Privacy-Preserving Pattern Matching on Encrypted Data

Abstract

Pattern matching is one of the most fundamental and important paradigms in several application domains such as digital forensics, cyber threat intelligence, or genomic and medical data analysis. While it is a straightforward operation when performed on plaintext data, it becomes a challenging task when the privacy of both the analyzed data and the analysis patterns must be preserved. In this paper, we propose new provably correct, secure, and relatively efficient (compared to similar existing schemes) public and private key based constructions that allow arbitrary pattern matching over encrypted data while protecting both the data to be analyzed and the patterns to be matched. That is, except the pattern provider (resp. the data owner), all other involved parties in the proposed constructions will learn nothing about the patterns to be searched (resp. the data to be inspected). Compared to existing solutions, the constructions we propose has some interesting properties: (1) the size of the ciphertext is linear to the size of plaintext and independent of the sizes and the number of the analysis patterns; (2) the sizes of the issued trapdoors are constant on the size of the data to be analyzed; and (3) the search complexity is linear on the size of the data to be inspected and is constant on the sizes of the analysis patterns. The conducted evaluations show that our constructions drastically improve the performance of the most efficient state of the art solution.

Public Key Encryption with Flexible Pattern Matching

“…Very recently, [3] addresses some of the problems above by introducing a fragmentation approach that consists in splitting the stream into non-overlapping fragments F h and into other non-overlapping fragments F h that straddle the former. This technique will be explained in more details in Section 4.1 but intuitively this is done in such a way that any searched pattern is entirely contained by a fragment F h or F h .…”

“…Based on this fragmentation approach, the authors of [3] propose a construction that allows to test the presence of one pattern at one position for a constant cost of 2 pairings. Moreover the dependency of the public key on the length of the string is replaced by a fixed upper bound on the length of the keywords to be searched, which is indeed much smaller in the context of DPI.…”

“…But this construction uses twice as many ciphertext elements as in [13] and shares several features with it, including the fact that security still relies on the interactive i-GDH assumption and that the public key depends linearly on the size of the alphabet. The authors of [3] also consider the notion of pattern privacy, meaning that the trapdoors should not reveal the corresponding pattern but, as already noted in [13], it is very hard to retain this property for this kind of schemes, which leads to a security model in [3] that seems a bit contrived. Moreover, in the asymmetric setting that we consider here, this property can only be achieved for patterns originating from a high min-entropy set as in [5].…”

“…From the efficiency standpoint, we note that [3] manages to reduce the size of the public key and the complexity of the detection procedure, compared to [13], but at the cost of ciphertexts containing twice as many elements. Moreover, if L is the size of the fragments and S is the plaintext alphabet (that is, we encrypt strings of characters b ∈ S) the public key of [3] is essentially of size L|S|, which remains quite important for many use-cases. For example, in the DPI context, it is natural to consider bytestrings which means that |S| = 256.…”

“…To stress these specificities, we call such a scheme a stream encryption supporting pattern matching. Recent papers use bilinear groups to provide public key constructions supporting these features [3,13]. These solutions are lighter than more generic ones (e.g.…”