Efficient Dynamic Searchable Encryption with Forward Privacy

Abstract

Searchable symmetric encryption (SSE) enables a client to perform searches over its outsourced encrypted files while preserving privacy of the files and queries. Dynamic schemes, where files can be added or removed, leak more information than static schemes. For dynamic schemes, forward privacy requires that a newly added file cannot be linked to previous searches. We present a new dynamic SSE scheme that achieves forward privacy by replacing the keys revealed to the server on each search. Our scheme is efficient and parallelizable and outperforms the best previous schemes providing forward privacy, and achieves competitive performance with dynamic schemes without forward privacy. We provide a full security proof in the random oracle model. In our experiments on the Wikipedia archive of about four million pages, the server takes one second to perform a search with 100,000 results.

A Secure Searchable Encryption Framework for Privacy-Critical Cloud Storage Services

“…Recently, several forward-private DSSE schemes only relying on symmetric primitives have been proposed (e.g., [20], [21], [22], [23]), some of which offer parallelism (e.g., [20], [21], [23]), and improved I/O access with computation efficiency using a caching strategy (e.g., [20], [21], [22]). For example, Lai et al in [20] modeled the relationship between keywords and files in DSSE as bipartite graphs.…”

“…• Highly secure against File-Injection Attacks: IM-DSSE offers forward privacy (see [2] or §4 for definition) which is an imperative security feature to mitigate the impact of practical file-injection attacks [11], [16]. Only a limited number of DSSE schemes offer this property (i.e., [2], [11], [15], [18], [20], [21], [22], [23]), some of which incur high client storage with costly update (e.g., [2]) or high delay, due to oblivious access techniques (e.g., [18]) and public-key operations (e.g., [11]). Additionally, IM-DSSE offers size-obliviousness property, where it hides all size information involved with the encrypted index and update query including (i) update query size (i.e., number of unique keywords in the updated file); (ii) and the number of keyword-file pairs in the database.…”

“…• Fully Parallelizable: IM-DSSE also supports parallelization (as in [5], [20], [21], [23]) for both update and search operations and, therefore, it takes full advantage of modern computing architecture to minimize the delay of cryptographic operations. Experiments on Amazon cloud indicates that the search latency of our framework is highly practical and mostly dominated by the clientserver communication (see §5).…”

Hardware-Supported ORAM in Effect: Practical Oblivious Search and Update on Very Large Dataset

“…Kamara et al [44] proposed a Dynamic SSE (DSSE) scheme that supports update functionality. Afterward, several DSSE schemes proposed offering different features in terms of security (e.g., [9]), efficiency (e.g., [14,22,45]), and query functionalities (e.g., [15,43,74]). Another line of research focuses on developing encrypted query techniques that are compliant with legacy systems.…”

“…23: Build keyword hash table (TW). All data in ORAM structures(12,22) are encrypted with ORAM key ko. B, B denote an ORAM block in ODS-DB and ODS-IDX, resp.…”