Efficient Dynamic Searchable Encryption with Forward Privacy - PowerPoint PPT Presentation

Efficient Dynamic Searchable Encryption with Forward Privacy Mohammad Alptekin Charalampos David Küpçü Etemad Papamanthou Evans Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 1

Problem Definition  Outsourced data should be encrypted for confidentiality.  The user want to perform search to access a particular data or selectively retrieve the outsourced files.  Search over the encrypted data? Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 4

Trivial Secure but Inefficient Solution Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 7

Trivial Secure but Inefficient Solution Encrypt Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 8

Trivial Secure but Inefficient Solution Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 9

Trivial Secure but Inefficient Solution Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 10

Trivial Secure but Inefficient Solution Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 11

Trivial Secure but Inefficient Solution Decrypt Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 12

Trivial Secure but Inefficient Solution Decrypt Local Search Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 13

Searchable Encryption  Index-based solutions Efficiency Security Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 15

Searchable Encryption  Index-based solutions Efficiency  Files f = {f 1 , f 2 , …, f n } Security  Dictionary W = {w 1 , w 2 , …, w m } Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 16

Searchable Encryption  Index-based solutions Efficiency  Files f = {f 1 , f 2 , …, f n } Security  Dictionary W = {w 1 , w 2 , …, w m }  For each keyword w i in dictionary W:  F w i = {identifiers of all files containing w i } Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 17

Searchable Encryption  Index-based solutions Efficiency  Files f = {f 1 , f 2 , …, f n } Security  Dictionary W = {w 1 , w 2 , …, w m }  For each keyword w i in dictionary W:  F w i = {identifiers of all files containing w i }  Generate a key K w i = F(K, w i ) Pseudo Random Function  Encrypt F w i under K w i Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 18

Searchable Encryption  Index-based solutions Efficiency  Files f = {f 1 , f 2 , …, f n } Security  Dictionary W = {w 1 , w 2 , …, w m }  For each keyword w i in dictionary W:  F w i = {identifiers of all files containing w i }  Generate a key K w i = F(K, w i ) Pseudo Random Function  Encrypt F w i under K w i  Store them at (random) locations in the index  Outsource the encrypted index together with the encrypted files Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 19

Searchable Encryption Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 20

Searchable Encryption PreComputation Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 21

Searchable Encryption PreComputation Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 22

Searchable Encryption PreComputation Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 23

Searchable Encryption PreComputation Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 24

Searchable Encryption Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 25

Searchable Encryption Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 26

Searchable Encryption Retrieve the files containing a keyword w i Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 27

Searchable Encryption Retrieve the files containing a keyword w i w i Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 28

Searchable Encryption Retrieve the files containing a keyword w i Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 29

Searchable Encryption Retrieve the files containing a keyword w i Decrypt Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 30

The Leakages  Search leakage  The set of encrypted files containing w i (Access pattern: f wi,t )  Needed for efficient response  Server does not know the keyword or the contents of files! Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 33

The Leakages  Search leakage  The set of encrypted files containing w i (Access pattern: f wi,t )  Needed for efficient response  Server does not know the keyword or the contents of files!  How many times a keyword is searched for (Search pattern: SP )  The tokens are deterministic! Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 34

The Leakages  File Insertion leakage (for dynamic schemes without forward privacy)  File identifier ( e j )  File size (| f j |) Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 35

The Leakages  File Insertion leakage (for dynamic schemes without forward privacy)  File identifier ( e j )  File size (| f j |)  Number of keywords in the file and if any of them was previously queried  They are encrypted under a key that is already revealed to the server.  If all keywords of a new file have already been queried, the server knows all its (encrypted) keywords upon insertion! Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 36

Exploiting Leakage  The leakages can be used to compromise confidentiality of the data and queries  Access pattern attacks [IKK12, NKW15, CGPR15]  Search pattern attacks [LZWT14]  File injection attacks [ZKP16] Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 37

Exploiting Leakage  The leakages can be used to compromise confidentiality of the data and queries  Access pattern attacks [IKK12, NKW15, CGPR15]  Search pattern attacks [LZWT14]  File injection attacks [ZKP16]  Without forward privacy, the server can link a new file to the previously queried keywords upon insertion for free! Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 38

Exploiting Leakage  The leakages can be used to compromise confidentiality of the data and queries  Access pattern attacks [IKK12, NKW15, CGPR15]  Search pattern attacks [LZWT14]  File injection attacks [ZKP16]  Without forward privacy, the server can link a new file to the previously queried keywords upon insertion for free!  Forward privacy prevents this leakage.  Makes adaptive injection attacks less effective [ZKP16]. Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 39

Forward Privacy  With forward privacy, the insertion leakage is limited to:  File identifier  File size  Number of keywords in the file and if any of them was previously queried  The server cannot link the new file to the previous searches Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 40

Our Scheme  Upon a search:  Client reveals the respective key to the server,  Server deletes all accessed index entries,  Client re-inserts them encrypted under a fresh key at new random locations in the index. Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 41

Our Scheme  Upon a search:  Client reveals the respective key to the server,  Server deletes all accessed index entries,  Client re-inserts them encrypted under a fresh key at new random locations in the index.  Slides:  Honest-but-curious server  Small but non-constant client storage Efficient Dynamic Searchable Encryption with Forward Privacy – Etemad, Küpçü , Papamanthou, Evans, PETS 2018 42