Dynamic Searchable Encryption with Small Client Storage

Abstract

We study the problem of dynamic searchable encryption (DSE) with forward-and-backward privacy. Many DSE schemes have been proposed recently but the most efficient ones have one limitation: they require maintaining one operation counter for each unique keyword, either stored locally at the client or stored encrypted at the server and accessed obliviously (e.g., with an oblivious map) during every operation. We propose three new schemes that overcome the above limitation and achieve constant permanent client storage with improved performance, both asymptotically and experimentally, compared to prior stateof-the-art works. In particular, our first two schemes adopt a "static-to-dynamic" transformation which eliminates the need for oblivious accesses during searches. Due to this, they are the first practical schemes with minimal client storage and non-interactive search. Our third scheme is the first quasi-optimal forward-andbackward DSE scheme with only a logarithmic overhead for retrieving the query result (independently of previous deletions). While it does require an oblivious access during search in order to keep permanent client storage minimal, its practical performance is up to four orders of magnitude better than the best existing scheme with quasi-optimal search.

Practical Non-Interactive Searchable Encryption with Forward and Backward Privacy

“…At the same time, Sun et al [52] proposed a practical Type-III scheme Janus++ by making use of their symmetric puncturable encryption. Very recently, Demertzis et al [22] proposed three new schemes focusing on small client storage, namely Type-III scheme QOS, Type-II schemes SD a and SD d . All these schemes achieve different tradeoffs between security and efficiency.…”

“…We compare Aura with the interactive and non-interactive SSE schemes. Regarding the interactive ones, there exist several schemes [9], [15], [22] achieving Type-II backward privacy. In our evaluation, we compare with the most efficient scheme SD d [22], that features small client storage at the expense of interactive update and search.…”

“…Regarding the interactive ones, there exist several schemes [9], [15], [22] achieving Type-II backward privacy. In our evaluation, we compare with the most efficient scheme SD d [22], that features small client storage at the expense of interactive update and search. Since SD d is not implemented under the network environment, we adapt its original implementation to make it compatible with Thrift.…”

“…We implement Aura and perform a comprehensive evaluation. The results show that Aura outperforms both the state-of-the-art (non)-interactive forward and backward-private DSSE schemes (Janus++ [52] and SD d [22]) in terms of search time, insertion time, deletion time, and communication cost.…”

“…However, most existing schemes achieve different tradeoffs between computation/communication cost and security guarantees. In brief, the Type-I schemes [9], [15] are based on ORAMs, and Type-II schemes [9], [15], [22] need high communication cost and multiple rounds of interactions to perform a search/update query. This cost incurred by interactions is usually non-negligible and will lead to a noticeable delay (20 − 30× slower than the non-interactive scheme as in our evaluation) in the realworld network environment.…”