Wildcard search in encrypted text
A wildcard searchable encryption method enables wildcard search of encrypted text in a cloud-stored encrypted file. In some embodiments, the wildcard searchable encryption method is implemented in a network intermediary, such as a proxy server. The network intermediary encrypts files on behalf of a user or an enterprise destined to be stored on a cloud storage service. The wildcard searchable encryption method performs keyword pre-processing of the file to be encrypted to generate a set of keyword-wildcard combinations in plaintext for some or all of the keywords in the file. The processed file is encrypted using an exact match searchable encryption algorithm. As a result of the encryption process, a search index is generated to include the keyword-wildcard combinations. As thus configured, the wildcard searchable encryption method enables wildcard search of the encrypted text, such as searches for prefixes or suffixes of the keywords.
1. A method for wildcard searchable encryption of cloud stored data, comprising:
generating, using a hardware processor, a plurality of keyword-wildcard combinations for at least one keyword in the file;
generating a processed file including content of the file and the plurality of keyword-wildcard combinations;
encrypting the processed file using an exact match searchable encryption algorithm to form an encrypted file;
encrypting the at least one keyword to form at least one encrypted keyword;
encrypting the plurality of keyword-wildcard combinations to form encrypted keyword-wildcard combinations;
generating a search index using the hardware processor and including a mapping of encrypted keywords of the processed file to a document index identifying the file, the encrypted keywords of the processed file including the at least one encrypted keyword and the encrypted keyword-wildcard combinations; and
transmitting the encrypted file to a cloud storage service.
2. The method of claim 1 , wherein generating, using the hardware processor, the plurality of keyword-wildcard combinations comprises:
generating, using the hardware processor, the plurality of keyword-wildcard combinations in plaintext for some or all words in the file.
3. The method of claim 1 , wherein generating, using the hardware processor, the plurality of keyword-wildcard combinations comprises:
processing the content of the file to generate a plurality of prefix combinations in plaintext for the at least one of the keyword of the file.
4. The method of claim 3 , wherein processing the content of the file to generate a plurality of prefix combinations in plaintext for the at least one keyword of the file comprises:
processing the content of the file to generate the plurality of prefix combinations for a keyword including one or more leading characters of the keyword forming prefixes of the keyword, one or more remaining characters being a wildcard.
5. The method of claim 1 , wherein generating, using the hardware processor, the plurality of keyword-wildcard combinations comprises:
processing the content of the file to generate a plurality of suffix combinations in plaintext for the at least one keyword of the file.
6. The method of claim 5 , wherein processing the content of the file to generate a plurality of suffix combinations in plaintext for the at least one keyword of the file comprises:
processing the content of the file to generate the plurality of suffix combinations for a keyword including one or more trailing characters of the keyword forming suffixes of the keyword, one or more remaining characters being a wildcard.
7. The method of claim 1 , wherein generating a processed file including the content of the file and the plurality of keyword-wildcard combinations comprises:
appending the plurality of keyword-wildcard combinations in plaintext to the tail of the content of the original file.
8. The method of claim 1 , further comprising:
receiving, using the hardware processor, a search request with a search term;
encrypting the search term in the search request using the exact match searchable encryption algorithm to form an encrypted search term;
searching for the encrypted search term in the search index;
receiving a search result from the search index in response to the encrypted search term matching an encrypted keyword in the search index, the search result comprising a document index associated with the encrypted keyword;
retrieving the encrypted file from the cloud storage service using the document index in the search result;
decrypting the encrypted file retrieved from the cloud storage to form a decrypted file; and
providing the decrypted file as the search result.
9. A system for wildcard searchable encryption of cloud stored data, comprising:
a memory; and
a hardware processor coupled to the memory, wherein the hardware processor is configured to:
generate a plurality of keyword-wildcard combinations for at least one keyword in the file;
generate a processed file including content of the file and the plurality of keyword-wildcard combinations;
encrypt the processed file using an exact match searchable encryption algorithm to form an encrypted file;
encrypt the at least one keyword to form at least one encrypted keyword;
encrypt the plurality of keyword-wildcard combinations to form encrypted keyword-wildcard combinations;
generate a search index including a mapping of encrypted keywords of the processed file to a document index identifying the file, the encrypted keywords of the processed file including the at least one encrypted keyword and the encrypted keyword-wildcard combinations; and
transmit the encrypted file to a cloud storage service.
10. The system of claim 9 , wherein in generating the plurality of keyword-wildcard combinations, the hardware processor is also configured to:
generate the plurality of keyword-wildcard combinations in plaintext for some or all words in the file.
11. The system of claim 9 , wherein in generating the plurality of keyword-wildcard combinations, the hardware processor is also configured to:
process the content of the file to generate a plurality of prefix combinations in plaintext for the at least one of the keyword of the file.
12. The system of claim 11 , wherein in processing the content of the file to generate a plurality of prefix combinations in plaintext for the at least one keyword of the file, the hardware processor is also configured to:
process the content of the file to generate the plurality of prefix combinations for a keyword including one or more leading characters of the keyword forming prefixes of the keyword, one or more remaining characters being a wildcard.
13. The system of claim 9 , wherein in generating the plurality of keyword-wildcard combinations, the hardware processor is also configured to:
process the content of the file to generate a plurality of suffix combinations in plaintext for the at least one keyword of the file.
14. The system of claim 13 , wherein in processing the content of the file to generate a plurality of suffix combinations in plaintext for the at least one keyword of the file, the hardware processor is also configured to:
process the content of the file to generate the plurality of suffix combinations for a keyword including one or more trailing characters of the keyword forming suffixes of the keyword, one or more remaining characters being a wildcard.
15. The system of claim 9 , wherein in generating a processed file including the content of the file and the plurality of keyword-wildcard combinations, the hardware processor is also configured to:
append the plurality of keyword-wildcard combinations in plaintext to the tail of the content of the original file.
16. The system of claim 9 , wherein the hardware processor is also configured to:
receive a search request with a search term;
encrypt the search term in the search request using the exact match searchable encryption algorithm to form an encrypted search term;
search for the encrypted search term in the search index;
receive a search result from the search index in response to the encrypted search term matching an encrypted keyword in the search index, the search result comprising a document index associated with the encrypted keyword;
retrieve the encrypted file from the cloud storage service using the document index in the search result;
decrypt the encrypted file retrieved from the cloud storage to form a decrypted file; and
provide the decrypted file as the search result.