VSSE.pdf

Transcript

1. Verifiable Symmetric Searchable Encryption for Semi-honest-but-curious Cloud Servers Research Meeting Qi Chai and Guang Gong Department of Electrical & Computer Engineering q3chai@uwaterloo.ca
2. Introduction
3. 3 Cloud computing enables convenient, on-demand access to a shared pool of configurable resources: • computation • storage • applications • services
4. Introduction • Outsourcing data to cloud servers, while increasing service availability and reducing users' burden of managing data, inevitably brings in new concerns such as data privacy, since the server is honest-but-curious • To mediate the conflicts of data usability and data privacy in such a scenario, research of searchable encryption is of increasing interest
5. Introduction (Con’t) Data owner/user Cloud server Crypto opt. Data Outcome Crypto opt. Crypto opt. Pre-process Querygen Search Query
6. Introduction (Con’t) • However, a public cloud server may be selfish in order to save its computation or download bandwidth • Thus, we consider a semi-honest-but-curious server, who may – execute only a fraction of search operations honestly – return a fraction of search outcome honestly • To fight, we propose verifiable symmetric searchable encryption (VSSE) – data/query privacy – verifiable searchability – efficiency, e.g., is it feasible even if the end user is a power- constrained device?
7. Introduction (Con’t) Data owner/user Cloud server Crypto opt. Data Outcome Crypto opt. Crypto opt. Pre-process Querygen Search Query Verify Server needs to prove to user that the claimed search outcome is correct and complete Proof
8. Our VSSE Scheme (by an example)
9. Pre-process Suppose we have: document ID1 : “BIG”, “BIN”,… document ID2 : “BAD”, “BAGS”,… document ID3 : “BIG”,… … Go through all documents and collect all word to our key word set {“BIG”, “BIN”, “BING”, “BAD”, “BAGS”,…} Build a conventional trie Then…
10. Pre-process (Con’t) Each node stores a tuple (r0 ,r1 ,r2 ) For root: r0 = root r1 = 0 r2 = sK (r1 ,0b1000000) =47 For node B: r0 =B r1 =gK (1,"B",0) =111 r2 =sK (r1 ,0b1000100) =47 For node I: r0 =I r1 =gK (2,“I",111) =16 r2 =sK (r1 ,0b0001010) =13 ... gK is a keyed hash function sK is a block cipher alphabetic set: {A,B,D,G,I,N,S,#} prefix signature
11. Pre-process (Con’t) A leaf node also stores a tuple (r0 ,r1 ,r2 ) But r2 is defined differently! For exmaple, x=ID1 || gK (ID1 ) y=ID1 || ID3 || gK (ID1 ||ID3 ) ...
12. Querygen • To search for a pattern “BIG”, a concatenation of prefix signatures of querying nodes is produces locally • 111 || 16 || 219 || 74 is submitted as a privacy-preserving query
13. Search • Outcome: Yes, ID1 || ID3 || gK (ID1 ||ID3 ) query is found in document ID1 & ID3 • Proof: 32 || 47 || 13 || 131 || 4 the proof of this search/outcome
14. Verify 1. check whether gK (ID1 ||ID3 ) equals gK of the received concatenation of IDs, e.g., ID1 || ID3 2. decrypt 131 to get (r1 ,r2 ) of node G, check if (r1 == 219) and verify if “#” is its child 3. decrypt 13 to get (r1 ,r2 ) of node I, check if (r1 == 16) and verify if “G” is its child 4. decrypt 47.... 5. return true if all tests can be passed; otherwise, return false
15. Implementation and Testing Results
16. Implementation Querygen and verify are developed on a Nexus S mobile phone, using Android SDK v2.3.4 together with javax.crypto.* and javax.security.* Keygen, pre-process and search are implemented on a laptop (P4 1.8, 2G memory) using Python v2.6 in conjunction with Psyco v1.6 and PyCrypto v2.2
17. Inputs of Testing • Two real world data sets are used: – corpus-I: Pride and Prejudice, by Jane Austen, which has about 70,000 English words related to literature and life – corpus-II: DBLP Computer Science Bibliography, including about 1.4 million publication records. We use title of each record to form corpus-II
18. Testing Results Testing of querygen and verify • 5.34 million second/querygen and 8.01 million second/verify • indicates that our scheme is quite efficient and practical even for resource-constrained end users
19. Thanks!