Structured Encryption and Controlled Disclosure Melissa Chase Seny Kamara Microsoft Research Asiacrypt '10 1

Cloud Storage Asiacrypt '10 2

o o Main concern: will my data be safe? o o it will be encrypted o o it will be authenticated o o it will be backed up o o access will be controlled o o … o o Security only vs. o o outsiders o o other tenants o o Q : can we provide security against the cloud operator? Security for Cloud Storage 3 Asiacrypt '10

o o How do we preserve confidentiality of data? o o Encryption! o o What happens when I need to retrieve my data? o o e.g., search over s or pictures Confidentiality in Cloud Storage 4 Asiacrypt '10

Searchable Symmetric Encryption [Song-Wagner-Perrig01] 5 Asiacrypt '10

o o General-purpose o o Two-party computation [Yao82] o o Oblivious RAMs [Goldreich-Ostrovsky96] o o Fully-homomorphic encryption [Gentry09] o o interactive or search is O(|data|) o o Searchable encryption o o [SWP01,Goh03,Chang-Mitzen.05,Boneh-diCrescenzo-Ostrovsky- Persiano04,…] : 1 round & O(#docs) server computation o o [Curtmola-Garay-K-Ostrovsky06] : 1 round & O(# of docs w/ word) server computation o o Functional encryption [Boneh-Sahai-Waters10] Related Work 6 Asiacrypt '10

o o Private keyword search over encrypted text data o o Q : can we privately query other types of encrypted data? o o maps o o image collections o o social networks o o web page archives Limits of Searchable Encryption 7 Asiacrypt '10

o o Communications o o headers, phone logs o o Networks o o Social networks o o Web crawlers o o Maps Graph Data 8 Asiacrypt '10

Structured Encryption 9 Asiacrypt '10 t

o o Structured Encryption o o Formal security definition o o simulation-based o o Constructions o o Graph encryption with adjacency queries o o Graph encryption with neighbor queries o o Web graph encryption with focused subgraph queries o o Controlled disclosure o o Application to cloud-based data brokering Our Results 10 Asiacrypt '10

11 Asiacrypt '10 Structured Encryption

o o Social network = Graph + Profiles Structured Data 12 Asiacrypt '10

Structured Encryption 13 Asiacrypt '10 t

o o Security against adaptive chosen query attacks o o generalizes CKA2-security from [CGKO06] o o Simulation-based definition o o ``given the ciphertext and the tokens no adversary can learn any information about the data and the queries, even if the queries are made adaptively” o o Too strong o o e.g., SSE constructions leak some information o o access pattern: pointers to documents that contain keyword o o search pattern: whether two tokens were for the same keyword CQA2-Security 14 Asiacrypt '10

o o Security is parameterized by 2 stateful leakage functions o o Simulation-based definition o o ``given the ciphertext and the tokens no adversary can learn any information about the data and the queries other than what can be deduced from the L 1 and L 2 leakages…” o o “…even if queries are made adaptively” CQA2-Security 15 Asiacrypt '10

Leakage Functions 16 Asiacrypt '10

CQA2-Security 17 Asiacrypt '10 Real WorldIdeal World q t ?$&$#&$#&$s!l) t L1L1 q L2L2,q

Adaptiveness 18 Asiacrypt '10

19 Asiacrypt '10 Constructions

o o Graph encryption with adjacency queries o o from matrix encryption with lookup queries o o Graph encryption with neighbor queries o o from text encryption with keyword search (i.e., SSE) o o Web graph encryption with focused subgraph queries o o from text encryption with keyword search o o from graph encryption with neighbor queries Constructions 20 Asiacrypt '10

Neighbor Queries on Graphs 21 Asiacrypt '10 t

Neighbor Queries on Graphs 22 Asiacrypt '10

Neighbor Queries on Graphs 23 Asiacrypt ' … …

o o Web graphs o o Text data -- pages o o Graph data --- hyperlinks o o Simple queries on web graphs o o All pages linked from P o o All pages that link to P o o Complex queries on web graphs o o ``mix” both text and graph structure o o search engine algorithms based on link-analysis o o Kleinberg’s HITS [Kleinberg99] o o SALSA [LM01] o o … FSQ on Web Graphs 24 Asiacrypt '10

o o HITS algorithm o o Step 1: compute focused subgraph o o Step 2: run iterative algorithm on focused subgraph Focused Subgraph Queries 25 Asiacrypt '10 Singapore

o o Encrypt o o pages with SE-KW o o graph with SE-NQ o o does not work! o o Chaining technique o o combine SE schemes (e.g., SE-KW with SE-NQ) o o preserves token size of first SE scheme o o Requires associative SE o o message space: private data items and semi-private information o o answer: pointers to data items + associated semi-private information o o [Curtmola-Garay-K-Ostrovsky06]: associative SSE but not CQA2 FSQ on Encrypted Graphs 26 Asiacrypt '10

FSQ on Web Graphs 27 Asiacrypt '10 t

FSQ on Web Graphs 28 Asiacrypt '10

FSQ on Web Graphs 29 Asiacrypt ' , 31, 3

30 Asiacrypt '10 Controlled Disclosure

o o Structured encryption o o Private queries on encrypted data o o Q : what about computing on encrypted data? o o Two-party computation o o Fully-homomorphic encryption o o 2PC & FHE don’t scale to massive datasets (e.g., Petabytes) o o Do we give up security? Limitations of Structured Encryption 31 Asiacrypt '10

o o Compromise o o reveal only what is necessary for the computation o o Local algorithms o o Don’t need to ``see” all their input o o e.g., simulated annealing, hill climbing, genetic algorithms, graph algorithms, link-analysis algorithms, … Controlled Disclosure 32 Asiacrypt '10 Family Colleagues

Controlled Disclosure 33 Asiacrypt '10 t q f

o o Microsoft Azure Marketplace o o Infochimps Cloud-based Data Brokerage 34 Asiacrypt '10

35 Asiacrypt '10 Secure Data Brokerage o o Producer o o accurate count of data usage o o Collusions b/w o o Cloud o o Consumer

36 Asiacrypt '10 Questions?