Advertisement

Practical Attacks on Relational Databases Protected via Searchable Encryption

  • Mohamed Ahmed Abdelraheem
  • Tobias Andersson
  • Christian Gehrmann
  • Cornelius Glackin
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 11060)

Abstract

Searchable symmetric encryption (SSE) schemes are commonly proposed to enable search in a protected unstructured documents such as email archives or any set of sensitive text files. However, some SSE schemes have been recently proposed in order to protect relational databases. Most of the previous attacks on SSE schemes have only targeted its common use case, protecting unstructured data. In this work, we propose a new inference attack on relational databases protected via SSE schemes. Our inference attack enables a passive adversary with only basic knowledge about the meta-data information of the target relational database to recover the attribute names of some observed queries. This violates query privacy since the attribute name of a query is secret.

Notes

Acknowledgments

This work was supported by European Union’s Horizon 2020 research and innovation programme under grant agreement No 644814, the PaaSword project within the ICT Programme ICT-07-2014: Advanced Cloud Infrastructures and Services.

Supplementary material

References

  1. 1.
    Abdelraheem, M.A., Andersson, T., Gehrmann, C.: Searchable encrypted relational databases: risks and countermeasures. In: The 12th Data Privacy and Management Workshop (2017)Google Scholar
  2. 2.
    Agrawal, R., Kiernan, J., Srikant, R., Xu, Y.: Order preserving encryption for numeric data. In: Proceedings of the 2004 ACM SIGMOD International Conference on Management of Data (2004)Google Scholar
  3. 3.
    Ailon, N., Chazelle, B.: Lower bounds for linear degeneracy testing. J. ACM (JACM) 52(2), 157–171 (2005)MathSciNetCrossRefGoogle Scholar
  4. 4.
    Bellare, M., Boldyreva, A., O’Neill, A.: Deterministic and efficiently searchable encryption. In: Annual International Cryptology Conference (2007)Google Scholar
  5. 5.
    Boldyreva, A., Chenette, N., O’Neill, A.: Order-preserving encryption revisited: improved security analysis and alternative solutions. In: Rogaway, P. (ed.) CRYPTO 2011. LNCS, vol. 6841, pp. 578–595. Springer, Heidelberg (2011).  https://doi.org/10.1007/978-3-642-22792-9_33CrossRefGoogle Scholar
  6. 6.
    Cash, D., Grubbs, P., Perry, J., Ristenpart, T.: Leakage-abuse attacks against searchable encryption. In: CCS 2015 (2015)Google Scholar
  7. 7.
    Cash, D., Jaeger, J., Jarecki, S., Jutla, C., Krawczyk, H., Rosu, M., Steiner, M.: Dynamic searchable encryption in very-large databases: Data structures and implementation. IACR Cryptology ePrint Archive (2014)Google Scholar
  8. 8.
    Cash, D., Jarecki, S., Jutla, C., Krawczyk, H., Roşu, M.-C., Steiner, M.: Highly-scalable searchable symmetric encryption with support for boolean queries. In: Canetti, R., Garay, J.A. (eds.) CRYPTO 2013. LNCS, vol. 8042, pp. 353–373. Springer, Heidelberg (2013).  https://doi.org/10.1007/978-3-642-40041-4_20CrossRefGoogle Scholar
  9. 9.
    Chase, M., Kamara, S.: Structured encryption and controlled disclosure. In: Abe, M. (ed.) ASIACRYPT 2010. LNCS, vol. 6477, pp. 577–594. Springer, Heidelberg (2010).  https://doi.org/10.1007/978-3-642-17373-8_33CrossRefGoogle Scholar
  10. 10.
    Curtmola, R., Garay, J., Kamara, S., Ostrovsky, R.: Searchable symmetric encryption: improved definitions and efficient constructions. In: CCS (2006)Google Scholar
  11. 11.
    Erickson, J.: Lower bounds for linear satisfiability problems. In: SODA 1995 (1995)Google Scholar
  12. 12.
    Center for Machine Learning and Intelligent Systems. University of california, irvine. https://archive.ics.uci.edu/ml/datasets.html. Accessed June 2017
  13. 13.
    Gold, O., Sharir, M.: Improved bounds for 3sum, k-sum, and linear degeneracy. CoRR, abs/1512.05279 (2015)Google Scholar
  14. 14.
    IARPA. Poster about protecting privacy and civil liberties. https://www.iarpa.gov/images/files/programs/spar/09-SPAR_final_v21.pdf
  15. 15.
    Islam, M.S., Kuzu, M., Kantarcioglu, M.: Access pattern disclosure on searchable encryption: Ramification, attack and mitigation. In NDSS 2012 (2012)Google Scholar
  16. 16.
    Kamara, S., Papamanthou, C.: Parallel and dynamic searchable symmetric encryption. In: Sadeghi, A.-R. (ed.) FC 2013. LNCS, vol. 7859, pp. 258–274. Springer, Heidelberg (2013).  https://doi.org/10.1007/978-3-642-39884-1_22CrossRefGoogle Scholar
  17. 17.
    Kellaris, G., Kollios, G., Nissim, K., O’Neill, A.: Generic attacks on secure outsourced databases. In: CCS (2016)Google Scholar
  18. 18.
    Kleinberg, J., Tardos, E.: Algorithm design. Pearson Education India (2006)Google Scholar
  19. 19.
    Kohavi, R., Becker, B.: Adult data set (1996). https://archive.ics.uci.edu/ml/machine-learning-databases/adult/. Accessed June 2017
  20. 20.
    Kurosawa, K., Ohtaki, Y.: UC-secure searchable symmetric encryption. In: Keromytis, A.D. (ed.) FC 2012. LNCS, vol. 7397, pp. 285–298. Springer, Heidelberg (2012).  https://doi.org/10.1007/978-3-642-32946-3_21
  21. 21.
    Lane, T., Kohavi, R.: Census-income (kdd) data set (2000). https://archive.ics.uci.edu/ml/machine-learning-databases/census-income-mld/. Accessed June 2017
  22. 22.
    Naveed, M., Kamara, S., Wright, C.: Inference attacks on property-preserving encrypted databases. In: CCS 2015 (2015)Google Scholar
  23. 23.
    OpenEMR. http://www.open-emr.org/. Accessed Mar 2017
  24. 24.
    Popa, R.A., Redfield, C., Zeldovich, N., Balakrishnan, H.: Cryptdb: protecting confidentiality with encrypted query processing. In: ACM Symposium on Operating Systems Principles (2011)Google Scholar
  25. 25.
    Laureano, R., Moro, S., Cortez, P.: Using data mining for bank direct marketing: an application of the crisp-dm methodology. In: Novais, P., et al. (eds.) Proceedings of the European Simulation and Modelling Conference - ESM 2011, pp. 117–121, Guimarães, Portugal, EUROSIS, October 2011. https://archive.ics.uci.edu/ml/datasets/Bank+Marketing. Accessed June 2017
  26. 26.
    Song, D.X., Wagner, D., Perrig, A.: Practical techniques for searches on encrypted data. In: IEEE Security and Privacy, S&P 2000Google Scholar
  27. 27.
    Van Liesdonk, P., Sedghi, S., Doumen, J., Hartel, P., Jonker, W.: Computationally efficient searchable symmetric encryption. In: Workshop on Secure Data Management (2010)Google Scholar

Copyright information

© Springer Nature Switzerland AG 2018

Authors and Affiliations

  • Mohamed Ahmed Abdelraheem
    • 1
  • Tobias Andersson
    • 2
  • Christian Gehrmann
    • 3
  • Cornelius Glackin
    • 1
  1. 1.Intelligent Voice Ltd.LondonUK
  2. 2.RISE SICSLundSweden
  3. 3.Lund UniversityLundSweden

Personalised recommendations