Method, apparatus, and computer-readable medium for searching polymorphically encrypted data

1. A method executed by one or more computing devices for searching polymorphically encrypted data, the method comprising:

storing, by at least one of the one or more computing devices, one or more pseudonymous tokens in a data store, the one or more pseudonymous tokens being generated by encrypting a ciphertext using a first algorithm and an encryption key, the first algorithm comprising a polymorphic algorithm configured to generate a distinct pseudonymous token for each application of the polymorphic algorithm and the same encryption key to the same ciphertext; and

identifying, by at least one of the one or more computing devices, data in the data store that corresponds to the ciphertext by querying the data store using a search token generated by encrypting the ciphertext using a second algorithm and the encryption key, the search token being distinct from the one or more pseudonymous tokens.

2. The method of claim 1 , wherein identifying data in the data store that corresponds to the ciphertext by querying the data store using the search token generated by encrypting the ciphertext using the second algorithm and the encryption key comprises:

applying one or more first transformations to one or more columns containing the one or more pseudonymous tokens to generate one or more transformed columns;

applying one or more second transformations to the search token to generate a transformed search token; and

identifying one or more rows corresponding to the ciphertext based at least in part on the one or more transformed columns and the transformed search token.

3. The method of claim 2 , wherein the identifying of the one or more rows corresponding to the ciphertext based at least in part on the one or more transformed columns and the transformed search token comprises:

comparing each transformed column value in the one or more transformed columns to the transformed search token using a matching function to identify one or more matching transformed column values; and

identifying one or more rows containing the one or more matching transformed column values as corresponding to the ciphertext.

4. The method of claim 1 , further comprising:

displaying, by at least one of the one or more computing devices, a first result if the search token is matched with the one or more pseudonymous tokens of a plurality of pseudonymous tokens, the first result including a list of at least one pseudonymous tokens; and

displaying, by at least one of the one or more computing devices, a different second result if the search token does not match with the one or more pseudonymous tokens of the plurality of pseudonymous tokens.

5. The method of claim 1 , further comprising:

modifying, by at least one of the one or more computing devices, the distinct pseudonymous token of the plurality of pseudonymous tokens by adding a respective one of one or more pseudo random permutation (PRP) seeds in the distinct pseudonymous token.

6. The method of claim 5 , further comprising:

encrypting, by at least one of the one or more computing devices, the respective one of the one or more PRP seeds using a different third algorithm and the encryption key, wherein the adding the respective one of the one or more PRP seeds includes adding the respective PRP seed either before or after the distinct pseudonymous token.

7. The method in claim 6 , further comprising:

encrypting, by at least one of the one or more computing devices, the one or more PRP seeds based on content of the distinct pseudonymous token as an initialization vector.

8. The method of claim 6 , further comprising:

detaching, by at least one of the one or more computing devices, the encrypted one or more PRP seeds; and

decrypting, by at least one of the one or more computing devices, the encrypted one or more PRP seeds using the third algorithm and the encryption key.

9. The method in claim 8 , further comprising:

decrypting, by at least one of the one or more computing devices, the one or more PRP seeds based on content of the distinct pseudonymous token as an initialization vector.

10. The method of claim 6 , further comprising:

decrypting, by at least one of the one or more computing devices, the respective pseudonymous token using a decryption first algorithm and the encryption key after detaching the respective PRP seed from the distinct pseudonymous token.

11. The method of claim 1 , wherein the second algorithm is different from the first algorithm.

12. A system for searching polymorphically encrypted data, comprising:

one or more processors; and

one or more memories operatively coupled to at least one of the one or more processors and having instructions stored thereon that, when executed by at least one of the one or more processors, cause at least one of the one or more processors to:

store one or more pseudonymous tokens in a data store, the one or more pseudonymous tokens being generated by encrypting a ciphertext using a first algorithm and an encryption key, the first algorithm comprising a polymorphic algorithm configured to generate a distinct pseudonymous token for each application of the polymorphic algorithm and the same encryption key to the same ciphertext; and

identify data in the data store that corresponds to the ciphertext by querying the data store using a search token generated by encrypting the ciphertext using a second algorithm and the encryption key, the search token being distinct from the one or more pseudonymous tokens.

13. The system of claim 12 , wherein at least one of the one or more memories has further instructions stored thereon that, when executed by at least one of the one or more processors, cause at least one of the one or more processors to:

apply one or more first transformations to one or more columns containing the one or more pseudonymous tokens to generate one or more transformed columns;

apply one or more second transformations to the search token to generate a transformed search token; and

identify one or more rows corresponding to the ciphertext based at least in part on the one or more transformed columns and the transformed search token.

14. The system of 13 , wherein at least one of the one or more memories has further instructions stored thereon that, when executed by at least one of the one or more processors, cause at least one of the one or more processors to:

compare each transformed column value in the one or more transformed columns to the transformed search token using a matching function to identify one or more matching transformed column values; and

identify one or more rows containing the one or more matching transformed column values as corresponding to the ciphertext.

15. The system of claim 12 , wherein at least one of the one or more memories has further instructions stored thereon that, when executed by at least one of the one or more processors, cause at least one of the one or more processors to:

modify the distinct pseudonymous token of the plurality of pseudonymous tokens by adding a respective one of one or more pseudo random permutation (PRP) seeds in the distinct pseudonymous token.

16. The system of claim 15 , wherein at least one of the one or more memories has further instructions stored thereon that, when executed by at least one of the one or more processors, cause at least one of the one or more processors to:

encrypt the respective one of the one or more PRP seeds using a different third algorithm and the encryption key, wherein the adding the respective one of the one or more PRP seeds includes adding the respective PRP seed either before or after the distinct pseudonymous token.

17. The system of claim 16 , wherein at least one of the one or more memories has further instructions stored thereon that, when executed by at least one of the one or more processors, cause at least one of the one or more processors to:

encrypt the one or more PRP seeds based on using the content of the distinct pseudonymous token as an initialization vector when encrypting one or more PRP seeds.

18. The system of claim 16 , wherein at least one of the one or more memories has further instructions stored thereon that, when executed by at least one of the one or more processors, cause at least one of the one or more processors to:

detach the encrypted one or more PRP seeds; and

decrypt the encrypted one or more PRP seeds using the third algorithm and the encryption key.

19. The system of claim 18 , wherein at least one of the one or more memories has further instructions stored thereon that, when executed by at least one of the one or more processors, cause at least one of the one or more processors to:

decrypt the one or more PRP seeds based on using the content of the distinct pseudonymous token as an initialization vector when decrypting one or more PRP seeds.

20. At least one non-transitory computer-readable medium storing computer-readable instructions that, when executed by one or more computing devices, cause at least one of the one or more computing devices to:

store one or more pseudonymous tokens in a data store, the one or more pseudonymous tokens being generated by encrypting a ciphertext using a first algorithm and an encryption key, the first algorithm comprising a polymorphic algorithm configured to generate a distinct pseudonymous token for each application of the polymorphic algorithm and the same encryption key to the same ciphertext; and

identify data in the data store that corresponds to the ciphertext by querying the data store using a search token generated by encrypting the ciphertext using a second algorithm and the encryption key, the search token being distinct from the one or more pseudonymous tokens.