Multi-Dimensional Range Query over Encrypted Data

Multi-Dimensional Range Query over Encrypted Data Elaine Shi Joint work with John Bethencourt, Hubert Chan, Dawn Song, Adrian Perrig

Network Audit Logs Network gateway Data center

An Ideal Solution Network gateway Data center

Auditor Query: (100 · port · 200) Æ ( ip 2 128.1.*.*) Trusted authority auditor

Auditor Query: (100 · port · 200) Æ ( ip 2 128.1.*.*) Capability: (100 · port · 200) Æ ( ip 2 128.1.*.*) Trusted authority auditor

Security Capability: (100·port ·200) Æ (ip 2128.1.*.*) • Can decrypt all matching entries • Cannot learn additional information for non-matching entries • Except for the fact that they do not match

The Challenges • Current practices: • No encryption • All-or-nothing decryption • Encryption with simple searches • Challenge: • How to design such an encryption scheme • Efficiency • Provable security

Generalized Problem Definition Setup: • Record: E = (msg, X) • msg 2 {0,1}* : non-searchable • X = (x1, x2, … , xn) 2 {0,1}n : searchable

Generalized Problem Definition • KeyGen • Key generation • Encrypt • Encryption • DeriveCap • Compute a capability • QueryDecrypt • Attempt to decrypt using a capability

KeyGen (, n) • : security parameter • n: bit-length of X KeyGen(, n) Trusted authority

KeyGen (, n) • Publish PK – public key • Retain MSK – master secret key KeyGen(, n) PK MSK Trusted authority

Encrypt(PK, X, msg) X = 00110 C Ã Encrypt(PK, X, msg)

Encrypt(PK, X, msg): Network Audit Log X = (IP = 1.2.3.4, port = 80, time = May 1st) C Ã Encrypt(PK, X, “Hello”)

P DeriveCap(PK, MSK, P ) P

DeriveCap(PK, MSK, P ) P:f(X) = 0 P:f(X) = 1 f: {0, 1}n ! {0, 1}

DeriveCap(PK, MSK, P ): Network Audit Log P: f(X) = 0 P:f(X) = 1 f: {0, 1}n ! {0, 1} Network audit log example: X :(IP, port, time) P : range query on X: (IP 2 128.2.*.*) Æ (port 2 [100, 200]) Æ (time 2 “May 2nd”)

P DeriveCap(PK, MSK, P ) Cap(P ) Ã DeriveCap(PK, MSK, P ) P Capability for property P

P QueryDecrypt(PK, Cap(P ), C) P

Generalized Problem Definition • KeyGen(, n) • Key generation • Encrypt(PK, X, msg) • Encryption • DeriveCap(PK, MSK, P ) • Compute a capability • QueryDecrypt(PK, Cap(P) , C) • Attempt to decrypt using a capability

Generalized Problem Definition • KeyGen(, n) • Key generation • Encrypt(PK, X, msg) • Encryption • DeriveCap(PK, MSK, P ) • Compute a capability • QueryDecrypt(PK, Cap(P) , C) • Attempt to decrypt using a capability X, P Network audit log example: X :(IP, port, time) P : range query on X

Security Requirements • Suppose adversary has capabilities for properties P1, P2, …, Pq • Let C = Encrypt(PK, X, msg) • 81 · i · q, X 2Pi • Adversary cannot learn additional information about X or msg • Computationally bounded adversary

Stock Trading through a Broker broker Buy if (price < $$$) Æ (time 2 {today, tomorrow} ) Buy/sell order Current stock price exchange investor

Stock Trading through a Broker broker Buy if (price < $$$) Æ (time 2 {today, tomorrow} ) Buy/sell order Current stock price exchange: Trusted party investor

Generalized Problem Definition • KeyGen(, n) • Key generation • Encrypt(PK, X, msg) • Encryption • DeriveCap(PK, MSK, P ) • Compute a capability • QueryDecrypt(PK, Cap(P) , C) • Attempt to decrypt using a capability X, P Stock trading example: X : {time range} £ {price range} P : (price, time) 2 X, range query

Remark • Network audit log ÃRQED • Encrypt under a point • Decrypt under a range • Stock trading ÃDual • Encrypt under a range • Decrypt under a point • RQED ! Dual

In this talk • Focus on multi-dimensional range query • In database applications, SQL queries are by nature range queries.

2-Dimensional Example Encrypt(msg, X) X = (IP, port)

Roadmap • Trivial construction • Reducing public key size • Using Anonymous Identity-Based Encryption • Efficient representation for ranges • 1 dimensional scheme • Extension to multiple dimensions

Roadmap • Trivial construction • Reducing public key size • Using Anonymous Identity-Based Encryption • Efficient representation for ranges • 1 dimensional scheme • Extension to multiple dimensions Main Technical Difficulty: Extension from 1-dim to multi-dim

Trivial Construction public-key encryptionPE = (K, E, D) B: hyper-rectangle, • RQED: • PK • MSK • Encrypt(PK, X, msg) • CapB • QueryDec(PK, CapB, C) • PE : • PKX for every point X • SKX for every point X • E (PKX, msg||0t) • SKX for each X 2 B • D (PKX,SKX, C) for each X 2 B

Trivial Construction public-key encryptionPE = (K, E, D) B: hyper-rectangle, • RQED: • PK • MSK • Encrypt(PK, X, msg) • CapB • QueryDec(PK, CapB, C) • PE : • PKX for every point X • SKX for every point X • E (PKX, msg) • SKX for each X 2 B • D (PKX,SKX, C) for each X 2 B

Trivial Construction PE = (K, E, D): public-key encryption B: hyper-rectangle, • RQED: • PK • MSK • Encrypt(PK, X, msg) • CapB • QueryDec(PK, CapB, C) • PE : • PKX for every point X • SKX for every point X • E (PKX, msg) • SKX for each X 2 B • D (PKX,SKX, C) for each X 2 B

Trivial Construction T: # different values along each dimension D: # dimensions

Roadmap • Trivial construction • Reducing public key size • Using Anonymous Identity-Based Encryption • Efficient representation for ranges • 1 dimensional scheme • Extension to multiple dimensions

What is AIBE? ID1 Public key encryption (PK1, SK1) ID2 PK1 ID3 ID4 ID5

What is AIBE? ID1 Public key encryption ID2 C Ã Encrypt(PK1, msg) ID3 ID4 ID5

What is AIBE? ID1 Public key encryption ID2 msg Ã Decrypt(PK1, SK1, C) C Ã Encrypt(PK1, msg) ID3 ID4 ID5

What is AIBE? ID1 Anonymous Identity-Based Encryption (AIBE) ID2 ID3 Trusted authority ID4 ID5

What is AIBE? ID1 Anonymous Identity-Based Encryption (AIBE) ID2 PK ID3 Trusted authority ID4 ID5

What is AIBE? ID1 Anonymous Identity-Based Encryption (AIBE) ID2 PK ID3 Trusted authority ID4 • Global public key: • rather than different public key for each user ID5

What is AIBE? ID1 Anonymous Identity-Based Encryption (AIBE) SK1 ID2 MSK SK2 ID3 SK3 Trusted authority SK4 ID4 SK5 ID5

What is AIBE? ID1 Anonymous Identity-Based Encryption (AIBE) ID2 C Ã Encrypt(PK, ID1, msg) ID3 Trusted authority ID4 ID5

What is AIBE? ID1 Anonymous Identity-Based Encryption (AIBE) ID2 msg Ã Decrypt(PK, SK1, C) C Ã Encrypt(PK, ID1, msg) ID3 Trusted authority ID4 ID5

What is AIBE? ID1 Anonymous Identity-Based Encryption (AIBE) ID2 C Ã Encrypt(PK, ID1, msg) C = ??????? ID3 Trusted authority ID4 ID5

Multi-Dimensional Range Query over Encrypted Data