The following article provides an introduction to Virtru's Encrypted Search feature. For a deeper dive into our technology please go to our Architecture Overview page and download the White Paper found at the bottom of the page. Section 4.1.2 of the Whitepaper covers "Searchable Encryption."

Jump To

About
How Encrypted Search Works
Encrypted Search Limitations
Security of Encrypted Search
Who Has Access to Search Keys?
Supported Platforms 

About

Virtru Encrypted Search uses a patented Tokenization and searching technique to allow searching of encrypted messages without exposing the underlying cleartext to any provider. Using Virtru’s patented techniques maintains maximum confidence in the security of messages and enables a seamless and frictionless experience for the end-users.  

How does Encrypted Search Work?

When enabled, every customer on a Virtru platform automatically receives a search key that is unique to users on their Virtru team. In the case of Virtru email clients, that Search Key is used to generate 4-character alphanumeric tokens (i.e., a0b1 x9u3 b4u8) for every word appearing in the email body. These tokens are then inserted into the actual email message, along with a number of random tokens that are added to prevent brute force correlation attacks.

When a user searches for keywords, tokens are generated for each search term and added to the search query. As a result, that user’s native email client is able to retrieve and display the search results without getting access to either the original search term or underlying content. Virtru’s servers never gain access either, thus ensuring that both existing user workflows and data security remain intact.

Encrypted Search Limitations

When performing an encrypted search there are a few limitations that may prevent a search from occurring or returning results.

1. Organizations can not search against emails received from outside of their organization

• Each organization has its own unique Search Key, which is not shared outside of the organization

2. Wildcard or fuzzy searching will not generate a search (he* or hellos does not match “hello”)

• The HMAC function does not allow for fuzzy searching. Must be the exact match

3. Organizations can not search encrypted attachments

4. Organizations can not search against previously encrypted emails

• Encrypted Search is not retroactive. With split knowledge, Virtru does not have access to customer content, thus cannot generate search tokens on previously sent messages

Security of Encrypted Search

Encrypted Search does not weaken the strength of Virtru’s symmetric encryption or give Virtru access to unencrypted content. It also does not replace traditional symmetric encryption, which will continue to be applied to your messages. Encrypted Search instead provides an additional set of encrypted data specifically designed to let an authorized individual ask if a message contains a particular word. It is part of a class of technologies called “Searchable Symmetric Encryption (SSE)” and is added in addition to the AES-256 bit symmetric encryption used to encrypt the message as a whole.

At a high level, the output of Virtru’s Encrypted Search has stronger security properties than Tokenization. If Tokenization is appropriate for use in your context, then Virtru’s Encrypted Search likely is too. However, like tokenization, enabling Encrypted Search may allow a third party to infer relationships between messages.

Who Has Access to Search Keys?

Virtru Encrypted Search Keys are unique for each organization. This means that external recipients will not be able to search the encrypted content of emails they receive from your team, even if they too are Virtru users with Encrypted Search enabled. This also means that if you receive a Virtru encrypted email from an external party, you will not be able to use your team's Search Keys to search that content.

Supported Platforms

When enabled, Encrypted Search tokens are injected by all Virtru platforms, including messages encrypted by the Virtru Gateway. Using an email endpoint client, users may search the contents of encrypted messages. In addition to Gmail, teams with Google Vault E-Discovery Support enabled will be able to search encrypted emails stored in Vault.