Breach-Resistant Structured Encryption Ghous Amjad, Seny Kamara - - PowerPoint PPT Presentation

Breach-Resistant Structured Encryption

Ghous Amjad, Seny Kamara & Tarik Moataz

Databases

“A database is an organized collection of data” --- Wikipedia

Encrypted Database

EncK

Q: can we encrypt DBs even in use?

Efficiency Leakage Functionality

Tradeoffs: Functionality vs. Efficiency

SK-FE-based STE-based PPE-based FHE-based ORAM-based PK-FE-based Efficiency Functionality SQL NoSQL

Tradeoffs: Efficiency vs. Security

Efficiency STE-based PPE-based FHE-based ORAM-based skFE-based pkFE-based Leakage STE+ORAM-based STE+ORAM-based

Background: Data Structures

• DXs map labels to values

• Get: DX[w3] returns id2
• MMs map labels to tuples


• Get: MM[w3] returns (id2 , id4)

w1 w2 w3

id1 id3 id2 Dictionary DX

w1 w2 w3

id1 id3 id4 id3 id2 id4 Multi-map MM

Structured Encryption [CK’10]

Setup(1k, DS) ⟾ (K, EDS)

Token(K, q) ⟾ tk

tk =

Query(EDS, tk) ⟾ ans

ans =

EDS = DS =

Background: Encrypted Data Structures

[CK’10]

Encrypted Multi-Map Encrypted relational DB Encrypted NoSQL DB Encrypted Graph DB Encrypted Inverted Index

=

Single-keyword SSE [SWP’00], [Goh’03], [CGKO’06], [CK10], [KPR’12], [KP’13], [CJJKRS’13], [CJJJKRS’14], [Bost’16] …

=

LS(MM)

Adaptive Security for STE [CGKO’06,CK’10]

Real Ideal

LQ(MM, wi)

LU(MM, ui)

Forward Privacy [SPS’14]

• Informally [SPS’14]
• Formally [Bost’16]

“Updates cannot be correlated to previous queries”

LQ

• MM, (op, w, v)
• = #v

Security of Encrypted Structures

[CGKO’06,CK’10]

• Definition guarantees security vs. adversary that
• Holds encrypted structure & executes queries
• Models an untrusted cloud provider
• Data breaches can occur even when server is trusted
• Storage is compromised
• Malicious employee
• Government subpoena
• Adversary holds encrypted structure but does not see queries

Snapshot Security

• Adversary holds encrypted structure but does not see queries
• Discussed and formalized in [LW’16] for PPE
• Discussed in [PBP’16, GRS’17] but never formalized for STE

Q: What is snapshot security?

Snapshot Security

Real Ideal

LS(MM0)

LS(MM1, op)

LS(MM2, op)

Snapshot Security and Breach-Resistance

• Informally
• Formally

“Breach-resistant leakage reveals at most the size of the current structure”

LSnp(MM, op1, . . . , opi) = LS(MMi) = X

w∈W

#MMi[w]

Tradeoffs: Efficiency vs. Security

Efficiency STE-based PPE-based FHE-based ORAM-based skFE-based pkFE-based Leakage

• vs. Persistent Adversary!

Tradeoffs: Efficiency vs. Security

Efficiency STE-based PPE-based FHE-based ORAM-based skFE-based pkFE-based Leakage

• vs. Snapshot Adversary

Snapshot Security

Breach- resistance Breach-resistance Forward privacy Insertion independence (variant of history independence) Write-only obliviousness

Static Structures Dynamic Structures

LS(MM) = X

w∈W

#MM[w]

Q: Can we design breach-resistant &

forward-private EMMs?

Dual-Secure EMMs

• [SPS’14]
• Query complexity

Q: Can we design efficient dual-secure EMMs?

O ✓ #MM[w] · polylog ✓ X

w∈W

#MM[w] ◆◆

[CJJJKRS’14]

πdyn

EMM.Setup 1k ,

,

Setup

[CJJJKRS’14]

w1 l2 w3 id1 id3 id4 id3 id2 id4

EMM.Setup 1k,

,

w2

* PRF and Enc keys are different but derived from wi

FKw1(1)

Encrypted MM

FKw1(2) FKw1(3) FKw2(1) FKw3(1) FKw3(2)

id1 id3 id4 id3 id2 id4

πdyn

Setup

[CJJJKRS’14]

Kw1

EMM.Get

,

πdyn

Get

FKw1(1)

• 1. DX.Get

,

DX

FKw1(2)

• 2. DX.Get

,

DX

FKw1(3)

• 3. DX.Get

,

DX

FKw1(4)

• 4. DX.Get

,

DX

⊥

[CJJJKRS’14]

EMM.Get

,

FKw1(1)

Dictionary DX

FKw1(2) FKw1(3) FKw2(1) FKw3(1) FKw3(2)

id1 id3 id4 id3 id2 id4

Kw1

FKw1(1)

• 1. DX.Get

,

DX

id1

FKw1(2)

• 2. DX.Get

,

DX

id3

FKw1(3)

• 3. DX.Get

,

DX

id4

FKw1(4)

• 4. DX.Get

,

DX

⊥

=

πdyn

Get

[CJJJKRS’14]

EMM.Edit+

,

πdyn

Edit+

FKw1(4)

id9

• 1. DX.Put

,

DX DX

[CJJJKRS’14]

EMM.Edit+

,

FKw1(1)

Dictionary DX

FKw1(2) FKw1(3) FKw2(1) FKw3(1) FKw3(2)

id1 id3 id4 id3 id2 id4

FKw1(4)

id9

FKw1(1)

Dictionary DX

FKw1(2) FKw1(3) FKw2(1) FKw3(1) FKw3(2)

id1 id3 id4 id3 id2 id4

FKw1(4)

id9

Edit+

πdyn

[CJJJKRS’14]

EMM.Edit-

,

πdyn

Edit-

FKw1(4)

id3

• 1. DX.Put

,

DX DX

[CJJJKRS’14]

EMM.Edit-

,

FKw1(1)

Dictionary DX

FKw1(2) FKw1(3) FKw2(1) FKw3(1) FKw3(2)

id1 id3 id4 id3 id2 id4

FKw1(4)

id3

FKw1(1)

Dictionary DX

FKw1(2) FKw1(3) FKw2(1) FKw3(1) FKw3(2)

id1 id3 id4 id3 id2 id4

FKw1(4)

id3

πdyn

Edit-

[CJJJKRS’14]

Kw1

EMM.Get

,

πdyn

Get

FKw1(1)

• 1. DX.Get

,

DX

FKw1(2)

• 2. DX.Get

,

DX

FKw1(3)

• 3. DX.Get

,

DX

FKw1(4)

• 4. DX.Get

,

DX

O (#MM[w] + dels0(w))

Forward-Private

• Why is not forward-private?
• new pairs encrypted under same key used for search,
• Kwi := FK(wi||1)
• so previously searched w’s can be linked to new pairs
• Making forward-private
• use keys with version number that rotates at each search
• Kwi := FK(wi||version||1)
• To search send keys for all versions
• FK(wi||version1||1), …, FK(wi||version8||1)

πdyn

πdyn

πdyn

Efficiency

• Most dynamic EMM constructions handle deletes naively
• forward-private or not
• Query complexity
• Storage complexity

O (#MM[w] + dels0(w))

O X

w∈W

#MM[w] + dels0(w) !

Rebuilding

• Rebuild operation
• Executed throughout lifetime of encrypted structure
• Removes/prunes delete pairs
• Cost
• Query complexity Storage complexity

Ω ✓ X

w∈W

#MM[w] ◆

O

• #MM[w] + delsr(w)
• O

✓ X

w∈W

#MM[w] + delsr(w) ◆

Rebuilding Encrypted Structures

• Ideally a zero-leakage operation
• Approach #1
• Client queries for each keyword and recovers encrypted id’s
• Removes deleted id’s
• Re-inserts new encrypted keywords and id’s
• Leakage

Leaks new information to persistent Adv: query leakage of unsearched keywords

LR(MM) = ✓✓ LG(MM, w) ◆

w∈W

, ✓ LU(MM, (w, id) ◆

w∈W

◆ = ✓ f(w), #MM[w] + delsr(w), g(w), #MM[w] ◆

w∈W

Rebuilding Encrypted Structures

• Ideally a zero-leakage operation
• Approach #2
• Keep track of searched and unsearched
• Use Approach #1 for searched
• For unsearched sample pair uniformly at random & re-insert
• Leakage

LR(MM) = ✓ f(w), #MM[w] + delsr(w), g(w), #MM[w] ◆

w∈S

, X

w∈U

#MM[w] ! = ✓ f(w), #MM[w], delsr(w), g(w) ◆

w∈S

, X

w∈U

#MM[w] ! Already leaked during queries

Rebuilding Encrypted Structures

• What about Snapshot security?
• Rebuild is not de-amortized
• Variant with de-amortized rebuild
• When de-amortized rebuild occurs impacts snapshot leakage
• Executed during Updates
• Requires stash at client

LSnp(MM) = LS(MM) = X

w∈W

#MM[w]

Forward-Private EMMs

Search Client Storage Forward Privacy Snapshot SPS’14 Yes Yes B’16 Yes No BMO’17 Yes No EKPE’17 Yes/No No This work Yes Yes

O (#W) O (#W + ML) O (#MM[w] + dels0(w)) O (#MM[w] + dels0(w)) O (#MM[w] + delsr(w)) O (#W) O (#W) O (#W) O

• #MM[w] + delss(w)
• O

✓ #MM[w] · polylog

• #MM

◆

Implementation

• Forward-private & response-hiding variant of
• de-amortized rebuild with λ = 3
• Java (1114 LOC)
• Clusion encrypted search library
• Lucene, Bouncy Castle
• HMAC-SHA256 for PRFs and ROs

πdyn

Experimental Setup

• Amazon EC2 c3.8xlarge instantce
• 32 vCPUs and 60GB of RAM
• Wikipedia
• 26.5GB & 2,681,795 files
• Experiments (in memory)
• time to setup EMM in function of pairs
• Size of EMM & size of client state in function of pairs
• Server query time in function of pairs for different selectivities
• Server update time in function of pairs for different λ
• Effect of rebuild on query time

Setup Time & Sizes

Query & Update Time

Thank you