Searchable encrypted data stores
Disclosed are various embodiments for searchable encrypted data stores. A plurality of rows in a data table that have a cell in a column of the row that matches a value are identified. A bitmap that represents the plurality of rows is generated. The bitmap is encrypted. A key is then generated for a key-value pair. The key can be represented by a message authentication code (MAC) based at least in part on a tuple of a name of the data table, an identifier of the column, and the value. The key-value pair with the key and the encrypted bitmap is then sent to a remote computing device for storage.
1. A system, comprising:
a computing device comprising a processor and a memory; and
machine readable instructions stored in the memory that, when executed by the processor, cause the computing device to at least:
identify a set of permitted values for a column of a data table;
for individual values in the set of permitted values, identify a respective plurality of rows in the data table that have a cell in the column that matches the individual values;
generate a bitmap that represents the respective plurality of rows;
compress the bitmap to generate a roaring bitmap;
encrypt the roaring bitmap to generate an encrypted bitmap;
generate a message authentication code (MAC) based at least in part on a tuple of a name of the data table, an identifier of the column, and the value;
send the MAC and the encrypted bitmap to a remote computing device for storage;
encrypt the data table to generate an encrypted data table; and
send the encrypted data table to the remote computing device for storage.
2. The system of claim 1 , wherein the machine readable instructions further cause the computing device to delete the data table from the memory of the computing device.
3. The system of claim 1 , wherein the machine readable instructions further cause the computing device to retrieve an encryption key from a key service, and the encrypted data table and the encrypted bitmap are encrypted using the encryption key from the key service.
4. The system of claim 3 , wherein the encryption key is a public key of an asymmetric encryption key pair.
5. A system, comprising:
a first computing device comprising a processor and a memory; and
machine readable instructions stored in the memory that, when executed by the processor, cause the first computing device to at least:
identify a plurality of rows in a data table that have a cell in a column of the row that matches a value;
generate a bitmap that represents the plurality of rows;
encrypt the bitmap to generate an encrypted bitmap;
generate a message authentication code (MAC) based at least in part on a tuple of a name of the data table, an identifier of the column, and the value; and
send the MAC and the encrypted bitmap to a second computing device via a network for storage.
6. The system of claim 5 , wherein the machine readable instructions further cause the computing device to at least:
encrypt at least a portion of the data table to generate an encrypted data table; and
send the encrypted data table to the second computing device for storage.
7. The system of claim 6 , wherein the machine readable instructions further cause the computing device to retrieve an encryption key from a key service, and the encrypted data table and the encrypted bitmap are encrypted using the encryption key from the key service.
8. The system of claim 7 , wherein the encryption key is a public key of an asymmetric encryption key-pair.
9. The system of claim 7 , wherein the encryption key is a symmetric encryption key.
10. The system of claim 5 , wherein the machine readable instructions further cause the computing device to at least:
compress the bitmap to generate a compressed bitmap; and
the machine readable instructions that encrypt the bitmap to generate the encrypted bitmap encrypt the compressed bitmap to generate the encrypted bitmap.
11. The system of claim 10 , wherein the compressed bitmap is a roaring bitmap.
12. The system of claim 5 , wherein the machine readable instructions further cause the computing device to delete the data table from the memory of the computing device.
13. A method, comprising
identifying, with a first computing device, a plurality of rows in a data table that have a cell in a column of the row that matches a value;
generating, with the first computing device, a bitmap that represents the plurality of rows;
encrypting, with the first computing device, the bitmap to generate an encrypted bitmap;
generating, with the first computing device, a message authentication code (MAC) based at least in part on a tuple of a name of the data table, an identifier of the column, and the value; and
sending, with the first computing device, the MAC and the encrypted bitmap to a second computing device via a network for storage.
14. The method of claim 13 , further comprising
encrypting, with the first computing device, at least a portion of the data table to generate an encrypted data table; and
sending, with the first computing device, the encrypted data table to the second computing device for storage.
15. The method of claim 14 , further comprising retrieving, with the first computing device, the encryption key from a key service, and the encrypted data table and the encrypted bitmap are encrypted using the encryption key from the key service.
16. The method of claim 15 , wherein the encryption key is a public key of an asymmetric encryption key-pair.
17. The method of claim 15 , wherein the encryption key is a symmetric encryption key.
18. The method of claim 13 , further comprising:
compressing, with the first computing device, the bitmap to generate a compressed bitmap; and
encrypting the bitmap to generate the encrypted bitmap further comprises encrypting the compressed bitmap to generate the encrypted bitmap.
19. The method of claim 18 , wherein the compressed bitmap is a roaring bitmap.
20. The method of claim 13 , further comprising deleting, with the first computing device, the data table.