Revisiting Leakage Abuse Attacks Laura Blackstone Seny Kamara - PowerPoint PPT Presentation

Revisiting Leakage Abuse Attacks Laura Blackstone Seny Kamara Tarik Moataz AROKI 
 SYSTEMS

Encrypted Search Trusted client Untrusted server Cat Fish Cat Dog Dog 2

Encrypted Search Cat Fish Encrypted Trusted client Cat Untrusted server Index Dog Dog Secret key 3

Encrypted Search Cat Fish Encrypted Trusted client Cat Untrusted server Index Dog Dog Cat Secret key 3

Encrypted Search Cat Fish Encrypted Trusted client Cat Untrusted server Index Dog Dog Cat Secret key Cat Cat Dog 3

Encrypted Search Cat Fish Encrypted Trusted client Cat Untrusted server Index Dog Dog Cat Secret key Cat Cat Dog 4

Encrypted Search Setup Leakage 
 L S Cat Fish Encrypted Trusted client Cat Untrusted server Index Dog Dog Cat Secret key Cat Cat Dog 4

Encrypted Search Setup Leakage 
 L S Cat Fish Encrypted Trusted client Cat Untrusted server Index Dog Dog Cat Secret key Query Leakage 
 Cat Cat L Q Dog 4

Query Leakage Terminology • Query equality pattern (qeq) • If and when the search is the same (search pattern) • Response identity pattern (rid) • The file identifiers matching the query (access pattern) • Co-occurrence pattern (co-occ) • The number of files shared by any two queries • Response length pattern (rlen) • The number of files matching a query • Volume pattern (vol) / Total volume pattern (tvol) • The number of bits of each file / the sum of file sizes in bits 5

Q : do we leak all of these patterns “at once”? 6

Encrypted Search Primitives Property-Preserving Functional Structured Encryption Encryption (PPE) Encryption (STE) Oblivious RAM Fully-Homomorphic (ORAM) Encryption (FHE) 7

Encrypted Search Primitives Property-Preserving Functional Structured Encryption Encryption (PPE) Encryption (STE) Oblivious RAM Fully-Homomorphic (ORAM) Encryption (FHE) 7

Encrypted Search STE- & ORAM- based schemes co-occ qeq vol rid rlen tvol 8

Encrypted Search Baseline STE STE- & ORAM- based schemes co-occ qeq vol rid rlen tvol 8

Encrypted Search Baseline STE STE- & ORAM- based schemes Semi-ORAM co-occ qeq vol rid rlen tvol 8

Encrypted Search Baseline STE STE- & ORAM- based schemes Semi-ORAM co-occ qeq OPQ STE [this work] vol rid rlen tvol 8

Encrypted Search Baseline STE STE- & ORAM- based schemes Semi-ORAM co-occ qeq OPQ STE [this work] vol rid rlen Full ORAM tvol 8

Q : can we use the disclosed leakage to recover user’s data? 9

Leakage Attacks Input Output Leakage Attack One or more User’s query or leakage pattern data recovery • Type of adversary Assumptions • Type of auxiliary data • Type of actions • … 10

Leakage Attacks Assumptions 11

Leakage Attacks Assumptions • Adversarial model • persistent: needs encrypted index, documents and queries • snapshot: needs encrypted index and documents 11

Leakage Attacks Assumptions • Adversarial model • persistent: needs encrypted index, documents and queries • snapshot: needs encrypted index and documents • Auxiliary information • known sample: needs sample from same distribution • known data: needs actual data or/and user queries • δ : fraction of adversarially-known data 11

Leakage Attacks Assumptions • Adversarial model • persistent: needs encrypted index, documents and queries • snapshot: needs encrypted index and documents • Auxiliary information • known sample: needs sample from same distribution • known data: needs actual data or/and user queries • δ : fraction of adversarially-known data • Passive vs. active • injection (chosen-data): needs to inject data 11

Leakage Attacks IKK Attack [Islam-Kuzu-Kantarcioglu12] Input Output IKK Attack Query recovery co-occ 12

Leakage Attacks IKK Attack [Islam-Kuzu-Kantarcioglu12] Input Output IKK Attack Query recovery co-occ • Persistent adversary Assumptions • Passive • Known sample * • Known queries 12

Leakage Attacks IKK Attack [Islam-Kuzu-Kantarcioglu12] Input Output IKK Attack Query recovery co-occ Vulnerable • Persistent adversary Assumptions schemes • Passive • Baseline STE • Known sample * • Semi-ORAM • Known queries 12

Leakage Attacks Count Attack [Cash-Grubbs-Perry-Ristenpart15] Input Output Count Attack Query recovery co-occ + rlen 13

Leakage Attacks Count Attack [Cash-Grubbs-Perry-Ristenpart15] Input Output Count Attack Query recovery co-occ + rlen Assumptions • Persistent adversary • Passive • Known data 13

Leakage Attacks Count Attack [Cash-Grubbs-Perry-Ristenpart15] Input Output Count Attack Query recovery co-occ + rlen Vulnerable Assumptions • Persistent adversary schemes • Baseline STE • Passive • Semi-ORAM • Known data 13

Impact of IKK & Count • “For example, IKK demonstrated that by observing accesses to an encrypted email repository, an adversary can infer as much as 80% of the search queries” • “It is known that access patterns, to even encrypted data, can leak sensitive information such as encryption keys [IKK]” • “A recent line of attacks […,Count,…] has demonstrated that such access pattern leakage can be used to recover significant information about data in encrypted indices. For example, some attacks can recover all search queries [Count,…] …” 14

A closer look at IKK & Count attacks 15

Non-trivial limitations 0.2 • High known-data rates 0.15 • Count v1 requires more than 80% and 5% of the queries Frequency • IKK requires more than 95% and 5% of the queries 0.1 SU dataset • Count v2 requires more than 60% M-MU dataset L-MU dataset • Practical vs. Theoretical? 0.05 • Low-vs. high selectivity keywords • Experiments all run on high-selectivity keywords 0 0 2000 4000 6000 8000 10000 • Keywords that are frequent in the user’s data Keywords rank • Re-ran on low-selectivity keywords and failed High- Pseudo-low Low • Both exploit co-occurrence selectivity selectivity selectivity ( ≥ 13) • relatively easy to hide (using OPQ SSE) (10-13) (1-2) 16

Q : can we de better than IKK & Count? 17

Summary of our Attacks Known-Data attacks 18

Summary of our Attacks Known-Data attacks Subgrap ID rid Query recovery Attack 18

Summary of our Attacks Vulnerable schemes Known-Data attacks • Baseline STE • Semi-ORAM Subgrap ID rid Query recovery Attack 18

Summary of our Attacks Vulnerable schemes Known-Data attacks • Baseline STE • Semi-ORAM Subgrap ID rid Query recovery Attack • Baseline STE • Semi-ORAM Subgraph VL vol Query recovery Attack 18

Summary of our Attacks Vulnerable schemes Known-Data attacks • Baseline STE • Semi-ORAM Subgrap ID rid Query recovery Attack • Baseline STE • Semi-ORAM Subgraph VL vol Query recovery Attack • Baseline STE • Semi-ORAM VolAn & • OPQ STE tvol Query recovery SelVolAn • Full ORAM Attacks 18

Summary of our Attacks Injection attacks Vulnerable schemes • Baseline STE • Semi-ORAM Decoding & • OPQ STE tvol Query recovery Binary • Full ORAM attacks First injection attack was by [Zhang-Katz-Papamanthou16] and 
 works against Baseline STE and Semi-ORAM 19

The Subgraph VL Attack 20

The Subgraph VL Attack • Let K ⊆ D be set of known documents • K = (K 2 , K 4 ) and D = (D 1 , …, D 4 ) 21

The Subgraph VL Attack • Let K ⊆ D be set of known documents • K = (K 2 , K 4 ) and D = (D 1 , …, D 4 ) Known Graph vol(K 4 ) vol(K 2 ) w 1 w 4 w 5 21

The Subgraph VL Attack • Let K ⊆ D be set of known documents • K = (K 2 , K 4 ) and D = (D 1 , …, D 4 ) Observed Graph Known Graph vol(K 4 ) vol(D 1 ) vol(D 2 ) vol(D 3 ) vol(D 4 ) vol(K 2 ) w 1 w 4 q 1 q 4 w 5 q 2 q 3 q 5 21

The Subgraph VL Attack • We need to match q i to some w j • The volumes are the ground of truth Observed Graph Known Graph vol(D 1 ) vol(D 2 ) vol(D 3 ) vol(D 4 ) vol(K 4 ) vol(K 2 ) q 1 q 4 w 1 w 4 q 2 q 3 q 5 w 5 22

The Subgraph VL Attack • Observations : if q i = w j then • N(w j ) ⊆ N(q i ) and #N(w j ) ≈ δ . #N(q i ) Observed Graph Known Graph vol(D 1 ) vol(D 2 ) vol(D 3 ) vol(D 4 ) vol(K 4 ) vol(K 2 ) q 1 q 4 w 1 w 4 q 2 q 3 q 5 w 5 23

The Subgraph VL Attack • Each query q starts with a candidate set C q = 𝕏 remove all words s.t. either N(w j ) ⊈ N(q i ) or #N(w j ) ≉ δ . N(q i ) • N(q 1 ) = C(q 1 ) ={w 4 ,w 5 ,w 1 } N(w 4 ) = N(q 2 ) = N(w 5 ) = N(q 3 ) = C(q 4 ) = {w 4 ,w 5 ,w 1 } N(w 1 ) = N(q 4 ) = C(q 5 ) ={w 4 ,w 5 ,w 1 } N(q 5 ) = Known Graph 24 Candidate Sets Observed Graph

The Subgraph VL Attack • Each query q starts with a candidate set C q = 𝕏 remove all words s.t. either N(w j ) ⊈ N(q i ) or #N(w j ) ≉ δ . N(q i ) • N(q 1 ) = C(q 1 ) ={w 4 ,w 5 ,w 1 } C(q 1 ) ={w 1 } N(w 4 ) = N(q 2 ) = N(w 5 ) = N(q 3 ) = C(q 4 ) = {w 4 ,w 5 ,w 1 } N(w 1 ) = N(q 4 ) = C(q 5 ) ={w 4 ,w 5 ,w 1 } N(q 5 ) = Known Graph 24 Candidate Sets Observed Graph