Order preserving encryption for numeric data

Rakesh AgrawalJerry KiernanRamakrishnan SrikantYirong Xu

article2004SIGMOD1,453 citations

Proposes an order-preserving encryption scheme for numeric data that enables standard database indexing and exact comparison query execution directly over ciphertexts without producing false positives or requiring decryption.

Listen

Modern database systems face significant security risks when unauthorized entities gain direct access to raw storage media, bypassing standard software access controls. While conventional encryption safeguards data at rest, it renders standard comparison and range queries impossible without decrypting the data first or performing slow, full-table scans. The article addresses this operational bottleneck by designing an Order Preserving Encryption Scheme (OPES) for numeric data. The primary objective is to demonstrate a robust encryption scheme that allows direct comparison, sorting, and indexing on encrypted numeric data without producing false query results or requiring whole-table re-encryptions during updates.

The authors evaluate OPES by implementing the method in a commercial database system (IBM DB2) and testing it against synthetic and real-world census datasets ranging up to 10 million records. OPES transforms original numeric values into encrypted values following a chosen target distribution across three key stages: modeling data using piece-wise linear splines, flattening the input distribution into a uniform space, and mapping the flattened values into the target distribution. The approach assumes a threat model where storage media is compromised, the database software itself remains trusted, and an adversary lacks prior knowledge of original data distributions.

Key findings confirm that OPES successfully conceals the original data distribution while preserving exact ordering. Statistical testing (Kolmogorov-Smirnov tests at a 5% significance level) demonstrated that the encrypted values are statistically indistinguishable from the specified target distribution. Furthermore, transforming data to a distinct target distribution altered the percentile rank of values significantly (e.g., shifting census data points by an average of 37 percentile points), effectively mitigating the risk of estimation exposure. The scheme handled full dataset replacements seamlessly without degrading output distribution quality. Performance testing revealed minimal operational overhead: building the model required less than 4 minutes for 1 million records, insertion overhead was negligible, decryption required only about 3 microseconds per tuple, and query retrieval overhead ranged from 3% for point lookups to roughly 50% for large batch retrievals of 1 million rows.

These findings demonstrate that organizations can protect sensitive stored data against physical theft or unauthorized file access without sacrificing the query performance provided by B-tree indexes. Unlike existing alternatives that yield false matches and require costly post-processing filtering, OPES produces exact query answers directly. While standard comparison predicates execute efficiently over encrypted columns, operations such as calculating sums or averages still require data decryption.

Organizations handling sensitive numeric data should consider order-preserving encryption when designing secure database architectures. Before full deployment, decision-makers should evaluate application-specific query patterns to determine if decryption costs for aggregate operations are acceptable, and ensure proper key management policies protect auxiliary encryption structures. The authors recommend extending future research to cover non-numeric data, such as variable-length strings, as well as optimizing database query plans for encrypted environments.

The conclusions of the article carry high empirical confidence for numeric domains within the evaluated threat model. However, readers should note that the security guarantees rely on the adversary having ciphertext access only without prior knowledge of the underlying data distribution; in scenarios where an adversary possesses domain insights or can perform chosen-plaintext attacks, additional safeguards are required.

IBM data encryption encrypted data query results order-preserving encryption numeric data privacy homomorphism

Agrawal et al (2004).pdf

Paper: Protecting Respondents' Identities in Microdata Release, Pierangela Samarati (2001). Establishes foundational concepts in privacy-preserving data release and quantification of disclosure risk that motivate secure database querying.

Paper: CryptoNets: Applying Neural Networks to Encrypted Data with High Throughput and Accuracy, Nathan Dowlin et al. (2016). Advances the paradigm of computing directly over encrypted data from relational comparison operations to complex neural network inference.

Cover for Order preserving encryption for numeric data

Abstract

Encryption is a well established technology for protecting sensitive data. However, once encrypted, data can no longer be easily queried aside from exact matches. We present an order-preserving encryption scheme for numeric data that allows any comparison operation to be directly applied on encrypted data. Query results produced are sound (no false hits) and complete (no false drops). Our scheme handles updates gracefully and new values can be added without requiring changes in the encryption of other values. It allows standard database indexes to be built over encrypted tables and can easily be integrated with existing database systems. The proposed scheme has been designed to be deployed in application environments in which the intruder can get access to the encrypted database, but does not have prior domain information such as the distribution of values and cannot encrypt or decrypt arbitrary values of his choice. The encryption is robust against estimation of the true value in such environments.

Topics

data encryption encrypted data query results sensitive informations

Keywords

order-preserving encryption numeric data privacy homomorphism range queries plaintext distribution incremental updatability minimal perfect hash functions database systems

1. INTRODUCTION
1.1 Estimation Exposure
1.2 Threat Model
1.3 Pedagogical Assumptions and Notations
1.4 Paper Layout
2. RELATED WORK
3. PROPOSED ORDER-PRESERVING ENCRYPTION SCHEME
3.1 Intuition
3.2 Overview of OPES
4. MODELING THE DISTRIBUTIONS
4.1 Bucket Boundaries
4.2 Growth Phase
4.3 Prune Phase
4.3.1 DataCost
4.3.2 IncrModelCost
5. FLATTEN
5.1 Mapping Function
5.2 Scale Factor
5.3 Encryption Key
5.4 Mapping a Plaintext Value into a Flat Value
5.5 Mapping a Flat Value into a Plaintext Value
6. TRANSFORM
6.1 Scaling the Target Distribution
6.2 Mapping Function
6.3 Mapping Flat Values to Cipher Values
6.4 Space Overhead
7. EXTENSIONS
7.1 Real Values
7.2 Duplicates
8. EVALUATION
8.1 Experimental Setup
8.2 Datasets
8.3 Distribution of Encrypted Values
8.4 Percentile Exposure
8.5 Incremental Updatability
8.6 Key Size
8.7 Time Overhead
9. SUMMARY
10. REFERENCES

Knowls

Knowl 1 — OPES Architecture and Three-Stage Framework
model/method
The Order Preserving Encryption Scheme (OPES) transforms numeric plaintext data into ciphertext such that order is strictly preserved, allowing equality predicates, range queries, comparison-based aggregations (MIN, MAX, COUNT), and ordering operators (ORDER BY, GROUP BY) to be evaluated directly on ciphertext without decrypting operands or generating false positives or false drops.

OPES executes in three successive stages:
1. Model Stage: The plaintext distribution $P = \{p_1, p_2, \dots, p_{|P|}\}$ over domain $[p_{\min}, p_{\max})$ and a user-specified target distribution are each partitioned into buckets and approximated as continuous piece-wise linear splines.
2. Flatten Stage: The plaintext database $P$ is mapped into an intermediate database $F$ over domain $[f_{\min}, f_{\max})$ such that the values in $F$ are uniformly distributed.
3. Transform Stage: The flat intermediate database $F$ is mapped into the ciphertext database $C$ over domain $[c_{\min}, c_{\max})$ such that the encrypted values follow the target distribution.
The end-to-end transformation strictly preserves ordering: $p_i < p_j \iff f_i < f_j \iff c_i < c_j$

The mapping parameters generated during initial database encryption form the secret encryption key $K = (K^f, K^c)$ , where $K^f$ maps between plaintext and flat values, and $K^c$ maps between flat and ciphertext values. The key $K$ remains static during subsequent data modifications, allowing new values to be inserted incrementally without re-encrypting existing data.
Knowl 2 — Estimation Exposure Metric and Threat Model for Order-Preserving Encryption
definition
In order-preserving encryption for numeric domains, security is evaluated against an adversary who has access only to ciphertext on vulnerable persistent storage while database management software execution memory is trusted (a ciphertext-only attack).

For a numeric plaintext domain $P$ with width $\text{domain-width}(P) = p_{\max} - p_{\min}$ , if an adversary can estimate with $c\%$ confidence that the plaintext value $p$ corresponding to a ciphertext value $c$ lies within an interval $[p_1, p_2]$ , the estimation exposure at $c\%$ confidence level is defined as: $\text{Exposure}_c = \frac{p_2 - p_1}{\text{domain-width}(P)}$

Smaller interval widths indicate greater exposure, whereas wider intervals indicate robustness against value estimation.
Knowl 3 — Piece-Wise Linear Distribution Modeling via Minimum Description Length
algorithm
OPES models continuous numeric distributions by partitioning the domain into variable-width buckets $[p_l, p_h)$ and modeling intra-bucket density as a linear spline connecting endpoint densities. Bucket boundaries are determined through a top-down recursive growth phase followed by a bottom-up Minimum Description Length (MDL) prune phase.
Input: Sorted distinct data points $P = \{p_1, \dots, p_N\}$ , minimum bucket size threshold $\tau = 10$
Output: Partitioned bucket tree with spline boundaries
function GrowthPhase(bucket $[p_l, p_h)$ containing points $\{p_{l+1}, \dots, p_{h-1}\}$ ):
    if $(h - l - 1) < \tau$ :
        return LeafBucket( $[p_l, p_h)$ )
    Fit linear spline $q p + r$ over $[p_l, p_h)$
    for each point $p_s \in \{p_{l+1}, \dots, p_{h-1}\}$ :
        Compute expected value $E(p_s)$ under linear spline density
        Deviation $\Delta(p_s) = |p_s - E(p_s)|$
    Find point $p_s$ that maximizes $\Delta(p_s)$
    left_child = GrowthPhase( $[p_l, p_s)$ )
    right_child = GrowthPhase( $[p_s, p_h)$ )
    return Node( $[p_l, p_h)$ , split_point= $p_s$ , left_child, right_child)
function PrunePhase(node):
    if node is leaf:
        return node
    node.left_child = PrunePhase(node.left_child)
    node.right_child = PrunePhase(node.right_child)
     $LB = \text{DataCost}(node) - \text{DataCost}(node.left) - \text{DataCost}(node.right) - \text{IncrModelCost}$
     $GB = LB + GB(node.left) + GB(node.right)$
    if $GB \le 0$ :
        Merge node.left_child and node.right_child into single LeafBucket(node.interval)
    return node
The prune phase runs bottom-up in $O(N)$ time over the generated splits, ensuring that the number of buckets minimizes the sum of model description cost and data deviation cost.
Knowl 4 — MDL Data Cost and Incremental Model Cost Formulation
equation
In the prune phase of distribution modeling, the MDL objective balances the cost of encoding deviations of flattened data points from uniformity against the cost of storing additional bucket parameters.

For a bucket $[p_l, p_h)$ whose plaintext points are mapped to flat coordinates $\{f_{l+1}, \dots, f_{h-1}\}$ via mapping function $M$ , the data encoding cost is: $\text{DataCost}(p_l, p_h) = \sum_{i=l+1}^{h-1} \log |f_i - E(i)|$ where $E(i)$ is the expected position of the $i$ -th point under an ideal uniform distribution: $E(i) = f_l + \frac{i - l}{h - l} (f_h - f_l)$

Assuming 32-bit representations for each bucket boundary, quadratic coefficient $s$ , and scale factor $z$ , partitioning a bucket into two introduces one boundary, one quadratic coefficient, and one scale factor. The incremental model cost is: $\text{IncrModelCost} = 32 \times 3 = 96 \text{ bits}$

The local benefit $LB$ and recursive global benefit $GB$ of splitting bucket $[p_l, p_h)$ at split point $p_s$ are: $LB(p_l, p_h) = \text{DataCost}(p_l, p_h) - \text{DataCost}(p_l, p_s) - \text{DataCost}(p_s, p_h) - \text{IncrModelCost}$ $GB(p_l, p_h) = LB(p_l, p_h) + GB(p_l, p_s) + GB(p_s, p_h)$
Knowl 5 — Flattening Mapping Function and Scale Factor Computation
equation
For a bucket $[0, w)$ with linear density $q p + r$ , the intra-bucket mapping function $M(p)$ transforming values into a uniform distribution is quadratic: $M(p) = z \left( s p^2 + p \right)$ where $s = \frac{q}{2r}$ is the quadratic coefficient and $z > 0$ is the scale factor.

To ensure that two adjacent integer plaintext values remain separated by at least 2 in the flattened space ( $M(p+1) - M(p) \ge 2$ for all $p \in [0, w)$ ) for floating-point error tolerance and updatability, the minimum scale factor is: $\hat{z} = \begin{cases} 2 & \text{if } s \ge 0 \\ \frac{2}{1 + s(2w - 1)} & \text{if } s < 0 \end{cases}$

To achieve inter-bucket uniformity, each flattened bucket width $w^f = M(w) = z(s w^2 + w)$ must be proportional to the number of points $n$ in that bucket ( $w^f = K n$ ). With minimum width $\hat{w}^f = \hat{z}(s w^2 + w)$ , the global constant $K$ across all $m$ buckets is: $K = \max_{i=1, \dots, m} \left\lceil \frac{\hat{w}^f_i}{n_i} \right\rceil$ and the scale factor assigned to bucket $i$ is: $z_i = \frac{K n_i}{s_i w_i^2 + w_i}$
Knowl 6 — Plaintext-to-Flat Mapping and Inversion Equations
equation
Let domain $P = [p_{\min}, p_{\max})$ be partitioned into $m$ buckets $\{B_1, \dots, B_m\}$ with widths $w_j$ and flattened widths $w^f_j = M_j(w_j)$ .

A plaintext value $p \in B_i$ is mapped to a flat value $f \in [f_{\min}, f_{\max})$ by: $f = f_{\min} + \sum_{j=1}^{i-1} w^f_j + M_i\left(p - p_{\min} - \sum_{j=1}^{i-1} w_j\right)$ where $M_i(x) = z_i(s_i x^2 + x)$ .

Given a flat value $f \in B^f_i$ , the corresponding plaintext value $p$ is recovered by: $p = p_{\min} + \sum_{j=1}^{i-1} w_j + M_i^{-1}\left(f - f_{\min} - \sum_{j=1}^{i-1} w^f_j\right)$ where the inversion function is: $M_i^{-1}(y) = \frac{-z_i \pm \sqrt{z_i^2 + 4 z_i s_i y}}{2 z_i s_i}$

When $|s_i y|$ is small relative to $|z_i|$ , numerical loss of precision in floating-point arithmetic is avoided by using the alternative formulation: $M_i^{-1}(y) = \frac{-2y}{-z_i \mp \sqrt{z_i^2 + 4 z_i s_i y}}$

Floating-point results are rounded to the nearest integer. If $M_i^{-1}(f)$ evaluates to $p - 1$ , $p$ is stored as $f + 1$ ; if it evaluates to $p + 1$ , $p$ is stored as $f - 1$ , exploiting the guaranteed spacing of at least 2 between mapped adjacent integers.
Knowl 7 — Target Distribution Scaling and Transformation to Ciphertext
model/method
The transform stage maps uniformly distributed flattened values $F$ into ciphertext values $C$ following a target distribution modeled with $k$ buckets $\{B^t_1, \dots, B^t_k\}$ of widths $w^t_i$ , quadratic coefficients $s^t_i$ , and scale factors $z^t_i$ .
1. Target scale factors $z^t_i$ ensure that adjacent flat values map to distinct target values: $\hat{z}^t_i = \begin{cases} \frac{0.5}{1 + s^t_i(2 w^t_i - 1)} & \text{if } s^t_i > 0 \\ 0.5 & \text{if } s^t_i \le 0 \end{cases}, \quad K^t = \min_{j=1,\dots,k} \left\lfloor \frac{\hat{z}^t_j (s^t_j (w^t_j)^2 + w^t_j)}{n^t_j} \right\rfloor, \quad z^t_i = \frac{K^t n^t_i}{s^t_i (w^t_i)^2 + w^t_i}$
2. The matching factor $L$ scales the target flat domain to equal the plaintext flat domain: $L = \frac{\sum_{i=1}^m w^f_i}{\sum_{i=1}^k \hat{w}^f_i}$ where $\hat{w}^f_i = z^t_i(s^t_i (w^t_i)^2 + w^t_i)$ .
3. Scaled cipher bucket parameters are defined as $w^c_i = L w^t_i$ , $\bar{w}^f_i = L \hat{w}^f_i$ , $s^c_i = s^t_i / L$ , and $z^c_i = z^t_i$ .
4. A flat value $f \in \bar{B}^f_i$ is mapped to a cipher value $c \in B^c_i$ via: $c = c_{\min} + \sum_{j=1}^{i-1} w^c_j + (M^c_i)^{-1}\left(f - f_{\min} - \sum_{j=1}^{i-1} \bar{w}^f_j\right)$ and a cipher value $c \in B^c_i$ is mapped back to flat value $f$ via: $f = f_{\min} + \sum_{j=1}^{i-1} \bar{w}^f_j + M^c_i\left(c - c_{\min} - \sum_{j=1}^{i-1} w^c_j\right)$
Knowl 8 — Floating-Point Encoding and Homophonic Duplicate Handling
model/method
OPES provides extensions to support floating-point numbers and datasets with high duplicate frequencies:
- Real (Floating-Point) Numbers: Positive 32-bit (or 64-bit) IEEE 754 floating-point numbers maintain their natural order when interpreted directly as unsigned integers. Negative floating-point values have an inverted order when interpreted as integers; this is corrected by subtracting negative values from the minimum negative integer ( $-2^{31}$ for 32-bit floats, $-2^{63}$ for 64-bit doubles) during query rewriting prior to encryption, and reversing the offset during result decryption.
- Duplicate Values: To prevent frequency analysis on small domains or skewed duplicates, a homophonic mapping is applied during the flatten stage. Bucket point counts $n_i$ include duplicate frequencies during scale factor computation. If integer $p$ maps to $f$ and $p + 1$ maps to $f'$ , an instance of $p$ is encrypted by randomly selecting an integer uniformly from the half-open interval $[f, f')$ . Equality queries on encrypted data are rewritten into range queries covering $[f, f')$ , concealing duplicate spikes while maintaining uniform intermediate density.
Knowl 9 — Ciphertext Domain Space Expansion Bound
theoretical result
Let $g_{p\min}$ and $g_{p\max}$ be the minimum and maximum gaps between consecutive sorted values in the plaintext domain $P$ , and let $g_{t\min}$ and $g_{t\max}$ be the minimum and maximum gaps in the target distribution. Define the plaintext gap ratio $G_p = \frac{g_{p\max}}{g_{p\min}}$ and the target gap ratio $G_t = \frac{g_{t\max}}{g_{t\min}}$ .

The span of the ciphertext domain $[c_{\min}, c_{\max})$ is bounded by: $c_{\max} - c_{\min} \le G_p \cdot G_t \cdot (p_{\max} - p_{\min})$

The worst-case additional storage overhead in bits for representing an encrypted value is: $\Delta \text{bits} \approx \log_2 G_p + \log_2 G_t$

Because $G_t$ is controlled by the user's choice of target distribution and $G_p \cdot G_t \ll 2^{32}$ in typical distributions, the ciphertext requires at most 4 additional bytes over the plaintext representation (e.g., 64-bit integers for 32-bit plaintexts).

Knowl 10 — Empirical Indistinguishability, Key Compactness, and Percentile Shift

empirical result

OPES was evaluated on DB2 Version 7 using 32-bit integer datasets (10K to 10M synthetic Gaussian, Zipf, and Uniform records, plus a 30,000-record US Census PUMS income dataset) encrypted to 64-bit ciphertext values.

Distribution Indistinguishability: The Kolmogorov-Smirnov test at a 5% significance level failed to disprove the null hypothesis across all dataset sizes and target distributions, proving OPES output is statistically indistinguishable from the chosen target distribution and flattened distributions are indistinguishable from uniform.
Percentile Movement: Transforming distributions produced substantial percentile shifts, masking input characteristics:

Input Distribution	Target Distribution	Average Percentile Shift (%)
Census	Gaussian	37
Census	Zipf	7
Census	Uniform	38
Gaussian	Zipf	45
Gaussian	Uniform	17
Zipf	Uniform	44

Efficiency and Key Size: Across all datasets up to 10M records, the MDL model required fewer than 200 buckets ( $< 2$ KB key size; $< 10$ buckets for Uniform). Model construction took less than 4 minutes for 1M records, insert overhead was negligible, and per-tuple decryption required approximately 3 microseconds.

Coverage note — Deliberately omitted prior-work comparisons (such as random number summation and bucketization baselines) and general DB2 query rewrite mechanics as they represent standard integration or context rather than novel OPES contributions.

References

1.R. Agrawal, J. Kiernan, R. Srikant, and Y. Xu. Hippocratic databases. In Proc. of the 28th Int'l Conference on Very Large Databases, Hong Kong, China, August 2002.
2.N. Ahituv, Y. Lapid, and S. Neumann. Processing encrypted data. Communications of the ACM, 30(9):777–780, 1987.
3.G. Bebek. Anti-tamper database research: Inference control techniques. Technical Report EECS 433 Final Report, Case Western Reserve University, November 2002.
4.L. Bouganim and P. Pucheral. Chip-secured data access: Confidential data on untrusted servers. In 28th Int'l Conference on Very Large Databases, pages 131–142, Hong Kong, China, August 2002.
5.Z. J. Czech, G. Havas, and B. S. Majewski. An optimal algorithm for generating minimal perfect hash functions. Information Processing Letters, 43(5):257–264, 1992.
6.E. Damiani, S. D. C. di Vimercati, S. Jajodia, S. Paraboschi, and P. Samarati. Balancing confidentiality and efficiency in untrusted relational dbmss. In Proc. of the 10th ACM Conf. on Computer and Communications Security (CCS), October 2003.
7.D. Denning. Cryptography and Data Security. Addison-Wesley, 1982.
8.J. Domingo-Ferrer and J. Herrera-Joancomarti. A privacy homomorphism allowing field operations on encrypted data. I Jornades de Matematica Discreta i Algorismica, Universitat Politecnica de Catalunya, March 1998.
9.J. Domingo i Ferror. A new privacy homomorphism and applications. Information Processing Letters, 60(5):277–282, 1996.
10.J. Feigenbaum, M. Y. Liberman, and R. N. Wright. Cryptographic protection of databases and software. In Proc. of the DIMACS Workshop on Distributed Computing and Cryptography, 1990.
11.E. A. Fox, Q. F. Chen, A. M. Daoud, and L. S. Heath. Order-preserving minimal perfect hash functions and information retrieval. ACM Transactions on Information Systems (TOIS), 9:281–308, 1991.
12.S. C. Gultekin Ozsoyoglu, David Singer. Anti-tamper databases: Querying encrypted databases. In Proc. of the 17th Annual IFIP WG 11.3 Working Conference on Database and Applications Security, Estes Park, Colorado, August 2003.
13.H. Hacigümüs, B. R. Iyer, C. Li, and S. Mehrotra. Executing SQL over encrypted data in the database-service-provider model. In Proc. of the ACM SIGMOD Conf. on Management of Data, Madison, Wisconsin, June 2002.
14.T. Hamilton. Error sends bank files to eBay. The Toronto Star, September 15, 2003.
15.Y. E. Ioannidis. The history of histograms (abridged). In Proc. of 29th Int'l Conf. on Very Large Data Bases (VLDB), Berlin, Germany, September 2003.
16.A. Konig and G. Weikum. Combining histograms and parametric curve fitting for feedback-driven query result-size estimation. In Proc. of the 25th Int'l Conference on Very Large Databases, Edinburgh, Scotland, 1999.
17.M. Mehta, R. Agrawal, and J. Rissanen. SLIQ: A fast scalable classifier for data mining. In Proc. of the Fifth Int'l Conference on Extending Database Technology (EDBT), Avignon, France, March 1996.
18.Oracle Corporation. Database Encryption in Oracle 8i, August 2000.
19.W. H. Press, S. A. Teukolsky, W. T. Vetterling, and B. P. Flannery. Numerical Recipes in C: The Art of Scientific Computing. Cambridge University Press, second edition, 1992.
20.J. Rissanen. Stochastic Complexity in Statistical Inquiry. World Scientific Publ. Co., 1989.
21.R. L. Rivest, L. Adelman, and M. L. Dertouzos. On data banks and privacy homomorphisms. In Foundations of Secure Computation, pages 169–178, 1978.
22.B. Schneier. Applied Cryptography. John Wiley, second edition, 1996.
23.D. X. Song, D. Wagner, and A. Perrig. Practical techniques for searches on encrypted data. In IEEE Symp. on Security and Privacy, Oakland, California, 2000.
24.D. R. Stinson. Cryptography: Theory and Practice. CRC Press, 2nd edition, 2002.
25.R. Vingralek. Gnatdb: A small-footprint, secure database system. In 28th Int'l Conference on Very Large Databases, pages 884–893, Hong Kong, China, August 2002.

Citation

MLA

Agrawal, R., et al. “Order Preserving Encryption for Numeric Data”. Proceedings of the 2004 ACM SIGMOD International Conference on Management of Data, 2004, pp. 563–74, https://doi.org/10.1145/1007568.1007632.

APA

Agrawal, R., Kiernan, J., Srikant, R., & Xu, Y. (2004). Order preserving encryption for numeric data. Proceedings of the 2004 ACM SIGMOD International Conference on Management of Data, 563–574. https://doi.org/10.1145/1007568.1007632

Chicago

Agrawal, R., J. Kiernan, R. Srikant, and Y. Xu. 2004. “Order Preserving Encryption for Numeric Data”. Proceedings of the 2004 ACM SIGMOD International Conference on Management of Data, 563–74. https://doi.org/10.1145/1007568.1007632.

Harvard

Agrawal, R. et al. (2004) “Order preserving encryption for numeric data”, Proceedings of the 2004 ACM SIGMOD international conference on Management of data. ACM, pp. 563–574. Available at: https://doi.org/10.1145/1007568.1007632.

Vancouver

1. Agrawal R, Kiernan J, Srikant R, Xu Y (2004) Order preserving encryption for numeric data. In: Proceedings of the 2004 ACM SIGMOD international conference on Management of data. ACM, pp 563–574

BibTeX

@inproceedings{Agrawal_2004, series={SIGMOD/PODS04}, title={Order preserving encryption for numeric data}, url={http://dx.doi.org/10.1145/1007568.1007632}, DOI={10.1145/1007568.1007632}, booktitle={Proceedings of the 2004 ACM SIGMOD international conference on Management of data}, publisher={ACM}, author={Agrawal, Rakesh and Kiernan, Jerry and Srikant, Ramakrishnan and Xu, Yirong}, year={2004}, month=June, pages={563–574}, collection={SIGMOD/PODS04} }

Metadata:Crossref

Access the Paper

This paper is available from its original source. Click below to access the PDF.

Open PDF

Order preserving encryption for numeric data

Abstract

Topics

Keywords

Table of Contents

Knowls

Knowl 1 — OPES Architecture and Three-Stage Framework

Knowl 2 — Estimation Exposure Metric and Threat Model for Order-Preserving Encryption

Knowl 3 — Piece-Wise Linear Distribution Modeling via Minimum Description Length

Knowl 4 — MDL Data Cost and Incremental Model Cost Formulation

Knowl 5 — Flattening Mapping Function and Scale Factor Computation

Knowl 6 — Plaintext-to-Flat Mapping and Inversion Equations

Knowl 7 — Target Distribution Scaling and Transformation to Ciphertext

Knowl 8 — Floating-Point Encoding and Homophonic Duplicate Handling

Knowl 9 — Ciphertext Domain Space Expansion Bound

Knowl 10 — Empirical Indistinguishability, Key Compactness, and Percentile Shift

References

Citation

BibTeX

Access the Paper