Encrypted query-based access to data

Abstract

A query-based system for sharing encrypted data, comprising at least one hardware processor; and at least one non-transitory memory device having embodied thereon instructions executable by the at least one hardware processor to: receive a file and a plaintext tag and provide secure access to the file using the plaintext tag, and, responsive to receiving a search query matching the plaintext tag, securely retrieve the file, wherein providing secure access to the file comprises: encrypting the file into multiple portions, storing each portion separately, deriving multiple differently encrypted ciphertexts by encrypting the plaintext tag multiple times, separately indexing each portion using a different one of the ciphertexts, wherein securely retrieving the file comprises: deriving multiple differently encrypted search queries by encrypting the search query multiple times, querying using the multiple encrypted search queries, retrieving at least some of the multiple portions, and recovering the file from the retrieved portions.

What is claimed is: 
     
         1 . A system for providing query-based access to a file, comprising:
 at least one storage device;   at least one hardware processor; and   at least one non-transitory memory device having embodied thereon program code executable by said at least one hardware processor to:
 provide query-based access to a file by:
 creating multiple encrypted portions of said file, 
 deriving multiple different ciphertexts from a plaintext term associated with said file using multiple different index keys, 
 associating each one of said multiple encrypted portions with a different one of said multiple different ciphertexts, 
 separately storing each one of said multiple encrypted portions at said at least one storage device, and 
 indexing each one of said multiple stored encrypted portions with said associated one of said multiple different ciphertexts, and 
 
 retrieve said file by:
 deriving at least some of said multiple different ciphertexts from said plaintext term using at least some of said multiple different index keys, 
 submitting said at least some of said multiple different ciphertexts as multiple different search queries, 
 for each submitted one of said multiple different ciphertexts, retrieving from said at least one storage device, said associated one of said multiple encrypted portions, and 
 recovering said file from said multiple retrieved encrypted portions. 
 
   
     
     
         2 . The system of  claim 1 , wherein said program code is further executable to derive said multiple different ciphertexts by hashing said plaintext term using said multiple different index keys. 
     
     
         3 . The system of  claim 1 , wherein said program code is executable to associate each one of said multiple encrypted portions with said different one of said multiple different ciphertexts by creating a map between said multiple different index keys and said multiple encrypted portions. 
     
     
         4 . The system of  claim 3 , wherein said program code is further executable to: derive said multiple different index keys from a seed according to a key sequence and create said map by indexing said map with said multiple different index keys according to said key sequence. 
     
     
         5 . The system of  claim 7 , further comprising a first client computer comprising a first one of said at least one hardware processor and a first one of said at least one non-transitory memory device, and a second client computer comprising a second one of said at last one hardware processor and a second one of said at least one non-transitory memory device, wherein said program code is further executable by said first client computer to provide said query-based access to said file to said second client computer by providing said seed to said second client computer. 
     
     
         6 . The system of  claim 3 , wherein said multiple different index keys are fewer than said multiple encrypted portions, wherein said map maps a unique combination of said multiple different index keys to each one of said multiple encrypted portions. 
     
     
         7 . The system of  claim 3 , wherein said program code is further executable to:
 index each one of said multiple stored encrypted portions by encrypting a storage location string of each one of said multiple stored encrypted portions according to said map, and   retrieve each associated one of said multiple encrypted portions from said at least one storage device by decrypting said storage location string of said associated one of said multiple encrypted portions according to said map.   
     
     
         8 . The system of  claim 3 , wherein said program code is further executable to create said multiple encrypted portions of said file by:
 encrypting said file with a file encryption key, and   partitioning said encrypted file into said multiple encrypted portions, wherein combining said multiple encrypted portions according to a correct sequence defined by said map reconstructs said encrypted file, and   wherein said program code is further executable to recover said file from said multiple retrieved encrypted portions by:
 combining said multiple retrieved encrypted portions according to said correct sequence defined by said map to reconstruct said encrypted file, and 
 decrypting said encrypted file with said file encryption key. 
   
     
     
         9 . A method for providing query-based access a file, comprising:
 creating multiple encrypted portions of a file;   deriving multiple different ciphertexts from a plaintext term associated with said file using multiple different index keys;   associating each one of said multiple encrypted portions with a different one of said multiple different ciphertexts;   separately storing each one of said multiple encrypted portions; and   indexing each one of said multiple stored encrypted portions with said associated one of said multiple different ciphertexts.   
     
     
         10 . The method of  claim 9 , wherein deriving said multiple different ciphertexts comprises hashing said plaintext term using said multiple different index keys. 
     
     
         11 . The method of  claim 9 , wherein associating each one of said multiple encrypted portions with said different one of said multiple different ciphertexts comprises creating a map between said multiple different index keys and said multiple encrypted portions. 
     
     
         12 . The method of  claim 11 , further comprising deriving said multiple different index keys from a seed according to a key sequence, wherein creating said map comprises indexing said map with said multiple different index keys according to said key sequence. 
     
     
         13 . The method of  claim 11 , wherein indexing each one of said multiple stored encrypted portions comprises encrypting a storage location string of each one of said multiple stored encrypted portions according to said map. 
     
     
         14 . The method of  claim 11 , wherein creating said multiple encrypted portions of said file comprises:
 encrypting said file with a file encryption key, and   partitioning said encrypted file into said multiple encrypted portions, wherein combining said multiple encrypted portions according to a correct sequence defined by said map reconstructs said encrypted file.   
     
     
         15 . A method for retrieving a file, comprising:
 deriving multiple different ciphertexts from a plaintext term associated with a file using multiple different index keys, wherein each one of multiple encrypted portions of said file is associated with a different one of said multiple different ciphertexts;   submitting said multiple different ciphertexts as multiple different search queries;   for each submitted one of said multiple different ciphertexts, retrieving said associated one of said multiple encrypted portions; and   recovering said file from said multiple retrieved encrypted portions.   
     
     
         16 . The method of  claim 15 , wherein deriving said multiple different ciphertexts comprises hashing said plaintext term using said multiple different index keys. 
     
     
         17 . The method of  claim 15 , further comprising associating each one of said multiple encrypted portions with said different one of said multiple different ciphertexts by creating a map between said multiple different index keys and said multiple encrypted portions. 
     
     
         18 . The method of  claim 17 , further comprising obtaining a seed and deriving said multiple different index keys from said seed according to a key sequence, wherein creating said map comprises indexing said map with said multiple different index keys according to said key sequence. 
     
     
         19 . The method of  claim 17 , wherein retrieving each associated one of said multiple encrypted portions further comprises decrypting a storage location string of said associated one of said multiple encrypted portions according to said map. 
     
     
         20 . The method of  claim 17 , wherein recovering said file from said multiple retrieved encrypted portions comprises:
 combining said multiple retrieved encrypted portions according to a correct sequence defined by said map to reconstruct an encrypted file, and   decrypting said encrypted file with a file encryption key.