All Your Queries Are Belong to Us: The Power of File-Injection Attacks on Searchable Encryption Yupeng Zhang, Jonathan Katz, Charalampos Papamanthou University of Maryland

What is Searchable Encryption? clientserver search query: keyword

An Example of Searchable Encryption k1k1 k2k2 k3k3 F1F1 F4F4 F2F2 F1F1 F2F2 F3F3 F4F4 F5F5 F6F6 F3F3 F6F6 F4F4 F2F2 F5F5 F1F1

k1k1 k2k2 k3k3 F1F1 F4F4 F2F2 F1F1 F2F2 F3F3 F4F4 F5F5 F6F6 F3F3 F6F6 F4F4 F2F2 F5F5 F1F1 k1k1 token

An Example of Searchable Encryption k1k1 k2k2 k3k3 F1F1 F4F4 F2F2 F1F1 F2F2 F3F3 F4F4 F5F5 F6F6 F3F3 F6F6 F4F4 F2F2 F5F5 F1F1 F7F7 F7F7

Leakage of Searchable Encryption k1k1 k2k2 k3k3 F1F1 F4F4 F2F2 F1F1 F2F2 F3F3 F4F4 F5F5 F6F6 F3F3 F6F6 F4F4 F2F2 F5F5 F1F1 k1k1 deterministic! file access patterns! F7F7 F7F7 search k 1 on new files!

Leakage of Searchable Encryption Search pattern leakage. Access pattern leakage. Leaked by all efficient searchable encryption schemes. No Forward Privacy. All SE schemes except [CM05, SPS14] do not have forward privacy.

Goal of Our Work What semantic information does this leakage actually reveal? We explore a new class of attacks that is devastating for query privacy.

Attacks on Searchable Encryption Islam et al. (IKK12) proposed a query recovery attack. Cash et al. (CGPR15) proposed another attack with higher success probability. The server knows all or most of the client’s files in plaintext.

Attack Model: File-injection Attack First proposed in CGPR15, but not used for query recovery attacks. clientserver search query: F1F1 F2F2 F3F3 k F4F4 F5F5 F6F6 F3F3 F5F5

Binary Search Attack k0k0 k1k1 k2k2 k3k3 k4k4 k5k5 k6k6 k7k7 File 1: k0k0 k1k1 k2k2 k3k3 k4k4 k5k5 k6k6 k7k7 File 2: k0k0 k1k1 k2k2 k3k3 k4k4 k5k5 k6k6 k7k7 File 3: search result Only inject 14 files for a universe of 10,000 keywords. Inject before seeing the queries (non-adaptive). Can recover all queries with probability 1.

Threshold Countermeasure Limitation of the attack: long injected files (|K|/2 keywords each). Countermeasure: filter all files that contains more than T keywords. Enron data set: 30,109 files, universe of 5,000 keywords Only 3% of files have more than T=200 keywords. Enron dataset. Accessed:

Modifying the Attack |K|/2T files of T keywords each to replace 1 file with |K|/2 keywords. Inject 131 files for |K|=5,000 and T=200. k0k0 k1k1 k2k2 k3k3 k4k4 k5k5 k6k6 k7k7 File 1: File 1File 2

Attacks with Partial File Leakage The server learns a portion of client’s files in plaintext. (Announcement and alert s broadcasted to many people)

Attacks with Partial File Leakage Adaptive, applies to SE schemes with no forward privacy. The server does not always succeed, but can determine whether attacks fails. k1k1 k2k2 k3k3 keywords estimated frequency f*(k 1 ) f*(k 2 ) f*(k 3 ) t f(t) k4k4 k5k5 f*(k 4 ) f*(k 5 ) token exact frequency candidate universe: f*(k)≈f(t) binary search attack

Attacks with Partial File Leakage Refer to our paper for an attack to recover multiple tokens

Experimental Methodology Enron data set with 30,109 s. Stem words in the s (remove -able, -ing etc.). Remove stop words (“to”, “you” etc.). Extract keywords (in total 77,000). Choose top 5,000 with highest frequency as the universe.

Experimental Results: Recover 1 Query U = 5,000, T = 200, number of injected files = 9

Experimental Results: Recover 100 Queries U = 5,000, T = 200, number of injected files <= 40

Extensions to Conjunctive SE Search files with keywords k 1, k 2, … k d. Ideal leakage: only leak the intersection of their search results. (No existing scheme achieves ideal leakage.)

Extensions to Conjunctive SE

Two other attacks, refer to our paper for more details.

Discussions on Potential Countermeasures Semantic filter. Search result padding. File ID shuffling and file length padding. Batched updates. Does not work! Partially works for static SE. Partially works.

Conclusions File-injection attacks are devastating for query privacy in SE Is it a satisfactory tradeoff between efficiency and leakage for existing SE? Future research:  Reduce or eliminate access pattern leakage  Exploring new directions such as interactive protocol or multi-server Forward Privacy