Security-Efficiency Tradeoffs in Searchable Encryption

Abstract

Besides their security, the efficiency of searchable encryption schemes is a major criteria when it comes to their adoption: in order to replace an unencrypted database by a more secure construction, it must scale to the systems which rely on it. Unfortunately, the relationship between the efficiency and the security of searchable encryption has not been widely studied, and the minimum cost of some crucial security properties is still unclear. In this paper, we present new lower bounds on the trade-offs between the size of the client state, the efficiency and the security for searchable encryption schemes. These lower bounds target two kinds of schemes: schemes hiding the repetition of search queries, and forward-private dynamic schemes, for which updates are oblivious. We also show that these lower bounds are tight, by either constructing schemes matching them, or by showing that even a small increase in the amount of leaked information allows for constructing schemes breaking the lower bounds.

A provably lightweight and secure DSSE scheme, with a constant storage cost for a smart device client

“…decrypting the results obtained from the server. Algorithm 3, specifically lines (25)(26)(27), is employed for the decryption process. Subsequently, the client generates a filter line (25)(26)(27) to identify and retain the values that were added, ensuring that only those additions and not the deleted values persist within the designated group ID 1 .…”

“…Algorithm 3, specifically lines (25)(26)(27), is employed for the decryption process. Subsequently, the client generates a filter line (25)(26)(27) to identify and retain the values that were added, ensuring that only those additions and not the deleted values persist within the designated group ID 1 . After decryption, the plaintext data and current Con are returned to the server for storage in the hash table S r .…”

“…After this, the researchers turned their attention to Dynamic SSE (DSSE) [20][21][22][23][24][25][26]. Secure DSSE schemes are challenging, from a security perspective, because database updates may reveal additional information to the server.…”

Hermes: I/O-Efficient Forward-Secure Searchable Symmetric Encryption

“…For now, we note that it involves buffering O (W ) updates on the client side before pushing them to the server, where W is an upper bound on the number of searchable keywords. It was proved in [10] that single-round forward-secure SSE requires Ω(W ) client storage. As a consequence, the new buffer does not increase client storage beyond a constant factor 3 .…”

“…Recall that our scheme uses W bins, each of capacity one page. As noted in the introduction, single-round forward-secure SSE requires Ω(W ) client storage [10]. If we buffer W updates on the client before pushing them to the server, we can afford to scan all W bins.…”