how to keyword-search securely in cloud storage service kaoru kurosawa ibaraki university, japan...

How to Keyword-Search Securely in Cloud Storage Service

Kaoru Kurosawa Ibaraki University, Japan

ICISC 2014, Dec. 3-5, Chung-Ang University, Korea

Cloud Storage Serviceis now available

Service Provider

Amazon S3/Cloud Drive Amazon

Google Drive Google

OneDrive Microsoft

iCloud Apple

Dropbox Dropbox

and many more

We know that

• we should store encrypted documents.• Then, we cannot even do keyword search.

A Searchable Symmetric Encryption(SSE) scheme

• solves this problem.• It consists of a store phase and a search phase.

In the store phase,

• A client stores the encrypted files (or documents) and the encrypted Index on the server

Client Server

E(D1), , E(D⋯ N) E(Index)

In the search phase,

• The client sends an encrypted keyword to the server

Client Server

E(keyword)

The server somehow returns

• The encrypted files E(D3), E(D6), E(D10)

which contain the keyword

Client Server

E(keyword)

E(D3), E(D6), E(D10)

So the client can

• retrieve some of the encrypted files• which contain a specific keyword,• keeping the keyword secret

Client Server

E(keyword)

E(D3), E(D6), E(D10)

SSE has been studied by

• D.Song, D.Wagner, A.Perrig (2000)• Eu-Jin Goh (2003)• Golle, Staddon, Waters (2004)• Y.Chang and M.Mitzenmacher (2005)• Curtmola, Garay, Kamara and Ostrovsky (2006)• Peishun Wang, Huaxiong Wang, Josef Pieprzyk (2008)• Kamara, Papamanthou an Roeder (2012)• Cash, Jarecki, Jutla, Krawczyk, Rosu, Steiner (2013)• Cash and Tessaro (2014)

In this talk,

• UC-Secure Searchable Symmetric Encryption

• How to Update Documents Verifiably in Searchable Symmetric Encryption

• Garbled Searchable Symmetric Encryption

• UC-Secure Searchable Symmetric Encryption, Kaoru Kurosawa and Yasuhiro Ohtaki (FC 2012)

By Passive Attack

• A server tries to break the privacy:• she tries to find • the keyword and the documents

Client Server

E(keyword)

E(D3), E(D6), E(D10)

Malicious

By Active Attack• A server tries to break the reliability:• she tries to forge and delete some files,• or replace E(D3) with another E(D100).

Client Server

E(keyword)

E(D3), E(D6), E(D10)E(D100)

Malicious

Curtmola, Garay, Kamara and Ostrovsky (2006)

• showed a rigorous definition of security against passive attacks (privacy.)• They also presented a scheme which satisfies their definition.

At FC 2012

Privacy Curtmola et al.Reliability Our paperUC security Our paper

We studied

and proved that Privacy + Reliability = UC security

Curtmola et al.

keyword DocumentsAustin D3, D6, D10

Boston D8, D10

Washington D1, D4, D8

Showed an SSE scheme such as follows.

Consider the following “Index”

Index16

The client first constructs E(Index) • as follows.• He chooses a pseudorandom permutation π.

= E(Index)

π(1)π(2)π(3)

He next computes • π(Austin, 1), π(Austin, 2) and π(Austin, 3),• Writes the indexes (3, 6, 10) in these addresses

Address

π(Austin, 1)

π(Austin, 2)

π(Austin, 3) E(Index)

Do the same for each keyword

Address

π(Austin, 1)

π(Austin, 2)

π(Austin, 3)

π(Boston, 1)

π(Boston, 2)

E(Index)

In the store phase,

• The client stores this E(Index) and the ciphertext of each file to the server

Client Server

E(Index) E(D1), , E(D⋯ N)

• The client sends a trapdoor information

Client Server

t(Austin)=( π(Austin, 1), π(Austin, 2), π(Austin, 3) )

E(Index)

The server findsthe corresponding indexes

Client Server

π(Austin, 1), π(Austin, 2), π(Austin, 3)

E(Index)22

and returns

Client Server

E(D3), E(D6), E(D10)

E(Index)23

This scheme

• Is secure against passive attacks.• But it is not secure against active attacks.

This scheme

• Is secure against passive attacks.• But it is not secure against active attacks.

• We will show how to make this scheme verifiable.

A naive approach is to add MAC to each E(Di)

Client Server

E(D3), MAC(E(D3)),E(D6), MAC(E(D6)),E(D10), MAC(E(D10))

The server returnsthese files together with their MACs 26

But a malicious server will

Client

Malicious

Replace some pair with another pairof (file, MAC)

E(D100), MAC(E(D100))

The client cannot detect this cheating

Client

Malicious

Because this is a valid pairof MAC

E(D100), MAC(E(D100))

In our verifiable scheme

π(Austin, 1)

So the server returns E(D3), Tag3=MAC(π(Austin, 1), E(D3))

We include π(Austin, 1) in the input of MAC

This method works

π(Austin, 1)

E(D3),

Tag3=MAC(π(Austin, 1), E(D3))

Because the MAC authenticates the whole communication

At the store phase,• The client writes such MAC values in E(Index)

3, tag3=MAC( π(Austin, 1), E(D3) )

6, tag6=MAC( π(Austin, 2) , E(D6) )

π(Austin, 1)

π(Austin, 2)

π(Austin, 3)

E(Index)

For a query π(Austin, 1)E(Index)

π(Austin, 1)

The server returns E(D3) and Tag3

3, tag3=MAC( π(Austin, 1), E(D3) )

The client checks the validity of

π(Austin, 1)

tag3=MAC( π(Austin, 1), E(D3) )

We next consider

• the definition of security.• The security against active attacks consists of privacy and reliability• We define privacy similarly to Curtmola et al. as follows.

Minimum Leakage

In the store phase,

E(D1), , E(D⋯ N), E(Index)

the server learns |D1|, …, |DN| and |{keywords}|

This means that the server knows the corresponding indexes {3, 6, 10}

For t(keyword),the server returns

t(keyword)

C(keyword)=( E(D3), E(D6), E(D10) )Tag

We call

these information• |D1|, …, |DN| and |{keywords}|• corresponding indexes {3, 6, 10}

The minimum leakage

The Privacy definition

• requires that the server should not be able to learn any more information

The Privacy definition

• requires that the server should not be able to learn any more information• To formulate this, we consider a real game and a simulation game

In the Real Game

D = {D1, …, DN}W={set of keywords}Index

Distinguisher

C= { E(D1), , E(D⋯ N) } I= E{ Index }

Challenger

In the search phase

keyword

Distinguisher

t(keyword)

Challenger

Repeat

keyword

Distinguisher

t(keyword)

Challenger

Finally

keyword

Distinguisher

t(keyword)

Challenger

b=0 or 1

In the Simulation Game

Distinguisher

Somehow computes the ciphertexts C= { E(D1), , E(D⋯ N) } I= E{ Index }

ChallengerSimulator

the minimum leakage|D1|, …, |DN| and |{keywords}|

keyword

Distinguisher

Somehow computes t(keyword)

ChallengerSimulator

the minimum leakage {3, 6, 10}

Repeat

keyword

Distinguiher

Somehow computes t(keyword)

ChallengerSimulator

{3, 6, 10}

Finally

keyword

Distinguisher

t(keyword)

ChallengerSimulator

{3, 6, 10}

b=0 or 1

We say that

• Privacy is satisfied if• there exists a simulator such that

the real game ≈ the simulation game

This Def. of privacy

• Was given by Curtmola et al.

• But it looks artificial.• Who is the distinguisher ?

Server ? No. Client ? No.

Distinguisher

C= { E(D1), , E(D⋯ N) } I= E{ Index }

Challenger

This question will be resolved

• When we consider UC security.

• From a view point of UC security, this is a very natural Def. of privacy.• We will come back to this point later.

The client sends

t(keyword)

The honest server returns C(keyword)={E(D3), E(D6), E(D10)} Tag

Next Reliability

We say that

Reliability is satisfied if no server can forge (C(keyword)*, Tag*)such that C(keyword)* ≠ C(keyword)

By the way,

Even if a protocol Σ is secure in stand-alone,it may not be secure • if Σ is executed concurrently,

• Or if Σ is a part of a large protocol

Client 1

Client 2

Server

Universal Composability (UC)

Is a framework which guarantees that • A protocol Σ is secure• Even if it is executed concurrently, and• Even if it is a part of a large protocol

The notion of UC

• was introduced by Canetti.• He proved that UC-security is maintained under a general protocol composition.

We formulated the UC security

• of verifiable SSE scheme.• To do so, we defined the ideal functionality FvSSE

as follows.

In the ideal world,

dummyClient

Ideal Functionality

Environment

D={D1, …, DN} W={set of keywords}Index

The dummy client relays them to FvSSE

dummyClient

Ideal Functionality

Environment

D={D1, …, DN} W={set of keywords}Index 59

FvSSE keeps them

dummyClient

Ideal Functionality

Environment

UC adversary

and sends the minimum leakage

dummyClient

Ideal Functionality

Environment

UC adversary

|D1|, …, |DN||{keywords}|

In the search phase

dummyClient

Ideal Functionality

Environment

keyword

UC adversary

The dummy client relays it to FvSSE

dummyClient

Ideal Functionality

Environment

keyword

UC adversary

FvSSE sends the minimum leakage

dummyClient

Ideal Functionality

Environment

keyword

UC adversary

{3,6,10}

The UC adversary S returns

dummyClient

Ideal Functionality

Environment

keyword

UC adversary

{3,6,10} Accept or Reject

If S returns Reject,

dummyClient

Ideal Functionality

Environment

keyword

UC adversary

{3,6,10} Reject

FvSSE sends Reject to the dummy client

dummyClient

Ideal Functionality

Environment

keyword

UC adversary

{3,6,10} Reject

Reject

The dummy client relays it to Z

dummyClient

Ideal Functionality

Environment

keyword

UC adversary

{3,6,10} Reject

Reject

If S returns Accept,

dummyClient

Ideal Functionality

Environment

keyword

UC adversary

{3,6,10} Accept

FvSSE sends {D3,D6,D10}

dummyClient

Ideal Functionality

Environment

keyword

UC adversary

{3,6,10} Accept

{D3,D6,D10}

The dummy client relays them to Z

dummyClient

Ideal Functionality

Environment

keyword

UC adversary

{3,6,10} Accept

{D3,D6,D10}

This is an ideal world

Because(Correctness.) The dummy client receives {D3,D6,D10} correctly,

or outputs Reject.(Security.) The UC adversary S learns only the minimum leakage.

Further S can corrupt

dummyClient

Ideal Functionality

Environment

ZUC adversary

dummyServer

corruptcorrupt

Also Z can interact with S freely

dummyClient

Ideal Functionality

Environment

ZUC adversary

dummyServer

corruptcorrupt

Z finally outputs 0 or 1

dummyClient

Ideal Functionality

Environment

ZUC adversary

dummyServer

corruptcorrupt

In the real world

Client Server

Environment

D={set of documents} W={set of keywords}Index

Client Server

Environment

D, W, Index

Then the client and the server runthe store phase.

In the search phase

Client Server

Environment

keyword

Client Server

Environment

keyword The client and the server run the search phase

Then the client sends D3, D6, D10 to Z

Client Server

Environment

keywordD3, D6, D10

An adversary A can corrupt

Client Server

Environment

ZAdversary

corruptcorrupt

Further Z can interact with A freely

Client Server

Environment

ZAdversary

corruptcorrupt

Z finally outputs 0 or 1

Client Server

Environment

ZAdversary

corruptcorrupt

We say that

• A verifiable SSE scheme is UC-secure if for any adversary A, there exists a UC-adversary S such that the real world ≈ the ideal world.

Equivalence

(Our Theorem) A verifiable SSE scheme is UC-secure if and only if it satisfies privacy and reliability

Herewe consider non-adaptive adversaries.

Client Server

Environment

ZAdversary

Akeyword Documents

Austin D3, D6, D10

Boston D8, D10

In the real world,

The client sends

Client Server

Environment

ZAdversary

keyword Documents

Austin D3, D6, D10

Boston D8, D10

These ciphertexts E(D1), …, E(D10), E(Index)

Suppose that the adversary A

Client Server

Environment

ZAdversary

keyword Documents

Austin D3, D6, D10

Boston D8, D10

E(D1), …, E(D10), E(Index)

corruptsD, W,

And sends these ciphertexts to Z

Client Server

Environment

ZAdversary

keyword Documents

Austin D3, D6, D10

Boston D8, D10

E(D1), …, E(D10), E(Index)

corrupts

E(D1), …, E(D10), E(Index)

In the Real Game of Privacy

D, W, Index

Distinguisher

C= { E(D1), , E(D⋯ N) } I= E{ Index }

Challenger

In the UC framework, let

Client Server

Environment ZAdversary

E(D1), …, E(D10), E(Index)

corrupts

E(D1), …, E(D10), E(Index)

challenger

D, W, Index

distinguisher

Equivalent to the real game of privacy

Client Server

Environment ZAdversary

E(D1), …, E(D10), E(Index)

corrupts

E(D1), …, E(D10), E(Index)

challenger

D, W, Index

distinguisher

In the ideal world

dummyClient

Ideal Functionality

Environment

ZUC adversary

D, W, Index

S must be able to send

dummyClient

Ideal Functionality

Environment

ZUC adversary

E(D1), …, E(D10), E(Index)

D, W, Index

In the Simulation Game of Privacy

Distinguisher

Somehow computes C= { E(D1), , E(D⋯ N) } I= E{ Index }

ChallengerSimulator

the minimum leakage|D1|, …, |DN| and |{keywords}|

In the UC framework, let

dummyClient

Ideal Functionality

Environment Z UC adversary S

E(D1), …, E(D10), E(Index)

challenger

D, W, Index

distinguisher simulator

Equivalent to the Sim. game of privacy

dummyClient

Ideal Functionality

Environment Z UC adversary S

E(D1), …, E(D10), E(Index)

challenger

D, W, Index

distinguisher simulator

The proof of the equivalence

• proceeds in this way.

The proof of the equivalence

• proceeds in this way.

• At the first glance, the Def. of privacy looked artificial.• But as we have seen now, it is very natural from a view point of UC

Lesson

• SSE is a good example to understand the notion of UC security.

Theorem

• Our scheme satisfies privacy and reliability• if E is CPA secure and MAC is unforgeable

Corollary

• Our scheme is UC-secure.

• How to Update Documents Verifiably in Searchable Symmetric Encryption,

Kaoru Kurosawa and Yasuhiro Ohtaki (CANS 2013)

Kamara, Papamanthou and Roeder (2012)

• showed a dynamic SSE scheme such that

the client can add, delete and modify the documents.

• However, their scheme is not verifiable.

Our contribution

Verifiabile DynamicCurtmola et al. X XOur FC 2012 scheme O XKamara et al. X OOur scheme of CANS 2013

First we show

• A more efficient SSE cheme than Curtmola et al. and• A more efficient verifiable SSE scheme than our FC 2012 scheme

Consider this example

D1 D2 D3 D4 D5Austin 1 0 1 0 1Boston 0 1 0 1 0Washington

1 1 1 0 0

In our SSE scheme

E(D1) E(D2) E(D3) E(D4) E(D5)PRF(Austin) ( 1 0 1 0 1)PRF(Boston) ( 0 1 0 1 0)PRF(Washington)

( 1 1 1 0 0)

The client computes

where PRF means pseudorandom function.

and adds

( 1 1 1 0 0)

+PRF’(Austin)+PRF’(Boston)

+PRF’(Washington)

The client stores this table

( 1 1 1 0 0)

+PRF’(Washington)

The server

In the search pahse,

( 1 1 1 0 0)

+PRF’(Boston)

The client sends

The server decrypts (10101)

( 1 1 1 0 0)

+PRF’(Boston)

and returns E(D1), E(D3) and E(D5)

( 1 1 1 0 0)

+PRF’(Boston)

In our verifiable SSE scheme,

( 1 1 1 0 0)

+PRF’(Boston)

the client stores this table

together with TagA=MAC( PRF(Austin), E(D1), E(D3), E(D5) ) TagB=MAC(PRF(Boston), E(D2), E(D4)) TagW=MAC(PRF(Washington), E(D1), E(D2), E(D3))

In our verifiable SSE scheme,

( 1 1 1 0 0)

+PRF’(Boston)

the client stores this table

where TagA=MAC( PRF(Austin), E(D1), E(D3), E(D5) )

and so on

E(D1), E(D3), E(D5 ), TagA

PRF(Austin) and PRF’(Austin)

The client accepts if

E(D1), E(D3), E(D5 ),

TagA=MAC(PRF(Austin), E(D1), E(D3), E(D5 ))

Theorem

• The above verifiable SSE scheme satisfies privacy and reliability if E is CPA-secure, PRF and PRF’ are psuedorandom functions and MAC is unforgeable.

Now suppose that

( 1 1 1 0 0)

+PRF’(Boston)

The client wants to modify D1 to D′1

D1 contains Austin and Washington

Therefore in the update phase

( 1 1 1 0 0)

+PRF’(Boston)

the client must update E(D1) TagA

We want to do this more efficiently

• In the proposed scheme,• we break this part (PRF(Austin), E(D1), E(D3), E(D5))

down to (PRF(Austin), 1,3,5) (1, E(D1)) 　　　　　　　　　　 … (5, E(D5))

The client authenticates

• each piece separately

(PRF(Austin), 1,3,5) (1, E(D1)) 　　　　　　　　　　 … separately (5, E(D5))

The last problem is

• How to timestamp on these (1, E(D1))

… (5, E(D5))

Remember that the client wants to update files.

We can solve this problem by

• using any authentication scheme which has the timestamp functionality

such as– Merkle hash tree– Authenticated skip list– RSA accumulator (in this talk)

Letx1 = H(1, E(D1)) x2 = H(2, E(D2)) x3 = H(3, E(D3)) x4 = H(4, E(D4)) x5 = H(5, E(D5))

A = g mod N(=pq)x1 x2 x3 x4 x5

For simplicity, suppose that x1 ～ x5 are primes.Then the client computes

and keeps A.

In the search phase

Tag1 =MAC(PRF(Austin), 1,3,5)

y= gx2 ・ x4 mod N

(1,E(D1)), (3,E(D3)), (5,E(D5)),

In the search phase

y= gx2 ・ x4 mod N

(1,E(D1)), (3,E(D3)), (5,E(D5)),

The client verifies that Tag1 =MAC(PRF(Austin), 1,3,5) A= yx1 ・ x3 ・ x5 mod N

In the search phase

y= gx2 ・ x4 mod N

(1,E(D1)), (3,E(D3)), (5,E(D5)),

The client verifies that Tag1 =MAC(PRF(Austin), 1,3,5) A= yx1 ・ x3 ・ x5 mod N ( = g x1 … x5 mod N )

In the update phase,

• To modify D1 to D1’

• the client sends only (1, E(D1’))

to the server.

He then updates A to

• where x1’= H(1, E(D1’))

A’= g mod N(=pq)x1’x2 x3 x4 x5

To delete D1

• Modify D1 to D1’=delete.

How to add files

• Please see the paper.

We defined the UC security

• of verifiable dynamic SSE schemes

We then proved that

• The proposed scheme is UC-secure against non-adaptive adversaries

• under the strong RSA assumption if

– E is CPA-secure– PRF and PRF’ are pseudorandom functions– H is a collision-resistant hash function

Finally

• Garbled Searchable Symmetric Encryption Kaoru Kurosawa (FC 2014)

So far,

• I have talked about single keyword search SSE schemes.

• I will talk about multiple keyword search SSE schemes.

Golle, Staddon and Waters (2004)• showed a multiple keyword SSE scheme which has keyword fields.

From To SubjectD1 Keyword 1 Keyword 2 Keyword 4D2 Keyword 2 Keyword 1 Keyword 5D3 Keyword 3 Keyword 2 Keyword 6

Golle, Staddon and Waters (2004)• A client can specify at most one keyword 　　　　　　　 in each keyword field.

From To SubjectD1 Keyword 1 Keyword 2 Keyword 4D2 Keyword 2 Keyword 1 Keyword 5D3 Keyword 3 Keyword 2 Keyword 6

In such a scheme, however,

• It’s hard to retrieve files which contain both Alice and Bob somewhere in the keyword fields

From To SubjectD1 Alice Bob Keyword 4D2 Bob Keyword 5 AliceD3 Keyword 3 Keyword 2 Keyword 6

Wang et al. (2008)

• Showed a keyword field free SSE scheme• But it works only for AND search.

Cash et al. (CRYPTO 2013)

• showed a keyword field free SSE scheme• which can support any search formula (in the random oracle model).

However,

• the search formula is revealed to the server and• the search phase requires 2 rounds.

Search formula

Search phase Search formula secrecy

Wang et al. only AND 　 1 round No

Cash et al. Any 2 rounds No

At FC 2014,

• I showed an SSE scheme such that even the search formula is kept secret.

Search formula

Search phase

Search formula secrecy

Wang et al. only AND 1 round NoCash et al. Any 2 rounds No Proposed Any 1 round Yes

• it can support any search formula and• the search phase requires only 1 round.

Search formula

Search phase

Search formula secrecy

Wang et al. only AND 1 round NoCash et al. Any 2 rounds No Proposed Any 1 round Yes

The proposed SSE scheme

• is based on Yao’s garbled circuit.

Yao (1982) constructed

• A secure two-party protocol by using• a garbled circuit and an oblivious transfer.

Alice Bob

GC + OT

f(x,y)

Since then,

garbled circuits have found many applications: • multi-party secure protocols, • one-time programs,• KDM-security, • verifiable computation, • homomorphic computations• and others.

The proposed scheme

• is the first application of garbled circuits to SSE

A garbled circuit of f

• is an encoding garble(f) such that• one can compute f(X) • from garble(f) and label(X) without learning anything on f and X.

garble(f)label(X) f(X)

However, if

• garble(f) or label(X) is reused, then some information on (f, X) is leaked.

garble(f)label(X) f(X)

Recently

• Goldwasser et al. constructed a scheme such that garble(f) can be reused• I constructed a scheme such that label(X) can be reused and applied it to multiple keyword SSE

High level overview of the proposed scheme

w1 w2 w3

D1 1 1 1D2 1 0 0

keywords

Consider this example.

w1 w2 w3

D1 (1 1 1)=X1

D2 (1 0 0)=X2

The client computes

w1 w2 w3

D1 label(X1)D2 label(X2)

The client also computes

PRF(w1) PRF(w2) PRF(w3)E(D1) label(X1)E(D2) label(X2)

and sends

Server

In the 1st search phase,

• Suppose that the client wants to search on f(w1,w2,w3)=w1 w⋀ 2 w⋀ 3

• He computes the garbled circuits of f: Γ1 for D1 and

Γ2 for D2.

PRF(w1), …, PRF(w3) Γ1

counter=1

The client sends

counter=1

The server has this tablePRF(w1) PRF(w2) PRF(w3)

E(D1) label(X1)E(D2) label(X2)

counter=1

The server computes f(X1) fromPRF(w1) PRF(w2) PRF(w3)

counter=1, label(X1) Γ1 f(X1)=1

garbled circuit

counter=1

Similarly she computes f(X2)PRF(w1) PRF(w2) PRF(w3)

counter=1 label(X2)

f(X2)=0

garbled circuit

The server returns E(D1)

Since f(X1)=1 and f(X2)=0,

In the 2nd search phase,

• Suppose that the client wants to search on g(w1,w2,w3)=w1 w⋁ 2 w⋁ 3

• He computes the garbled circuits of g: Δ1 for D1 and

Δ2 for D2.

PRF(w1), …, PRF(w3)Δ1

counter=2

The client sends

and returns E(D1), E(D2)

The server computes g(X1)=g(X2)=1,

Note that

• label(X1) is reused for Γ1 and Δ1

label(X1)Γ1

f(X1)=1

g(X1)=1

• label(X2) is reused for Γ2 and Δ2

label(X2)Γ2

f(X2)=0

g(X2)=1

More details

Bellare et al. (2012)defined Kurosawa（ 2014）

extended them togarbling schemes extended garbling

schemesInput-circuit privacy label reusable privacy

The difference is that

• counter is included • in the extended GC generation algorithm

(eGC.gen) and• in the extended GC evaluation algorithm

(eGC.eval)

This is a Boolean circuit f

This is the topological circuit f-

Label.gen algorithm chooses

• 2 random strings (vi0, vi

1) for each wire i• such that the lsbs are different: • lsb(vi

0) ≠ lsb(vi1)

AND v1

0, v11

v20, v2

v30, v3

v40, v4

label(0000) is

AND v1

0, v11

v20, v2

v30, v3

v40, v4

this vector.

label(1111) is

AND v1

0, v11

v20, v2

v30, v3

v40, v4

this vector.

eGC.gen algorithm takes

AND v1

0, v11

v20, v2

v30, v3

v40, v4

eGC.gen

counter

a boolean circuit fAll the strings

and outputs a garbled circuit Γ

AND v1

0, v11

v20, v2

v30, v3

v40, v4

eGC.gen

counter

Γa boolean circuit fAll the strings

eGC.eval algorithm takes

eGC.eval

counter

the topological circuit f-label(0011),for example

and outputs f(0,0,1,1)

eGC.eval

counter

the topological circuit f-label(0011),for example

f(0,0,1,1)

Label reusable privacy (informal)

• Even if label(x1, …, xn) = (v1

x1, …, vnxn)

is reused for multiple garbled circuits Γ1, Γ2, …. ,

• no information on (x1, …, xn) and (f1,f2, … )

are leaked, where Γi is a garbled circuit of fi

Our construction

• of the extended garbling scheme which satisfies label reusable privacy is the same as the usual construction of the garbling scheme except for that counter is included in the hash function H.

For simplicity, consider f(x1,x2)

f(x1,x2)

v10, v1

v20, v2

Each input wire has two labels

eGC.gen algorithm

computes• y00=H(counter, v1

0, v20) f(⊕ 0,0)

• y01=H(counter, v10, v2

1) f(⊕ 0,1)

0) f(⊕ 1,0)

1) f(⊕ 1,1)

Note that

this part works as one-time pad

0) f(⊕ 0,0)

1) f(⊕ 0,1)

0) f(⊕ 1,0)

1) f(⊕ 1,1)

Roughly speaking,

• the garbled circuit Γ is a random permutation of (y00, …, y11).

y00=H(counter, v10, v2

0) f(0,0)⊕

1) f(0,1)⊕

0) f(1,0)⊕

1) f(1,1)⊕

More precisely

lsb(v10) lsb(v2

0) y00

lsb(v10) lsb(v2

1) y01

lsb(v11) lsb(v2

0) y10

lsb(v11) lsb(v2

1) y11

Construct this table

If lsb(v10)=0,

0 lsb(v20) y00

0 lsb(v21) y01

1 lsb(v20) y10

1 lsb(v21) y11

then the 1st column is

If lsb(v20)=1

0 1 y00

0 0 y01

1 1 y10

1 0 y11

then the 2nd column is

Then permute the rows in such a way that (00) ～ (11) appear here

0 0 y01

0 1 y00

1 0 y11

1 1 y10

The garbled circuit Γ is these 4 bits

eGC.eval algorithm takes

counter

eGC.eval

label(11)= (v11, v2

y01 =H(counter,v10, v2

1) f(01)⊕

y00 =H(counter, v10, v2

0) f(00)⊕

1) f(11)⊕

0) f(10)⊕

Ｔ he garbled circuit Γ

Since lsb(v11)= １ , lsb(v2

counter

eGC.eval

y01 =H(counter,v10,v2

1) 0⊕

0) 0⊕

1) f(11)⊕

0) 0⊕

look at the 3rd row of Γ(v1

1, v21)

Then we can compute f(1,1)from the given inputs

counter

eGC.eval

y01 =H(counter,v10,v2

1) 0⊕

0) 0⊕

1) f(⊕ 11)

0) 0⊕

garbled circuit Γ

11f(1,1)

label(11)= (v11, v2

Theorem

• The above construction satisfies label reusable privacy in the random oracle model

How to Apply Extended Garbling Scheme to Multiple Keyword SSE

w1 w2 w3

D1 e11=1 e12=1 e13=1D2 e21=1 e22=0 e23=0

Consider this example

The client computes

v110=AESk(1,1,0)

v111=AESk(1,1,1)

w1 w2 w3

D1 e11=1 e12=1 e13=1D2 e21=1 e22=0 e23=0

Since e11=1, let

v110=AESk(1,1,0)

v11= v111=AESk(1,1,1)

w1 w2 w3

D1 e11=1 e12=1 e13=1D2 e21=1 e22=0 e23=0

In this way,

w1 w2 w3

D1 v11=v111 v12=v12

1 v13=v131

D2 v21=v211 v22=v22

0 v23=v230

the client computes each entry of this table.

w1 w2 w3

D1 (v11 v12 v13)=label(X1)D2 (v21 v22 v23)=label(X2)

Namely for D1,

The client generates these strings by using AES (v11

0, v111), (v12

0, v121), (v13

0, v131)

chooses each element of label(X1) from (111)

(v110, v11

1), (v120, v12

1), (v130, v13

label(X1)=(v11, v22 , v33)

w1 w2 w3

D1 1 1 1D2 1 0 0

Similarly for D2,

The client generates these strings by using AES (v21

0, v211), (v22

0, v221), (v23

0, v231)

chooses each element of label(X2) from (100)

(v210, v21

1), (v220, v22

1), (v230, v23

label(X2)=(v11, v22 , v33)

w1 w2 w3

D1 1 1 1D2 1 0 0

The client further computes

and sends

The server

After the store phase,

• The clients keeps only the secret keys of AES, E, PRF and PRF’.

• He remembers nothing other than these.

• Suppose that the client searches on f(w1,w2,w3)=w1 w⋀ 2 w⋀ 3

For D1,

• the client re-generates these strings (v11

0, v111), …, (v13

0, v131)

by using AES in the same way as in the store phase.

f(w1,w2,w3)=w1 w⋀ 2 w⋀ 3

counter eGC.gen

and computes the garbled circuit Γ1

(v110, v11

1), …, (v130, v13

Then the client runs eGC.gen on input

For D2,

• The client computes the garbled circuit Γ2

similarly

The topological circuit f- and counter

The client sends

The server has this table

The server runs eGC.eval on input

eGC.eval

and computes z1=f(X1)

label(X1)

the garbled circuit Γ1

the topological circuit ｆ -counter

E(D1) if z1=1

The server returns

The same for D2

Theorem

In the proposed scheme,if the underlying extended garbling scheme satisfies label reusable privacy

Then only the following information is leaked to the server(other than the minimum leakage)

• The topological circuit f- • (π(j1), …, π(jc)),

　 where π is a random permutation and {wj1, …, wjc} are the queried keywords

In the scheme of Cash et al. (2013)

If 「 Japan AND Crypto 」 is searched,the following information is leaked to the server

the search formula ＝ AND the search result of Japan or that of Crypto and some more information （ see Sec.5.3 of their paper ）

Communication overheadof the proposed scheme

• Let m = # of files c = # of search keywords s = # of gates of f• In the search phase, the com. overhead is |counter|+(c+4m(s-1))×128+4m bits

If # of search keywords is 2

• The communication overhead is |counter|+256+ 4× （ # of files ） bits

Computer simulation

• We used a computer such as follows. 2.4GHz CPU and 32G byte RAM OS = CentOS 6.5 C++ and NTL library

• The total # of keywords is 20.• We generated Index randomly

The running time of the clientin the search phase

The running time of the serverin the search phase

In the proposed SSE scheme,Search

formulaSearch phase

Search formulasecrecy

Wang et al.(2008)

Only AND

1 round ---

Cash at al.(CRYPTO 2013)

Any 2 rounds leaked

Kurosawa(FC 2014)

Any 1 round secret

Summary

• UC-Secure Searchable Symmetric Encryption

• How to Update Documents Verifiably in Searchable Symmetric Encryption

• Garbled Searchable Symmetric Encryption

Thank you !

how to keyword-search securely in cloud storage service kaoru kurosawa ibaraki university, japan...

server client server

server client server

korea slide

server client server

encrypted files ed

ed n eindex

uc security slide

encrypted keyword

Documents

man is a genius when he is dreaming. akira kurosawa

ibaraki prefecture - meti

mask of the black death, the _ kurosawa

observation rocks by kaoru

dr. kaoru ishikawa`s biography - … · kaoru ishikawa`s...

csr report of ibaraki plant - yokohama rubber … report of...

cryptography for cloud storage service kaoru kurosawa...

biografi kaoru ishikawa

advanced components & materials division ibaraki works

mask of the black death the kurosawa

ibaraki jet orientation

studio open ibaraki arcus project 2008

yamaguchi kaoru - on the liquidation of government debt

kurosawa akira

open malicious source symantec security response kaoru...

kurosawa-desmedt meets tight security · kurosawa-desmedt...

map ami en - ibaraki

kinoshita,h., hirata,t. - ibaraki

ryuichi kurosawa and daniel proga -...

cineclub.ens.frcinÉ-club normal-e sup' mardi 9 novembre...