Searchable encryption enabling encrypted search based on document type
AssigneeSkyhigh Networks, Inc.
InventorHani T. Dawoud
Life of this patent
Estimating the term…
Abstract
A searchable encryption method enables encrypted search of encrypted documents based on document type. In some embodiments, the searchable encryption method is implemented in a network intermediary, such as a proxy server. The network intermediary encrypts documents on behalf of a user or an enterprise destined to be stored on a cloud service provider. The searchable encryption method encodes document type information into the encrypted search index while preserving encryption security. Furthermore, the searchable encryption method enables search of encrypted documents using the same encrypted index, either for a particular document type or for all encrypted documents regardless of the document type.
Claims20
A method comprising:
- receiving, at a network intermediary device over a communication network, a document destined for a cloud service provider, the document having a document type;
- selecting one or more keywords in the received document;
- for each selected keyword in the received document, encoding a document type identifier into an encrypted keyword label for the selected keyword in the document using a key that relates to the selected keyword;
- generating a search index in response to the encoding a document type identifier into an encrypted keyword label;
- encrypting the received document using a second encryption algorithm;
- transmitting the encrypted document to the cloud service provider;
- storing the encrypted document at the cloud service provider;
- and
- in response to a search request for a requested document type, performing a search for is documents stored at the cloud service provider using the search index to return documents stored at the cloud service provider that match the requested document type.
A system for searchable encryption of cloud stored data encoding a document type, comprising:
- a network proxy server configured as a network intermediary device to receive, over a communication network, a document destined for a cloud service provider, the document having one or more keywords;
- and to determine a document type of the received document;
- wherein for each keyword in the received document, the network proxy server is further configured to:
- encrypt a document index identifying the received document;
- generate an encrypted keyword label based on the document type of the received document;
- and
- generate a search index entry mapping the encrypted keyword label to the encrypted document index;
- wherein the network proxy server is further configured to generate a search index in response to the search index entries generated for each keyword in the received document;
- encrypt the received document using a second encryption algorithm;
- transmit, over the communication network, the encrypted document to the cloud service provider;
- store the encrypted document at the cloud service provider;
- and
- wherein the network proxy server is further configured to, in response to a search request for a requested document type, perform a search for documents stored at the cloud service provider using the search index to return documents stored at the cloud service provider that match the requested document type.
Dependencies are inferred from the claim text.