Patent Publication Number: US-9425960-B2

Title: Searchable encryption for outsourcing data analytics

Description:
TECHNICAL FIELD 
     This description relates to searchable encryption for outsourcing data analytics. 
     BACKGROUND 
     Protecting the privacy and confidentiality of data may be desirable and important for a company or an organization. However, sometimes the company or organization may need to make their sensitive data available to third parties. For example, during a financial audit, the company or organization may need to make their data available to a financial auditor. In this example scenario, two sets of privacy issues may need to be considered when a company&#39;s accounting data is audited by an external party. The company wants to safeguard its data, while the auditors want to safeguard their investigation methods. 
     Thus, multiple parties may have privacy and confidentiality concerns regarding their data and their methods. In the example provided above, the company wants to preserve the privacy of the data it lets the auditor access for the purpose of the audit. On the other hand, what makes the auditor effective and efficient in his work are the queries he runs, which are his know-how and intellectual property. The challenge is therefore to ensure both the privacy of the data and the privacy of the queries. 
     SUMMARY 
     In general, this document describes a searchable encryption system and techniques for protecting the data of multiple parties. This document provides exemplary scenarios and contexts for implementing and using the searchable encryption system and techniques. However, these exemplary scenarios and uses are not meant to limit the scenarios and contexts in which the searchable encryption system and techniques may be used. For example, this document describes an exemplary context for the searchable encryption system and techniques for outsourcing data analytics. In this exemplary context, a data owner desires to encrypt his data only once and communicate the data in encrypted form to a data analyst. The data analyst can then perform a series of queries for which the data analyst works with the data owner for help in translating the constants in the queries. 
     The searchable encryption system and techniques allows keyword searches and range queries. Furthermore, additional queries may reuse the results of previous queries as tokens and thereby make dependent queries without interaction between the data owner and the data analyst. The searchable encryption system and techniques may be provably secure. 
     According to one general aspect, a method for performing data analytics on outsourced data may include receiving, at a data analyst, cipher text representing data from a data owner such that the data remains hidden from the data analyst, generating a query token using a constant provided by the data analyst such that the constant remains hidden from the data owner, and analyzing the cipher text using the query token. 
     Implementations may include one or more of the following features. For example, the method may further include outputting one or more identity query tokens as a result of analyzing the cipher text, analyzing the cipher text using the outputted identity query tokens, and outputting additional identity query tokens. The data may include one or more tuples and the cipher text may be generated by the data owner encrypting the tuples using a secret key and a corresponding public security parameter such that the cipher text is unique for each of the tuples. 
     Generating the query token may include inputting the constant and a public security parameter by the data analyst such that the constant remains hidden from the data owner, inputting a secret key by the data owner such that the secret key remains hidden from the data analyst and outputting the query token to the data analyst. 
     In one exemplary implementation, generating the query token may include generating a set of range query tokens using constants provided by the data analyst such that the constants remain hidden from the data owner and analyzing the cipher text comprises analyzing the cipher text using the set of range query tokens. The method may further include outputting one or more identity query tokens as a result of analyzing the cipher text, analyzing the cipher text using the outputted identity query tokens and outputting additional identity query tokens. 
     In another general aspect, a system for performing data analytics on outsourced data may include an encryption generator that is arranged and configured to encrypt data from a data owner, output a cipher text and communicate the cipher text to a data analyst such that the data remains hidden from the data analyst, a query generator that is arranged and configured to generate a query token using a constant provided by the data analyst such that the constant remains hidden from the data owner and an analysis engine that is arranged and configured to analyze the cipher text using the query token. 
     Implementations may include one or more of the following features. For example, the analysis engine may be arranged and configured to output one or more identity query tokens as a result of analyzing the cipher text, analyze the cipher text using the outputted identity query tokens and output additional identity query tokens. The data may include one or more tuples and the encryption generator encrypts the tuples using a secret key and a corresponding public security parameter such that the cipher text is unique for each of the tuples. The query generator may be arranged and configured to generate the query token by receiving the constant and a public security parameter from the data analyst such that the constant remains hidden from the data owner, receiving a secret key from the data owner such that the secret key remains hidden from the data analyst and outputting the query token to the data analyst. 
     In one exemplary implementation, the query generator may be arranged and configured to generate a set of range query tokens using constants provided by the data analyst such that the constants remain hidden from the data owner and the analysis engine is arranged and configured to analyze the cipher text using the set of range query tokens. The analysis engine may be further arranged and configured to output one or more identity query tokens as a result of analyzing the cipher text, analyze the cipher text using the outputted identity query tokens and output additional identity query tokens. 
     In another general aspect, a computer program product for performing data analytics on outsourced data may be tangibly embodied on a computer-readable medium and include executable code that, when executed, is configured to cause a data processing apparatus to encrypt data from a data owner, output a cipher text and communicate the cipher text to a data analyst such that the data remains hidden from the data analyst, generate a query token using a constant provided by the data analyst such that the constant remains hidden from the data owner and analyze the cipher text using the query token. 
     Implementations may include one or more of the following features. For example, the executable code that, when executed, may cause the data processing engine to output one or more identity query tokens as a result of analyzing the cipher text, analyze the cipher text using the outputted identity query tokens and output additional identity query tokens. 
     The computer program product may include executable code that, when executed, causes the data processing engine to generate the query token by receiving the constant and a public security parameter from the data analyst such that the constant remains hidden from the data owner, receiving a secret key from the data owner such that the secret key remains hidden from the data analyst and outputting the query token to the data analyst. 
     In one exemplary implementation, the computer program product may include executable code that, when executed, causes the data processing engine to generate a set of range query tokens using constants provided by the data analyst such that the constants remain hidden from the data owner and analyze the cipher text using the set of range query tokens. The computer program product may further include executable code that, when executed, causes the data processing engine to output one or more identity query tokens as a result of analyzing the cipher text, analyze the cipher text using the outputted identity query tokens and output additional identity query tokens. 
     The details of one or more implementations are set forth in the accompanying drawings and the description below. Other features will be apparent from the description and drawings, and from the claims. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is an exemplary block diagram for a searchable encryption system. 
         FIG. 2  is a flowchart illustrating example operations of the system of  FIG. 1 . 
         FIG. 3  is a swim lane diagram illustrating example operations of the system of  FIG. 1 . 
     
    
    
     DETAILED DESCRIPTION 
       FIG. 1  is an exemplary block diagram of a search encryption system  100 . The system  100  may include a key generator  102 , an encryption generator  104 , a data store  106 , a network  108 , a data store  110 , a query generator  112 , and an analysis engine  114 . The searchable encryption system  100  may be used to protect the data of multiple different parties such that the data of each respective party remains hidden from the other parties. At the same time, the system  100  enables the parties to interact with each other&#39;s data in a secure manner to accomplish their respective goals and/or tasks. For example, the system  100  enables a data owner to encrypt their data and send the data in encrypted form to a data analyst. The data analyst can then search the encrypted data such that the data remains hidden from the data analyst and at the same time keep their own search techniques and methodologies hidden from the data owner. In this manner, the data analyst can conduct a remote or outsourced financial audit using the data from the data owner without the data analyst having to physically go to the data owner&#39;s site to protect the security of the data. Since the data is encrypted, it remains secure during transmission from the data owner to the data analyst and it remains secure while being searched by the data analyst. 
     More specifically, in the context of a financial audit, the job of a financial auditor is to analyze a set of data (e.g., accounting documents) in order to establish that these documents are a fair representation of the business conducted by the data owner (e.g., the company being audited). In addition, a financial auditor may also be asked to look for indicators of fraud, waste and/or abuse. 
     From an abstract point of view, the auditor may query the accounting data and analyze the results. Even though a large amount of queries may be generated in the course of an audit, the final outcome of the audit can be as small as a few paragraphs in the company&#39;s annual report. For reporting purposes, a final report may detail the result and not the means or methods of how the results were obtained. In this context, the system  100  enables the goals of both parties to be met. 
     The key generator  102  may be arranged and configured to receive a security parameter, k, and a data definition, Γ, and to output a secret key, SK, and a public parameter, PP. In one exemplary implementation, the key generator  102  may choose primes p, q, and o, p=2q+1=4o+3, such that o&gt;τ, that the DDH problem is assumed to be infeasible in G* q  and that the DL problem is assumed to be infeasible in G* p . The key generator  102  may randomly select two secret keys x &lt; &gt;  and x =  from Z* q . The key generator  102  may further randomly select a group element g from Z* p  of order 2q (a generator of Z* p ). The public parameter PP is p and g. In this manner, the data owner may keep the secret key secret and may share the public parameter PP with others including the data analyst. 
     The key generator  102  may be implemented as software, hardware, or a combination of hardware and software. In one exemplary implementation, the key generator  102  may be implemented as a computer program product embodied on a tangible medium. 
     In the example context of the data owner and the data analyst, the key generator  102  may be a component that is controlled and operated by the data owner. In this manner, the data owner can generate the secret key and keep the key hidden from other parties since it is the secret key that will be used to encrypt the data owner&#39;s data. 
     The encryption generator  104  may be arranged and configured to use the secret key, SK, the public parameter, PP, to encrypt one or more rows of data, t, from data  106  and to output cipher text, C. In one exemplary implementation, the encryption generator  104  creates a ciphertext
 
β= c   2x     =    mod  q  
 
     For each dεD the encryption generator  104  may randomly select an element r in Z* q  and an element r′ in Z* p  and computes 
     
       
         
           
             γ 
             = 
             
               
                 d 
                 
                   2 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     x 
                     &lt;&gt; 
                   
                 
               
               ⁢ 
               mod 
               ⁢ 
               
                   
               
               ⁢ 
               q 
             
           
         
       
       
         
           
             e 
             = 
             
               
                 g 
                 
                   2 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   r 
                 
               
               ⁢ 
               mod 
               ⁢ 
               
                   
               
               ⁢ 
               p 
             
           
         
       
       
         
           
             
               e 
               ′ 
             
             = 
             
               { 
               
                 
                   
                     
                       
                         β 
                         2 
                       
                       ⁢ 
                       
                         g 
                         
                           2 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           ry 
                         
                       
                       ⁢ 
                       mod 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       p 
                     
                   
                   
                     
                       
                         if 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         c 
                       
                       &lt; 
                       d 
                     
                   
                 
                 
                   
                     
                       r 
                       ′ 
                     
                   
                   
                     otherwise 
                   
                 
               
             
           
         
       
     
     Let (e j ,e′ j ) be the encryption (e,e′) for d j εD as described above. Then, let C &lt; =(e 1 ,e′ 1 ), (e 2 ,e′ 2 ), . . . , (e τ ,e′ τ ) be the encryption for the entire “smaller-than” range query. The encryption generator  104  may choose a random permutation Π &gt;  of [1,τ]. Let C &lt;  be an element-wise permutation of the encryptions of C &lt;  according to Π &lt; . 
     Let Π be a fixed random permutation of Z* q  known to the data owner and analyst and Π(a) be the element at position a in the permutation. The encryption generator  104  may use, for example, a cryptographic hash function of equal bit length. The function does not have to be one-way or trap-door. Again, for each dεD the encryption generator  104  may randomly select an element r in Z* q  and an element r′ in Z* p  and compute 
     
       
         
           
             γ 
             = 
             
               
                 d 
                 
                   2 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     x 
                     &lt;&gt; 
                   
                 
               
               ⁢ 
               mod 
               ⁢ 
               
                   
               
               ⁢ 
               q 
             
           
         
       
       
         
           
             e 
             = 
             
               
                 g 
                 
                   2 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   r 
                 
               
               ⁢ 
               mod 
               ⁢ 
               
                   
               
               ⁢ 
               p 
             
           
         
       
       
         
           
             
               e 
               ′ 
             
             = 
             
               { 
               
                 
                   
                     
                       
                         
                           Π 
                           ⁡ 
                           
                             ( 
                             β 
                             ) 
                           
                         
                         2 
                       
                       ⁢ 
                       
                         g 
                         
                           2 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           ry 
                         
                       
                       ⁢ 
                       mod 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       p 
                     
                   
                   
                     
                       
                         if 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         c 
                       
                       &gt; 
                       d 
                     
                   
                 
                 
                   
                     
                       r 
                       ′ 
                     
                   
                   
                     otherwise 
                   
                 
               
             
           
         
       
     
     Let (e j ,e′ j ) be the encryption (e,e′) for d j εD, as described above. Then, let C &gt; =(e 1 ,e′ 1 ), (e 2 ,e′ 2 ), . . . , (e τ ,e′ τ ) be the encryption for the entire “greater-than” range query. The encryption generator  104  may choose another random permutation Π &gt;  of [1,τ]. Let C &gt;  be an element-wise permutation of the encryptions of C &gt;  according to this permutation Π &gt;  of the “greater-than” range queries. 
     For identity queries, the encryption generator  103  may randomly selects two elements r and r′ in Z* q  and computes
 
 e=g   2r  mod  p  
 
 e′=β   2   g   2rβ  mod  p  
 
     Let C = =(e,e′) be the encryption for the identity query. 
     The cipher text C for the entire tuple t is C=C &lt; , C &gt; , C = . 
     The encryption generator  104  may be implemented as software, hardware, or a combination of hardware and software. In one exemplary implementation, the encryption generator  104  may be implemented as a computer program product embodied on a tangible medium. 
     In the example context of the data owner and the data analyst, the encryption generator  104  may be a component that is controlled and operated by the data owner. In this manner, the data owner can generate the cipher text using the secret key and keep the key hidden from other parties since it is the secret key that needs to be used to decrypt the data owner&#39;s data. 
     The cipher text C may be communicated over the network  108  from the data owner to another party such as, for example, the data analyst. The cipher text may be stored in a data store  110  for future use by the analysis engine  114 . The network  108  may include any type of wired and/or wireless network. The network  108  may include a combination of networks including one or more local area networks (LANs) and/or wide area networks (WANs) including, for example, the Internet. Since the cipher text is an encrypted form of the data, the network itself does not necessarily need to be a secure network. The network  108  may be configured to support any type of protocols suitable for the communication of data including, for example, any type of Internet-related protocol. 
     The query generator  112  may be arranged and configured to generate a query token using a constant provided by the data analyst such that the constant remains hidden from the data owner. The query generator  112  may generate different types of query tokens including, for example, range query tokens and identity query tokens. The range query tokens may be used by the analysis engine  114  to conduct range searches on the cipher text. The identity query tokens may be used by the analysis engine  114  to conduct more specific searches on the cipher text. 
     The inputs to the query generator  112  include the secret key, SK, that is input by the data owner, a constant that is input by the data analyst and the public parameter, which may be input by either party. The query generator  112  is configured such that the secret key remains hidden from the data analyst and the constant remains hidden from the data owner. The output of the query generator  112  is a query token, which may be a range query token or an identity query token. The type of query token outputted by the query generator  112  may depend on the type of constant input by the data analyst. The output from the query generator  112  may be configured to go just to the data analyst and not to the data owner. The data analyst may use the output of the query generator  112  as input to the analysis engine  114 . 
     The query generator  112  may perform its operations to generate and output query tokens either prior to or after the encryption generator  104  has performed its operations on the data to generate the cipher text. The operation of the query generator  112  is not dependent on the operation or results of the encryption generator  104 . 
     In one exemplary implementation, the query generator  112  may output range query tokens. The process to generate range query tokens may be referred in this document as PrepareRangeQuery. The PrepareRangeQuery operation is an interactive, privacy-preserving protocol between the data owner, DO, and the data analyst, DA. The data analyst has as input to the query generator  112  a constant rc (we can drop the superscript i, since we assume one-dimensional tuples) that the DA wishes to use in a range query as upper or lower bound. The query generator  112  chooses a random element r in Z* q−1  such that r has a multiplicative inverse r −1  in Z* q−1 , i.e. rr −1  mod(q−1)=1, and the following is communicated over the network  112  to the data owner:
 
 DA→DO:rc   2r  mod  q  
 
     The data owner has as input to the query generator  112  the secret key SK and in particular x &lt; &gt; . The following is communicated to the data analyst over the network  112 :
 
 DO→DA :( rc   2r ) x     &lt; &gt;     =rc   2rx     &lt; &gt;    mod  q  
 
     The query generator  112  then computes for the data analyst:
 
 DA:RQ =( rc   2rx     &lt; &gt;   ) r     −1     =rc   2x     &lt; &gt;    mod  q  
 
     Note that the range query token RQ corresponds to the intermediate key γ in the encrypt operation performed by the encryption generator  104 . The data analyst outputs RQ; the data owner has no output. During the protocol, loosely speaking, the data analyst has learnt nothing about x &lt; &gt;  and the data owner has learnt nothing about rc. 
     In another exemplary implementation, the query generator  112  may generate and output identity query tokens. The PrepareIdentityQuery operation is the duplicate of PrepareRangeQuery for identity queries. The data analyst has as input a constant is he wishes to use in an identity query. The data owner has as input the secret key SK, in particular x = . The data analyst has as output an identity query token IQ and the data owner has no output. The data analyst chooses a random element r in Z* q−1 , such that r has a multiplicative inverse r −1  in Z* q−1 , i.e. rr −1  mod(q−1)=1 and the protocol proceeds as follows:
 
 DA→DO:rc   2r  mod  q  
 
 DO→DA :( rc   2r ) x     =     =rc   2rx     =    mod  q  
 
 DA:IQ =( rc   2rx     −   ) r     −1     =rc   2x     −    mod  q  
 
     The query generator  112  may be implemented as software, hardware, or a combination of hardware and software. In one exemplary implementation, the query generator  112  may be implemented as a computer program product embodied on a tangible medium. In one exemplary implementation, the query generator  112  may be divided into multiple components with one of the components accessible to the data owner and another of the components accessible to the data analyst. In this manner, the data owner and the data analyst may each access a portion of the query generator  112  to input their respective information. 
     The analysis engine  114  may be arranged and configured to analyze the cipher text using one or more of the query tokens. The analysis engine  114  enables the data analyst to conduct range query searches and identity query searches on the cipher text. In one exemplary implementation, the analysis engine  114  receives as input the query tokens outputted by the query generator  112 , the public parameter, and the cipher text. The analysis engine  114  searches the cipher text using the query tokens. The analysis engine  114  may be configured to output additional query tokens. 
     In one exemplary implementation, the analysis engine  114  is configured to receive range query tokens or identity query tokens and to output identity query tokens. The outputted identity query tokens may then be used as input to the analysis engine  114  such that additional searches may be performed on the cipher text using the outputted tokens. In this manner, the results of the analysis engine  114  may be used to conduct additional searches against the cipher text. At the same time, the search constants and the search methodologies of the data analyst remain protected as they are not decipherable by the data owner. 
     A query language may be defined to enable the data analyst to query the data in the form of the cipher text. Let t= d 1 , d 2 , . . . , d n    be a n-tuple (row) in the ledger data. Denote t.d i  the i-th data item of row t. In one exemplary implementation, a flattened, non-normalized form of the data may be considered, where all data tables have been condensed into one flat table. However, other forms of data may be used. Let c i  be any constant query string for t.d i . The grammar G for a query expression expr is as follows:
 
expr:=expr expr|expr expr| s expr
 
 s expr:= t.d   i    op c   i   |t.d   i    ops t′·d   i  
 
 op:=ops|&lt;|&gt; 
 
 ops:=== 
 
     This grammar implies range queries (c i &lt;t.d i   t.d i &lt;c i′ (c i &lt;c i′ )) and keyword searches (c i ==t.d i ). The expression expr t may be written if expr matches the record t. The footprint (RC, IC, FK) of an expression expr is its set RC of used constants in range queries, its set IC of used constants in identity queries and its set FK of used foreign fields or keys. For instance, the query expression t.d 1 &gt;2 t.d 1 &lt;6 t.d 2 ==4 t.d 3 ==t′·d 3  has the footprint ({2,6}, {4}, {t′·d 3 }). 
     The language includes an important feature of the encryption scheme: comparing for equality the data items of two tuples. If a query has returned a set of tuples, each data item in this tuple can be used in subsequent keyword searches without loss of privacy. This may be referred to as query result reusability. 
     The system  100  provides the advantage that the queries are not revealed to the encrypting party. Nevertheless the querying party can search for any range it chooses. Thus, the process to generate the query tokens by translating constants into the query tokens may be an interactive protocol, that does not reveal its inputs. The query token protocol for the querier is a privacy-preserving protocol that protects the constant from the encrypting party (and the secret key from the querier). The encryption scheme preserves the privacy of the query. 
     In one exemplary implementation, the data (e.g., tuple t) may be assumed to be one-dimensional and range queries expr:=c&gt;rc c&lt;rc′ or identity queries expr:=c==ic may be used to search against the cipher text. It must be ensured that the footprint of expr, i.e. the range query tokens RQ and RQ′ for rc and rc′ and the identity query token IQ for ic, is in the set RQ and IQ, respectively. 
     Let y=x 2  mod p be a quadratic residue modulo p. Then x′=y o+1  mod p is a square root of y and the other square root is x″=p−x′. Let *√{square root over (y)}=min(x′,x″) be the smaller square root. Note that *√{square root over (y)}≦q. 
     Recall that RQ=rc 2x     &lt; &gt;   . A range query expr proceeds as follows: Let C &lt; =(e 1 ,e′ 1 ), (e 2 ,e′ 2 ), . . . , (e τ ,e′ τ ) be the “smaller-than” range query part of C. For each (e i ,e′ i ) (with i=1, 2, . . . , τ) the analysis engine  114  computes 
     
       
         
           
             
               ζ 
               i 
             
             = 
             
               
                 
                   
                     e 
                     i 
                     ′ 
                   
                   
                     e 
                     i 
                     RQ 
                   
                 
                 ⋆ 
               
               ⁢ 
               mod 
               ⁢ 
               
                   
               
               ⁢ 
               p 
             
           
         
       
     
     Let C &gt; =(e 1 ,e′ 1 ), (e 2 ,e′ 2 ), . . . , (e τ ,e′ τ ) be the “greater-than” range query part of C. For each (e i ,e′ i ) (with i=1, 2, . . . , τ) the analysis engine  114  computes 
     
       
         
           
             
               η 
               i 
             
             = 
             
               
                 
                   
                     e 
                     i 
                     ′ 
                   
                   
                     e 
                     i 
                     
                       RQ 
                       ′ 
                     
                   
                 
                 ⋆ 
               
               ⁢ 
               mod 
               ⁢ 
               
                   
               
               ⁢ 
               p 
             
           
         
       
     
     Recall that Π is a fixed random permutation of Z* q . If Π(ζ i )=η j  for any i,jε[1,τ], then the data analyst concludes that expr matches t. 
     An identity query expr:=c==ic proceeds as follows: Recall that IQ=ic 2x     =   . Let C − =(e,e′) be the encryption for the identity query. The analysis engine  114  computes 
     
       
         
           
             θ 
             = 
             
               
                 
                   
                     e 
                     ′ 
                   
                   
                     e 
                     IQ 
                   
                 
                 ⋆ 
               
               ⁢ 
               mod 
               ⁢ 
               
                   
               
               ⁢ 
               p 
             
           
         
       
     
     If θ=IQ, then the data analyst concludes that expr matches t. 
     The system  100  supports multi-dimensional database tuples of the form t= c 1 , c 2 , . . . , c n   . In the Setup(k, Γ) operation, the data owner chooses n pairs of secret keys x 1   &lt; &gt; , x 1   = , x 2   &lt; &gt; , x 2   = , . . . , x″ &lt; &gt; , x″ = . In the Encrypt(SK, t) operation the encryption generator  104  encrypts each c i  with each secret key x j   =  creating
 
β i,j =( c   i ) 2x     j       =    mod  q  
 
     The encryption generator  104  then creates intermediate ciphertexts C &lt; , C &gt; , and C =  for each β i,j  (under each domain element d i εD i ). The resulting ciphertext has size O(Dn 2 ) and the secret key has size O(n). 
     The analysis engine  114  in the Analyze(PP, C, RQ, IQ, expr) operation may use as input a query token for a specific element c i  of the tuple. The goal may be to obtain an identity query token for element t.d j . The data analyst then selects the cipher text part C &lt;,&gt;,=  that encrypts β i,j  (under the domain elements d i εD i ) and applies the described algorithm. 
     The procedure described above allows the data analyst to link every element with every other element. The data analyst can obtain an identity query token for any column by searching for elements in any other column. Not every database structure requires this, e.g. the following database relations
 
 d   1     d   2   d   3    d   3     d   4   d   5  
 
     do not require the full search capability. Instead, it can be sufficient to be able to search for triples (d 1 ,d 2 ,d 3 ) and (d 3 ,d 4 , d 5 ). The data owner can restrict the data analyst to a subset of possible searches by selectively not encrypting all β i,j . In the example, all pairs that are not contained in any triple (e.g. (d 1 ,d 4 ) and (d 4 ,d 1 )) can be left out of the ciphertext. Obviously, this choice has to be communicated to the data analyst, such that he can make the right selection in the cipher text. 
     The system  100  supports the full grammar G and not only simple range or identity queries. The data analyst first breaks the query into simple queries of the form described connected by the binary operators   or  . The data analyst may use the query generator  112  to obtain range query tokens for virtual lowest −∞ and upmost elements ∞ to augment range queries of the form t.d i &lt;c i  or t.d i &gt;c i  with t.d i &gt;−∞ or t.d i &lt;∞, respectively, that cannot be combined otherwise. In a first step, the data analyst then executes all simple range queries obtaining a result set Ω j  for each simple query expression expr j . 
     As a second step, the data analyst combines the sets: For two query expressions expr and expr′ connected by a   operation and the analysis engine  114  computes the combined result set Ω =Ω∩Ω′. For two query expressions expr and expr′ connected by a   operation he computes the combined result set Ω =Ω∪Ω′. The final result set Ω* that combines all query expressions is the result of the complex query. 
     The query language may be used for expressing some of the most common queries in fraud auditing. For example, a very common fraud pattern is employees misappropriating company funds by creating fake invoices and getting these invoices paid to themselves. In order to lower the risk of being caught, fraudsters commonly use two techniques. First, the amount of the fake invoice is kept just under the threshold above which an explicit approval from a manager would be required. In addition, fraudsters often create invoices for types of supplies that do not require a Goods Receipt (GR) document. This document is produced when physical goods are delivered to the company, and is required as a proof of delivery for triggering the payment of the invoice. However, for immaterial supplies such as services, no GR is produced, which weakens the invoice verification process. Assuming the threshold is $10,000 and amount is the field representing an invoice amount in a table row t of invoices paid by the company, the query could be:
 
 t .amount&gt;9500   t .amount&lt;10000   t .GRRequired==false
 
     The above expression may be expressed informally as “give me all invoices with an amount $500 below the threshold and for which no Goods Receipt document is required”. 
     A variation on the fraud pattern above is for a fraudster to create a fake storefront supplier and issue invoices for payment into an arbitrary bank account. Cases are documented where the fraudster used the same bank account as the one the company pays his salary into. If we assume a field invoiceBankAccount in a table row t of invoices and a field employeeBankAccount in a table row t′ of employees, the query for the suspicious employee would be:
 
 t .employeeBankAccount== t ′.invoiceBankAccount
 
     The above are just a couple of examples of queries that may be used to search the cipher text keeping the constants and the data secret. 
     Referring to  FIG. 2 , an exemplary process  200  illustrates example operations of the system  100  of  FIG. 1 . Process  200  may include receiving, at a data analyst, cipher text representing data from a data owner such that the data remains hidden from the data analyst ( 210 ), generating a query token using a constant provided by the data analyst such that the constant remains hidden from the data owner ( 220 ) and analyzing the cipher text using the query token ( 230 ). Process  200  may include outputting one or more identity query tokens as a result of analyzing the cipher text ( 240 ), which then may be used to analyze the cipher text. 
     For example, the encryption generator  104  may be configured to generate the cipher text and to send the cipher text over the network  108  to the data store  110  and/or directly to the analysis engine  114  for use by the data analyst. The data owner&#39;s data is encrypted by the encryption generator  104  using the secret key generated by the key generator  102 , where the secret key is kept secret by the data owner such that it is not revealed to the data analyst. 
     The query generator  112  may be configured to generate one or more query tokens using the constant provided by the data analyst such that the constant remains hidden from the data owner ( 220 ). In one exemplary implementation, generating the query token may be an interactive protocol between the data owner and the data analyst such that the data owner is providing an input of the secret key to the query generator  112  and the data analyst is inputting the constant and the public parameter. 
     The query tokens that are output from the query generator  112  may be used as input to the analysis engine  114  to analyze the cipher text ( 230 ). The analysis engine  114  enables the data analyst to search the cipher text using different types of query tokens and different types of searches to carry out, for example, a financial audit or other type of data analysis for the data owner without revealing any search methodologies. 
     Referring to  FIG. 3 , an exemplary swim lane diagram  300  illustrates example operations of the system  100  of  FIG. 1 . The diagram  300  illustrates various operations as they may be performed by the data owner and/or the data analyst. For example, the data owner may have data that the desire to have analyzed remotely by a data analyst. To protect the integrity and secrecy of the data, the data owner may generate a secret key ( 310 ) and use the secret key to encrypt the data ( 320 ). As discussed above with respect to  FIG. 1 , the data may be in many different forms and types. The result of encrypting the data ( 320 ) is cipher text. The data owner may communicate the cipher text to the data analyst ( 330 ) knowing that the data is secure because the data owner retains the secret key that was used to encrypt the data. 
     The data analyst receives the cipher text ( 340 ) and may store the cipher text in a database such that it may be searched at a later time. The data analyst and the data owner may interactively generate the query tokens ( 350 ). As discussed above, the query generator  112  may include a component on the data analyst side and a component on the data owner side. In one exemplary implementation, each of the component may be computer program products, which include instructions that, when executed, cause a data processing apparatus to perform the processing of the query generator  112 . 
     The data analyst may input a constant to the query generator  112  that the data analyst wishes to use in a query to search the cipher text. The query generator  112  may generate a result to hide the constant and the resulting information from the query generator  112  may be sent to the data owner. The data owner may input the secret key to the query generator  112  and the result is sent to the data analyst to input into the query generator  112  to get the query token. 
     The data analyst may analyze the data ( 360 ) by using the query tokens to search the cipher text. The results of the analyze operation produces additional query tokens ( 370 ), which may be used to conduct additional searches for further data analysis. 
     In this manner, the data owner is able to send sensitive data in a secure format to a data analyst so that the data analyst can perform remote searches of the data using constants selected by the data analysts knowing that the constants will remain hidden from the data owner. This enables data analysis to be outsourced remotely in secure ways for both parties in a manner that was not previously possible. 
     Implementations of the various techniques described herein may be implemented in digital electronic circuitry, or in computer hardware, firmware, software, or in combinations of them. Implementations may be implemented as a computer program product, i.e., a computer program tangibly embodied in an information carrier, e.g., in a machine-readable storage device, for execution by, or to control the operation of, data processing apparatus, e.g., a programmable processor, a computer, or multiple computers. A computer program, such as the computer program(s) described above, can be written in any form of programming language, including compiled or interpreted languages, and can be deployed in any form, including as a stand-alone program or as a module, component, subroutine, or other unit suitable for use in a computing environment. A computer program can be deployed to be executed on one computer or on multiple computers at one site or distributed across multiple sites and interconnected by a communication network. 
     Method steps may be performed by one or more programmable processors executing a computer program to perform functions by operating on input data and generating output. Method steps also may be performed by, and an apparatus may be implemented as, special purpose logic circuitry, e.g., an FPGA (field programmable gate array) or an ASIC (application-specific integrated circuit). 
     Processors suitable for the execution of a computer program include, by way of example, both general and special purpose microprocessors, and any one or more processors of any kind of digital computer. Generally, a processor will receive instructions and data from a read-only memory or a random access memory or both. Elements of a computer may include at least one processor for executing instructions and one or more memory devices for storing instructions and data. Generally, a computer also may include, or be operatively coupled to receive data from or transfer data to, or both, one or more mass storage devices for storing data, e.g., magnetic, magneto-optical disks, or optical disks. Information carriers suitable for embodying computer program instructions and data include all forms of non-volatile memory, including by way of example semiconductor memory devices, e.g., EPROM, EEPROM, and flash memory devices; magnetic disks, e.g., internal hard disks or removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks. The processor and the memory may be supplemented by, or incorporated in special purpose logic circuitry. 
     To provide for interaction with a user, implementations may be implemented on a computer having a display device, e.g., a cathode ray tube (CRT) or liquid crystal display (LCD) monitor, for displaying information to the user and a keyboard and a pointing device, e.g., a mouse or a trackball, by which the user can provide input to the computer. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback, e.g., visual feedback, auditory feedback, or tactile feedback; and input from the user can be received in any form, including acoustic, speech, or tactile input. 
     Implementations may be implemented in a computing system that includes a back-end component, e.g., as a data server, or that includes a middleware component, e.g., an application server, or that includes a front-end component, e.g., a client computer having a graphical user interface or a Web browser through which a user can interact with an implementation, or any combination of such back-end, middleware, or front-end components. Components may be interconnected by any form or medium of digital data communication, e.g., a communication network. Examples of communication networks include a local area network (LAN) and a wide area network (WAN), e.g., the Internet. 
     While certain features of the described implementations have been illustrated as described herein, many modifications, substitutions, changes and equivalents will now occur to those skilled in the art. It is, therefore, to be understood that the appended claims are intended to cover all such modifications and changes as fall within the scope of the embodiments.