论文标题
隐藏访问模式是不够的：在可搜索的加密中利用搜索模式泄漏
Hiding the Access Pattern is Not Enough: Exploiting Search Pattern Leakage in Searchable Encryption
论文作者
论文摘要
最新的可搜索对称加密（SSE）方案可以通过存储在服务器中的加密数据库进行安全搜索，同时限制泄漏到服务器的信息。这些方案专注于隐藏访问模式，该计划是指匹配客户端查询的一组文档。这为当前攻击提供了保护，这些攻击在很大程度上取决于此泄漏成功。但是，大多数SSE构造还泄漏了两个查询是否针对相同的关键字，也称为搜索模式。 在这项工作中，我们表明搜索模式泄漏会严重破坏当前的SSE防御能力。我们提出了一种利用访问和搜索模式泄漏以及一些背景和查询分布信息的攻击，以恢复客户端执行的查询的关键字。我们的攻击遵循了最大似然估计方法，并且很容易适应使访问模式混淆的SSE防御措施。我们从经验上表明，我们的攻击效率是高效的，它的表现要优于其他提议的攻击，并且在我们对其进行评估的三个防御措施中，即使这些防御措施设置为高隐私权制度，也完全挫败了我们对其进行评估的三个防御。这些发现凸显了隐藏搜索模式（大多数构造的功能）是提供SSE中实用隐私保证的关键。
Recent Searchable Symmetric Encryption (SSE) schemes enable secure searching over an encrypted database stored in a server while limiting the information leaked to the server. These schemes focus on hiding the access pattern, which refers to the set of documents that match the client's queries. This provides protection against current attacks that largely depend on this leakage to succeed. However, most SSE constructions also leak whether or not two queries aim for the same keyword, also called the search pattern. In this work, we show that search pattern leakage can severely undermine current SSE defenses. We propose an attack that leverages both access and search pattern leakage, as well as some background and query distribution information, to recover the keywords of the queries performed by the client. Our attack follows a maximum likelihood estimation approach, and is easy to adapt against SSE defenses that obfuscate the access pattern. We empirically show that our attack is efficient, it outperforms other proposed attacks, and it completely thwarts two out of the three defenses we evaluate it against, even when these defenses are set to high privacy regimes. These findings highlight that hiding the search pattern, a feature that most constructions are lacking, is key towards providing practical privacy guarantees in SSE.
