server is further configured to process the content of the document to generate a plurality of suffix combinations in plaintext for some or all of the keywords in the document. ### Claim 16 (depends on 15) The system of claim 15, wherein the network proxy server is further configured to process the content of the document to generate the plurality of suffix combinations in plaintext for a keyword including one or more trailing characters of the keyword forming suffixes of the keyword, one or more remaining characters being a wildcard. ### Claim 17 (depends on 11) The system of claim 11, wherein the network proxy server is further configured to append the keyword-wildcard combinations in plaintext to the tail of the original document content. ### Claim 18 (depends on 11) The system of claim 11, wherein the network proxy server is further configured to encrypting the original document using a bulk encryption algorithm. ### Claim 19 (depends on 11) The system of claim 11, wherein the network proxy server is further configured to receive a search request with a search term, to generate a search term label using the search term in the search request being applied to the exact match searchable encryption algorithm, to search for the search term label in the search index, in response to the search term label matching an encrypted keyword label in the search index, to retrieve from the search index the encrypted document index mapped to the matching encrypted keyword label, to decrypt the retrieved encrypted document index, to retrieve the encrypted document from the cloud service provider using the decrypted document index, to decrypt the retrieved document, and to provide the decrypted document as the search result. ### Claim 20 (depends on 11) The system of claim 11, wherein the network proxy server is further configured to receive the document destined for the cloud service provider, the document comprising one of a file, a data record, a data field, a data with structured data format, or a data with unstructured data format.