Abstract:While storing documents on the cloud can be attractive, the question remains whether cloud providers can be trusted with storing private documents. Even if trusted, data breaches are ubiquitous. To prevent information leakage one can store documents encrypted. If encrypted under traditional schemes, one loses the ability to perform simple operations over the documents, such as searching through them. Searchable encryption schemes were proposed allowing some search functionality while documents remain encrypted. Orthogonally, research is done to find attacks that exploit search and access pattern leakage that most efficient schemes have. One type of such an attack is the ability to recover plaintext queries. Passive query-recovery attacks on single-keyword search schemes have been proposed in literature, however, conjunctive keyword search has not been considered, although keyword searches with two or three keywords appear more frequently in online searches. We introduce a generic extension strategy for existing passive query-recovery attacks against single-keyword search schemes and explore its applicability for the attack presented by Damie et al. (USENIX Security '21). While the original attack achieves up to a recovery rate of 85% against single-keyword search schemes for an attacker without exact background knowledge, our experiments show that the generic extension to conjunctive queries comes with a significant performance decrease achieving recovery rates of at most 32%. Assuming a stronger attacker with partial knowledge of the indexed document set boosts the recovery rate to 85% for conjunctive keyword queries with two keywords and achieves similar recovery rates as previous attacks by Cash et al. (CCS '15) and Islam et al. (NDSS '12) in the same setting for single-keyword search schemes.

IHOP: Improved Statistical Query Recovery against Searchable Symmetric Encryption through Quadratic Optimization

Query Recovery from Easy to Hard: Jigsaw Attack against SSE

A Highly Accurate Query-Recovery Attack against Searchable Encryption using Non-Indexed Documents

Secure Graph Database Search with Oblivious Filter

Interpreting and Mitigating Leakage-Abuse Attacks in Searchable Symmetric Encryption

Passive Attacks Against Searchable Encryption.

Query Recovery Attacks on Searchable Encryption Based on Partial Knowledge

Hiding the Access Pattern is Not Enough: Exploiting Search Pattern Leakage in Searchable Encryption

Secure Boolean Queries over Encrypted Data from Indistinguishability Obfuscation

Passive Query-Recovery Attack Against Secure Conjunctive Keyword Search Schemes

Exploring the Security Vulnerability in Frequency-Hiding Order-Preserving Encryption

Verifiable Searchable Symmetric Encryption from Indistinguishability Obfuscation.

Volume-Hiding Range Searchable Symmetric Encryption for Large-Scale Datasets

Reducing Paging and Exit Overheads in Intel SGX for Oblivious Conjunctive Keyword Search

EPPSQ: Achieving efficient and privacy-preserving statistics queries over encrypted data in smart grids

Searchable Symmetric Encryption with Forward Search Privacy

Slicer: Verifiable, Secure and Fair Search over Encrypted Numerical Data Using Blockchain

Towards Efficient Verifiable Conjunctive Keyword Search For Large Encrypted Database

Verifiable searchable symmetric encryption for conjunctive keyword queries in cloud storage

Toward Secure Multikeyword Top-k Retrieval over Encrypted Cloud Data

LEAP - Leakage-Abuse Attack on Efficiently Deployable, Efficiently Searchable Encryption with Partially Known Dataset.