This document discusses privacy-enhanced search techniques. It begins by motivating the need for searching encrypted or remote data without revealing sensitive information to untrusted providers. It then outlines several approaches for private information retrieval and searching directly on encrypted data, including techniques using bloom filters and searchable symmetric encryption. Key properties and examples of each technique are provided.

1. SEARCHING IN PRIVACY
COPING WITH SURVEILLANCE

2. OVERVIEW
• Motivation
• Types of privacy-enhanced search
• Search by Example

3. MOTIVATION
• Use remote / untrusted storage for any data
• Protect your data

4. REMOTE / UNTRUSTED
STORAGE
• What if you don’t trust the storage provider ?
• Encrypt
• What if you want to use a search provider
but don’t trust them ?
• What if you want to search your encrypted data ?

5. WHAT IFYOU WANTTO SEARCH
YOUR ENCRYPTED DATA ?
Naïve approach: Server sends you everything

6. WHAT IFYOU WANTTO SEARCH
YOUR ENCRYPTED DATA ?
Can we do better ?

7. TYPES OF
PRIVACY-ENHANCED SEARCH
• Private Information Retrieval (PIR)
• Search on encrypted data

8. PRIVATE INFORMATION
RETRIEVAL (PIR)
• Server should not learn what you are looking for
• Server may or may not have access to
searchable data

9. SEARCH ON
ENCRYPTED DATA
• Server should not learn anything about your data
• Especially not learn anything when you are
searching

10. ADDRESS BOOK MATCHING
Naïve approach
• Normalize, then send to server

11. ADDRESS BOOK MATCHING
Naïve approach
• Normalize, then send to server
JUST DON’T.

12. ADDRESS BOOK MATCHING
Better approach
• Hash your data. Like WhatsApp, or Gravatar.
• Still guessable (e-mail addresses)
• Gravatar tracking
• Still pre-computable (phone numbers)
• Steal the database or match what you like

13. ADDRESS BOOK MATCHING
Hash (social) connections
• My phone number m, friend's number f
• Hash: h(min(m, f), max(m, f))
• Both ends must have the other contact in the
address book to match
• Anybody can confirm your connections

14. ADDRESS BOOK MATCHING
Hash (phone # | e-mail) || (first | last name)
• Common names (e.g. John) still easily retrievable
• Users have to enter their own name
(besides phone no.) for others to find them
• Contacts must contain first name & last name

15. ADDRESS BOOK MATCHING
BLOOM FILTERS
Setup
• Compute m-bit vector from k independent hash
functions with range [1…m] of all entries to match
• Hashes need not be cryptographically secure,
just independent

16. ADDRESS BOOK MATCHING
BLOOM FILTERS
1
1
1
h1(p) = i1
h2(p) = i2
h3(p) = i3
h4(p) = i4
1
……………
position i3
m bits

17. ADDRESS BOOK MATCHING
BLOOM FILTERS
Properties:
• Never any false negatives
• n insertions
• Probability of bit = 0: (1 - 1/m)kn
• False positive rate: (1 - e-kn/m)k

18. KEYWORD SEARCH
SEARCHABLE SYMMETRIC KEY ENCRYPTION
Properties:
• Probabilistic search
• False positives with probability 1/2
m
per word, i.e.
L/2
m
for a document with L words
• n insertions
• Probability of bit being zero: (1 - 1/m)
kn
• False positive rate: (1 - e
-kn/m
)
k

19. SSKE
BASIC SCHEME
Setup
• Break document into L words W1...WL, either with
• n bits (padded; leaks word count) or
• with length information (leaks word & document lengths)
• PRG (stream cipher with key k' that only client knows)
• S1...SL with (n - m) bits each
• Keyed PRF Fki(x) maps (n - m) bits to m bits
W1 W2 Wi WL… …

20. SSKE
BASIC SCHEME
Setup
• Ti := Si || Fki(Si)
• Ciphertext Ci := Wi ⊕ Ti
• Send encrypted document to server
Si Fki(Si)
Wi
⊕ Ci
C1 C2 Ci CL… …

21. SSKE
BASIC SCHEME
Search for keyword wj
• Tell server
• wj
• ki for all locations i (with Wi) to search

22. SSKE
BASIC SCHEME
Search for keyword wj
• Server computes Ci ⊕ wj
• If Ci ⊕ wj = s || Fki(s), yield s for all locations i
• Client can decrypt s and check for false positives

23. SSKE
BASIC SCHEME
Problems
• Linear search effort, inefficient for real-world
documents with different word lengths
• Client reveals ki of searched subset and wj

24. SSKE
BASIC SCHEME
Improvement
• Use PRG G to generate ki := GK(Wi), K secret key
• Does not depend on i but only on K and Wi
• Reveal wj and GK(wj) for lookup
• Still reveals keyword wj

25. SSKE
BASIC SCHEME
Second improvement: Setup
• Encrypt all words in document xi := Esk(Wi)
• Split each word xi into Li with (n - m) and Ri with m
bits
• Now generate ki := GK(Li)
• Ci := xi ⊕ Ti

26. SSKE
BASIC SCHEME
Search
• Tell server
• xj
• kj := GK(Lj)

27. QUESTIONS ?

28. REFERENCES
• https://whispersystems.org/blog/contact-discovery/
• http://www.cs.berkeley.edu/~dawnsong/papers/
se.pdf
• http://www.csd.uoc.gr/~hy590-82/lecture9-se.ppt
• https://crypto.stanford.edu/~eujin/papers/
secureindex/2003nov-encsearch.pdf

29. IMAGE SOURCES
• http://www.cominvent.com/wp-content/uploads/2008/02/
dilbert-searchengine.gif
• http://i3.asn.im/Overloaded-truck-_tshp.jpg
• http://www.hairofthedogdave.com/wp/wp-content/
uploads/2008/11/yes-we-can.jpg
• http://www.8-bitcentral.com/blog/2013/allMyHeart.html
• https://oeilsj.files.wordpress.com/2011/02/nike_swoosh.gif