Skyhigh Networks, Inc.

Paul Grubbs

Kaushik Narayan

Rajiv Gupta

Sekhar R Sarukkai

Alexandra Boldyreva

Nathan Chenette

A encrypted text wildcard search method enables wildcard search of encrypted text by using a permuterm index storing permuted keyword strings that are encrypted using an order preserving encryption algorithm. The permuted keyword strings are encrypted using an order preserving encryption algorithm or a modular order preserving encryption algorithm and stored in the permuterm index. In response to a search query containing a wildcard search term, the encrypted text wildcard search method transforms the wildcard search term to a permuted search term having a prefix search format. The permuted search term having the prefix search format is then used to perform a range query of the permuterm index to retrieve permuted keyword strings having ciphertext values that fall within the range query. In some embodiments, the encrypted text wildcard search method enables prefix search, suffix search, inner-wildcard search, substring search and multiple wildcard search of encrypted text.

Wildcard search in encrypted text using order preserving encryption

A method enables prefix search of cloud stored encrypted files that are encrypted using an order preserving encryption (OPE) algorithm. The encrypted text prefix search method generates a minimum possible plaintext string and a maximum possible plaintext string of the same character length including the search term as the prefix. The minimum and maximum possible plaintext strings are encrypted using the same order preserving encryption algorithm for the encrypted text. The method determines from the minimum ciphertext and the maximum ciphertext a set of common leading digits. The set of common leading digits is used as an OPE encrypted prefix search term and provided to a cloud storage service to search in the cloud stored encrypted files for encrypted text matching the OPE encrypted prefix search term.

Prefix search in encrypted text

An encryption key management system and method implements enterprise managed encryption key for an enterprise using encryption for cloud-based services. In some embodiments, the enterprise deploys a key agent on the enterprise data network to distribute encryption key material to the network intermediary on a periodic basis. The network intermediary receives the encryption key material from the enterprise and stores the encryption key material in temporary storage and uses the received encryption key material to derive a data encryption key to perform the encryption of the enterprise's data. In this manner, the enterprise can be provided with the added security assurance of maintaining and managing its own encryption key while using cloud-based data storage services. The encryption key management system and method can be applied to ensure that the enterprise's one or more encryption keys do not leave the enterprise's premises.

Encryption in the cloud using enterprise managed keys

An order-preserving tokenization (OPT) method receives a plaintext and generates a token as the ciphertext which preserves the sort order of the plaintext by using stored legacy plaintext-to-ciphertext mapping data and a tail bounded probability distribution sampler to sample a random order preserving function. More specifically, the OPT method uses a mapping table to store plaintext-to-ciphertext mapping for previously generated ciphertexts. The mapping table enables efficient searching of the ciphertext space as the OPT method only needs to look for ciphertext in the space that most likely will have the desired plaintext. In this manner, the order-preserving tokenization method of the present invention realizes a fast algorithm that is also more computational efficient. In one embodiment, the OPT method uses a tail bounded hypergeometric distribution sampler as the probability distribution sampler.

Order preserving tokenization

An order-preserving encryption (OPE) encryption method receives a plaintext (clear text) and generates a ciphertext (encrypted text) using a software arbitrary precision floating point libraries during initial recursive computation rounds. In response to the ciphertext space reducing to breakpoint, the OPE encryption method continues computations using a hardware floating point processor to accelerate the computation. In this manner, the OPE encryption method enables efficient order preserving encryption to enable range queries on encrypted data.

Order preserving encryption method

A method implements searchable encryption of cloud stored data by appending tokenized keywords to an encrypted file destined for a cloud storage service. In some embodiments, the tokenized keywords are appended to the header of the encrypted file. Searching of cloud-stored encrypted files using the native search capability of the cloud storage service is then possible by performing the search using the tokenized keywords. In alternate embodiments of the present invention, a method enables searching of cloud stored encrypted file using a cloud search appliance.

Growing community of inventors

Sunnyvale, CA, United States of America

Paul Grubbs