1 Pseudorandom-Permutation Index

2 Outline Introduction Goh’s Z-IDX PRP-Index Secure game

3 Introduction Keyword index is a data structure that allows us to search in constant time for documents containing specified keywords Unfortunately, standard index constructions are not designed for encrypted documents, because they may leak some information about the document.

4 Parameter e: pseudo random permutation f: pseudo random function Key: k D w : (w 1, w 2,.., w n ) D id : document’s identifier

5 Goh ’ s Z-IDX

6 Bloom Filter

7 PRP-Index1&2 ‘water’ trapdoor: t 1 = E k (‘water’) codeword: x 1 =e(t 1, D id ) key: y 1 =f(D id, t 1 ) 1. sorted sequence2. hash(collision) BuildIndex (D, Key) SearchIndex (trapdoor, Index)

8 PRP-Index1 x 4 : (1, 4) Search time: O(log n) x 3 <x 4 <x 1 <x 5 <x 6

9 PRP-Index2 h(x4)h(x4) x 4 : (1, 4) ….. m 用 f id (E k (w 4 )) 加密 null s

10 PRP-Index3 ‘water’ trapdoor: t 1 = E k (‘water’) codeword: x 1 =f(D id, t 1 ) key: y 1 =e(t 1, D id ) 3. hash + sequence pointer BuildIndex (D, Key) SearchIndex (trapdoor, Index)

11 PRP-Index3 h(x4)h(x4) x 4 : (1, 4) E y 4 (1, 2) E y 4 (4)E y 4 (-1) s ….. m

12 ɛ -IND-CKA Encryption 1. The challenger C runs the KeyGen(s) algorithm to generate key k. 2. Attacker A can ask C for the E k (W) for any keyword W {0, 1}* of his choice. 3. A sends W 0, W 1 on which it wants to challenge. 唯一的 限制是 step2 時不能對 W 0, W 1 做 query. C gives A E k ( W b ), where b {0, 1}. 4. A can continue to ask for trapdoors for any keyword as long as W ≠ W 0, W Then, A outputs b’ {0, 1} and wins the game if b=b’. Adv A (s)=|Pr[b=b’ ]-1/2| < ɛ 12

13 ɛ -IND-CKA Index 1. The challenger C runs the KeyGen(s) algorithm to generate key k. 2. Attacker A can ask C for the Buildindex(D, k) and trapdoor E k (W) where D is document and W {0, 1}* of his choice. 3. A sends D 0, D 1 on which it wants to challenge. 唯一的 限制是 step2 時不能對 中的 keyword 做 trapdoor query. C gives A the = Buildindex(D b, k), where b {0, 1}. 13

14 ɛ -IND-CKA Index 4. A can continue to ask for trapdoors for any keyword as long as W 5. Then, A outputs b’ {0, 1} and wins the game if b = b’. Adv A (s)=|Pr[b=b’ ] - 1/2| < ɛ

15 ɛ -IND-CKA Index If the encrypted function E is a ɛ -IND-CKA encryption, then PRP-Index is a ɛ -IND-CKA Index