Efficient Dynamic Searchable Encryption with Forward Privacy - - PowerPoint PPT Presentation

▶
efficient dynamic searchable encryption
SMART_READER_LITE
LIVE PREVIEW

Efficient Dynamic Searchable Encryption with Forward Privacy - - PowerPoint PPT Presentation

Mar 02, 2023 664 likes •1.58k views

Efficient Dynamic Searchable Encryption with Forward Privacy Mohammad Alptekin Charalampos David Kp Etemad Papamanthou Evans Efficient Dynamic Searchable Encryption with Forward Privacy Etemad, Kp , Papamanthou, Evans, PETS

slide-1
SLIDE 1

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 1

Efficient Dynamic Searchable Encryption with Forward Privacy

Mohammad Etemad Alptekin Küpçü Charalampos Papamanthou David Evans

slide-2
SLIDE 2

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 4

Problem Definition

  • Outsourced data should be encrypted for confidentiality.
  • The user want to perform search to access a particular data
  • r selectively retrieve the outsourced files.
  • Search over the encrypted data?
slide-3
SLIDE 3

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 7

Trivial Secure but Inefficient Solution

slide-4
SLIDE 4

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 8

Trivial Secure but Inefficient Solution

Encrypt

slide-5
SLIDE 5

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 9

Trivial Secure but Inefficient Solution

slide-6
SLIDE 6

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 10

Trivial Secure but Inefficient Solution

slide-7
SLIDE 7

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 11

Trivial Secure but Inefficient Solution

slide-8
SLIDE 8

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 12

Trivial Secure but Inefficient Solution

Decrypt

slide-9
SLIDE 9

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 13

Trivial Secure but Inefficient Solution

Decrypt Local Search

slide-10
SLIDE 10

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 15

Searchable Encryption

  • Index-based solutions

Security Efficiency

slide-11
SLIDE 11

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 16

Searchable Encryption

  • Index-based solutions
  • Files f = {f1, f2, …, fn}
  • Dictionary W = {w1, w2, …, wm}

Security Efficiency

slide-12
SLIDE 12

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 17

Searchable Encryption

  • Index-based solutions
  • Files f = {f1, f2, …, fn}
  • Dictionary W = {w1, w2, …, wm}
  • For each keyword wi in dictionary W:
  • Fwi = {identifiers of all files containing wi}

Security Efficiency

slide-13
SLIDE 13

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 18

Searchable Encryption

  • Index-based solutions
  • Files f = {f1, f2, …, fn}
  • Dictionary W = {w1, w2, …, wm}
  • For each keyword wi in dictionary W:
  • Fwi = {identifiers of all files containing wi}
  • Generate a key Kwi = F(K, wi)
  • Encrypt Fwi under Kwi

Security Efficiency Pseudo Random Function

slide-14
SLIDE 14

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 19

Searchable Encryption

  • Index-based solutions
  • Files f = {f1, f2, …, fn}
  • Dictionary W = {w1, w2, …, wm}
  • For each keyword wi in dictionary W:
  • Fwi = {identifiers of all files containing wi}
  • Generate a key Kwi = F(K, wi)
  • Encrypt Fwi under Kwi
  • Store them at (random) locations in the index
  • Outsource the encrypted index together with the encrypted files

Security Efficiency Pseudo Random Function

slide-15
SLIDE 15

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 20

Searchable Encryption

slide-16
SLIDE 16

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 21

Searchable Encryption

PreComputation

slide-17
SLIDE 17

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 22

Searchable Encryption

PreComputation

slide-18
SLIDE 18

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 23

Searchable Encryption

PreComputation

slide-19
SLIDE 19

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 24

Searchable Encryption

PreComputation

slide-20
SLIDE 20

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 25

Searchable Encryption

slide-21
SLIDE 21

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 26

Searchable Encryption

slide-22
SLIDE 22

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 27

Searchable Encryption

Retrieve the files containing a keyword wi

slide-23
SLIDE 23

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 28

Searchable Encryption

Retrieve the files containing a keyword wi

wi

slide-24
SLIDE 24

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 29

Searchable Encryption

Retrieve the files containing a keyword wi

slide-25
SLIDE 25

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 30

Searchable Encryption

Retrieve the files containing a keyword wi Decrypt

slide-26
SLIDE 26

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 33

  • Search leakage
  • The set of encrypted files containing wi (Access pattern: fwi,t)
  • Needed for efficient response
  • Server does not know the keyword or the contents of files!

The Leakages

slide-27
SLIDE 27

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 34

  • Search leakage
  • The set of encrypted files containing wi (Access pattern: fwi,t)
  • Needed for efficient response
  • Server does not know the keyword or the contents of files!
  • How many times a keyword is searched for (Search pattern: SP)
  • The tokens are deterministic!

The Leakages

slide-28
SLIDE 28

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 35

  • File Insertion leakage (for dynamic schemes without forward

privacy)

  • File identifier (ej)
  • File size (|fj|)

The Leakages

slide-29
SLIDE 29

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 36

  • File Insertion leakage (for dynamic schemes without forward

privacy)

  • File identifier (ej)
  • File size (|fj|)
  • Number of keywords in the file and if any of them was previously

queried

  • They are encrypted under a key that is already revealed to the server.
  • If all keywords of a new file have already been queried, the server knows

all its (encrypted) keywords upon insertion!

The Leakages

slide-30
SLIDE 30

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 37

Exploiting Leakage

  • The leakages can be used to compromise confidentiality
  • f the data and queries
  • Access pattern attacks [IKK12, NKW15, CGPR15]
  • Search pattern attacks [LZWT14]
  • File injection attacks [ZKP16]
slide-31
SLIDE 31

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 38

Exploiting Leakage

  • The leakages can be used to compromise confidentiality
  • f the data and queries
  • Access pattern attacks [IKK12, NKW15, CGPR15]
  • Search pattern attacks [LZWT14]
  • File injection attacks [ZKP16]
  • Without forward privacy, the server can link a new file to

the previously queried keywords upon insertion for free!

slide-32
SLIDE 32

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 39

Exploiting Leakage

  • The leakages can be used to compromise confidentiality
  • f the data and queries
  • Access pattern attacks [IKK12, NKW15, CGPR15]
  • Search pattern attacks [LZWT14]
  • File injection attacks [ZKP16]
  • Without forward privacy, the server can link a new file to

the previously queried keywords upon insertion for free!

  • Forward privacy prevents this leakage.
  • Makes adaptive injection attacks less effective [ZKP16].
slide-33
SLIDE 33

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 40

  • With forward privacy, the insertion leakage is limited to:
  • File identifier
  • File size
  • Number of keywords in the file and if any of them was previously queried
  • The server cannot link the new file to the previous searches

Forward Privacy

slide-34
SLIDE 34

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 41

  • Upon a search:
  • Client reveals the respective key to the server,
  • Server deletes all accessed index entries,
  • Client re-inserts them encrypted under a fresh key at new random

locations in the index.

Our Scheme

slide-35
SLIDE 35

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 42

  • Upon a search:
  • Client reveals the respective key to the server,
  • Server deletes all accessed index entries,
  • Client re-inserts them encrypted under a fresh key at new random

locations in the index.

  • Slides:
  • Honest-but-curious server
  • Small but non-constant client storage

Our Scheme

slide-36
SLIDE 36

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 43

  • Upon a search:
  • Client reveals the respective key to the server,
  • Server deletes all accessed index entries,
  • Client re-inserts them encrypted under a fresh key at new random

locations in the index.

  • Slides:
  • Honest-but-curious server
  • Small but non-constant client storage
  • Paper:
  • Dynamic, efficient, parallelizable, forward-private, simulation-secure

Our Scheme

slide-37
SLIDE 37

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 44

Our Scheme

w1 w3 w4 f1 f2 w2 w1 f3 w1 w4

slide-38
SLIDE 38

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 45

Our Scheme

  • W = {w1, w2, w3, w4}
  • (wi, fj): fj contains wi.

w1 w3 w4 f1 f2 w2 w1 f3 w1 w4

slide-39
SLIDE 39

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 46

The indexes

# files # searches MW w1 w2 w3 w4 TW

Client Side Server Side

slide-40
SLIDE 40

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 47

Build

# files # searches 1 MW w1 w2 w3 w4 TW Adding

w1 w3 w4 f1

slide-41
SLIDE 41

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 48

Build

# files # searches 1 MW w1 w2 w3 w4 TW Adding

w1 w3 w4 f1

Kw1 = F(K, w1, 0)

slide-42
SLIDE 42

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 49

Build

# files # searches 1 MW w1 w2 w3 w4 TW Adding

w1 w3 w4 f1

Kw1 = F(K, w1, 0) A1 = F(Kw1, 1, 0) Address

slide-43
SLIDE 43

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 50

Build

# files # searches 1 MW w1 w2 w3 w4 TW (w1, f1) Adding

w1 w3 w4 f1

Kw1 = F(K, w1, 0) A1 = F(Kw1, 1, 0) Address K1 = F(Kw1, 1, 1) Encryption key

slide-44
SLIDE 44

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 51

Build

# files # searches 1 1 MW w1 w2 w3 w4 TW (w1, f1) Adding

w1 w3 w4 f1

slide-45
SLIDE 45

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 52

Build

# files # searches 1 1 MW w1 w2 w3 w4 TW (w1, f1) Adding

w1 w3 w4 f1

Kw3 = F(K, w3, 0)

slide-46
SLIDE 46

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 53

Build

# files # searches 1 1 MW w1 w2 w3 w4 TW (w1, f1) Adding

w1 w3 w4 f1

Kw3 = F(K, w3, 0) A3 = F(Kw3, 1, 0) Address

slide-47
SLIDE 47

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 54

Build

# files # searches 1 1 MW w1 w2 w3 w4 TW (w1, f1) (w3, f1) Adding

w1 w3 w4 f1

Kw3 = F(K, w3, 0) A3 = F(Kw3, 1, 0) K3 = F(Kw3, 1, 1) Encryption key Address

slide-48
SLIDE 48

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 55

Build

# files # searches 1 1 1 MW w1 w2 w3 w4 TW (w4, f1) (w1, f1) (w3, f1) After adding

w1 w3 w4 f1

slide-49
SLIDE 49

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 56

Build

# files # searches 3 1 1 2 MW w1 w2 w3 w4 TW (w4, f1) (w2, f2) (w1, f1) (w1, f3) (w1, f2) (w4, f3) (w3, f1) After adding

w1 w3w4 f1 f2 w2 w1 f3 w1 w4

slide-50
SLIDE 50

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 57

Search

# files # searches 3 1 1 2 MW (Client) w1 w2 w3 w4 TW (Server) Searching for w4 (w4, f1) (w2, f2) (w1, f1) (w1, f3) (w1, f2) (w4, f3) (w3, f1)

slide-51
SLIDE 51

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 58

Search

# files # searches 3 1 1 2 MW (Client) w1 w2 w3 w4 TW (Server) Searching for w4 (w4, f1) (w2, f2) (w1, f1) (w1, f3) (w1, f2) (w4, f3) (w3, f1) Kw4 = F(K, w4, 0)

slide-52
SLIDE 52

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 59

Search

# files # searches 3 1 1 2 MW (Client) w1 w2 w3 w4 TW (Server) Searching for w4 (w4, f1) (w2, f2) (w1, f1) (w1, f3) (w1, f2) (w4, f3) (w3, f1) Kw4 = F(K, w4, 0) nw = 2

slide-53
SLIDE 53

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 60

Search

# files # searches 3 1 1 2 MW (Client) w1 w2 w3 w4 TW (Server) Searching for w4 (w4, f1) (w2, f2) (w1, f1) (w1, f3) (w1, f2) (w4, f3) (w3, f1) Kw4 = F(K, w4, 0) nw = 2

slide-54
SLIDE 54

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 61

Search

# files # searches 3 1 1 2 MW (Client) w1 w2 w3 w4 TW (Server) The server: (w4, f1) (w2, f2) (w1, f1) (w1, f3) (w1, f2) (w4, f3) (w3, f1) for i = 1 to nw

Ai = F(Kw4, i, 0) Ki = F(Kw4, i, 1)

slide-55
SLIDE 55

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 62

Search

# files # searches 3 1 1 2 MW (Client) w1 w2 w3 w4 TW (Server) The server: (w4, f1) (w2, f2) (w1, f1) (w1, f3) (w1, f2) (w4, f3) (w3, f1) for i = 1 to nw

Ai = F(Kw4, i, 0) Ki = F(Kw4, i, 1)

slide-56
SLIDE 56

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 63

Search

# files # searches 3 1 1 2 MW (Client) w1 w2 w3 w4 TW (Server) The server: (w4, f1) (w2, f2) (w1, f1) (w1, f3) (w1, f2) (w4, f3) (w3, f1) for i = 1 to nw

Ai = F(Kw4, i, 0) Ki = F(Kw4, i, 1)

slide-57
SLIDE 57

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 64

Search

# files # searches 3 1 1 2 MW (Client) w1 w2 w3 w4 TW (Server) The server: (w4, f1) (w2, f2) (w1, f1) (w1, f3) (w1, f2) (w4, f3) (w3, f1) for i = 1 to nw

Ai = F(Kw4, i, 0) Ki = F(Kw4, i, 1)

f1 f3

slide-58
SLIDE 58

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 65

Search

# files # searches 3 1 1 2 MW (Client) w1 w2 w3 w4 TW (Server) The server: (w4, f1) (w2, f2) (w1, f1) (w1, f3) (w1, f2) (w4, f3) (w3, f1) for i = 1 to nw

Ai = F(Kw4, i, 0) Ki = F(Kw4, i, 1)

f1 f3

slide-59
SLIDE 59

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 66

Search

# files # searches 3 1 1 2 MW (Client) w1 w2 w3 w4 TW (Server) The server removes the found entries from the index. (w2, f2) (w1, f1) (w1, f3) (w1, f2) (w3, f1)

slide-60
SLIDE 60

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 67

Search

# files # searches 3 1 1 2 1 MW (Client) w1 w2 w3 w4 TW (Server) (w2, f2) (w1, f1) (w1, f3) (w1, f2) (w3, f1) The client Kw4 = F(K, w4, 1)

slide-61
SLIDE 61

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 68

Search

# files # searches 3 1 1 2 1 MW (Client) w1 w2 w3 w4 TW (Server) (w2, f2) (w1, f1) (w1, f3) (w1, f2) (w3, f1) The client Kw4 = F(K, w4, 1) Fresh key

slide-62
SLIDE 62

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 69

Search

# files # searches 3 1 1 2 1 MW (Client) w1 w2 w3 w4 TW (Server) (w2, f2) (w1, f1) (w1, f3) (w1, f2) (w3, f1) The client Kw4 = F(K, w4, 1) for i = 1 to nw

Ai = F(Kw4, i, 0) Ki = F(Kw4, i, 1) (w4, f1) and (w4, f3)

slide-63
SLIDE 63

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 70

Search

# files # searches 3 1 1 2 1 MW (Client) w1 w2 w3 w4 TW (Server) (w2, f2) (w1, f1) (w1, f3) (w1, f2) (w3, f1) The client Kw4 = F(K, w4, 1) for i = 1 to nw

Ai = F(Kw4, i, 0) Ki = F(Kw4, i, 1) (w4, f1) and (w4, f3)

slide-64
SLIDE 64

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 71

Search

# files # searches 3 1 1 2 1 MW (Client) w1 w2 w3 w4 TW (Server) (w2, f2) (w1, f1) (w4, f1) (w1, f3) (w4, f3) (w1, f2) (w3, f1) After searching for w4

slide-65
SLIDE 65

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 72

File Insertion

Adding f4 w4 w3 # files # searches 3 1 1 2 1 MW (Client) w1 w2 w3 w4

slide-66
SLIDE 66

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 73

File Insertion

Adding f4 w4 w3 Kw3 = F(K, w3, 0) Kw4 = F(K, w4, 1) # files # searches 3 1 1 2 1 MW (Client) w1 w2 w3 w4

slide-67
SLIDE 67

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 74

File Insertion

Adding f4 w4 w3 Kw3 = F(K, w3, 0) Kw4 = F(K, w4, 1) # files # searches 3 1 1 2 1 MW (Client) w1 w2 w3 w4 (w3, f4) (w4, f4)

slide-68
SLIDE 68

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 75

File Insertion

TW (Server) (w4, f4) (w2, f2) (w1, f1) (w3, f4) (w4, f1) (w1, f3) (w4, f3) (w1, f2) (w3, f1) After adding f4 w4 w3

slide-69
SLIDE 69

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 76

File Insertion

TW (Server) (w4, f4) (w2, f2) (w1, f1) (w3, f4) (w4, f1) (w1, f3) (w4, f3) (w1, f2) (w3, f1) After adding f4 w4 w3

Each entry is always encrypted with a key that is not known to the server.

slide-70
SLIDE 70

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 77

File Insertion

# files # searches 3 1 2 3 1 MW (Client) w1 w2 w3 w4 TW (Server) (w4, f4) (w2, f2) (w1, f1) (w3, f4) (w4, f1) (w1, f3) (w4, f3) (w1, f2) (w3, f1) After adding f4 w4 w3

Each entry is always encrypted with a key that is not known to the server.

slide-71
SLIDE 71

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 79

File Deletion - Indexes

TW (w2, f2) (w1, f1) (w4, f1) (w1, f3) (w4, f3) (w1, f2) (w3, f1) TF (f1, addr[w3,f1]) (f3, addr[w4,f3]) (f2, addr[w1,f2]) (f1, addr[w4,f1]) (f3, addr[w1,f3]) (f2, addr[w2,f2]) (f1, addr[w1,f1])

slide-72
SLIDE 72

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 80

File Deletion - Indexes

# files # searches 3 1 1 2 1 MW (Client) w1 w2 w3 w4 # keywords 3 2 2 f1 f2 f3 MF (Client)

slide-73
SLIDE 73

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 81

File Deletion - Client

Deleting f3 Kf3 = F(K, f3) nf3 = 2 # files # searches 3 1 1 2 1 MW (Client) w1 w2 w3 w4 # keywords 3 2 2 f1 f2 f3 MF (Client)

slide-74
SLIDE 74

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 82

File Deletion - Client

Deleting f3 Kf3 = F(K, f3) nf3 = 2 # files # searches 3 1 1 2 1 MW (Client) w1 w2 w3 w4 # keywords 3 2 2 f1 f2 f3 MF (Client)

slide-75
SLIDE 75

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 83

File Deletion - Server

TW (w2, f2) (w1, f1) (w4, f1) (w1, f3) (w4, f3) (w1, f2) (w3, f1) TF (f1, addr[w3,f1]) (f3, addr[w4,f3]) (f2, addr[w1,f2]) (f1, addr[w4,f1]) (f3, addr[w1,f3]) (f2, addr[w2,f2]) (f1, addr[w1,f1]) The server: for i = 1 to nf3

Ai = F(Kf3, i, 0) Ki = F(Kf3, i, 1)

slide-76
SLIDE 76

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 84

File Deletion - Server

TW (w2, f2) (w1, f1) (w4, f1) (w1, f3) (w4, f3) (w1, f2) (w3, f1) TF (f1, addr[w3,f1]) (f3, addr[w4,f3]) (f2, addr[w1,f2]) (f1, addr[w4,f1]) (f3, addr[w1,f3]) (f2, addr[w2,f2]) (f1, addr[w1,f1]) The server: for i = 1 to nf3

Ai = F(Kf3, i, 0) Ki = F(Kf3, i, 1)

slide-77
SLIDE 77

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 85

File Deletion - Server

TW (w2, f2) (w1, f1) (w4, f1) (w1, f3) (w4, f3) (w1, f2) (w3, f1) TF (f1, addr[w3,f1]) (f3, addr[w4,f3]) (f2, addr[w1,f2]) (f1, addr[w4,f1]) (f3, addr[w1,f3]) (f2, addr[w2,f2]) (f1, addr[w1,f1]) The server: for i = 1 to nf3

Ai = F(Kf3, i, 0) Ki = F(Kf3, i, 1)

slide-78
SLIDE 78

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 86

File Deletion - Server

TW (w2, f2) (w1, f1) (w4, f1) (w1, f2) (w3, f1) TF (f1, addr[w3,f1]) (f2, addr[w1,f2]) (f1, addr[w4,f1]) (f2, addr[w2,f2]) (f1, addr[w1,f1])

slide-79
SLIDE 79

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 87

File Deletion - Client

# files # searches 3 1 1 2 1 MW (Client) w1 w2 w3 w4 # keywords 3 2 f1 MF (Client) f2

slide-80
SLIDE 80

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 88

File Deletion - Client

# files # searches 3 1 1 2 1 MW (Client) w1 w2 w3 w4 # keywords 3 2 f1 MF (Client)

This will be updated with searches and insertions!

f2

slide-81
SLIDE 81

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 89

File Deletion - Client

# files # searches 3 1 1 2 1 MW (Client) w1 w2 w3 w4 # keywords 3 2 f1 MF (Client)

This will be updated with searches and insertions!

f2

This will be updated with insertions and deletions!

slide-82
SLIDE 82

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 92

  • [SPS14] uses an ORAM-based data structure as the index.
  • Search cost: O(dlog3N)
  • Update cost: O(rlog2N)
  • Sophos (Σoφoς) [B16] uses public key operations.

Related work

slide-83
SLIDE 83

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 95

  • Dataset:
  • n: ~4M Wikipedia pages (files)
  • m: ~10M dictionary size (keywords)
  • N: ~500M total index entries (server side)
  • Implementation: C/C++ with the Crypto++ library
  • SHA1
  • Indexes are implemented as C++ maps.
  • Server: Amazon EC2 using m4.4xlarge instances (64GB of

memory, 16 CPU cores) running Ubuntu 16.04 LTS.

  • Single core employed.
  • Client: Apple MacBook Air Laptop
  • Sophos and our scheme are run and compared.

Performance

slide-84
SLIDE 84

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 98

Performance - Search

slide-85
SLIDE 85

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 101

Conclusion

  • Forward privacy reduces the leakage and makes the

attacks less effective.

slide-86
SLIDE 86

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 102

Conclusion

  • Forward privacy reduces the leakage and makes the

attacks less effective.

  • Our scheme:
  • Achieves forward privacy
  • Is parallelizable
  • Is efficient (only PRFs, hash functions, and simple maps)
  • Has security proof via simulation
slide-87
SLIDE 87

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 103

Conclusion

  • Forward privacy reduces the leakage and makes the

attacks less effective.

  • Our scheme:
  • Achieves forward privacy
  • Is parallelizable
  • Is efficient (only PRFs, hash functions, and simple maps)
  • Has security proof via simulation
  • Future Work:
  • Backward privacy
  • Remove any linkage between a deleted file and later searches.
  • Existing solutions require index rebuild.
slide-88
SLIDE 88

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 104

Conclusion

  • Forward privacy reduces the leakage and makes the

attacks less effective.

  • Our scheme:
  • Achieves forward privacy
  • Is parallelizable
  • Is efficient (only PRFs, hash functions, and simple maps)
  • Has security proof via simulation
  • Future Work:
  • Backward privacy
  • Remove any linkage between a deleted file and later searches.
  • Existing solutions require index rebuild.
  • Reducing the client storage
  • From O(m+n) without adding extra rounds.
slide-89
SLIDE 89

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 105

Thank You Questions?

etemad@virginia.edu akupcu@ku.edu.tr cpap@umd.edu evans@virginia.edu

slide-90
SLIDE 90

Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü, Papamanthou, Evans, PETS 2018 106

[SWP00] D. Song, D. Wagner, A. Perrig, Practical techniques for searches on encrypted data, IEEE Security and Privacy, 2000. [KPR12] S. Kamara, C. Papamanthou, T. Roeder, Dynamic Searchable Symmetric Encryption, ACM CCS, 2012. [KP13] S. Kamara, C. Papamanthou, Parallel and Dynamic Searchable Symmetric Encryption, FC, 2013. [KO12] K. Kurosawa, Y. Ohtaki, UC-secure searchable symmetric encryption, FC, 2012. [IKK12] M. Islam, M. Kuzu, M. Kantarcioglu, Access pattern disclosure on searchable encryption: Ramification, attack and mitigation, NDSS 2012. [ZKP16] Y. Zhang, J. Katz, C. Papamanthou, All your queries are belong to us: The power of file-injection attacks on searchable encryption, USENIX Security, 2016. [NKW15] M. Naveed, S. Kamara, C. V. Wright, Inference attacks on property-preserving encrypted databases, ACM CCS 2015. [LZWT14] C. Liu, L. Zhu, M. Wang, Y.-a. Tan, Search pattern leakage in searchable encryption: Attacks and new construction, Information Sciences, 2014 [CGPR15] D. Cash, P. Grubbs, J. Perry, T. Ristenpart, Leakage abuse attacks against searchable encryption,” ACM CCS 2015 [SPS14] E. Stefanov, C. Papamanthou, E. Shi, Practical dynamic searchable encryption with small leakage, NDSS 2014. [B16] R. Bost, Sophos - forward secure searchable encryption, ACM CCS 2016.

References