Search pattern leakage in searchable encryption: Attacks and new construction

Abstract

Searching on remote encrypted data (commonly known as searchable encryption) has become an important issue in secure data outsourcing, since it allows users to outsource encrypted data to an untrusted third party while maintains the capability of keyword search on the data.Searchable encryption can be achieved using the classical method called oblivious RAM, but the resultant schemes are too inefficient to be applied in the real-world scenarios (e.g., cloud computing). Recently, a number of efficient searchable encryption schemes have been proposed under weaker security guarantees. Such schemes, however, still leak statistical information about the users' search pattern.In this paper, we first present two concrete attack methods to show that the search pattern leakage will result in such a situation: an adversary who has some auxiliary knowledge can uncover the underlying keywords of user queries. To address this issue, we then develop a grouping-based construction (GBC) to transform an existing searchable encryption scheme to a new scheme hiding the search pattern. Finally, experiments based on the realworld dataset demonstrate the effectiveness of our attack methods and the feasibility of our construction.

A Leakage-Abuse Attack Against Multi-User Searchable Encryption

“…Recent papers on leakage-abuse attacks [6,12,15,21,22,32] show that the threat caused by prior knowledge is becoming a matter of concern in single-user SE. This threat is even more serious in the multi-user setting where the dataset is owned and accessed by a number of users and users do not trust other users except the ones they explicitly authorize to search their data.…”

Cloud Computing Information System Architecture for Precast Supply Chain Management

“…It is an approach to outsource data with the aim of decreasing the data storage and reducing the management issues [21]. Main benefits of cloud computing implementation are: less infrastructure investment, convenience, flexibility, enhanced performance and cost reduction [5].…”

Distributed Searchable Symmetric Encryption

“…Revealing the search pattern in SSE schemes is a serious problem, as it allows an attacker to perform statistical analysis on the occurrence frequency of each query. This allows an attacker to gain knowledge on the underlying plaintext keywords, rendering the encryption scheme less useful (as is convincingly demonstrated by Liu et al [20]). The problem of leaking the search pattern is not only recognized in the setting of SSE, but also in the setting of predicate encryption [25].…”