SLIDE 1
Searching on/Testing Encrypted Data Lecture 23 Searchable - - PowerPoint PPT Presentation
Searching on/Testing Encrypted Data Lecture 23 Searchable - - PowerPoint PPT Presentation
Searching on/Testing Encrypted Data Lecture 23 Searchable Encryption Searchable Encryption A test key T w that allows one to test if Dec SK (C) = w Searchable Encryption A test key T w that allows one to test if Dec SK (C) = w No other
SLIDE 2
SLIDE 3
Searchable Encryption
A test key Tw that allows one to test if DecSK(C) = w
SLIDE 4
Searchable Encryption
A test key Tw that allows one to test if DecSK(C) = w No other information about the message should be leaked
SLIDE 5
Searchable Encryption
A test key Tw that allows one to test if DecSK(C) = w No other information about the message should be leaked w from a small dictionary of “keywords”
SLIDE 6
Searchable Encryption
A test key Tw that allows one to test if DecSK(C) = w No other information about the message should be leaked w from a small dictionary of “keywords” Public-Key Encryption with Keyword Search (PEKS)
SLIDE 7
Searchable Encryption
A test key Tw that allows one to test if DecSK(C) = w No other information about the message should be leaked w from a small dictionary of “keywords” Public-Key Encryption with Keyword Search (PEKS) e.g. Application: delegating e-mail filtering
SLIDE 8
Searchable Encryption
A test key Tw that allows one to test if DecSK(C) = w No other information about the message should be leaked w from a small dictionary of “keywords” Public-Key Encryption with Keyword Search (PEKS) e.g. Application: delegating e-mail filtering Sender attaches a list of (searchably) encrypted keywords to the (normally encrypted) mail. Receiver hands the mail-server test keys for keywords of its choice. Mail-server filters mails by checking for keywords and can forward them appropriately.
SLIDE 9
Searchable Encryption
SLIDE 10
Searchable Encryption
Components: (PK,SK)←KeyGen, Tw←TestKeyGen(SK,w), EncPK(w), DecSK(C) and TestTw(C)
SLIDE 11
Searchable Encryption
Components: (PK,SK)←KeyGen, Tw←TestKeyGen(SK,w), EncPK(w), DecSK(C) and TestTw(C) Correctness: For all (possibly adversarially chosen) words w, for C←EncPK(w), we have DecSK(C) = w and TestTw(C)=1. For any other (adversarially chosen) word w’, TestTw’(C)=0.
SLIDE 12
Searchable Encryption
Components: (PK,SK)←KeyGen, Tw←TestKeyGen(SK,w), EncPK(w), DecSK(C) and TestTw(C) Correctness: For all (possibly adversarially chosen) words w, for C←EncPK(w), we have DecSK(C) = w and TestTw(C)=1. For any other (adversarially chosen) word w’, TestTw’(C)=0. May require perfect or statistical correctness. Or, should hold w.h.p against computationally bounded environments choosing w, w’ (after seeing PK, and for w’, possibly after seeing C, Tw also).
SLIDE 13
Searchable Encryption
Components: (PK,SK)←KeyGen, Tw←TestKeyGen(SK,w), EncPK(w), DecSK(C) and TestTw(C) Correctness: For all (possibly adversarially chosen) words w, for C←EncPK(w), we have DecSK(C) = w and TestTw(C)=1. For any other (adversarially chosen) word w’, TestTw’(C)=0. May require perfect or statistical correctness. Or, should hold w.h.p against computationally bounded environments choosing w, w’ (after seeing PK, and for w’, possibly after seeing C, Tw also). Secrecy: CPA or CCA security against adversary with oracle access to TestKeyGen(SK, . ), as long as adversary doesn’ t query w0,w1
SLIDE 14
Trivial Solution: using PKE
SLIDE 15
Trivial Solution: using PKE
If the dictionary is small, (PK,SK) = { (PKw,SKw) | w in dictionary}
SLIDE 16
Trivial Solution: using PKE
If the dictionary is small, (PK,SK) = { (PKw,SKw) | w in dictionary} To encrypt a keyword (or, in fact, a list of keywords), EncPK(w)= <EncPK1(0), ..., EncPKw(1), ..., EncPKn(0)>
SLIDE 17
Trivial Solution: using PKE
If the dictionary is small, (PK,SK) = { (PKw,SKw) | w in dictionary} To encrypt a keyword (or, in fact, a list of keywords), EncPK(w)= <EncPK1(0), ..., EncPKw(1), ..., EncPKn(0)> TestKeyGen(SK,w) = SKw
SLIDE 18
Trivial Solution: using PKE
If the dictionary is small, (PK,SK) = { (PKw,SKw) | w in dictionary} To encrypt a keyword (or, in fact, a list of keywords), EncPK(w)= <EncPK1(0), ..., EncPKw(1), ..., EncPKn(0)> TestKeyGen(SK,w) = SKw Keys and ciphertexts proportional to the dictionary size
SLIDE 19
Trivial Solution: using IBE
SLIDE 20
Derive (PKw,SKw) as keys in an IBE scheme for identity w
Trivial Solution: using IBE
SLIDE 21
Derive (PKw,SKw) as keys in an IBE scheme for identity w (PK,SK) = (MPK,MSK) (master keys) for the IBE
Trivial Solution: using IBE
SLIDE 22
Derive (PKw,SKw) as keys in an IBE scheme for identity w (PK,SK) = (MPK,MSK) (master keys) for the IBE To encrypt a keyword (or, in fact, a list of keywords), EncPK(w)= <IBEncPK(0;id=0), ..., IBEncPK(1;id=w), ..., IBEncPK(0;id=n)>
Trivial Solution: using IBE
SLIDE 23
Derive (PKw,SKw) as keys in an IBE scheme for identity w (PK,SK) = (MPK,MSK) (master keys) for the IBE To encrypt a keyword (or, in fact, a list of keywords), EncPK(w)= <IBEncPK(0;id=0), ..., IBEncPK(1;id=w), ..., IBEncPK(0;id=n)> TestKeyGen(SK,w) = SKw, the secret-key for id=w
Trivial Solution: using IBE
SLIDE 24
Derive (PKw,SKw) as keys in an IBE scheme for identity w (PK,SK) = (MPK,MSK) (master keys) for the IBE To encrypt a keyword (or, in fact, a list of keywords), EncPK(w)= <IBEncPK(0;id=0), ..., IBEncPK(1;id=w), ..., IBEncPK(0;id=n)> TestKeyGen(SK,w) = SKw, the secret-key for id=w Compact keys, but ciphertext is still long
Trivial Solution: using IBE
SLIDE 25
PEKS from Anonymous IBE
SLIDE 26
PEKS from Anonymous IBE
Suppose, to encrypt a keyword EncPK(w)= IBEncPK(1;id=w)
SLIDE 27
PEKS from Anonymous IBE
Suppose, to encrypt a keyword EncPK(w)= IBEncPK(1;id=w) Secure?
SLIDE 28
PEKS from Anonymous IBE
Suppose, to encrypt a keyword EncPK(w)= IBEncPK(1;id=w) Secure? IBE ciphertexts may reveal id (can have the id in the clear)
SLIDE 29
PEKS from Anonymous IBE
Suppose, to encrypt a keyword EncPK(w)= IBEncPK(1;id=w) Secure? IBE ciphertexts may reveal id (can have the id in the clear) Anonymous IBE
SLIDE 30
PEKS from Anonymous IBE
Suppose, to encrypt a keyword EncPK(w)= IBEncPK(1;id=w) Secure? IBE ciphertexts may reveal id (can have the id in the clear) Anonymous IBE Ciphertext does not reveal id used, unless has key for that id
SLIDE 31
PEKS from Anonymous IBE
Suppose, to encrypt a keyword EncPK(w)= IBEncPK(1;id=w) Secure? IBE ciphertexts may reveal id (can have the id in the clear) Anonymous IBE Ciphertext does not reveal id used, unless has key for that id
- cf. Anonymous (or key-private) encryption: ciphertext does not
reveal the PK used for encryption (unless SK known)
SLIDE 32
PEKS from Anonymous IBE
Suppose, to encrypt a keyword EncPK(w)= IBEncPK(1;id=w) Secure? IBE ciphertexts may reveal id (can have the id in the clear) Anonymous IBE Ciphertext does not reveal id used, unless has key for that id
- cf. Anonymous (or key-private) encryption: ciphertext does not
reveal the PK used for encryption (unless SK known) Consistency issue: IBE makes no guarantees about what the output is when decrypted using a wrong id’ s key (except that it reveals nothing about the correct plaintext)
SLIDE 33
PEKS from Anonymous IBE
SLIDE 34
PEKS from Anonymous IBE
Consistency issue: IBE makes no guarantees about what the output is when decrypted using a wrong id’ s key (except that it reveals nothing about the correct plaintext)
SLIDE 35
PEKS from Anonymous IBE
Consistency issue: IBE makes no guarantees about what the output is when decrypted using a wrong id’ s key (except that it reveals nothing about the correct plaintext) To encrypt a keyword, EncPK(w)= (IBEncPK(r;id=w),r) for a random message r (|r|=k)
SLIDE 36
PEKS from Anonymous IBE
Consistency issue: IBE makes no guarantees about what the output is when decrypted using a wrong id’ s key (except that it reveals nothing about the correct plaintext) To encrypt a keyword, EncPK(w)= (IBEncPK(r;id=w),r) for a random message r (|r|=k) If decrypting IBEncPK(r;id=w), for a random r, using a wrong id’ s key gives r with significant probability, then breaks IBE security
SLIDE 37
PEKS from Anonymous IBE
Consistency issue: IBE makes no guarantees about what the output is when decrypted using a wrong id’ s key (except that it reveals nothing about the correct plaintext) To encrypt a keyword, EncPK(w)= (IBEncPK(r;id=w),r) for a random message r (|r|=k) If decrypting IBEncPK(r;id=w), for a random r, using a wrong id’ s key gives r with significant probability, then breaks IBE security Breaking IBE’ s security: give out r0,r1; decrypt challenge using the wrong id’ s key; probability of getting r0 when encryption is of r1 is 2-k, but is significant when it is of r0
SLIDE 38
PEKS from Anonymous IBE
Consistency issue: IBE makes no guarantees about what the output is when decrypted using a wrong id’ s key (except that it reveals nothing about the correct plaintext) To encrypt a keyword, EncPK(w)= (IBEncPK(r;id=w),r) for a random message r (|r|=k) If decrypting IBEncPK(r;id=w), for a random r, using a wrong id’ s key gives r with significant probability, then breaks IBE security Breaking IBE’ s security: give out r0,r1; decrypt challenge using the wrong id’ s key; probability of getting r0 when encryption is of r1 is 2-k, but is significant when it is of r0 Or add such “decryption recognition” directly to Anonymous IBE
SLIDE 39
Predicate Encryption
SLIDE 40
Predicate Encryption
Test for properties of encrypted attributes
SLIDE 41
Predicate Encryption
Test for properties of encrypted attributes For C←EncPK(a), we require that boolean TestTp(C)=1 iff P(a)=1
SLIDE 42
Predicate Encryption
Test for properties of encrypted attributes For C←EncPK(a), we require that boolean TestTp(C)=1 iff P(a)=1
TP is the key to test for property P
SLIDE 43
Predicate Encryption
Test for properties of encrypted attributes For C←EncPK(a), we require that boolean TestTp(C)=1 iff P(a)=1 Or TestTp(C) = P(a), for a function P (e.g. P(a,m)=m if P’(a)=1, else ⟂)
TP is the key to test for property P
SLIDE 44
Predicate Encryption
Test for properties of encrypted attributes For C←EncPK(a), we require that boolean TestTp(C)=1 iff P(a)=1 Or TestTp(C) = P(a), for a function P (e.g. P(a,m)=m if P’(a)=1, else ⟂) P from a certain predicate family will be supported
TP is the key to test for property P
SLIDE 45
Predicate Encryption
Test for properties of encrypted attributes For C←EncPK(a), we require that boolean TestTp(C)=1 iff P(a)=1 Or TestTp(C) = P(a), for a function P (e.g. P(a,m)=m if P’(a)=1, else ⟂) P from a certain predicate family will be supported e.g. P that checks for equality (a=w?) (i.e., PEKS), or for range (a∈[r,s]?) or membership in a list (a∈S?)
TP is the key to test for property P
SLIDE 46
Predicate Encryption
Test for properties of encrypted attributes For C←EncPK(a), we require that boolean TestTp(C)=1 iff P(a)=1 Or TestTp(C) = P(a), for a function P (e.g. P(a,m)=m if P’(a)=1, else ⟂) P from a certain predicate family will be supported e.g. P that checks for equality (a=w?) (i.e., PEKS), or for range (a∈[r,s]?) or membership in a list (a∈S?) Trivial solution, when the predicate family is small
TP is the key to test for property P
SLIDE 47
Predicate Encryption
Test for properties of encrypted attributes For C←EncPK(a), we require that boolean TestTp(C)=1 iff P(a)=1 Or TestTp(C) = P(a), for a function P (e.g. P(a,m)=m if P’(a)=1, else ⟂) P from a certain predicate family will be supported e.g. P that checks for equality (a=w?) (i.e., PEKS), or for range (a∈[r,s]?) or membership in a list (a∈S?) Trivial solution, when the predicate family is small (PK,SK)={(PKP,SKP) | P in the predicate family}. Ciphertext has EncPKp(P(a)) for each P.
TP is the key to test for property P
SLIDE 48
Predicate Encryption
Test for properties of encrypted attributes For C←EncPK(a), we require that boolean TestTp(C)=1 iff P(a)=1 Or TestTp(C) = P(a), for a function P (e.g. P(a,m)=m if P’(a)=1, else ⟂) P from a certain predicate family will be supported e.g. P that checks for equality (a=w?) (i.e., PEKS), or for range (a∈[r,s]?) or membership in a list (a∈S?) Trivial solution, when the predicate family is small (PK,SK)={(PKP,SKP) | P in the predicate family}. Ciphertext has EncPKp(P(a)) for each P. Can support functions instead of predicates
TP is the key to test for property P
SLIDE 49
Predicate Encryption
Test for properties of encrypted attributes For C←EncPK(a), we require that boolean TestTp(C)=1 iff P(a)=1 Or TestTp(C) = P(a), for a function P (e.g. P(a,m)=m if P’(a)=1, else ⟂) P from a certain predicate family will be supported e.g. P that checks for equality (a=w?) (i.e., PEKS), or for range (a∈[r,s]?) or membership in a list (a∈S?) Trivial solution, when the predicate family is small (PK,SK)={(PKP,SKP) | P in the predicate family}. Ciphertext has EncPKp(P(a)) for each P. Can support functions instead of predicates e.g. Can attach a message to be revealed if Test positive
TP is the key to test for property P
SLIDE 50
Predicate Encryption
Test for properties of encrypted attributes For C←EncPK(a), we require that boolean TestTp(C)=1 iff P(a)=1 Or TestTp(C) = P(a), for a function P (e.g. P(a,m)=m if P’(a)=1, else ⟂) P from a certain predicate family will be supported e.g. P that checks for equality (a=w?) (i.e., PEKS), or for range (a∈[r,s]?) or membership in a list (a∈S?) Trivial solution, when the predicate family is small (PK,SK)={(PKP,SKP) | P in the predicate family}. Ciphertext has EncPKp(P(a)) for each P. Can support functions instead of predicates e.g. Can attach a message to be revealed if Test positive Can use IBE to shorten keys. Ciphertext still too long.
TP is the key to test for property P
SLIDE 51
Predicate Encryption
SLIDE 52
Predicate Encryption
Comparison predicates (given Enc(a), for a∈[1,n], check if a ≥ q)
SLIDE 53
Predicate Encryption
Comparison predicates (given Enc(a), for a∈[1,n], check if a ≥ q) Can use a “set-hiding” broadcast encryption for intervals
SLIDE 54
Predicate Encryption
Comparison predicates (given Enc(a), for a∈[1,n], check if a ≥ q) Can use a “set-hiding” broadcast encryption for intervals Will see in next lecture
SLIDE 55
Predicate Encryption
Comparison predicates (given Enc(a), for a∈[1,n], check if a ≥ q) Can use a “set-hiding” broadcast encryption for intervals Will see in next lecture Idea: create ciphertexts that can be decrypted by keys in a range. To encrypt a, encrypt a random message addressed to the range [a,n]. Test key is the key for index q.
SLIDE 56
Predicate Encryption
Comparison predicates (given Enc(a), for a∈[1,n], check if a ≥ q) Can use a “set-hiding” broadcast encryption for intervals Will see in next lecture Idea: create ciphertexts that can be decrypted by keys in a range. To encrypt a, encrypt a random message addressed to the range [a,n]. Test key is the key for index q. Extends to range checking
SLIDE 57
Conjunctive Predicates
SLIDE 58
Conjunctive Predicates
Predicates of the form (ϕ1(a1) AND .... AND ϕn(am))
SLIDE 59
Conjunctive Predicates
Predicates of the form (ϕ1(a1) AND .... AND ϕn(am)) Should not reveal which clauses were not satisfied, if any
SLIDE 60
Conjunctive Predicates
Predicates of the form (ϕ1(a1) AND .... AND ϕn(am)) Should not reveal which clauses were not satisfied, if any e.g. in [BW07] ϕi can be equality check (a=w?), comparison (a ≥ q?), range check (a∈[r,s]?) or membership in a list (a∈S?)
SLIDE 61
Conjunctive Predicates
Predicates of the form (ϕ1(a1) AND .... AND ϕn(am)) Should not reveal which clauses were not satisfied, if any e.g. in [BW07] ϕi can be equality check (a=w?), comparison (a ≥ q?), range check (a∈[r,s]?) or membership in a list (a∈S?) Tool: Hidden Vector matching, in which each ϕi is an equality check or a don’ t care
SLIDE 62
Conjunctive Predicates
Predicates of the form (ϕ1(a1) AND .... AND ϕn(am)) Should not reveal which clauses were not satisfied, if any e.g. in [BW07] ϕi can be equality check (a=w?), comparison (a ≥ q?), range check (a∈[r,s]?) or membership in a list (a∈S?) Tool: Hidden Vector matching, in which each ϕi is an equality check or a don’ t care e.g. Using hidden vector matching to implement a conjunctive comparison predicate: for all i, ai ≥ ri
SLIDE 63
Conjunctive Predicates
Predicates of the form (ϕ1(a1) AND .... AND ϕn(am)) Should not reveal which clauses were not satisfied, if any e.g. in [BW07] ϕi can be equality check (a=w?), comparison (a ≥ q?), range check (a∈[r,s]?) or membership in a list (a∈S?) Tool: Hidden Vector matching, in which each ϕi is an equality check or a don’ t care e.g. Using hidden vector matching to implement a conjunctive comparison predicate: for all i, ai ≥ ri Check if binary [Xaij] defined as Xaij = 1 iff j ≤ ai, matches with [Trij] defined as Trij= 1 if j ≤ ri, and * otherwise
SLIDE 64
Conjunctive Predicates
SLIDE 65
Conjunctive Predicates
Using hidden vector matching for set membership: a∈S⊆[1,n]?
SLIDE 66
Conjunctive Predicates
Using hidden vector matching for set membership: a∈S⊆[1,n]? Set membership is a disjunction of equalities: can be represented as (the negation of) a conjunction of inequalities
SLIDE 67
Conjunctive Predicates
Using hidden vector matching for set membership: a∈S⊆[1,n]? Set membership is a disjunction of equalities: can be represented as (the negation of) a conjunction of inequalities Check if binary vector Xa defined as Xai = 1 iff a=i, matches with TS defined as TSi= 0 if i∉S, and * otherwise
SLIDE 68
Conjunctive Predicates
Using hidden vector matching for set membership: a∈S⊆[1,n]? Set membership is a disjunction of equalities: can be represented as (the negation of) a conjunction of inequalities Check if binary vector Xa defined as Xai = 1 iff a=i, matches with TS defined as TSi= 0 if i∉S, and * otherwise Key and ciphertext proportional to size of universe [1,n]
SLIDE 69
Conjunctive Predicates
Using hidden vector matching for set membership: a∈S⊆[1,n]? Set membership is a disjunction of equalities: can be represented as (the negation of) a conjunction of inequalities Check if binary vector Xa defined as Xai = 1 iff a=i, matches with TS defined as TSi= 0 if i∉S, and * otherwise Key and ciphertext proportional to size of universe [1,n] Can extend to conjunction with other predicates
SLIDE 70
Conjunctive Predicates
Using hidden vector matching for set membership: a∈S⊆[1,n]? Set membership is a disjunction of equalities: can be represented as (the negation of) a conjunction of inequalities Check if binary vector Xa defined as Xai = 1 iff a=i, matches with TS defined as TSi= 0 if i∉S, and * otherwise Key and ciphertext proportional to size of universe [1,n] Can extend to conjunction with other predicates More efficient set membership?
SLIDE 71
Bloom Filters
SLIDE 72
Bloom Filters
Elements x in the universe mapped to n-bit binary vectors h(x)
SLIDE 73
Bloom Filters
Elements x in the universe mapped to n-bit binary vectors h(x) A subset S is represented by H(S) = ⋁x∈S h(x) (i.e., bit-wise OR)
SLIDE 74
Bloom Filters
Elements x in the universe mapped to n-bit binary vectors h(x) A subset S is represented by H(S) = ⋁x∈S h(x) (i.e., bit-wise OR) Given H(S), to check if x∈S, for each coordinate i s.t h(x)i = 1, check that H(S)i = 1
SLIDE 75
Bloom Filters
Elements x in the universe mapped to n-bit binary vectors h(x) A subset S is represented by H(S) = ⋁x∈S h(x) (i.e., bit-wise OR) Given H(S), to check if x∈S, for each coordinate i s.t h(x)i = 1, check that H(S)i = 1 No false negatives
SLIDE 76
Bloom Filters
Elements x in the universe mapped to n-bit binary vectors h(x) A subset S is represented by H(S) = ⋁x∈S h(x) (i.e., bit-wise OR) Given H(S), to check if x∈S, for each coordinate i s.t h(x)i = 1, check that H(S)i = 1 No false negatives False positive if all i s.t. h(x)i = 1 are covered by h(x’) for a set
- f other values x’
SLIDE 77
Bloom Filters
Elements x in the universe mapped to n-bit binary vectors h(x) A subset S is represented by H(S) = ⋁x∈S h(x) (i.e., bit-wise OR) Given H(S), to check if x∈S, for each coordinate i s.t h(x)i = 1, check that H(S)i = 1 No false negatives False positive if all i s.t. h(x)i = 1 are covered by h(x’) for a set
- f other values x’
If h is a random function with outputs of weight d, can bound the false positive rate in terms of n, d and |S|
SLIDE 78
Bloom Filters
Elements x in the universe mapped to n-bit binary vectors h(x) A subset S is represented by H(S) = ⋁x∈S h(x) (i.e., bit-wise OR) Given H(S), to check if x∈S, for each coordinate i s.t h(x)i = 1, check that H(S)i = 1 No false negatives False positive if all i s.t. h(x)i = 1 are covered by h(x’) for a set
- f other values x’
If h is a random function with outputs of weight d, can bound the false positive rate in terms of n, d and |S| Or h a CRHF with range being indices of a “cover free set system”
SLIDE 79
Set-Membership Predicate with Bloom Filters
SLIDE 80
Set-Membership Predicate with Bloom Filters
To check a ∈ S ⊆ U, where the universe U can be large
SLIDE 81
Set-Membership Predicate with Bloom Filters
To check a ∈ S ⊆ U, where the universe U can be large Checking if a ∈ S amounts to checking if the vector h(a) is covered by H(S)
SLIDE 82
Set-Membership Predicate with Bloom Filters
To check a ∈ S ⊆ U, where the universe U can be large Checking if a ∈ S amounts to checking if the vector h(a) is covered by H(S) Implemented using hidden vector matching
SLIDE 83
Set-Membership Predicate with Bloom Filters
To check a ∈ S ⊆ U, where the universe U can be large Checking if a ∈ S amounts to checking if the vector h(a) is covered by H(S) Implemented using hidden vector matching S encrypted: Ta defined as: Tai = 1 if h(a)i = 1, else *
SLIDE 84
Set-Membership Predicate with Bloom Filters
To check a ∈ S ⊆ U, where the universe U can be large Checking if a ∈ S amounts to checking if the vector h(a) is covered by H(S) Implemented using hidden vector matching S encrypted: Ta defined as: Tai = 1 if h(a)i = 1, else * a encrypted: TS defined as: TSi= 0 if H(S)=0, else *
SLIDE 85
Inner-product Predicate
SLIDE 86
Inner-product Predicate
Attribute a is a vector. Predicate Pv is also specified by a vector v: Pv(a) = 1 iff <v,a> = 0
SLIDE 87
Inner-product Predicate
Attribute a is a vector. Predicate Pv is also specified by a vector v: Pv(a) = 1 iff <v,a> = 0 Or function Pv : Pv(a,m)=m iff <v,a>=0, else ⊥
SLIDE 88
Inner-product Predicate
Attribute a is a vector. Predicate Pv is also specified by a vector v: Pv(a) = 1 iff <v,a> = 0 Or function Pv : Pv(a,m)=m iff <v,a>=0, else ⊥ General enough to capture several applications
SLIDE 89
Inner-product Predicate
Attribute a is a vector. Predicate Pv is also specified by a vector v: Pv(a) = 1 iff <v,a> = 0 Or function Pv : Pv(a,m)=m iff <v,a>=0, else ⊥ General enough to capture several applications e.g. Anonymous IBE from Inner-Product PE (with attached messages) over attributes in ZN x ZN
SLIDE 90
Inner-product Predicate
Attribute a is a vector. Predicate Pv is also specified by a vector v: Pv(a) = 1 iff <v,a> = 0 Or function Pv : Pv(a,m)=m iff <v,a>=0, else ⊥ General enough to capture several applications e.g. Anonymous IBE from Inner-Product PE (with attached messages) over attributes in ZN x ZN For encrypting to identity id use attribute aid = (1,id). SKid is the test key for predicate with vid = (-id,1). Anonymity: attribute remains hidden if no matching SK given
SLIDE 91
Inner-product Predicate
SLIDE 92
Inner-product Predicate
Can be used to get Hidden Vector matching predicate
SLIDE 93
Inner-product Predicate
Can be used to get Hidden Vector matching predicate Map a given pattern vector of length m to a vector v in (ZN)2m by mapping * to (0,0) and a to (1,a).
SLIDE 94
Inner-product Predicate
Can be used to get Hidden Vector matching predicate Map a given pattern vector of length m to a vector v in (ZN)2m by mapping * to (0,0) and a to (1,a). Map the hidden attribute vector u to a vector a by mapping each co-ordinate ui to ( -ri.ui , ri ), for random ri
SLIDE 95
Inner-product Predicate
Can be used to get Hidden Vector matching predicate Map a given pattern vector of length m to a vector v in (ZN)2m by mapping * to (0,0) and a to (1,a). Map the hidden attribute vector u to a vector a by mapping each co-ordinate ui to ( -ri.ui , ri ), for random ri If pattern matches u, then <v,a>=0
SLIDE 96
Inner-product Predicate
Can be used to get Hidden Vector matching predicate Map a given pattern vector of length m to a vector v in (ZN)2m by mapping * to (0,0) and a to (1,a). Map the hidden attribute vector u to a vector a by mapping each co-ordinate ui to ( -ri.ui , ri ), for random ri If pattern matches u, then <v,a>=0 Random ri to avoid cancelations while summing, so that if pattern does not match, w.h.p <v,a>≠0
SLIDE 97
Inner-product Predicate
Can be used to get Hidden Vector matching predicate Map a given pattern vector of length m to a vector v in (ZN)2m by mapping * to (0,0) and a to (1,a). Map the hidden attribute vector u to a vector a by mapping each co-ordinate ui to ( -ri.ui , ri ), for random ri If pattern matches u, then <v,a>=0 Random ri to avoid cancelations while summing, so that if pattern does not match, w.h.p <v,a>≠0 Can support * in both the pattern and the hidden vector
SLIDE 98
Inner-product Predicate
SLIDE 99
Inner-product Predicate
Other predicates implied:
SLIDE 100
Inner-product Predicate
Other predicates implied: Polynomials: Pv can be a polynomial (represented as a vector
- f co-efficients) and attribute a the value (represented as the
vector <1,a,a2,...,ad>) at which Pv is evaluated, or vice versa
SLIDE 101
Inner-product Predicate
Other predicates implied: Polynomials: Pv can be a polynomial (represented as a vector
- f co-efficients) and attribute a the value (represented as the
vector <1,a,a2,...,ad>) at which Pv is evaluated, or vice versa Disjunction (a1=v1) OR (a2=v2): polynomial (a1-v1) (a2-v2)
SLIDE 102
Inner-product Predicate
Other predicates implied: Polynomials: Pv can be a polynomial (represented as a vector
- f co-efficients) and attribute a the value (represented as the
vector <1,a,a2,...,ad>) at which Pv is evaluated, or vice versa Disjunction (a1=v1) OR (a2=v2): polynomial (a1-v1) (a2-v2) Conjunction (a1=v1) AND (a2=v2): r1(a1-v1) + r2(a2-v2)
SLIDE 103
Inner-product Predicate
Other predicates implied: Polynomials: Pv can be a polynomial (represented as a vector
- f co-efficients) and attribute a the value (represented as the
vector <1,a,a2,...,ad>) at which Pv is evaluated, or vice versa Disjunction (a1=v1) OR (a2=v2): polynomial (a1-v1) (a2-v2) Conjunction (a1=v1) AND (a2=v2): r1(a1-v1) + r2(a2-v2) Exact threshold: for A, V ⊆ [1,n], PV
,t(A) = 1 iff |A⋂V|=t
SLIDE 104
Inner-product Predicate
Other predicates implied: Polynomials: Pv can be a polynomial (represented as a vector
- f co-efficients) and attribute a the value (represented as the
vector <1,a,a2,...,ad>) at which Pv is evaluated, or vice versa Disjunction (a1=v1) OR (a2=v2): polynomial (a1-v1) (a2-v2) Conjunction (a1=v1) AND (a2=v2): r1(a1-v1) + r2(a2-v2) Exact threshold: for A, V ⊆ [1,n], PV
,t(A) = 1 iff |A⋂V|=t
Map V to v as v0=1 and for i=1 to n, vi = 1 iff i∈V . Map A to a vector a where a0 = -t, for i=1 to n, ai = 1 iff i∈A.
SLIDE 105
Predicate/Functional Encryption
SLIDE 106
Predicate/Functional Encryption
Constructions using bilinear pairings known [KSW08,LOSTW10,OT10]
SLIDE 107
Predicate/Functional Encryption
Constructions using bilinear pairings known [KSW08,LOSTW10,OT10] Supports inner product predicates (and more)
SLIDE 108
Predicate/Functional Encryption
Constructions using bilinear pairings known [KSW08,LOSTW10,OT10] Supports inner product predicates (and more) Can base security on Decision Linear assumption
SLIDE 109
Predicate/Functional Encryption
Constructions using bilinear pairings known [KSW08,LOSTW10,OT10] Supports inner product predicates (and more) Can base security on Decision Linear assumption Can get CCA security
SLIDE 110
Today
SLIDE 111
Today
Searching on Encrypted Data
SLIDE 112
Today
Searching on Encrypted Data To check if encrypted keyword matches a given keyword
SLIDE 113
Today
Searching on Encrypted Data To check if encrypted keyword matches a given keyword From anonymous IBE
SLIDE 114
Today
Searching on Encrypted Data To check if encrypted keyword matches a given keyword From anonymous IBE Predicate/Functional encryption
SLIDE 115
Today
Searching on Encrypted Data To check if encrypted keyword matches a given keyword From anonymous IBE Predicate/Functional encryption To check if encrypted attributes satisfy a given predicate
SLIDE 116
Today
Searching on Encrypted Data To check if encrypted keyword matches a given keyword From anonymous IBE Predicate/Functional encryption To check if encrypted attributes satisfy a given predicate Hidden vector matching, inner-product predicate, ...