1. Structured Encryption and Controlled Disclosure Melissa Chase Seny Kamara Microsoft Research Asiacrypt '10 1

2. Cloud Storage Asiacrypt '10 2

3. o o Main concern: will my data be safe? o o it will be encrypted o o it will be authenticated o o it will be backed up o o access will be controlled o o … o o Security only vs. o o outsiders o o other tenants o o Q : can we provide security against the cloud operator? Security for Cloud Storage 3 Asiacrypt '10

4. o o How do we preserve confidentiality of data? o o Encryption! o o What happens when I need to retrieve my data? o o e.g., search over emails or pictures Confidentiality in Cloud Storage 4 Asiacrypt '10

5. Searchable Symmetric Encryption [Song-Wagner-Perrig01] 5 Asiacrypt '10

6. o o General-purpose o o Two-party computation [Yao82] o o Oblivious RAMs [Goldreich-Ostrovsky96] o o Fully-homomorphic encryption [Gentry09] o o interactive or search is O(|data|) o o Searchable encryption o o [SWP01,Goh03,Chang-Mitzen.05,Boneh-diCrescenzo-Ostrovsky- Persiano04,…] : 1 round & O(#docs) server computation o o [Curtmola-Garay-K-Ostrovsky06] : 1 round & O(# of docs w/ word) server computation o o Functional encryption [Boneh-Sahai-Waters10] Related Work 6 Asiacrypt '10

7. o o Private keyword search over encrypted text data o o Q : can we privately query other types of encrypted data? o o maps o o image collections o o social networks o o web page archives Limits of Searchable Encryption 7 Asiacrypt '10

8. o o Communications o o email headers, phone logs o o Networks o o Social networks o o Web crawlers o o Maps Graph Data 8 Asiacrypt '10

9. Structured Encryption 9 Asiacrypt '10 t

10. o o Structured Encryption o o Formal security definition o o simulation-based o o Constructions o o Graph encryption with adjacency queries o o Graph encryption with neighbor queries o o Web graph encryption with focused subgraph queries o o Controlled disclosure o o Application to cloud-based data brokering Our Results 10 Asiacrypt '10

11. 11 Asiacrypt '10 Structured Encryption

12. o o Social network = Graph + Profiles Structured Data 12 Asiacrypt '10

13. Structured Encryption 13 Asiacrypt '10 t

14. o o Security against adaptive chosen query attacks o o generalizes CKA2-security from [CGKO06] o o Simulation-based definition o o ``given the ciphertext and the tokens no adversary can learn any information about the data and the queries, even if the queries are made adaptively” o o Too strong o o e.g., SSE constructions leak some information o o access pattern: pointers to documents that contain keyword o o search pattern: whether two tokens were for the same keyword CQA2-Security 14 Asiacrypt '10

15. o o Security is parameterized by 2 stateful leakage functions o o Simulation-based definition o o ``given the ciphertext and the tokens no adversary can learn any information about the data and the queries other than what can be deduced from the L 1 and L 2 leakages…” o o “…even if queries are made adaptively” CQA2-Security 15 Asiacrypt '10

16. Leakage Functions 16 Asiacrypt '10

17. CQA2-Security 17 Asiacrypt '10 Real WorldIdeal World q t ?$&$#&$#&$s!l) t L1L1 q L2L2,q

18. Adaptiveness 18 Asiacrypt '10

19. 19 Asiacrypt '10 Constructions

20. o o Graph encryption with adjacency queries o o from matrix encryption with lookup queries o o Graph encryption with neighbor queries o o from text encryption with keyword search (i.e., SSE) o o Web graph encryption with focused subgraph queries o o from text encryption with keyword search o o from graph encryption with neighbor queries Constructions 20 Asiacrypt '10

21. Neighbor Queries on Graphs 21 Asiacrypt '10 t

22. Neighbor Queries on Graphs 22 Asiacrypt '10

23. Neighbor Queries on Graphs 23 Asiacrypt '10 1 3 2 4 … …

24. o o Web graphs o o Text data -- pages o o Graph data --- hyperlinks o o Simple queries on web graphs o o All pages linked from P o o All pages that link to P o o Complex queries on web graphs o o ``mix” both text and graph structure o o search engine algorithms based on link-analysis o o Kleinberg’s HITS [Kleinberg99] o o SALSA [LM01] o o … FSQ on Web Graphs 24 Asiacrypt '10

25. o o HITS algorithm o o Step 1: compute focused subgraph o o Step 2: run iterative algorithm on focused subgraph Focused Subgraph Queries 25 Asiacrypt '10 Singapore

26. o o Encrypt o o pages with SE-KW o o graph with SE-NQ o o does not work! o o Chaining technique o o combine SE schemes (e.g., SE-KW with SE-NQ) o o preserves token size of first SE scheme o o Requires associative SE o o message space: private data items and semi-private information o o answer: pointers to data items + associated semi-private information o o [Curtmola-Garay-K-Ostrovsky06]: associative SSE but not CQA2 FSQ on Encrypted Graphs 26 Asiacrypt '10

27. FSQ on Web Graphs 27 Asiacrypt '10 t

28. FSQ on Web Graphs 28 Asiacrypt '10

29. FSQ on Web Graphs 29 Asiacrypt '10 3 1 2 4 1, 31, 3

30. 30 Asiacrypt '10 Controlled Disclosure

31. o o Structured encryption o o Private queries on encrypted data o o Q : what about computing on encrypted data? o o Two-party computation o o Fully-homomorphic encryption o o 2PC & FHE don’t scale to massive datasets (e.g., Petabytes) o o Do we give up security? Limitations of Structured Encryption 31 Asiacrypt '10

32. o o Compromise o o reveal only what is necessary for the computation o o Local algorithms o o Don’t need to ``see” all their input o o e.g., simulated annealing, hill climbing, genetic algorithms, graph algorithms, link-analysis algorithms, … Controlled Disclosure 32 Asiacrypt '10 Family Colleagues

33. Controlled Disclosure 33 Asiacrypt '10 t q f

34. o o Microsoft Azure Marketplace o o Infochimps Cloud-based Data Brokerage 34 Asiacrypt '10

35. 35 Asiacrypt '10 Secure Data Brokerage o o Producer o o accurate count of data usage o o Collusions b/w o o Cloud o o Consumer

36. 36 Asiacrypt '10 Questions?