Searchable Encryption Applied Cryptography ECECS 498 AM University

Searchable Encryption Applied Cryptography ECE/CS 498 AM University of Illinois

Searchable Encryption • Client wants to outsource files to server bur retain search functionality • Client wants to: 1. Send all documents to server 2. Query the server to retrieve some document(s) 3. Add, delete (or update) documents • How to do this securely and efficiently? 2

Searchable Encryption Server Client Queries w 1, w 2, … Security: “the server should learn nothing about the client’s files. ” 3

Solutions? • Yao’s Garbled Circuits (MPC)? – Huge overhead: • Circuit must decrypt entire dataset • New circuit for every query • Oblivious RAM? 4

In-place Construction • First idea: – A document is just a collection of keywords – Encrypt each keyword of each document using deterministic encryption Doc: Encrypted Doc: … … 5

In-place Construction • First idea: – A document is just a collection of keywords – Encrypt each keyword of each document using deterministic encryption Doc: Encrypted Doc: • What is leaked? … … 6

In-place Construction • A better idea: – Dawn Song, David Wagner, and Adrian Perrig. "Practical techniques for searches on encrypted data. " In IEEE S&P, 2000. Keyword Ciphertext: 7

In-place Construction • Final construction: – Dawn Song, David Wagner, and Adrian Perrig. "Practical techniques for searches on encrypted data. " In IEEE S&P, 2000. Keyword Ciphertext: Client can hide position of matches by randomly permuting ciphertexts 8

9

Searchable Encryption • Relevant for security: 1. 2. Search outcome: doc(s) identifier(s) that match a query Search pattern: whether queries are for the same keywords • Desideratum: – A secure searchable encryption scheme should reveal nothing other than the search outcome and the search pattern. • Consequences of revealing search outcome and search pattern? – Lecture on Thursday: Attacks on Searchable Encryption 10

Searchable Encryption • Why not build an index? Source: http: //th 30 z. blogspot. com/2010/10/python-inverted-index-for-dummies. html 11

Searchable Encryption Initialization Client Server Search Client Keyword w Server encrypted keyword w 12

Model & Terminology • History: documents & their contents • View: encrypted index and search tokens • Trace: search outcome, search pattern, size of documents Client Server 13

Algorithms • client server 14

SSE: Intuition • 15

Searchable Encryption with Index • Server Document IDs Client 3, 5 1, 7, 16 3, 5 7 13, 11, 5, 2, 1 Encrypted Index 16

Searchable Encryption with Index Server Document IDs Client 3, 5 1, 7, 16 3, 5 7 13, 11, 5, 2, 1 Encrypted Index • What is leaked? – Before the first query? – After? 17

Basic SSE • 18

Basic SSE • 19

Basic SSE • 20

Basic SSE: Analysis • Correctness: • Security: 21

22

Updates? • Dynamic Symmetric Searchable Encryption (DSSE): – Seny Kamara, Charalampos Papamanthou, and Tom Roeder. "Dynamic searchable symmetric encryption. " In ACM CCS, 2012. • Add a document • Delete a document • Client creates tokens so the server can update the index 23

Dynamic SSE Keyword Tokens Encrypted address Encrypted Nodes doc_id next_ptr 24

Dynamic SSE • 25

Dynamic SSE • 26

Dynamic SSE • 27

Dynamic SSE: Analysis • Correctness: • Security: • Why is it dynamic? 28

Dynamic SSE • 29

Security of Searchable Encryption • Formalization of security: – “Leakage profile” approach of [CGKO 06] • Leakage profile: – Simulation-based approach – Define a “leakage profile” for each construction: • Characterizes exactly what information an adversary can learn – Prove security by producing a simulator which outputs a view indistinguishable from real functionality – Simulator is given exactly what is in the leakage profile • Beware: can give a false sense of what is actually guaranteed 30

Security of Searchable Encryption • 31

References • [SWP 00] Song, Dawn Xiaoding, David Wagner, and Adrian Perrig. "Practical techniques for searches on encrypted data. " In IEEE S&P, 2000. • [CGKO 11] Reza Curtmola, Juan Garay, Seny Kamara, and Rafail Ostrovsky. "Searchable symmetric encryption: improved definitions and efficient constructions. " Journal of Computer Security 19, no. 5 (2011): 895 -934. • [KPR 12] Seny Kamara, Charalampos Papamanthou, and Tom Roeder. "Dynamic searchable symmetric encryption. " In ACM CCS, 2012. 32