Wildcard search in encrypted text using order preserving encryption
A encrypted text wildcard search method enables wildcard search of encrypted text by using a permuterm index storing permuted keyword strings that are encrypted using an order preserving encryption algorithm. The permuted keyword strings are encrypted using an order preserving encryption algorithm or a modular order preserving encryption algorithm and stored in the permuterm index. In response to a search query containing a wildcard search term, the encrypted text wildcard search method transforms the wildcard search term to a permuted search term having a prefix search format. The permuted search term having the prefix search format is then used to perform a range query of the permuterm index to retrieve permuted keyword strings having ciphertext values that fall within the range query. In some embodiments, the encrypted text wildcard search method enables prefix search, suffix search, inner-wildcard search, substring search and multiple wildcard search of encrypted text.
1. A method for performing wildcard search of encrypted cloud stored data comprising:
permuting keyword strings for a plurality of keywords of an unencrypted document to form permuted keyword strings;
encrypting the permuted keyword strings using an order-preserving encryption algorithm to form encrypted permuted keyword strings;
storing the encrypted permuted keyword strings in a first index;
receiving a document search request comprising a wildcard search term, wherein the document search request is directed to encrypted documents stored in a cloud service provider, wherein the encrypted documents include an encrypted copy of the unencrypted document that was formed by encrypting the unencrypted document using a document encryption algorithm;
transforming the wildcard search term to a permuted search term by adding a first character delimiter to a character string of the wildcard search term and rotating characters of the character string until a wildcard term is at an end of the character string;
generating a minimum possible plaintext string using the permuted search term as prefix and padding the permuted search term to a first character length using one or more trailing characters indicative of a minimum possible value related to the search term;
generating a maximum possible plaintext string using the permuted search term as prefix and padding the permuted search term to the first character length using one or more trailing characters indicative of a maximum possible value related to the search term;
encrypting the minimum possible plaintext string and the maximum possible plaintext string using the order-preserving encryption algorithm;
generating a minimum ciphertext from the minimum possible plaintext string and a maximum ciphertext from the maximum possible plaintext string; and
determining a set of common leading digits from the minimum ciphertext and the maximum ciphertext;
formulating a range query, wherein the range query includes the set of common leading digits;
performing the range query on the first index; and
receiving a query search result in response to the range query.
2. The method of claim 1 , wherein the wildcard search term comprises one of a prefix search term, a suffix search term, an inner-wildcard search term, a substring search and a multiple wildcard search term, the wildcard search term being a character string including a wildcard term.
3. The method of claim 1 , wherein the query search result received in response to the range query comprises encrypted permuted keyword strings having ciphertext values that fall within the range query.
4. The method of claim 3 , further comprising:
providing the encrypted permuted keyword strings of the query search result to a searchable encryption search index;
searching for the encrypted permuted keyword strings in the searchable encryption search index;
retrieving from the searchable encryption search index an encrypted document index mapped to a matching encrypted permuted keyword string;
decrypting the encrypted document index to form a decrypted document index;
retrieving an encrypted document from the cloud service provider using the decrypted document index;
decrypting the encrypted document to form a decrypted retrieved document; and
providing the decrypted retrieved document in response to the document search request.
5. A method for performing wildcard search of encrypted cloud stored data comprising:
permuting keyword strings for a plurality of keywords of an unencrypted document to form permuted keyword strings;
encrypting the permuted keyword strings using an encryption algorithm to form encrypted permuted keyword strings;
storing the encrypted permuted keyword strings in a first index;
receiving a document search request comprising a wildcard search term, wherein the document search request is directed to encrypted documents stored in a cloud service provider, wherein the encrypted documents include an encrypted copy of the unencrypted document that was formed by encrypting the unencrypted document using a document encryption algorithm;
formulating a range query based on the wildcard search term;
performing the range query on the first index;
receiving a query search result in response to the range query;
generating a plaintext search result from the query search result; and
identifying a matching document from the cloud service provider containing the plaintext search result by:
encrypting plaintext keyword strings of the plaintext search result using the encryption algorithm;
performing a document search query of the cloud service provider using the encrypted plaintext keyword strings; and
returning a document search result in response to the document search query.
6. The method of claim 5 , wherein the encryption algorithm used to encrypt the permuted keyword strings comprises an order preserving encryption algorithm.
7. The method of claim 5 , wherein generating the plaintext search result comprises:
decrypting the search result using the encryption algorithm; and
unpermuting the decrypted search result to obtain plaintext keyword strings.
8. The method of claim 5 , wherein the document search result comprises an encrypted document from the cloud service provider having an encrypted text matching at least one of the encrypted plaintext keyword strings and wherein identifying a matching document from the cloud service provider containing the plaintext search result comprises decrypting the encrypted document to form a decrypted document and providing the decrypted document in response to the document search request.
9. A system for performing wildcard search of encrypted cloud stored data, comprising:
a memory;
a hardware processor coupled to the memory and configured to:
permute keyword strings for a plurality of keywords of an unencrypted document to form permuted keyword strings;
encrypt the permuted keyword strings using an order-preserving encryption algorithm to form encrypted permuted keyword strings;
store the encrypted permuted keyword strings in a first index;
receive a document search request comprising a wildcard search term, wherein the document search request is directed to encrypted documents stored in a cloud service provider, wherein the encrypted documents include an encrypted copy of the unencrypted document that was formed by encrypting the unencrypted document using a document encryption algorithm;
transform the wildcard search term to a permuted search term by adding a first character delimiter to a character string of the wildcard search term and rotating characters of the character string until a wildcard term is at an end of the character string;
generate a minimum possible plaintext string using the permuted search term as prefix and padding the permuted search term to a first character length using one or more trailing characters indicative of a minimum possible value related to the search term;
generate a maximum possible plaintext string using the permuted search term as prefix and padding the permuted search term to the first character length using one or more trailing characters indicative of a maximum possible value related to the search term;
encrypt the minimum possible plaintext string and the maximum possible plaintext string using the order-preserving encryption algorithm;
generate a minimum ciphertext from the minimum possible plaintext string and a maximum ciphertext from the maximum possible plaintext string;
determine a set of common leading digits from the minimum ciphertext and the maximum ciphertext;
formulate a range query, wherein the range query includes the set of common leading digits;
perform the range query on the first index; and
receive a query search result in response to the range query.
10. The system of claim 9 , wherein the query search result received in response to the range query comprises encrypted permuted keyword strings having ciphertext values that fall within the range query.
11. A system for performing wildcard search of encrypted cloud stored data, comprising:
a memory;
a hardware processor coupled to the memory and configured to:
permute keyword strings for a plurality of keywords of an unencrypted document to form permuted keyword strings;
encrypt the permuted keyword strings using an encryption algorithm to form encrypted permuted keyword strings;
store the encrypted permuted keyword strings in a first index;
receive a document search request comprising a wildcard search term, wherein the document search request is directed to encrypted documents stored in a cloud service provider, wherein the encrypted documents include an encrypted copy of the unencrypted document that was formed by encrypting the unencrypted document using a document encryption algorithm;
formulate a range query based on the wildcard search term;
perform the range query on the first index;
receive a query search result in response to the range query;
generating a plaintext search result from the query search result; and
identify a matching document from the cloud service provider containing the plaintext search result by:
encrypting plaintext keyword strings of the plaintext search result using the document encryption algorithm;
performing a document search query of the cloud service provider using the encrypted plaintext keyword strings; and
returning a document search result in response to the document search query.
12. The system of claim 11 , wherein the encryption algorithm used to encrypt the permuted keyword strings comprises an order preserving encryption algorithm.
13. The system of claim 11 , wherein generating the plaintext search result comprises:
decrypting the search result using the encryption algorithm; and
unpermuting the decrypted search result to obtain plaintext keyword strings.
14. The system of claim 11 , wherein the document search result comprises an encrypted document from the cloud service provider having an encrypted text matching at least one of the encrypted plaintext keyword strings and wherein identifying a matching document from the cloud service provider containing the plaintext search result comprises decrypting the encrypted document to form a decrypted document and providing the decrypted document in response to the document search request.