Systems and methods using emulation for end to end encryption
Methods and system implement solutions for integrating encryption and emulation into native database formats and/or architectures. “Native” database is used to describe a database that has not been designed for end to end encryption, an off the shelf database deployment, and/or a commercially available database. According to some embodiments, various encryption systems and methods employ emulation operations to enable a native database and native database functions to leverage full encryption primitives. Various aspects integrate emulation operations into standard database implementations, where the emulation enables native database functions to operate on entirely encrypted data.
1 . An emulation system comprising:
at least one processor operatively connected to a memory, the at least one processor when executing configured to:
integrate an emulation layer into a dynamic schema database deployment;
maintain the dynamic schema database architecture;
accept and respond to database queries made on the standard dynamic schema database through the emulation layer;
wherein the emulation layer is configured to:
maintain data stored on the dynamic schema database so that designated data is in an encrypted format when stored, queried, and output, the encrypted format encoding at least a portion of document units of data from dynamic schema source data comprising at least documents, and the encrypted format further comprising at least an encrypted multi-map data structure of label and tuple pairs;
execute queries against the designated data in the encrypted format stored in the encrypted multi-map data structure; and
return the output to any query on the designated data to a requesting client in the encrypted format used in the encrypted multi-map data structure.
2 . The system of claim 1 , wherein the system is further configured to maintain any output from any query response in the encrypted format.
3 . The system of claim 1 , wherein the at least one processor is configured to transform plaintext data into an encrypted multi-map data structure.
4 . The system of claim 3 , wherein the at least one processor is configured to construct an index on the encrypted values in the encrypted multi-map.
5 . The system of claim 1 , wherein the at least one processor is configured to construct at least one search token for accessing the multi-map data structure as part of the query on the designated data.
6 . The system of claim 5 , wherein the at least one processor is configured to construct the at least one search token comprising at least a cyphertext value and index value.
7 . The system of claim 5 , wherein the at least one processor is configured to construct the at least one search token comprising a sub token including at least a cyphertext value and index value for each counter in a state dictionary associated with the cyphertext value being queried.
8 . The system of claim 1 , wherein the at least one processor is configured to construct a range search token comprising vectors of sub tokens.
9 . The system of claim 8 , wherein the at least one processor is configured to generate the sub tokens for the range search token based on counter information in a cover of the range to be searched.
10 . The system of claim 1 , wherein the at least one processor is configured to transform textual values of a plaintext database into numeric values for transformation into an encrypted multimap representation to enable end to end encryption of text search.
11 . The system of claim 1 , wherein the at least one processor is configured to:
transform textual values of a plaintext database into a tree representation;
transform the tree representation into an encrypted multimap and hypergraph representation to enable end to end encryption of pattern search.
12 . A computer implemented method for end to end encryption, the method comprising:
integrating, by at least one processor, an emulation layer into a dynamic schema database deployment;
maintaining, by the at least one processor the dynamic schema database architecture;
accepting and responding, by the at least one processor, to database queries made on the dynamic schema database through the emulation layer;
maintaining, by the at least one processor, data stored on the dynamic schema database so that designated data is in an encrypted format when stored, queried, and output, the encrypted format encoding at least a portion of document units of data from dynamic schema source data comprising at least documents, and the encrypted format further comprising at least an encrypted multi-map data structure of label and tuple pairs;
executing, by the at least one processor, queries against the designated data in the encrypted format stored in the encrypted multi-map data structure; and
returning, by the at least one processor, the output to any query on the designated data to a requesting client in the encrypted format stored in the encrypted multi-map data structure.
13 . The method of claim 12 , wherein the method further comprises maintaining, by the at least one processor, any output from any query response in the encrypted format.
14 . The method of claim 12 , wherein the method further comprises transforming plaintext data into an encrypted multi-map.
15 . The method of claim 14 , wherein the method further comprises constructing an index on the encrypted values in the encrypted multi-map.
16 . The method of claim 12 , wherein the method further comprises constructing at least one search token as part of the query on the designated data.
17 . The method of claim 16 , wherein the method further comprises constructing the at least one search token comprising at least a cyphertext value and index value.
18 . The method of claim 16 , wherein the method further comprises constructing the at least one search token comprising a sub token including at least a cyphertext value and index value for each counter in a state dictionary associated with the cyphertext value being queried.
19 . The method of claim 12 , wherein the method further comprises constructing a range search token comprising vectors of sub tokens.
20 . The method of claim 19 , wherein the method further comprises generating the sub-tokens for the range search token based on counter information in a cover of the range to be searched.
21 . The method of claim 12 , wherein the method further comprises transforming textual values of a plaintext database into numeric values for transformation into an encrypted multimap representation to enable end to end encryption of text search.
22 . The method of claim 12 , wherein the method further comprises:
transforming textual values of a plaintext database into a tree representation; and
transforming the tree representation into an encrypted multimap and hypergraph representation to enable end to end encryption of pattern search.