IHOP: Improved Statistical Query Recovery against Searchable Symmetric Encryption through Quadratic Optimization. Simon Oya, and Florian Kerschbaum. In USENIX Security Symposium, pp. 2407-2424, 2022. [Slides]
Privacy-Preserving Searchable Encryption
Storing data in the cloud is very convenient: it frees resources on our local devices and provides data availability as long as we have an Internet connection. However, storing privacy-sensitive data in the cloud is somewhat scary: what if the cloud is looking at our data? Can we trust the cloud?
Luckily, we are very good at hiding data using cryptography! We can encrypt of all our data and store it in the cloud. However, if we try to search for any data item, turns out we cannot do this by default if the data is encrypted. Enter searchable encryption!
Searchable encryption enables the storage of encrypted data on a cloud provider, along with cryptographic structures that allow secure searches to be performed on the data. Now, the cloud provider learns nothing about the data itself or how it is accessed. However, total protection incurs a lot of overhead, which means that, in practice, we should leak some information to the cloud provider. Understanding the implications of such leakage and designing systems that limit such leakage (while still being efficient) are two very important questions that my research deals with.
I have looked at this problem by developing attacks against searchable encryption schemes, since the performance of an attack gives us some indication of the privacy level the system provides. If you are curious about this, check my publications below. I recommend starting with the SAP attack, which has enough statistics to show you the kind of work I do. If you liked that, check a more sophisticated attack called IHOP, as well as my proudest academic achievement: the slides I used to present this work. There is also a video of that talk somewhere, but please don’t watch it.
Publications
Hiding the Access Pattern is Not Enough: Exploiting Search Pattern Leakage in Searchable Encryption. Simon Oya, and Florian Kerschbaum. In USENIX Security Symposium, pp. 127-142, 2021. [Slides]
Obfuscated Access and Search Patterns in Searchable Encryption. Zhiwei Shang, Simon Oya, Andreas Peter, and Florian Kerschbaum. In Network and Distributed System Security Symposium (NDSS), 2021. [Slides]