Encrypted information retrieval

1. A method, comprising:

generating a partitioned database in which a database is partitioned into shards each having a shard identifier that logically distinguishes each shard from other shards, and database entries in each shard are partitioned into buckets having a bucket identifier that logically distinguishes each bucket in the shard from other buckets in the shard;

receiving, by a server including one or more processors and from a client device, a batch of client-encrypted queries, wherein the batch of client-encrypted queries includes two or more queries that have each been encrypted by the client device and specify a shard identifier for the client-encrypted query;

processing, by the server, the batch of client-encrypted queries using a set of server-encrypted data stored in a database, wherein each database entry is server-encrypted and is capable of being decrypted by a corresponding decryption key, wherein the processing includes:

grouping, by the server, the client-encrypted queries according to shard identifiers of the client-encrypted queries, wherein each group of client-encrypted queries includes multiple queries;

executing, by the server and for each shard, the multiple queries in the group of client-encrypted queries for the shard together in a batch execution process; and

generating, by the server and for each shard, multiple server-encrypted results to the multiple queries in the group of client-encrypted queries; and

transmitting, by the server, the multiple server-encrypted results for each shard to the client device.

2. The method of claim 1 , further comprising:

receiving, from the client device, a set of client-encrypted entity identifiers;

encrypting, by the server, the set of client-encrypted entity identifiers to create a set of sever-client-encrypted identifiers;

transmitting, by the server, the set of server-client-encrypted identifiers to the client device.

3. The method of claim 2 , further comprising:

generating, by the client device, a set of queries using the set of server-client-encrypted identifiers;

generating, by the client device, a set of decryption keys using the set of server-client-encrypted identifiers;

encrypting, by the client device, the set of queries to create the batch of client-encrypted queries.

4. The method of claim 3 , further comprising:

encrypting, by the server, a set of data stored in the database, wherein, for a plurality of entries in the database, each database entry is server-encrypted and is capable of being decrypted by a corresponding decryption key, wherein generating the partitioned database includes assigning each server-encrypted database entry to a bucket.

5. The method of claim 4 , further comprising:

applying, by the client device, the set of decryption keys generated by the client device using the set of server-client-encrypted identifiers to the multiple server-encrypted results to reveal unencrypted results to the client-encrypted queries.

6. The method of claim 4 , wherein generating the partitioned database further comprises partitioning each bucket into smaller chunks.

7. The method of claim 6 , wherein executing the multiple queries comprises executing each query on each chunk of the bucket, which reduces CPU usage and response time by shrinking a search space for each query execution.

8. A system comprising:

a memory device; and

a server, including one or more processors, configured to execute instructions that cause the server to perform operations comprising:

generating, in the memory device, a partitioned database in which a database is partitioned into shards each having a shard identifier that logically distinguishes each shard from other shards, and database entries in each shard are partitioned into buckets having a bucket identifier that logically distinguishes each bucket in the shard from other buckets in the shard;

receiving, from a client device, a batch of client-encrypted queries, wherein the batch of client-encrypted queries includes two or more queries that have each been encrypted by the client device and specify a shard identifier for the client-encrypted query;

processing the batch of client-encrypted queries using a set of server-encrypted data stored in a database, wherein each database entry is server-encrypted and is capable of being decrypted by a corresponding decryption key, wherein the processing includes:

grouping the client-encrypted queries according to shard identifiers of the client-encrypted queries, wherein each group of client-encrypted queries includes multiple queries;

executing, for each shard, the multiple queries in the group of client-encrypted queries for the shard together in a batch execution process; and

generating, for each shard, multiple server-encrypted results to the multiple queries in the group of client-encrypted queries; and

transmitting the multiple server-encrypted results for each shard to the client device.

9. The system of claim 8 , wherein the instructions cause the server to perform operations further comprising:

receiving, from the client device, a set of client-encrypted entity identifiers;

encrypting the set of client-encrypted entity identifiers to create a set of sever-client-encrypted identifiers;

transmitting the set of server-client-encrypted identifiers to the client device.

10. The system of claim 9 , wherein the instructions cause the server to perform operations further comprising:

generating, by the client device, a set of queries using the set of server-client-encrypted identifiers;

generating, by the client device, a set of decryption keys using the set of server-client-encrypted identifiers;

encrypting, by the client device, the set of queries to create the batch of client-encrypted queries.

11. The system of claim 10 , wherein the instructions cause the server to perform operations further comprising:

encrypting a set of data stored in the database, wherein, for a plurality of entries in the database, each database entry is server-encrypted and is capable of being decrypted by a corresponding decryption key, wherein generating the partitioned database includes assigning each server-encrypted database entry to a bucket.

12. The system of claim 11 , wherein the instructions cause the server to perform operations further comprising:

applying, by the client device, the set of decryption keys generated by the client device using the set of server-client-encrypted identifiers to the multiple server-encrypted results to reveal unencrypted results to the client-encrypted queries.

13. The system of claim 11 , wherein generating the partitioned database further comprises partitioning each bucket into smaller chunks.

14. The system of claim 13 , wherein executing the multiple queries comprises executing each query on each chunk of the bucket, which reduces CPU usage and response time by shrinking a search space for each query execution.

15. A non-transitory computer readable medium storing instructions that, upon execution by a server including one or more processors, cause the server to perform operations comprising:

generating, in a memory device, a partitioned database in which a database is partitioned into shards each having a shard identifier that logically distinguishes each shard from other shards, and database entries in each shard are partitioned into buckets having a bucket identifier that logically distinguishes each bucket in the shard from other buckets in the shard;

receiving, from a client device, a batch of client-encrypted queries, wherein the batch of client-encrypted queries includes two or more queries that have each been encrypted by the client device and specify a shard identifier for the client-encrypted query;

processing the batch of client-encrypted queries using a set of server-encrypted data stored in a database, wherein each database entry is server-encrypted and is capable of being decrypted by a corresponding decryption key, wherein the processing includes:

grouping the client-encrypted queries according to shard identifiers of the client-encrypted queries, wherein each group of client-encrypted queries includes multiple queries;

executing, for each shard, the multiple queries in the group of client-encrypted queries for the shard together in a batch execution process; and

generating, for each shard, multiple server-encrypted results to the multiple queries in the group of client-encrypted queries; and

transmitting the multiple server-encrypted results for each shard to the client device.

16. The non-transitory computer readable medium of claim 15 , wherein the instructions cause the server to perform operations further comprising:

receiving, from the client device, a set of client-encrypted entity identifiers;

encrypting the set of client-encrypted entity identifiers to create a set of sever-client-encrypted identifiers;

transmitting the set of server-client-encrypted identifiers to the client device.

17. The non-transitory computer readable medium of claim 16 , wherein the instructions cause the server to perform operations further comprising:

generating, by the client device, a set of queries using the set of server-client-encrypted identifiers;

generating, by the client device, a set of decryption keys using the set of server-client-encrypted identifiers;

encrypting, by the client device, the set of queries to create the batch of client-encrypted queries.

18. The non-transitory computer readable medium of claim 17 , wherein the instructions cause the server to perform operations further comprising:

encrypting a set of data stored in the database, wherein, for a plurality of entries in the database, each database entry is server-encrypted and is capable of being decrypted by a corresponding decryption key, wherein generating the partitioned database includes assigning each server-encrypted database entry to a bucket.

19. The non-transitory computer readable medium of claim 18 , wherein the instructions cause the server to perform operations further comprising:

applying, by the client device, the set of decryption keys generated by the client device using the set of server-client-encrypted identifiers to the multiple server-encrypted results to reveal unencrypted results to the client-encrypted queries.

20. The non-transitory computer readable medium of claim 18 , wherein generating the partitioned database further comprises partitioning each bucket into smaller chunks.