System and method for secure database queries

Patent metadata

Field	Value
Publication number	US-9286488-B2
Application number	US-201414207418-A
Country	US
Kind code	B2
Filing date	Mar 12, 2014
Priority date	Mar 13, 2013
Publication date	Mar 15, 2016
Grant date	Mar 15, 2016

Abstract

Disclosed are a system and method of performing secure computations on a protected database. Embodiments of the method provide, in a secure processor, a database of cryptographically hashed values based on a database of cleartext values, receive a cryptographically hashed query value as input into the secure processor wherein the query value is a hash of a cleartext value that corresponds to a cleartext query, perform a comparison operation within the secure processor to determine the presence of the hashed query value within the database of cryptographically hashed values and provide the results of the comparison operation to an external interface of the secure processor, wherein the contents of the database of cryptographically hashed values and the comparison operations are encapsulated within the secure processor and unexposed externally therefrom.

First claim

What is claimed is:

1. A method of performing secure computations on a protected database comprising:
providing, in a secure processor, a database of cryptographically hashed values based on a database of cleartext values;
receiving a plurality of cryptographically hashed query values as input into the secure processor, wherein the plurality of cryptographically hashed query values are hashes formed from a cleartext query and variations of the cleartext query;
performing a comparison operation within the secure processor to determine the presence of one or more of the plurality of received hashed query values or any of a set of associated hashed query values within the database of cryptographically hashed values; and
providing the results of the comparison operation to an external interface of the secure processor, wherein the contents of the database of cryptographically hashed values and the comparison operation are encapsulated within the secure processor and unexposed externally therefrom.

2. The method of claim 1 further comprising a non-secure processor producing the plurality of cryptographically hashed query values for input to the secure processor, wherein the non-secure processor produces the plurality of cryptographically hashed query values by transforming the cleartext query to a hashed value.

3. The method of claim 1 further comprising a non-secure processor:
receiving the cleartext query;
producing the variations of the cleartext query; and
hashing the cleartext query and the variations of the cleartext query from the plurality of cryptographically hashed query values.

4. The method of claim 3 further comprising a non-secure processor transmitting the plurality of cryptographically hashed query values to the secure processor.

5. The method of claim 1 further comprising a non-secure processor receiving the results of the comparison operation.

6. The method of claim 5 further comprising the non-secure processor executing a process based on the received results of the comparison operation.

7. The method of claim 1 wherein the providing a database of cryptographically hashed values based on a database of cleartext values includes transforming a database of cleartext values into the database of cryptographically hashed values wherein the elements of the database of cleartext values have associated hashed elements in the database of cryptographically hashed values.

8. The method of claim 1 wherein the secure processor is an encapsulated processor that includes physical security measures and anti-tamper protections that prevents external access of internal operations.

9. The method of claim 1 wherein performing the comparison operation includes computing additional hashed query values that are variations of the hashed query value and enable the secure processor to determine the presence of any of a set of associated hashed query values.

10. The method of claim 9 wherein the hashed query value represents an internet address and the additional hashed query values represent sub-domain internet addresses associated with the internet address.

11. A method of performing secure computations on a protected database comprising:
providing, in a secure processor, a database of cryptographically hashed values based on a database of cleartext, wherein the providing a database of cryptographically hashed values based on a database of cleartext values includes:
transforming a first database of cleartext values into a second database of cryptographically hashed values wherein the elements of the first database have associated hashed elements in the second database;
encrypting the contents of the second database and formatting the data into an encrypted datastream configured for transmission to the secure processor;
providing the encrypted datastream to the input of the secure processor;
decrypting the encrypted datastream within the secure processor; and
storing the results of the decryption in a third database located within the secure processor thereby producing a replica of the second database of cryptographically hashed values within the secure processor;

receiving a cryptographically hashed query value as input into the secure processor wherein the query value is a hash of a cleartext value that corresponds to a cleartext query;
performing a comparison operation within the secure processor to determine the presence of the hashed query value or any of a set of associated hashed query values within the database of cryptographically hashed values; and
providing the results of the comparison operation to an external interface of the secure processor, wherein the contents of the database of cryptographically hashed values and the comparison operation are encapsulated within the secure processor and unexposed externally therefrom.

12. A non-transitory computer readable medium comprising instructions for performing secure computations on a protected database, by:
providing, in a secure processor, a database of cryptographically hashed values based on a database of cleartext values;
receiving a plurality of cryptographically hashed query values as input into the secure processor, wherein the plurality of cryptographically hashed query values are hashes formed from a cleartext query and variations of the cleartext query;
performing a comparison operation within the secure processor to determine the presence of one or more of the plurality of received hashed query values or any of a set of associated hashed query values within the database of cryptographically hashed values; and
providing the results of the comparison operation to an external interface of the secure processor, wherein the contents of the database of cryptographically hashed values and the comparison operation are encapsulated within the secure processor and unexposed externally therefrom.

13. The computer readable medium of claim 12 in which the providing a database of cryptographically hashed values based on a database of cleartext values includes transforming a database of cleartext values into the database of cryptographically hashed values wherein the elements of the database of cleartext values have associated hashed elements in the database of cryptographically hashed values.

14. A non-transitory computer readable medium comprising instructions for performing secure computations on a protected database, by:
providing, in a secure processor, a database of cryptographically hashed values based on a database of cleartext values; in which the providing a database of cryptographically hashed values based on a database of cleartext values includes:
transforming a first database of cleartext values into a second database of cryptographically hashed values wherein the elements of the first database have associated hashed elements in the second database;
encrypting the contents of the second database and formatting the data into an encrypted datastream configured for transmission to the secure processor;
providing the encrypted datastream to the input of the secure processor;
decrypting the encrypted datastream within the secure processor; and
storing the results of the decryption in a third database located within the secure processor thereby producing a replica of the second database of cryptographically hashed values within the secure processor;

receiving a cryptographically hashed query value as input into the secure processor wherein the query value is a hash of a cleartext value that corresponds to a cleartext query;
performing a comparison operation within the secure processor to determine the presence of the hashed query value or any of a se

Assignees

• Northrop Grumman Systems Corp

Inventors

• Bennison James E

Classifications

• G06F16/137

  Hash-based (content-based indexing of textual data G06F16/31) · CPC title

• H04L9/3236 Primary

  using cryptographic hash functions · CPC title

• G06F21/72 Primary

  in cryptographic circuits · CPC title

• G06F21/6227 Primary

  where protection concerns the structure of data, e.g. records, types, queries · CPC title