Method for using an ORAM database by a terminal equipment, corresponding computer program product and device
A method for using, by a terminal equipment, an Oblivious Random-Access Memory (ORAM) database created in a remote server. A third-party device is connected to the terminal equipment and to the remote server through a communications network and executes receiving a request, sent by the terminal equipment, for having the third-party device to initiate the creation of the ORAM database in the remote server, initializing the creation of the ORAM database in the remote server by sending to the remote server ORAM database elements, generating metadata associated to the ORAM database created in the remote server, and sending, to the terminal equipment, the metadata for allowing the terminal equipment to use the ORAM database created in the remote server without going through the third-party device.
1 . A method of implementing, by a terminal equipment, an Oblivious Random-Access Memory, hereafter ORAM, database created in a remote server, the method comprising:
executing, by a third-party device being connected to the terminal equipment and to the remote server through a communications network, receiving a request, sent by the terminal equipment through the communications network, for having the third-party device to initiate creation of the ORAM database in the remote server; and
responsive to said receiving the request and by the third-party device:
initializing the creation of the ORAM database in the remote server by sending to the remote server, through the communications network, ORAM database elements,
generating metadata associated to the ORAM database created in the remote server, and
sending, to the terminal equipment through the communications network, the metadata for allowing the terminal equipment to use the ORAM database created in the remote server without going through the third-party device.
2 . The method according to claim 1 , wherein said initializing the creation of the ORAM database further comprises:
generating a temporary symmetric encryption key;
encrypting initial data blocks of the ORAM database with the temporary symmetric encryption key; and
sending, to the remote server through the communications network, the encrypted initial data blocks as part of the ORAM database elements.
3 . The method according to claim 2 , wherein said metadata comprise said temporary symmetric encryption key.
4 . The method according to claim 3 , further comprising: by the third-party device and responsive to said sending to the terminal equipment the metadata, deleting the metadata stored in the third-party device.
5 . The method according to claim 3 , further comprising: by the third-party device and after said sending to the terminal equipment the metadata, receiving, from the terminal equipment through the communications network, the metadata associated to the ORAM database in an encrypted form based on a secret encryption key different from the temporary symmetric encryption key.
6 . The method according to claim 2 , further comprising: by the third-party device and responsive to said sending to the terminal equipment the metadata, deleting the metadata stored in the third-party device.
7 . The method according to claim 2 , further comprising: by the third-party device and after said sending to the terminal equipment the metadata, receiving, from the terminal equipment through the communications network, the metadata associated to the ORAM database in an encrypted form based on a secret encryption key different from the temporary symmetric encryption key.
8 . The method according to claim 1 , further comprising: by the third-party device and responsive to said sending to the terminal equipment the metadata, deleting the metadata stored in the third-party device.
9 . The method according to claim 1 , further comprising: by the third-party device and after said sending to the terminal equipment the metadata, receiving, from the terminal equipment through the communications network, the metadata associated to the ORAM database in an encrypted form based on a secret encryption key different from a temporary symmetric encryption key.
10 . A non-transitory computer-readable storage medium comprising program code instructions for implementing the method according to claim 1 .
11 . A method of implementing, by a terminal equipment, an Oblivious Random-Access Memory, hereafter ORAM, database created in a remote server, the method comprising:
executing, by the terminal equipment being connected to a third-party device and to the remote server through a communications network:
sending a request, to the third-party device through the communications network, for having the third-party device to initiate creation of the ORAM database in the remote server, and
receiving, from the third-party device through the communications network, metadata allowing the terminal equipment to use the ORAM database created in the remote server without going through the third-party device.
12 . The method according to claim 11 , wherein said metadata comprise a temporary symmetric encryption key used by the third-party device to encrypt initial blocks of the ORAM database stored in the remote server.
13 . The method according to claim 12 , further comprising, by the terminal equipment, sending, to the third-party device through the communications network, an access token so that the third-party device can access the remote server for initializing the creation of the ORAM database in the remote server.
14 . The method according to claim 11 , further comprising, by the terminal equipment, sending, to the third-party device through the communications network, an access token so that the third-party device can access the remote server for initializing the creation of the ORAM database in the remote server.
15 . The method according to claim 14 , further comprising, by the terminal equipment and after said receiving from the third-party device the metadata, revoking the access token sent to the third-party device so that the third-party device cannot access any more the ORAM database in the remote server.
16 . The method according to claim 11 , further comprising, by the terminal equipment, a writing at least one data block in the ORAM database by:
encrypting the at least one data block of the ORAM database with a secret encryption key different from a temporary symmetric encryption key,
sending, to the remote server through the communications network, the encrypted at least one data block for storing in the ORAM database, and
updating the metadata for taking into account the sending of the encrypted at least one data block.
17 . The method according to claim 11 , further comprising, by the terminal equipment, a reading of at least one encrypted data block of the ORAM database by:
receiving, from the remote server through the communications network, the at least one encrypted data block of the ORAM database, and
decrypting the encrypted data block based on a temporary symmetric encryption key if the metadata indicates that the encrypted data block is an initial block of the ORAM database encrypted by the third-party device or based on a secret encryption key if the metadata indicates that the encrypted data block is a data block of the ORAM database encrypted by the terminal equipment.
18 . The method according to claim 11 , further comprising, by the terminal equipment, sending, to the third-party device through the communications network, the metadata in an encrypted form based on a secret encryption key.
19 . A device implementing, by a terminal equipment, an Oblivious Random-Access Memory, hereafter ORAM, database created in a remote server, the device comprising:
a processor or a dedicated computing machine configured to:
receive a request, sent by the terminal equipment through a communications network, for having a third-party device to initiate the creation of the ORAM database in the remote server, and
responsive to said receiving the request:
initialize the creation of the ORAM database in the remote server by sending to the remote server, through the communications network, ORAM database elements,
generate metadata associated to the ORAM database created in the remote server, and
send, to the terminal equipment through the communications network, the metadata for allowing the terminal equipment to use the ORAM database created in the remote server without going through the third-party device.
20 . A device implementing, by a terminal equipment, an Oblivious Random-Access Memory, hereafter ORAM, database created in a remote server, the device comprising:
a processor or a dedicated computing machine configured to:
send a request, to a third-party device through a communications network, for having the third-party device to initiate creation of the ORAM database in the remote server, and
receive, from the third-party device through the communications network, metadata allowing the terminal equipment to use the ORAM database created in the remote server without going through the third-party device.