Range search on encrypted spatial data with dynamic updates1

Searchable Encryption can search over encrypted data without accessing data or queries in plaintext. It preserves privacy while queries are performed over data on an untrusted server. To ensure the efficiency of search, most Searchable Encryption schemes reveal access patterns, i.e., a server learns which encrypted files are retrieved for each query. Unfortunately, by collecting access patterns, a file-injection attack can completely compromise the query privacy offered by Searchable Encryption. In this paper, we propose a novel pre-encryption obfuscation mechanism, referred to as Vaccine, which can effectively protect searchable encrypted data against a file-injection attack. Specifically, the main idea of Vaccine is to introduce a self file-injection attack, which obfuscates access patterns obtained by an attacker and prevents this attacker from inferring correct queries in plaintext. In addition, by harnessing natural language processing techniques, Vaccine can effectively remove self-injected files from search results, and therefore introduce minimal tradeoffs. Our experimental results on a real-world dataset show that Vaccine can reduce an adversary's guessing probability from 1 to $3.7\times 10^{-3}$ , which significantly promotes privacy protection. Furthermore, Vaccine introduces only 3.4% false negatives and no false positives in search results.

Inverse biometrics methods are a major privacy concern for users of biometric recognition systems. Affine‐based reconstruction attack is an inverse biometrics method that models the biometric recognition algorithm by an affine approximation. This type of attack reconstructs targeted biometric references using the modelled biometric recognition algorithm and the comparison scores issued by the system. Although this reconstruction method has only been successfully applied to reconstruct face images, the common consensus is that any biometric system that issues comparison scores could be vulnerable to such an attack since this method is sufficiently general to be applied to other biometric templates. Here it is shown that the attack fails to regenerate sparse vascular feature point templates. The reconstruction attack on feature point patterns extracted from retina and hand vascular images is tested. The inverse attack match rate for reconstructed reference templates was 0.3% in one experiment using retinal vasculature and 0% for all others. These results show that the reconstruction attack is not as catastrophic as it is widely accepted to be, and that vascular biometric template protection schemes that store sparse templates as references and reveal comparison scores are not susceptible to affine‐based reconstruction attacks.

Searchable (symmetric) encryption allows encryption while still enabling search for keywords. Its immediate application is cloud storage where a client outsources its files while the (cloud) service provider should search and selectively retrieve those. Searchable encryption is an active area of research and a number of schemes with different efficiency and security characteristics have been proposed in the literature. Any scheme for practical adoption should be efficient -- i.e. have sub-linear search time --, dynamic -- i.e. allow updates -- and semantically secure to the most possible extent. Unfortunately, efficient, dynamic searchable encryption schemes suffer from various drawbacks. Either they deteriorate from semantic security to the security of deterministic encryption under updates, they require to store information on the client and for deleted files and keywords or they have very large index sizes. All of this is a problem, since we can expect the majority of data to be later added or changed. Since these schemes are also less efficient than deterministic encryption, they are currently an unfavorable choice for encryption in the cloud. In this paper we present the first searchable encryption scheme whose updates leak no more information than the access pattern, that still has asymptotically optimal search time, linear, very small and asymptotically optimal index size and can be implemented without storage on the client (except the key). Our construction is based on the novel idea of learning the index for efficient access from the access pattern itself. Furthermore, we implement our system and show that it is highly efficient for cloud storage.

Data locality exists everywhere in the memory hierarchy. Most applications show temporal and spatial locality, and computer system and architecture designers utilize this property to improve the system performance with better data layout, prefetching, and scheduling. The locality property can be represented by memory access patterns, which records the time and frequency of accessed addresses. From the security perspective, if an attacker can trace the access pattern, sensitive information inside of the application could be observed and leaked. Oblivious RAM is one of the most effective solutions to mitigate the access pattern leakage on the system, which adds redundant data blocks in space and time. With ORAM protection, the intrinsic data locality is broken by the randomly stored data. Therefore, the application cannot gain any performance benefits from locality if the ORAM protocol is used. In this work, we would like to study the potential to support multi-range accesses with new storage and access efficient ORAM construction. Our proposed designs include two major schemes: Lite-rORAM, which minimize the storage overhead of existing rORAM; and Hybrid-rORAM, which support multiple ranges accesses with minimum storage overhead. We achieve the goal to preserve the locality for consecutive data blocks with different ranges in the application while obfuscates the access pattern as well. We tested our proposed schemes with different workloads on local and remote backends. The experimental results show that, in the best case, our proposed ORAM construction can reduce the data block retrieval time to 0.24x of the baseline Path ORAM, with 87.5% storage overhead reduction compared to rORAM.

Searchable encryption enables searches to be performed on encrypted documents stored on an untrusted server without exposing the documents or the search terms to the server. Nevertheless, the server typically learns which encrypted documents match the query-the so-called access pattern-since the server must return those documents. Recent studies have demonstrated that access patterns can be used to infer the search terms in some scenarios. In this paper, we propose a framework to protect systems using searchable symmetric encryption from access-pattern leakage. Our technique is based on d-privacy, a generalized version of differential privacy that provides provable security guarantees against adversaries with arbitrary background knowledge.

Performing joins over encrypted data is particularly challenging, since the query result or access pattern of 1 : n-joins reveals the frequency of each distinct element in the column. This frequency information is used in many easy, but very detrimental inference attacks. In this paper we present a different approach: Instead of implementing a stand-alone join operator that reveals the frequency of each element in the column, we show how to construct joins over encrypted data after selection operations have been applied. These joins only leak the fine granular access pattern and frequency of elements selected for the join. Our new fine-granularly secure joins use searchable encryption and key-policy attribute-based encryption and support dynamically adding and removing database rows. Their performance is practical and we present an implementation in MySQL.

As a prominent cryptographic tool, geometric searchable encryption (GSE) can be applied in many scenarios, such as location-based services (LBS), social networks and vehicle networks. Unfortunately, most of existing searchable encryption schemes supporting the functionality of geometric range searches suffer from false positives, which will lead people to make a wrong decision and further raise some serious consequences such as financial loss. In addition, some of them are designed under a symmetric system, which is not enough flexible deployed in LBS since in a symmetric system only a private key holder creates ciphertext, whereas in a public-key system anyone who holds a public key can produce ciphertext. In this paper, we intend to design a novel GSE scheme without any false positive under a public-key system supporting arbitrary geometric area searches, which is able to guarantee an accurate query result. Toward this goal, we develop a novel technique in handling the relation between a point and any convex polygon in combination with an inner product encryption, which is able to support arbitrary convex polygon range searches without any false positive. A comprehensive experiment demonstrates that, compared with the known schemes, our scheme possesses a 100% accuracy as well as an acceptable efficiency in the sense that it can guarantee that all files retrieved by users are exactly matched ones. Finally, we provide two practical examples of our GSE scheme: privacy-preserving friend-nearby notification with a common point of interest and privacy-preserving parking monitor and guiding system.

Searchable encryption (SE) enables data users to securely search encrypted data stored in untrusted cloud servers. However, most SE schemes allow for leakages of access and search patterns to maximize efficiency and functionality. Recent attacks have shown that adversaries can recover query keywords with prior knowledge of the database by exploiting these leakages. Unfortunately, the existing schemes that protect access and search patterns result in frequent communications and high computational costs. Furthermore, complex calculation processes also raise challenges for verifying search results. To address these concerns, we first design an efficient conjunctive SE scheme with search and access pattern privacy using private set intersection. In the proposed scheme, we utilize random numbers to obfuscate the values of polynomials and randomly divide the results into two parts, which simplifies the search process, improves search efficiency, and eliminates the need for time-consuming ciphertext multiplication operations. We also extend this scheme to support search result verifiability. Specifically, by embedding a random number as the root of the return polynomial, we achieve verifiability of search results. Furthermore, we prove the security of both schemes employing the simulation-based method. Finally, we implement the schemes in a real database and thorough performance analyses demonstrate their efficiency.

This article represents a dynamic grid system (DGS), a privacy grid system defined by the user. This is the primary all-encompassing secure and spatial data satisfying basic essential necessities for confidentiality-securing snapshot and location-based services (LBSs). First, secure and spatial data are responsible for achieving simple matching operation using a semi-trusted third party. The semi-trusted third party has no information about the location of the user. Second, under the defined adversary model, we can provide a secured snapshot and uninterrupted location-based services. Third, not beyond the proximity of the user???s area, the communication cost does not rely on others ideal confidentiality location; it depends on the number of pertinent salient activities. Fourth, despite these things, it has only been targeted on the range and our system that can effectively support different spatial queries without altering the algorithms that are kept running by the semi-reliable third parties and the database servers, given that the spatial query is abstracted into spatial regions within the desired search area. The experimental assessment shows a more efficient approach towards the dynamic grid structure than the progressive confidentiality technique for uninterrupted location-based services. We offer a dual spatial data transformation and encryption scheme in which encrypted requests are executed completely on the encrypted database by the provider, and the user gets encrypted results. To attain services found on their location, location-based services want users to consistently report their locations to a potentially unreliable server which may open them to security risks. Lamentably, there were many restrictions in the existing confidentiality-securing methods for location-based services, such as the trustworthy third party requirement, confidentiality restrictions and high overhead communication.

Recent studies have shown that machine learning as a service is susceptible to reconstruction attacks that would expose users' privacy. When it comes to face recognition systems, privacy leakage could incur unpredictable effects on confidential or financial matters. This paper focuses on black-box reconstruction attacks on face recognition systems, including face verification and face identification applications. Considering a face recognition system in the real world, the adversary only has access to the similarity score of a query compared to a certain ID. We build our method based on a pretrained StyleGAN face generator and optimize its latent code to obtain a face image that maximizes the similarity score. Given the similarity score alone, we adopt zeroth-order optimization to estimate the gradients faithfully. Our method can attack 1:1 verification system with efficient and high-quality. To validate the effectiveness of the proposed method, we perform extensive experiments on face recognition systems, and reveal their risks of privacy leakage.

Searchable symmetric encryption allows operating on encrypted data, particularly keyword-based search on documents and range-based search on spatial data. Various methods can be used in Searchable symmetric encryption, such as order-preserving or fully homomorphic encryption, for different levels of information leakage. New schemes with more efficient search operations and reduced access and search pattern leakage that support novel settings, such as dynamic data sets and multiple users, have been proposed in the last few years. Especially with the emergence of cloud storage, encrypting sensitive remote data while preserving the ability to operate efficiently is an ample opportunity for the military and industry. However, there are risks when deploying Searchable symmetric encryption that must be considered since some Searchable symmetric encryption schemes proposed in the past have been (completely) broken by the research community.

Cross-lingual multi-keyword rank search with semantic extension over encrypted data

Cloud computing has greatly facilitated large-scale data outsourcing due to its cost efficiency, scalability and many other advantages. Subsequent privacy risks force data owners to encrypt sensitive data, hence making the outsourced data no longer searchable. Searchable Symmetric Encryption (SSE) is an advanced cryptographic primitive addressing the above issue, which maintains efficient keyword search over encrypted data without disclosing much information to the storage provider. Existing SSE schemes implicitly assume that original user data is centralized, so that a searchable index can be built at once. Nevertheless, especially in cloud computing applications, user-side data centralization is not reasonable, e.g. an enterprise distributes its data in several data centers. In this paper, we propose the notion of Multi-Data-Source SSE (MDS-SSE), which allows each data source to build a local index individually and enables the storage provider to merge all local indexes into a global index afterwards. We propose a novel MDS-SSE scheme, in which an adversary only learns the number of data sources, the number of entire data files, the access pattern and the search pattern, but not any other distribution information such as how data files or search results are distributed over data sources. We offer rigorous security proof of our scheme, and report experimental results to demonstrate the efficiency of our scheme.

Several attacks have shown that the leakage from the access pattern in searchable encryption is dangerous. Attacks exploiting leakage from the query pattern are as dangerous, but less explored. While there are known, lightweight countermeasures to hide information in the access pattern by padding the ciphertexts, the same is not true for the query pattern. Oblivious RAM hides the query patterns, but requires a logarithmic overhead in the size of the database and hence will become even slower as data grows. In this paper we present a query smoothing algorithm to hide the frequency information in the query pattern of searchable encryption schemes by introducing fake queries. Our method only introduces a constant overhead of 7 to 13 fake queries per real query in our experiments. Furthermore, we show that our query smoothing algorithm can also be applied to range-searchable encryption schemes and then prevents all recent plaintext recovery attacks.

Outsourcing encrypted data to the cloud demands efficient and confidentiality-preserving search techniques, yet existing Searchable Symmetric Encryption (SSE) schemes suffer from severe access and search pattern leakage, and the problem is more intractable in multi-data-owner scenarios where cross-dataset privacy-preserving search remains unsolved. This paper proposes PSSE-MDO (Privacy-Preserving SSE with Pattern Obfuscation for Multiple Data Owners), the first SSE scheme that achieves robust access and search pattern hiding for multi-data-owner settings with constant client-side overhead. Our core innovation is a cryptographic protocol enabling users to issue a single constant-sized search token (trapdoor) for searching across all data owners' encrypted indexes. The scheme integrates Inner-Product Predicate Encryption (IPE) and Somewhat Homomorphic Encryption (SHE) to probabilistically obfuscate search results for each query. A key experimental result shows that the client-side cost approximately 120 ms for search token generation—remains constant regardless of the number of data owners, in contrast to existing pattern-hiding schemes with linearly scaling costs. This validates PSSE-MDO's practicality for real-world large-scale collaborative cloud systems, marking a significant step toward practical privacy-preserving search in federated cloud environments.