US9454673B1 - Searchable encryption for cloud storage - Google Patents
Searchable encryption for cloud storage Download PDFInfo
- Publication number
- US9454673B1 US9454673B1 US14/536,460 US201414536460A US9454673B1 US 9454673 B1 US9454673 B1 US 9454673B1 US 201414536460 A US201414536460 A US 201414536460A US 9454673 B1 US9454673 B1 US 9454673B1
- Authority
- US
- United States
- Prior art keywords
- tokenized
- file
- search
- keywords
- cloud
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 claims abstract description 83
- 230000004044 response Effects 0.000 claims description 4
- 238000010586 diagram Methods 0.000 description 6
- 239000000284 extract Substances 0.000 description 5
- 238000013500 data storage Methods 0.000 description 4
- 238000004590 computer program Methods 0.000 description 2
- 230000006870 function Effects 0.000 description 2
- 238000007726 management method Methods 0.000 description 2
- 239000000203 mixture Substances 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000012544 monitoring process Methods 0.000 description 1
- 230000035755 proliferation Effects 0.000 description 1
- 239000004557 technical material Substances 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6209—Protecting access to data via a platform, e.g. using keys or access control rules to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/10—File systems; File servers
- G06F16/14—Details of searching files based on file metadata
- G06F16/148—File search processing
-
- G06F17/30864—
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
- H04L9/3242—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/76—Proxy, i.e. using intermediary entity to perform cryptographic operations
Definitions
- Cloud computing is the use of computing resources, including hardware and software, that are delivered as a service over a network, typically the Internet.
- cloud computing achieves increased popularity and adoption of cloud-based services by businesses increases, concerns over security and risks of using these cloud-based services become significant.
- systems and software applications were deployed in enterprise environments, such as within an enterprise's own private data network, with strict controls and policies to ensure that data and usage are compliant with the enterprise's standards.
- the adoption of cloud-based services offered by third parties creates a potential mismatch, or complete absence, of expected enterprise level controls. Enterprises are faced with the challenge of accessing risk exposure associated with the use of cloud-based services in order to apply compensating controls.
- cloud-based services coming into widespread use, data security for data and files stored on the cloud-based service providers become an important issue.
- cloud-based data storage has also come into widespread use.
- data security for data and files stored on the cloud-based storage data has become an important issue.
- FIG. 1 is a block diagram illustrating a network intermediary providing encryption of cloud stored files in embodiments of the present invention.
- FIG. 2 is a flowchart illustrating a method for searchable encryption of cloud stored data in embodiments of the present invention.
- FIG. 3 is a flowchart illustrating a method for executing a search using the searchable encryption method of FIG. 2 in embodiments of the present invention.
- FIG. 4 is a block diagram illustrating a cloud search appliance providing searching of cloud stored encrypted files in embodiments of the present invention.
- FIG. 5 is a flowchart illustrating a method for enabling searching of cloud stored encrypted files using a cloud search appliance in embodiments of the present invention.
- FIG. 6 is a flowchart illustrating a method for executing a search using the cloud search appliance of FIG. 4 in embodiments of the present invention.
- FIG. 7 is a block diagram illustrating a cloud search appliance providing searching of cloud stored encrypted files in alternate embodiments of the present invention.
- FIG. 8 is a flowchart illustrating a method for enabling searching of cloud stored encrypted files using the cloud search appliance of FIG. 7 in embodiments of the present invention.
- FIG. 9 is a flowchart illustrating a method for executing a search using the cloud search appliance of FIG. 7 in embodiments of the present invention.
- the invention can be implemented in numerous ways, including as a process; an apparatus; a system; a composition of matter; a computer program product embodied on a computer readable storage medium; and/or a processor, such as a processor configured to execute instructions stored on and/or provided by a memory coupled to the processor.
- these implementations, or any other form that the invention may take, may be referred to as techniques.
- the order of the steps of disclosed processes may be altered within the scope of the invention.
- a component such as a processor or a memory described as being configured to perform a task may be implemented as a general component that is temporarily configured to perform the task at a given time or a specific component that is manufactured to perform the task.
- the term ‘processor’ refers to one or more devices, circuits, and/or processing cores configured to process data, such as computer program instructions.
- a method implements searchable encryption of cloud stored data by appending tokenized keywords to an encrypted file destined for a cloud storage service.
- the tokenized keywords are appended to the header of the encrypted file. Searching of cloud-stored encrypted files using the native search capability of the cloud storage service is then possible by performing the search using the tokenized keywords.
- a method enables searching of cloud stored encrypted file using a cloud search appliance.
- a “cloud-based service” or “cloud service” refers to computing resources, including hardware and software, that are delivered as a service over a data network. In most cases, the cloud service is deployed on the publicly available Internet. In embodiments of the present invention, the cloud-based service may also be deployed on a private data network of an enterprise, or be deployed on a third party private data network, or be deployed on a personal data network.
- “cloud content” or “cloud data” refers to data or files being processed or stored on a cloud-based service on behalf of an enterprise.
- the cloud-based service may be a cloud storage service, customer relationship management (CRM) services, information technology (IT) services or other types of cloud services.
- the cloud data or content may be stored as data files or in other formats.
- an enterprise may wish to adopt one or more cloud-based services for data storage or other applications. Furthermore, the enterprise may deploy security measures to monitor and control the use of the cloud-based services from the enterprise's own private data network or by the enterprise's employees and users.
- an enterprise data network redirects network traffic between a client device and a cloud-based service through a network intermediary.
- the client device may be situated within the enterprise data network or be associated with the enterprise.
- the network intermediary may provide monitoring and assessment of the enterprise's cloud usage.
- the network intermediary is used to provide additional security function, such as file encryption for uploaded data.
- FIG. 1 is a block diagram illustrating a network intermediary providing encryption of cloud stored files in embodiments of the present invention.
- an enterprise may operate an enterprise data network 10 including one or more network servers 12 communicating with one or more user devices 18 .
- the enterprise data network 10 includes an enterprise network edge 14 , such as a proxy server, which is used to communicate with a public data network 20 , such as the publicly accessible Internet.
- the enterprise or users of the enterprise data network 10 may wish to use one or more cloud services provided by cloud service providers, such as cloud storage service 30 , that are deployed on the public data network 20 .
- Network traffic from the user device 18 is sent to the network server 12 and travels to the enterprise network edge 14 and then onto the cloud service providers.
- Network traffic from the cloud service providers are received at the enterprise network edge 14 and then transmitted onto the network server 12 to be distributed to the user device 18 .
- the enterprise may redirect all network traffic destined for one or more cloud service providers through a network intermediary 25 , which can be implemented as a network proxy server.
- a proxy server refers to a server, which can be a computer system or a software application, that acts as an intermediary for requests from clients seeking resources from other servers.
- the network intermediary 25 may be configured as reverse/forward proxies. Thus, requests and data from the user device 18 are intercepted by the network intermediary 25 before reaching the cloud storage service 30 .
- the network intermediary 25 is a cloud-based service and may be deployed on the publicly accessible Internet, such as public data network 20 . In other embodiments, the network intermediary 25 may be deployed on a private data network of an enterprise, or be deployed on a third party private data network.
- the term “data” will be used to refer to data or files in any format that is being exchanged in the network environment described herein.
- the cloud-based service 30 may be a cloud storage service, such as Box.com or collaboration services, such as Office 365 .
- the cloud-based service 30 may also be a customer relationship management (CRM) service, information technology (IT) service or other types of cloud services.
- CRM customer relationship management
- IT information technology
- the network intermediary 25 performs encryption of data and files before sending the data and files onto the cloud storage service 30 .
- the network proxy server 25 includes an encryption system 28 which encrypts and decrypts file content based on one or more encryption algorithms.
- the content can be a file or list of words from the file.
- the encryption system may utilize keys, algorithms, pseudo random number generators and encoding algorithms suitable for encrypting the files from the user.
- a user in an enterprise data network 10 wishing to use a cloud-based data storage service 30 for storing data files, uses a computing device 18 to access the cloud storage service 30 .
- the user's request is redirected to the network proxy server 25 acting as the network intermediary.
- the network proxy server 25 may be configured as reverse/forward proxies.
- requests and files from the user are intercepted by the network proxy server 25 before reaching the cloud storage service 30 .
- the network proxy server 25 performs, among other things, encryption of the files before sending the files onto the cloud storage service for storage. In this manner, data security is ensured as files are stored on the cloud service provider 30 as encrypted files and any one accessing the file on the cloud service provider directly will only see the encrypted text.
- the network intermediary 25 retrieves the file and also decrypts the file. The decrypted file is then provided to the user device 18 through the enterprise data network 10 .
- a method to implement searchable encryption of cloud stored data generates tokenized keywords for a file to be encrypted and attaches the tokenized keywords to the encrypted file.
- the tokenized keywords are appended to the header of encrypted file.
- the encrypted file with the modified header is stored on a cloud service provider. With the encrypted file thus stored with the modified header, the cloud-stored encrypted file can be searched using the tokenized keywords.
- FIG. 2 is a flowchart illustrating a method for searchable encryption of cloud stored data in embodiments of the present invention.
- the searchable encryption method may be implemented in the network proxy server 25 of FIG. 1 in embodiments of the present invention. More specifically, in some embodiments, the searchable encryption method may be implemented in the encryption system 28 of the network proxy server 25 .
- a method 100 starts when the network proxy server receives a file upload from a user device destined for a cloud storage service ( 102 ).
- the network proxy server may intercept a file upload from a user within an enterprise data network to a cloud storage service. Instead of allowing the user to upload the file directly to the cloud storage service, the file is uploaded to the network proxy server.
- the method 100 then extracts the content of the file ( 104 ). For instance, all the keywords of the file are extracted. The method 100 may generate a dictionary of these unique keywords from the content. In the present embodiment, keywords of a file represent some or all of the unique words in the file. The method then tokenizes each keyword identified ( 106 ). In one example, the method 100 tokenizes the keywords using a hash-based message authentication code (HMAC). For example, the method 100 may generate MAC (message authentication code) using the HMACSha1+Base64 encoding. After tokenization, the method then aggregates the tokenized keywords (the MACs) by appending the tokenized keywords together into a string with each tokenized keyword being separated by a separator ( 108 ). In one embodiment, the tokenized keywords are appended together using a space as the separator.
- HMAC hash-based message authentication code
- the method 100 encrypts and encodes the file using an encryption algorithm ( 110 ).
- the encryption algorithm is an AES256-GCM authenticated encryption.
- the method 100 then appends the string of tokenized keywords to the encrypted file as a file header ( 112 ). That is, the tokenized keyword string is used as a file header or is added to the native file header to form a modified file header to the encrypted file.
- the file header is also referred to as a keyword header in the present description.
- the method 100 then sends the encrypted file with the keyword header to the cloud storage service ( 114 ).
- the string of tokenized keywords is appended to the file header of the encrypted file.
- the string of tokenized keywords can be appended to the tail of the encrypted file.
- the specific location where the tokenized keyword string is attached is not critical to the practice of the present invention.
- the encrypted file including the keyword header is indexed to enable searching at the cloud storage service. That is, the tokenized keywords in the keyword header are indexed by the cloud storage service.
- the encrypted file is now searchable using the native search functionality of cloud storage service by providing the tokenized keywords as search terms.
- FIG. 3 is a flowchart illustrating a method for executing a search using the searchable encryption method of FIG. 2 in embodiments of the present invention.
- the search method may be implemented in the network proxy server 25 of FIG. 1 in embodiments of the present invention. More specifically, in some embodiments, the searchable encryption method may be implemented in the encryption system 28 of the network proxy server 25 .
- a method 150 provides the process for executing a search of a cloud-stored encrypted file using the keyword header.
- the method 150 receives a search request with a search term from a user device ( 152 ).
- the user device executes a search request for a file that is stored on the cloud storage service.
- the user device's search request is intercepted by the network proxy server. Accordingly, the search request is received by the method 150 at the network proxy server.
- the method 150 Upon receiving the search request, the method 150 tokenizes the search term in the search request ( 154 ). The search term is tokenized using the same encoding algorithm used previously to generate the tokenized keywords of the encrypted file. In this manner, the tokenized search term will correspond to the tokenized keywords previously generated. The method 150 then sends the search request with the tokenized search term to the cloud storage service ( 156 ). At the cloud storage service, the search is executed using the tokenized search term. The cloud storage service uses its native search functionality to search for the tokenized search term in the indexed content. Because the cloud storage service has previously indexed the tokenized keywords in the keyword header of the encrypted file, the cloud storage service is able to detect a match of the tokenized search term to the tokenized keyword.
- the method 150 receives the search result from the cloud storage service.
- the method 150 provides the search result to the user device.
- the network proxy server When the network proxy server intercepts a request to download a file stored on the cloud storage device, the network proxy server retrieves the encrypted file and decrypts the file based on the encryption algorithm previously used. The decoded or unencrypted file is then provided to the user device.
- the files stored in the cloud storage service for a user may have some files that are encrypted and some files that are not.
- the searchable encryption method described above can be applied by using folder level encryption where all encrypted files are stored in a folder and the search requests will be directed to the encrypted folder which has the keyword header with tokenized keywords.
- FIG. 4 is a block diagram illustrating a cloud search appliance providing searching of cloud stored encrypted files in embodiments of the present invention.
- an enterprise data network 10 is configured to redirect network traffic to a network intermediary 25 .
- the network intermediary 25 (or network proxy server 25 ) encrypts files on behalf of the enterprise data network for storage on the cloud storage service 30 , as described above with reference to FIG. 1 .
- a cloud search appliance 50 is deployed to store a search index to facilitate searching of cloud-stored encrypted files at one or more cloud service providers.
- the search index is an encrypted search index so that information and data of the enterprise do not exist as clear data outside of the enterprise data network.
- the cloud search appliance 50 is deployed on the publicly accessible Internet, such as public data network 20 .
- the cloud search appliance 50 may be deployed on a private data network of an enterprise, or be deployed on a third party private data network.
- the cloud search appliance provides searching functions for the enterprise data network, especially for cloud-stored encrypted data and files.
- the cloud search appliance 50 provides an API (application programming interface) for receiving search requests and providing search results.
- the network proxy server 25 receives a file from the enterprise data network destined to the cloud storage service 30 .
- the network proxy server 25 extracts the keywords from the content of the file and encrypts the file.
- the keywords are tokenized using a searchable encryption algorithm.
- the tokenized keyword and the file identifier are then added to an encrypted search index in the cloud search appliance 50 .
- the network proxy server 25 then sends the encrypted file to the cloud storage service 30 for storage.
- the file identifier includes an address pointer or a location pointer indicating the location at which the encrypted file is stored.
- the network proxy server 25 receives the search request and forwards the search request to the cloud search appliance 50 .
- the network proxy server 25 encrypts or tokenize the search term and forwards the tokenized search term to the cloud search appliance 50 .
- the cloud search appliance 50 searches the indexed content and returns the search result to the network proxy server 25 .
- the search result includes one or more file identifiers identifying the locations at which one or more files containing the search term are stored.
- the network proxy server 25 can provide the search result to the user or can retrieve the one or more indexed encrypted files from the cloud storage service 30 and return one or more decrypted files to the user.
- FIG. 5 is a flowchart illustrating a method for enabling searching of cloud stored encrypted files using a cloud search appliance in embodiments of the present invention.
- the method may be implemented in the network proxy server 25 of FIG. 4 in embodiments of the present invention.
- a method 200 starts when the network proxy server receives a file upload from a user device destined for a cloud storage service ( 202 ).
- the network proxy server may intercept a file upload from a user within an enterprise data network to a cloud storage service. Instead of allowing the user to upload the file directly to the cloud storage service, the file is uploaded to the network proxy server.
- the method 200 then extracts the content of the file ( 204 ). For instance, all the keywords of the file are extracted. The method 200 may generate a dictionary of these unique keywords from the content. In the present embodiment, keywords of a file represent some or all of the unique words in the file. The method then tokenizes each keyword identified ( 206 ). In one example, the method 200 tokenizes the keywords using a searchable encryption algorithm.
- the method 200 then stores the tokenized keywords and the associated file identifier in the cloud search appliance ( 208 ).
- the tokenized keywords and file identifier are added to a search index in the cloud search appliance.
- the file identifier includes an address pointer or a location pointer indicating the location at which the encrypted file is stored.
- the method 200 encrypts and encodes the file using an encryption algorithm ( 210 ).
- the encryption algorithm is an AES256-GCM authenticated encryption.
- the method 200 then sends the encrypted file to the cloud storage service ( 212 ).
- FIG. 6 is a flowchart illustrating a method for executing a search using the cloud search appliance of FIG. 4 in embodiments of the present invention.
- the search method may be implemented in the network proxy server 25 of FIG. 4 in embodiments of the present invention.
- a method 250 provides the process for executing a search of a cloud-stored encrypted file using the cloud search appliance.
- the method 250 receives a search request with a search term from a user device ( 252 ).
- the user device executes a search request for a file that is stored on the cloud storage service.
- the user device's search request is intercepted by the network proxy server. Accordingly, the search request is received by the method 250 at the network proxy server.
- the method 250 Upon receiving the search request, the method 250 tokenizes the search term in the search request ( 254 ). The search term is tokenized using the same encoding algorithm used previously to generate the tokenized keywords of the encrypted file. In this manner, the tokenized search term will correspond to the tokenized keywords previously generated.
- the method 250 then sends the search request with the tokenized search term to the cloud search appliance ( 256 ).
- the search is executed using the tokenized search term.
- the cloud search appliance searches its search index for the tokenized search term. In response to a match being found, the cloud search appliance returns the one or more file identifiers.
- the method 250 receives the search result from the cloud search appliance.
- the method 250 provides the search result to the user device.
- a network proxy server and a cloud search appliance are deployed within an enterprise data network or deployed on a private data network of an enterprise to provide search functionality for encrypted files stored in cloud storage services.
- FIG. 7 is a block diagram illustrating a cloud search appliance providing searching of cloud stored encrypted files in alternate embodiments of the present invention.
- an enterprise data network 10 is configured to redirect network traffic to a network intermediary 25 .
- the network intermediary 25 is deployed within the enterprise data network 10 .
- the network intermediary 25 may be deployed in a private data network under the control of the enterprise.
- the network intermediary 25 (or network proxy server 25 ) encrypts files on behalf of the enterprise data network for storage on the cloud storage service 30 .
- the encrypted file is provided to the enterprise edge 14 and then is sent to the cloud storage service 30 .
- a cloud search appliance 50 is deployed to store a search index to facilitate searching of cloud-stored encrypted files at one or more cloud service providers.
- the cloud search appliance 50 is deployed within the enterprise data network 10 .
- the cloud search appliance 50 may be deployed in a private data network under the control of the enterprise.
- the cloud search appliance 50 exists behind the firewall of the enterprise data network 10 . Accordingly, the cloud search appliance 50 may employ a search index is not encrypted and contains keywords in clear text.
- the network intermediary 25 encrypts files for storage on one or more cloud service providers 30 . However, the network intermediary 25 stores keywords in the cloud search appliance 50 in clear text format.
- the network proxy server 25 receives a file from a user device of the enterprise data network destined to the cloud storage service 30 .
- the network proxy server 25 extracts the keywords from the content of the file and also encrypts the file.
- the keywords and the file identifier are added to a search index in the cloud search appliance 50 .
- the network proxy server 25 then sends the encrypted file through the enterprise edge 14 to the cloud storage service 30 for storage.
- the file identifier includes an address pointer or a location pointer indicating the location at which the encrypted file is stored.
- the network proxy server 25 receives the search request and forwards the search request to the cloud search appliance 50 .
- the network proxy server 25 forwards the search term to the cloud search appliance 50 as clear text.
- the cloud search appliance 50 searches the indexed content and returns the search result to the network intermediary 25 .
- the search result includes one or more file identifiers identifying the locations at which one or more files containing the search term are stored.
- the network intermediary 25 can provide the search result to the user or can retrieve the one or more indexed encrypted files from the cloud storage service 30 and return one or more decrypted files to the user.
- FIG. 8 is a flowchart illustrating a method for enabling searching of cloud stored encrypted files using the cloud search appliance of FIG. 7 in embodiments of the present invention.
- the method may be implemented in the network proxy server 25 of FIG. 7 in embodiments of the present invention.
- a method 300 starts when the network proxy server receives a file upload from a user device destined for a cloud storage service ( 302 ).
- the network proxy server may intercept a file upload from a user within an enterprise data network to a cloud storage service. Instead of allowing the user to upload the file directly to the cloud storage service, the file is uploaded to the network proxy server.
- the method 300 then extracts the content of the file ( 304 ). For instance, all the keywords of the file are extracted. The method 300 may generate a dictionary of these unique keywords from the content. In the present embodiment, keywords of a file represent some or all of the unique words in the file. The method 300 then stores the keywords and the associated file identifier in the cloud search appliance ( 306 ). In particular, the keywords and file identifier are added to a search index in the cloud search appliance. In some embodiments, the file identifier includes an address pointer or a location pointer indicating the location at which the encrypted file is stored.
- the method 300 encrypts and encodes the file using an encryption algorithm ( 308 ).
- the encryption algorithm is an AES256-GCM authenticated encryption.
- the method 300 then sends the encrypted file to the cloud storage service ( 310 ).
- FIG. 9 is a flowchart illustrating a method for executing a search using the cloud search appliance of FIG. 7 in embodiments of the present invention.
- the search method may be implemented in the network proxy server 25 of FIG. 7 in embodiments of the present invention.
- a method 350 provides the process for executing a search of a cloud-stored encrypted file using the cloud search appliance.
- the method 350 receives a search request with a search term from a user device ( 352 ).
- the user device executes a search request for a file that is stored on the cloud storage service.
- the user device's search request is intercepted by the network proxy server. Accordingly, the search request is received by the method 350 at the network proxy server.
- the method 350 Upon receiving the search request, the method 350 sends the search request with the search term in clear text to the cloud search appliance ( 354 ).
- the search is executed using the search term in clear text.
- the cloud search appliance searches its search index for the search term. In response to a match being found, the cloud search appliance returns the one or more file identifiers.
- the method 350 receives the search result from the cloud search appliance.
- the method 350 provides the search result to the user device. In some embodiments, the method 350 may further retrieve the indexed encrypted file or files from the cloud storage service ( 360 ).
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Theoretical Computer Science (AREA)
- Signal Processing (AREA)
- Computer Networks & Wireless Communication (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Physics & Mathematics (AREA)
- Bioethics (AREA)
- Health & Medical Sciences (AREA)
- Computer Hardware Design (AREA)
- General Health & Medical Sciences (AREA)
- Software Systems (AREA)
- Databases & Information Systems (AREA)
- Library & Information Science (AREA)
- Data Mining & Analysis (AREA)
- Power Engineering (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
- Storage Device Security (AREA)
Abstract
Description
Claims (6)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US14/536,460 US9454673B1 (en) | 2013-11-08 | 2014-11-07 | Searchable encryption for cloud storage |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US201361902104P | 2013-11-08 | 2013-11-08 | |
US14/536,460 US9454673B1 (en) | 2013-11-08 | 2014-11-07 | Searchable encryption for cloud storage |
Publications (1)
Publication Number | Publication Date |
---|---|
US9454673B1 true US9454673B1 (en) | 2016-09-27 |
Family
ID=56939638
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US14/536,460 Active US9454673B1 (en) | 2013-11-08 | 2014-11-07 | Searchable encryption for cloud storage |
Country Status (1)
Country | Link |
---|---|
US (1) | US9454673B1 (en) |
Cited By (19)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20160379009A1 (en) * | 2015-06-29 | 2016-12-29 | Microsoft Technology Licensing, Llc | Privacy Enhanced Personal Search Index |
US9679155B1 (en) * | 2015-06-12 | 2017-06-13 | Skyhigh Networks, Inc. | Prefix search in encrypted text |
US9894042B2 (en) * | 2015-07-24 | 2018-02-13 | Skyhigh Networks, Inc. | Searchable encryption enabling encrypted search based on document type |
US10127391B1 (en) * | 2015-12-28 | 2018-11-13 | EMC IP Holding Company LLC | Encrypted search indexes |
US10176207B1 (en) | 2015-06-09 | 2019-01-08 | Skyhigh Networks, Llc | Wildcard search in encrypted text |
CN109670331A (en) * | 2019-02-21 | 2019-04-23 | 哈尔滨工程大学 | It is a kind of that encryption method symmetrically can search for based on block chain |
CN110135986A (en) * | 2019-04-23 | 2019-08-16 | 武汉大学 | It is a kind of to can search for encrypted file data method based on what block chain intelligence contract was realized |
US10404669B2 (en) | 2015-06-09 | 2019-09-03 | Skyhigh Networks, Llc | Wildcard search in encrypted text |
US10534929B2 (en) * | 2018-04-11 | 2020-01-14 | Capital One Services, Llc | System and method for automatically securing sensitive data in public cloud using a serverless architecture |
CN111984995A (en) * | 2020-08-14 | 2020-11-24 | 杭州视洞科技有限公司 | Data encryption method of network camera based on private cloud |
US11036592B2 (en) | 2017-09-14 | 2021-06-15 | Commvault Systems, Inc. | Distributed content indexing architecture with separately stored file previews |
US11086834B2 (en) * | 2017-09-14 | 2021-08-10 | Commvault Systems, Inc. | Distributed framework for data proximity-based task splitting in a content indexing system |
US11120142B2 (en) * | 2017-11-13 | 2021-09-14 | Alibaba Group Holding Limited | Device and method for increasing the security of a database |
US11144663B2 (en) * | 2016-12-30 | 2021-10-12 | Robert Bosch Gmbh | Method and system for search pattern oblivious dynamic symmetric searchable encryption |
CN113688410A (en) * | 2021-08-20 | 2021-11-23 | 山东云海国创云计算装备产业创新中心有限公司 | Data retrieval method, device, FPGA and medium |
US11263088B2 (en) | 2017-09-14 | 2022-03-01 | Commvault Systems, Inc. | Distributed architecture for tracking content indexing |
US11321190B2 (en) | 2017-09-14 | 2022-05-03 | Commvault Systems, Inc. | Distributed framework for task splitting and task assignments in a content indexing system |
US20220365921A1 (en) * | 2021-04-30 | 2022-11-17 | Intuit Inc. | Verifiable Cacheable Calclulations |
US11764948B1 (en) * | 2018-04-30 | 2023-09-19 | Amazon Technologies, Inc. | Cryptographic service interface |
Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7949666B2 (en) * | 2004-07-09 | 2011-05-24 | Ricoh, Ltd. | Synchronizing distributed work through document logs |
US20110150466A1 (en) * | 2009-12-18 | 2011-06-23 | Cisco Technology, Inc. | Encapsulation scheme for optical over ethernet |
US8402358B2 (en) * | 1998-12-08 | 2013-03-19 | SuperMedia LLC | System and method of dynamically generating index information |
US8930691B2 (en) * | 2011-08-16 | 2015-01-06 | Microsoft Corporation | Dynamic symmetric searchable encryption |
US9047480B2 (en) * | 2013-08-01 | 2015-06-02 | Bitglass, Inc. | Secure application access system |
- 2014
- 2014-11-07 US US14/536,460 patent/US9454673B1/en active Active
Patent Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US8402358B2 (en) * | 1998-12-08 | 2013-03-19 | SuperMedia LLC | System and method of dynamically generating index information |
US7949666B2 (en) * | 2004-07-09 | 2011-05-24 | Ricoh, Ltd. | Synchronizing distributed work through document logs |
US20110150466A1 (en) * | 2009-12-18 | 2011-06-23 | Cisco Technology, Inc. | Encapsulation scheme for optical over ethernet |
US8930691B2 (en) * | 2011-08-16 | 2015-01-06 | Microsoft Corporation | Dynamic symmetric searchable encryption |
US9047480B2 (en) * | 2013-08-01 | 2015-06-02 | Bitglass, Inc. | Secure application access system |
Cited By (30)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US10176207B1 (en) | 2015-06-09 | 2019-01-08 | Skyhigh Networks, Llc | Wildcard search in encrypted text |
US10404669B2 (en) | 2015-06-09 | 2019-09-03 | Skyhigh Networks, Llc | Wildcard search in encrypted text |
US10902063B2 (en) | 2015-06-09 | 2021-01-26 | Skyhigh Networks, Llc | Wildcard search in encrypted text |
US9679155B1 (en) * | 2015-06-12 | 2017-06-13 | Skyhigh Networks, Inc. | Prefix search in encrypted text |
US20170300714A1 (en) * | 2015-06-12 | 2017-10-19 | Skyhigh Networks, Inc. | Prefix search in encrypted text |
US9953186B2 (en) * | 2015-06-12 | 2018-04-24 | Skyhigh Networks, Inc. | Prefix search in encrypted text |
US10083315B2 (en) * | 2015-06-29 | 2018-09-25 | Microsoft Technology Licensing, Llc | Privacy enhanced personal search index |
US20160379009A1 (en) * | 2015-06-29 | 2016-12-29 | Microsoft Technology Licensing, Llc | Privacy Enhanced Personal Search Index |
US9894042B2 (en) * | 2015-07-24 | 2018-02-13 | Skyhigh Networks, Inc. | Searchable encryption enabling encrypted search based on document type |
US10063528B2 (en) * | 2015-07-24 | 2018-08-28 | Skyhigh Networks, Inc. | Searchable encryption enabling encrypted search based on document type |
US10498706B2 (en) * | 2015-07-24 | 2019-12-03 | Skyhigh Networks, Llc | Searchable encryption enabling encrypted search based on document type |
US20190042767A1 (en) * | 2015-12-28 | 2019-02-07 | EMC IP Holding Company LLC | Encrypted search indexes |
US10127391B1 (en) * | 2015-12-28 | 2018-11-13 | EMC IP Holding Company LLC | Encrypted search indexes |
US10586058B2 (en) * | 2015-12-28 | 2020-03-10 | EMC IP Holding Company LLC | Encrypted search indexes |
US11144663B2 (en) * | 2016-12-30 | 2021-10-12 | Robert Bosch Gmbh | Method and system for search pattern oblivious dynamic symmetric searchable encryption |
US11321190B2 (en) | 2017-09-14 | 2022-05-03 | Commvault Systems, Inc. | Distributed framework for task splitting and task assignments in a content indexing system |
US11263088B2 (en) | 2017-09-14 | 2022-03-01 | Commvault Systems, Inc. | Distributed architecture for tracking content indexing |
US11687511B2 (en) | 2017-09-14 | 2023-06-27 | Commvault Systems, Inc. | Distributed framework for data proximity-based task splitting in a content indexing system |
US11036592B2 (en) | 2017-09-14 | 2021-06-15 | Commvault Systems, Inc. | Distributed content indexing architecture with separately stored file previews |
US11086834B2 (en) * | 2017-09-14 | 2021-08-10 | Commvault Systems, Inc. | Distributed framework for data proximity-based task splitting in a content indexing system |
US11120142B2 (en) * | 2017-11-13 | 2021-09-14 | Alibaba Group Holding Limited | Device and method for increasing the security of a database |
US12008116B2 (en) | 2017-11-13 | 2024-06-11 | Alibaba Group Holding Limited | Device and method for increasing the security of a database |
US10534929B2 (en) * | 2018-04-11 | 2020-01-14 | Capital One Services, Llc | System and method for automatically securing sensitive data in public cloud using a serverless architecture |
US11764948B1 (en) * | 2018-04-30 | 2023-09-19 | Amazon Technologies, Inc. | Cryptographic service interface |
CN109670331A (en) * | 2019-02-21 | 2019-04-23 | 哈尔滨工程大学 | It is a kind of that encryption method symmetrically can search for based on block chain |
CN110135986A (en) * | 2019-04-23 | 2019-08-16 | 武汉大学 | It is a kind of to can search for encrypted file data method based on what block chain intelligence contract was realized |
CN110135986B (en) * | 2019-04-23 | 2024-01-16 | 武汉大学 | Method for realizing searchable encrypted file data based on blockchain intelligent contract |
CN111984995A (en) * | 2020-08-14 | 2020-11-24 | 杭州视洞科技有限公司 | Data encryption method of network camera based on private cloud |
US20220365921A1 (en) * | 2021-04-30 | 2022-11-17 | Intuit Inc. | Verifiable Cacheable Calclulations |
CN113688410A (en) * | 2021-08-20 | 2021-11-23 | 山东云海国创云计算装备产业创新中心有限公司 | Data retrieval method, device, FPGA and medium |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US9454673B1 (en) | Searchable encryption for cloud storage | |
US10063528B2 (en) | Searchable encryption enabling encrypted search based on document type | |
US10404669B2 (en) | Wildcard search in encrypted text | |
US10614135B2 (en) | Wildcard search in encrypted text using order preserving encryption | |
US9953186B2 (en) | Prefix search in encrypted text | |
US10902063B2 (en) | Wildcard search in encrypted text | |
US9686243B1 (en) | Encrypted universal resource identifier (URI) based messaging | |
RU2576479C2 (en) | Method and system for visiting third party application via cloud platform | |
US9197419B1 (en) | Security system for data stored in the cloud | |
US20230188507A1 (en) | Domain specific browser identifiers as replacement of browser cookies | |
US9740877B2 (en) | Systems and methods for data loss prevention while preserving privacy | |
US10698940B2 (en) | Method for searching for multimedia file, terminal device, and server | |
US10963593B1 (en) | Secure data storage using multiple factors | |
US9225720B1 (en) | Security system for data stored in the cloud | |
US9774551B2 (en) | User device, cloud server and share link identification method | |
US10020940B2 (en) | Identity-based encryption for securing access to stored messages | |
US10063655B2 (en) | Information processing method, trusted server, and cloud server | |
US9596081B1 (en) | Order preserving tokenization | |
US11695546B2 (en) | Decoupled custom event system based on ephemeral tokens for enabling secure custom services on a digital audio stream | |
US10885217B1 (en) | Client microservice for secure and efficient searchable encryption | |
US10997301B1 (en) | Variable encryption techniques for secure and efficient searchable encryption | |
EP3313052A1 (en) | Means for enhancing privacy of users of a cloud-based service | |
CN107707528B (en) | Method and device for isolating user information | |
CN110808993A (en) | Data transmission control method, device, computer system and medium | |
US11238168B2 (en) | Secure, efficient, and flexible searchable-encryption techniques |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment | Owner name: SKYHIGH NETWORKS, INC., CALIFORNIA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:SARUKKAI, SEKHAR;NARAYAN, KAUSHIK;GUPTA, RAJIV;AND OTHERS;SIGNING DATES FROM 20141218 TO 20150105;REEL/FRAME:034685/0476 | |
STCF | Information on status: patent grant | Free format text: PATENTED CASE | |
AS | Assignment | Owner name: MORGAN STANLEY SENIOR FUNDING, INC., MARYLAND Free format text: SECURITY INTEREST;ASSIGNOR:SKYHIGH NETWORKS, LLC;REEL/FRAME:046416/0286 Effective date: 20180410 Owner name: MORGAN STANLEY SENIOR FUNDING, INC., MARYLAND Free format text: SECURITY INTEREST;ASSIGNOR:SKYHIGH NETWORKS, LLC;REEL/FRAME:046416/0225 Effective date: 20180410 | |
AS | Assignment | Owner name: SKYHIGH NETWORKS, LLC, CALIFORNIA Free format text: CHANGE OF NAME;ASSIGNOR:SKYHIGH NETWORKS, INC.;REEL/FRAME:047985/0829 Effective date: 20180105 | |
MAFP | Maintenance fee payment | Free format text: PAYMENT OF MAINTENANCE FEE, 4TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1551); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY Year of fee payment: 4 | |
AS | Assignment | Owner name: JPMORGAN CHASE BANK, N.A., NEW YORK Free format text: CORRECTIVE ASSIGNMENT TO CORRECT THE RECEIVING PARTY DATA PREVIOUSLY RECORDED AT REEL: 046416 FRAME: 0286. ASSIGNOR(S) HEREBY CONFIRMS THE ASSIGNMENT;ASSIGNOR:SKYHIGH NETWORKS, LLC;REEL/FRAME:054560/0325 Effective date: 20180410 | |
AS | Assignment | Owner name: SKYHIGH NETWORKS, LLC, CALIFORNIA Free format text: RELEASE OF INTELLECTUAL PROPERTY COLLATERAL - REEL/FRAME 046416/0286;ASSIGNOR:JPMORGAN CHASE BANK, N.A., AS COLLATERAL AGENT;REEL/FRAME:054211/0739 Effective date: 20201026 | |
AS | Assignment | Owner name: SKYHIGH NETWORKS, LLC, CALIFORNIA Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:MORGAN STANLEY SENIOR FUNDING, INC.;REEL/FRAME:057620/0102 Effective date: 20210726 Owner name: MCAFEE, LLC, CALIFORNIA Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:MORGAN STANLEY SENIOR FUNDING, INC.;REEL/FRAME:057620/0102 Effective date: 20210726 | |
AS | Assignment | Owner name: MCAFEE, LLC, CALIFORNIA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:SKYHIGH NETWORKS, LLC;REEL/FRAME:057010/0244 Effective date: 20210726 | |
AS | Assignment | Owner name: JPMORGAN CHASE BANK, N.A., AS ADMINISTRATIVE AGENT AND COLLATERAL AGENT, NEW YORK Free format text: SECURITY INTEREST;ASSIGNOR:MCAFEE, LLC;REEL/FRAME:059354/0335 Effective date: 20220301 | |
AS | Assignment | Owner name: JPMORGAN CHASE BANK, N.A., AS ADMINISTRATIVE AGENT, NEW YORK Free format text: CORRECTIVE ASSIGNMENT TO CORRECT THE THE PATENT TITLES AND REMOVE DUPLICATES IN THE SCHEDULE PREVIOUSLY RECORDED AT REEL: 059354 FRAME: 0335. ASSIGNOR(S) HEREBY CONFIRMS THE ASSIGNMENT;ASSIGNOR:MCAFEE, LLC;REEL/FRAME:060792/0307 Effective date: 20220301 | |
MAFP | Maintenance fee payment | Free format text: PAYMENT OF MAINTENANCE FEE, 8TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1552); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY Year of fee payment: 8 |