We propose a simple and efficient searchable symmetric encryption scheme based on a Bitmap index that evaluates Boolean queries. Our scheme provides a practical solution in settings where communications and computations are very constrained as it offers a suitable trade-off between privacy and performance.

1. Introduction Our BXT-Bitmap Scheme Security, Performance and Storage Analysis Conclusion
Executing Boolean Queries on an Encrypted
Bitmap Index
Mohamed Ahmed Abdelraheem1, Christian Gehrmann1, Malin
Lindstr¨om2 and Christian Nordahl2
1SICS Swedish ICT AB
2Blekinge Institute of Technology
CCSW 2016, Vienna
28 Oct 2016
1 / 24

2. Introduction Our BXT-Bitmap Scheme Security, Performance and Storage Analysis Conclusion
Data Breaches Everywhere
Figure 1: World’s Biggest Data Breaches
2 / 24

3. Introduction Our BXT-Bitmap Scheme Security, Performance and Storage Analysis Conclusion
Snowden Disclosures
Figure 2: Snowden Disclosures 3 / 24

4. Introduction Our BXT-Bitmap Scheme Security, Performance and Storage Analysis Conclusion
Protect our privacy and still enjoy public cloud services?
Figure 3: Ed Snowden’s ACLU SXSW Talk, March 2014
4 / 24

5. Introduction Our BXT-Bitmap Scheme Security, Performance and Storage Analysis Conclusion
Encrypted Search
Fully Homomorphic Encryption (FHE).
Secure Multiparty Computation (MPC).
Oblivious RAM (ORAM).
Searchable Symmetric Encryption (SSE).
Deterministic Encryption (DET).
Order Preserving Encryption (OPE).
5 / 24

6. Introduction Our BXT-Bitmap Scheme Security, Performance and Storage Analysis Conclusion
Symmetric Searchable Encryption Schemes I
Threat Model
SSE schemes achieve (non)-adaptive security against an
honest-but-curious adversary.
Efficieny comes at the price of leakage
Access Pattern: size of the search result.
Search Pattern: whether two searches are similar.
Remark
Still better than DET and OPE schemes allowing leakage before
any queries which makes offline inference attacks possible.
6 / 24

7. Introduction Our BXT-Bitmap Scheme Security, Performance and Storage Analysis Conclusion
Symmetric Searchable Encryption Schemes II
Song et al. [2000] proposed the first practical SSE scheme.
Curtumola et al. [2006] and many other SSE schemes achieve
optimal search time (sublinear) using the inverted index.
Liesdonk et al. [2009] proposed the first dynamic SSE scheme
using a Bitmap index.
Cash et al. [2013] proposed the first sublinear scheme
supporting Boolean queries w1 ∧ f (w2, · · · , wt).
Remark
Our work is inspired by Cash et al BXT and OXT protocols.
7 / 24

8. Introduction Our BXT-Bitmap Scheme Security, Performance and Storage Analysis Conclusion
Our Contribution
First multi-keyword SSE scheme on an encrypted Bitmap Index:
Trade-off between: communication, performance, security.
Single-round communication.
Reasonable security targeting constrained environments.
Linear search but embarrassingly parallel.
Suitable for very large and dense datasets.
Remark
Final query result is decided at the Client. This makes our work
different than standard SSE schemes but yields efficiency and
security benefits.
8 / 24

9. Introduction Our BXT-Bitmap Scheme Security, Performance and Storage Analysis Conclusion
Cash et al interactive-BXT and OXT Protocols
Evaluate queries of the form w1 ∧ f (w2, ..., wt):
w1 (s-term) has low freq, other wi (x-terms) has larger freq.
Use an auxiliary set (XSet) beyond its main index (TSet).
Security Leakage:
Number of documents and number of keyword-docID pairs, N.
No intersection between s-terms (OXT).
Intersections between s-terms and nothing between x-terms
(interactive-BXT).
Cost:
Sublinear search time (optimal).
Communication and computation are high.
Storage is on the order of keyword-doc ID pairs (optimal but
not for BXT and OXT when used with dense datasets).
9 / 24

10. Introduction Our BXT-Bitmap Scheme Security, Performance and Storage Analysis Conclusion
Single Keyword on Encrypted Bitmap
Plaintext Bitmap Index
Each keyword wj is associated with a bit string holding an active
bit at index i iff the ith document or record contains wj .
Encrypted Bitmap Index (single keyword)
Each keyword wj is encrypted using DET encryption and its
associated Bitmap is one-time pad encrypted (Liesdonk et al).
w1 ∧ w2 on the above Encrypted Bitmap Index
Leaks the result set of w1 and the result set of w2.
Our Goal
Evaluate queries of the form w1 ∧ f (w2, ..., wt) using an encrypted
Bitmap Index with no leakage beyond the actual result set.
10 / 24

11. Introduction Our BXT-Bitmap Scheme Security, Performance and Storage Analysis Conclusion
BXT-Bitmap Encypted Database Setup
Assume n documents and m keywords. Each keyword wj has
Kj = PRF1(KI , wj ).
pointer pj to its corresponding encrypted Bitmap Be created
using a large key derived from Kj .
two secret tags (stag, xtag) whose hash value is stored in
two hash tables HTstag and HTxtag.
stag = PRF2(KS , wj ) = (KS1, KS2)
xtag = PRF2(KX , wj ) = (KX1, KX2)
Hash table’s elements (lj , dj )
HTstag : lj = hash(KS1) and dj = enc(KS2, pj ||Kj ).
HTxtag : lπ(j) = hash(KX1) and dπ(j) = enc(KX2, pj ).
size of each is O(m).
11 / 24

12. Introduction Our BXT-Bitmap Scheme Security, Performance and Storage Analysis Conclusion
Encrypted database
label Value
hash(KS1) E(KS2, p1||K1)
hash(KS2) E(KS2, p2||K2)
· · · · · ·
hash(KSi ) E(KS2, pi ||Ki )
· · · · · ·
hash(KSm) E(KS2, pm||Km)
Table 1: s-term hash table.
label Value
· · · · · ·
· · · · · ·
· · · · · ·
hash(KX1) E(KX2, p1)
· · · · · ·
· · · · · ·
Table 2: x-term hash table, π(1) = i.
id 1 2 · · · · · · · · · · · · · · · · · · n
p1 0 1 · · · · · · · · · · · · · · · · · · 1
p2 1 0 · · · · · · · · · · · · · · · · · · 1
...
...
... · · · · · · · · · · · · · · · · · ·
...
pm 1 1 · · · · · · · · · · · · · · · · · · 0
Table 3: Encrypted Bitmap Index (B ) 12 / 24

13. Introduction Our BXT-Bitmap Scheme Security, Performance and Storage Analysis Conclusion
Conjunctive Search Process w1 ∧ w2 ∧ · · · ∧ wt (I)
Client (w1 ∧ · · · ∧ wt, KS , KX ):
stag → PRF2(KS , w1) = (KS1, KS2).
xtagj → PRF2(KX , wj ) = (KXj1 , KXj2 ), j ≥ 2.
Send stag and all xtagj to Server.
Server (Be, HStag, HXtag, stag, xtagj ):
Use stag and HStag to retrieve result set RS of w1 from Be.
Use xtagi and HXtag to find pointerxtagj to access Be.
For each idi ∈ RS: send the bit Be[pointerxtagj , idi ] to Client.
Client (Be[pointerxtagj , idi ], idi ∈ RS):
For each (idi , xtagj ), find vj = Dec(Be[pointerxtagj , idi ]).
Retrieve document idi if all vj are active bits.
13 / 24

14. Introduction Our BXT-Bitmap Scheme Security, Performance and Storage Analysis Conclusion
Conjunctive Search Process w1 ∧ w2 ∧ · · · ∧ wt (II)
Single-round communication
Different than standard SSE schemes where Server determines final
result set. But secure and suitable for constrained settings.
More than one-round communication
Allowing the Server to determine final result comes at the cost of
more info leakage and communication rounds with the Client.
14 / 24

15. Introduction Our BXT-Bitmap Scheme Security, Performance and Storage Analysis Conclusion
Security Analysis I
Our solution does not reveal:
direct intersections between x-terms.
intersection between an s-term and any subset of the x-terms
within same query.
But reveals only intersection between the s-terms.
Avoid s-terms Intersection?
During setup the client permutes the document identifiers for each
keyword using a pseudorandom permutation with a unique secret
key specifically generated for each keyword.
Unavoidable Access Pattern Leakage
During retrieval process the index server will be able to know the
intersection between s-terms unless access pattern is hidden or the
index server and retrieval server have no communication.
15 / 24

16. Introduction Our BXT-Bitmap Scheme Security, Performance and Storage Analysis Conclusion
Security Analysis II
Our scheme leaks:
Number of documents n.
Number of unique keywords m.
Size of the s-term w1.
Search pattern.
Intersection between s-terms.
and has no other leakage beyond what can be deduced from the
specified leakage.
Security level
At least the same level of security achieved by Cash et al’s
interactive BXT protocol.
16 / 24

17. Introduction Our BXT-Bitmap Scheme Security, Performance and Storage Analysis Conclusion
Performance Compared to Cash et al Protocols
Protocol Communication Size No of Rounds Computations Search
Ours (t − 1) · s 1 n xor, n/b hash O(n)
I. BXT (t − 1) · s · |f | (t − 1) · s s Decryptions s
OXT (t − 1) · s · |G| 1 (t − 1) · s Exp. s
Table 4: s ≡ number of document identifiers corresponding to the s-term.
t ≡ number of terms. b ≡ output size of hash func used during key gen.
|f | ≡ the output size of f (xtrapi , ind) in bits. |G| ≡ the size of the group
elements in bits where the group G satisfies the decision Diffie-Hellman
(DDH) assumption).
17 / 24

18. Introduction Our BXT-Bitmap Scheme Security, Performance and Storage Analysis Conclusion
Storage Compared to Cash et al Protocols (Census)
n 100,000 150,000 200,000 250,000 299,285
N 3,792,048 5,686,907 7,582,582 9,478,817 11,347,304
HTstag/HTxtag 0.16 0.19 0.20 0.21 0.22
Bitmaps 36 62 90 119 149
Est. TSet (BXT) 122 183 244 305 365
Table 5: Storage results in MB for the Census data set, for subsets from
100,000 to 299,285 rows and 41 columns, and the estimated storage of
the TSet. Note that n denotes the number of documents while N denotes
the size (total number of keyword occurrences) of the Census dataset.
Remark
Minimal size of each TSet entry under the BXT protocol is 257 bits and more
than that for OXT.
18 / 24

19. Introduction Our BXT-Bitmap Scheme Security, Performance and Storage Analysis Conclusion
Storage Compared to Cash et al Protocols (Enron)
n 100,000 200,000 300,000 400,000
N 14,352,245 26,509,765 43,529,924 57,516,347
HTstag/HTxtag 7 10 17 25
Bitmaps 1582 4414 11446 22124
Est. TSet (BXT) 461 851 1398 1848
Table 6: Storage results in MB for the Enron data set, for subsets from
100,000 to 400,000 documents, and the estimated storage of the TSet.
19 / 24

20. Introduction Our BXT-Bitmap Scheme Security, Performance and Storage Analysis Conclusion
Single Vs Conjunctive
100 150 200 250 300
0
50
100
150
Number of documents, x1000
Time(ms)
w1
w1 ∧ w2
Figure 4: Single Keyword vs Conjunctive Keyword (Census)
20 / 24

21. Introduction Our BXT-Bitmap Scheme Security, Performance and Storage Analysis Conclusion
Conjunctive Search depends on the s-term
10 100 1000 10000 100000
0
50
100
150
Frequency of keyword
Time(ms)
L ∧ V
V ∧ H
V
Figure 5: End-to-end execution time for the Census data set, 299,285
documents. H denotes a term with high frequency, L denotes a term with
low frequency and V denotes the term that varies in frequency.
21 / 24

22. Introduction Our BXT-Bitmap Scheme Security, Performance and Storage Analysis Conclusion
Number of x-terms does not affect search time
2 3 4 5
0
50
100
150
Number of x-terms
Time(ms)
Figure 6: End-to-end execution time for the non-interactive conjunctive
search on the complete Census data set with a growing number of
x-terms. The s-term has low frequency and the frequency of the x-terms
varies between 4,177 and 100,955.
22 / 24

23. Introduction Our BXT-Bitmap Scheme Security, Performance and Storage Analysis Conclusion
Conclusion
Proposed a secure multi-keyword SSE scheme.
Practical in limited communication and computation settings.
Suitable for very dense datasets.
Encrypted Bitmap is also efficient in processing Boolean
queries similar to plaintext Bitmap index.
Combining an inverted index with a Bitmap index in one
length-hiding index would yield better time-storage trade-off.
23 / 24

24. Introduction Our BXT-Bitmap Scheme Security, Performance and Storage Analysis Conclusion
Thank you for your attention
24 / 24