Tarik Moataz - Encrypted Search: from Research to Real-World Systems

Encrypted Search
From Research to Real-World Systems
Tarik Moataz
CSNP Boston Chapter Jan 23rd 2020
AROKI 
SYSTEMS

A little bit about me…
• Currently
• Chief Technology Officer at Aroki Systems (https://aroki.com )
• Associate Director of the Encrypted Systems Lab at Brown University
• Visiting Scientist at Brown University
• Background
• PhD in Computer Science with a focus on Encrypted Search
• Some of my Projects:
• Pixek - an e2e encrypted Photo App (https://pixek.com)
• Clusion - an open source Encrypted Search Java Library
2

4
4%
14,717,618,286*
*Since 2013
Aroki Systems https://aroki.com

Why so Few?
5
“…because it would have hurt Yahoo’s ability to index and search message data…”
— J. Bonforte in NY Times
Cost?Incompetence? Lazyness?

Once Upon a Time: No Encryption
Memory
App
!6
TLS
Full disk encryption
Disk
Adversary can see
decrypted information in RAM
Transparent database encryption
Current Situation

Once Upon a Time: No Encryption
Memory
App
!7
Disk
Adversary sees nothing
(Almost) Utopian Situation

Q:can we search on encrypted data?
8Aroki Systems https://aroki.com

9
Yes.

10
tk
Encrypted Search

Cryptographic Building Blocks
11
Property-Preserving
Encryption (PPE)
Fully-Homomorphic
Encryption (FHE)
Functional
Encryption (FE)
Oblivious RAM
(ORAM)
Structured Encryption
(STE)

Performance
LeakageFunctionality

Evolution from 2000-2019
13
Property-Preserving
Encryption (PPE)
Oblivious RAM
(ORAM)
Structured Encryption
(STE)
DET‘06
OPE‘09
OPE proofs‘11
CryptDB‘12
MS Always Enc‘15
PPE attacks‘15
Snapshot PPE‘16
ORAM‘92
Tree-based
ORAM
‘12
SSE‘00
Efficient SSE‘06
STE‘10
Boolean SSE’13
OXT; BlindSeer’14
SQL’17
Inference attacks’12
Path ORAM‘13
Volume
attacks
‘19
OblivP2P‘16
CS2’12
Clusion; OpenSSE’16
Distribution-Hiding PPE‘18

Q:what is property-preserving encryption?

Property-Preserving Encryption (PPE)
Maintains a well-defined relation between the original data
•equality, order, orthogonality, prefix etc
15
Deterministic
encryption [BBN06]
=plaintext plaintext
=Z2hqc2Rh Z2hqc2Rh
Order preserving
encryption [BCLO09]
<16 20
<6372 18974
Prefix preserving
encryption [BBKN01]
⎕Secure Security
b2trbSxkZg b2trbSxkZgj2Rh⎕

PPE-based Encrypted Search
Encryption
16
Employee Age Salary
Sam 35 120K
Lilly 30 135K
Harry 35 135K
HR Employees Table
Deterministic
Encryption
Employee Age Salary
eXR5bmR Z2hqc2Rh cHF1ZmJk
d2Vyd3Nl bHdrdWV5 aGV5ZGJz
ZGZzZGV Z2hqc2Rh aGV5ZGJz
Encrypted HR Employees Table

Search
17
SELECT *
FROM Employees
Where Salary = 135k
Q =
Q
Employee Age Salary
eXR5bmR Z2hqc2Rh cHF1ZmJk
d2Vyd3Nl bHdrdWV5 aGV5ZGJz
ZGZzZGV Z2hqc2Rh aGV5ZGJz
Encrypted HR Employees Table
SELECT *
FROM Employees
Where Salary = aGV5ZGJz
Q =
Deterministic
Encryption

• Legacy-friendliness
• No changes to backends
• (Almost) Zero overhead
• Only encryption and decryption added to the client-side processing
• High functionality
• DTE and OPE enable the evaluation of complex queries
18
But what about security?
Pros & Cons

Adversarial Models in Encrypted Search
Background
19
Snapshot
Adversaries
Take (multiple) snapshot(s)
of the encrypted data
•Device theft
Persistent
Adversaries
Observe the entire state
of the database including
searches and updates
•Machine compromise
•Malicious host
Active
Adversaries
Are persistent adversaries
that CAN deviate from the
protocol
•File injection

PPE Security
Snapshot Adversary
20
PPE attacks
Inference Attacks [NKW15]
• sorting attack
• Cumulative attack
‘15
‘16
’17
‘18
Extension 2 of Inference Attacks [GSNBR17]
• non-crossing attack
• w/ non-ideal OPE leakage attack
• known plaintext/ciphertext attacks
Extension 1 of Inference Attacks [DDC16]
• inter-column correlation attack
• intra+inter-column correlation attack
• leakage attacks
Extension 3 of Inference Attacks [BGCRS18]
• non-crossing attack
• w/ non-ideal OPE leakage attack
• known plaintext/ciphertext attacks
Up to 100% of data
recovery in the weakest
adversarial model

Q:what is structured encryption?

Structured Encryption (STE) [CK10]
DS
EDS
Setup 1k, DSEDS,
Token , qtk
tk
Query tk, EDSans
ans
!22Aroki Systems https://aroki.com

Setup 1k, DSEDS,
Token , qtk
Query tk, EDSans
!23
DS
EDS
tk
ans
Structured Encryption (STE) [CK10]
Setup Leakage 
LS
Query Leakage 
LQ

24
File collection
File1 File2 File3
File4 File5 File6
data crypto
cryptosecurity
data
data
data
privacy
privacy
crypto
data
security
privacy
crypto
File1 File3 File4 File6
File2
File4 File5
File2 File3 File6
Inverted
index
STE-based Encrypted Search
Instance

25
Instance
STE  
encryption
data
security
privacy
crypto
File1 File3 File4 File6
File2
File4 File5
File2 File3 File6

26
Instance
“data”Q =
tk
Think of the token as solution to a maze
STE
encryption
“pt1”, “pt2”, “pt3", “pt4”tk =

• (Almost) Zero overhead
• Optimal search
• High functionality
• Exact, range and Boolean search
• Legacy-friendliness
• Recently solved - was unsolved for almost 20 years
27
But what about security?
Pros & Cons

STE Security
Snapshot Adversary
28
Encrypted
data structure
No
query
1st
query
2nd
query …

STE Security
Persistent Adversary
29
Encrypted
data structure
No
query
1st
query
2nd
query …
Note that the adversary does not learn
the content, but the memory locations

STE Cryptanalysis
30
STE attacks
Snapshot adversary
‘20 No known attack
STE attacks
Persistent adversary
‘12 IKK attack [IKK12]
• Requires 95% knowledge of
the user data
‘15 Count attack [CGPR15]
• Requires 80% knowledge of
the user data
‘16 Range attack [KKNO16]
• Distribution assumptions
STE attacks
Active adversary
‘16 File injection [ZKP16]
Query recovery - no data recovery

Tradeoffs: Performance vs. Security
31
Performance
STE/SSE-based
PPE-based
FHE-based
ORAM-based
skFE-based pkFE-based
Leakage

Tradeoffs: Functionality vs. Performance
32
SK-FE-based STE/SSE-based
PPE-based
FHE-based
ORAM-based
PK-FE-based
Performance
Functionality

Q:can encrypted search be deployed?

Why Isn’t Encrypted Search Deployed?
34

End-to-End Encryption
Messaging / Video
35
messaging video

Q: what about databases?

37
PPE-based
Always Encrypted
End-to-End Encryption
Databases
STE-based (coming soon)
AROKI 
SYSTEMS
PPE-based
+
Trusted hardware
2019

Thank you!
@arokisystems
https://aroki.com

Tarik Moataz - Encrypted Search: from Research to Real-World Systems

Recommended

Recommended

More Related Content

Similar to Tarik Moataz - Encrypted Search: from Research to Real-World Systems

Similar to Tarik Moataz - Encrypted Search: from Research to Real-World Systems (20)

More from CSNP

More from CSNP (12)

Recently uploaded

Recently uploaded (20)

Tarik Moataz - Encrypted Search: from Research to Real-World Systems