Note: Differentially Private Access Patterns for Searchable Symmetric Encryption

最新推荐文章于 2023-04-09 11:56:34 发布
最新推荐文章于 2023-04-09 11:56:34 发布
阅读量349 收藏
点赞数
文章标签： 数据库 开发工具 runtime
原文链接：http://www.cnblogs.com/tinoryj/p/10607412.html
版权

The Core Issues and Ideas of This Paper

Problem

  • Baseline Searchable Symmetric Encryption (SSE) could not avoid access-pattern leakage.
  • ORAM algorithm performance is extremely low and cannot be applied in practice.

Idea

Solve the Access-pattern Leakage of current SSE by introducing differential privacy.

Important knowledge

Searchable Symmetric Encryption (SSE)

An SSE scheme is a tuple (KeyGen, BuildIndex, Token, Search, SKE) and asymmetric key encryption scheme.
Screen Shot 2018-11-03 at 19.50.52

  • (\(`K_I`\), \(`K_D`\) ) ← KeyGen(\(`1^\kappa`\) ): Probabilistic key generation.
    • Security parameter \(`\kappa`\): input.
    • Secret key \(`K_I`\): For the secure index,
    • Secret key \(`K_D`\) ← SKE.Gen(\(`1^\kappa`\)): For the document collection.
  • \(`I`\) ← BuildIndex(\(`K_I`\), \(`(D, W)`\)): Probabilistic algorithm for the client to build a secure index.
    • \(`K_I`\): input.
    • \(`D`\): Document collection.
    • \(`W`\): keyword lists W.
    • \(`I`\): Secure index.
  • \(`\tau`\) ← Token(\(`K_I`\), \(`w`\)): (Probabilistic) algorithm for the client to generate search tokens.
  • \(`R`\) ← Search(\(`I`\), \(`\tau`\)): Deterministic algorithm for the server.
    • \(`R`\): Document identifications.
  • \(`c`\) ← SKE.Enc(\(`K_D`\), \(`D`\)): Probabilistic algorithm for the client to encrypt the document collection.
  • \(`D`\) ← SKE.Dec(\(`K_D`\), \(`c`\)): Deterministic algorithm for the client to decrypt a ciphertext of a document.

Access-pattern Leakage

In the practical application of SSE, there is Access-pattern Leakage. The main reasons are list as flow:

  • The cloud server is able to observe which files are accessed in the encrypted database by the client.
  • To be used in practice, most existing SSE schemes allow it.
  • With some a priori knowledge of the outsourced documents, the adversary could recover the content of the queries with high accuracy.

Query Recovery Attack (IKK Attack)

IKK attack is a typical attack method for SSE with Access-pattern Leakage.

Assumption

The adversary has the knowledge of a (\(`r\times r`\) matrix \(`M`\) that depicts the probability of keyword co-occurrence (r is the number of keywords).

Method
  1. Compute \(`l\times l`\) co-occurrence matrix \(`\hat{M}`\) by the observed access patterns(a sub-matrix of \(`M`\)).
  2. The best match of \(`\hat{M}`\) to \(`M`\) can be generated by optimization methods (e.g. Simulated Annealing).

ORAM Algorithm

This algorithm allows SSE to defend against Access-pattern Leakage (with IKK attack method), but has serious performance problems and is of low practical value.

  • Allows a client to hide its access pattern from the remote server by continuously shuffling and re-encrypting data as they are accessed.
  • Access one of n documents in the storage, at least o(log n) documents need to be accessed. [Too much overhead for SSE]

Differential Privacy

Differential Privacy introduction: The Differential Privacy Frontier (Extended Abstract)

Assuming a positive real number \(`\epsilon`\), \(`A`\) is a random algorithm that takes a data set as input (representing the data owned by the relying party). \(`imA`\) represents the mapping of \(`A`\). For all data sets \(`D_1`\) and \(`D_2`\) of non-single elements (i.e., one person's data) and all subsets \(`S`\) of \(`imA`\), algorithm \(`A`\) is \(`\epsilon - differential \quad privacy`\), where the probability depends on the randomness of the algorithm.

Pr[A(D_1)\in S]\leqslant e^\epsilon \times Pr[A(D_2) \in S]

If an attacker is required to receive a \(`Q_i`\) (\(`i_{th}`\) query) value through a \(`\epsilon - differential \quad privacy`\) algorithm, he will not be able to distinguish between the two data sets if \(`\epsilon`\) is small enough.

Erasure Coding

The erasure code is the main method for adding redundancy to the Secure index.
Notes on erasure codes that I have posted on cnblogs

Key points

Assumption

  • Adversary has complete knowledge of the document collection.
  • Server simply passively monitors the storage access patterns and infers the content of the corresponding queries.

Why Introduce Differential Privacy for SSE

Differential privacy is a strong privacy guarantee for an individual’s input to a (randomized) function or sequence of functions.

Differential Privacy rules imply that the adversary cannot distinguish between queries using distinct search terms that induce access patterns that are within the specified distance of one another.

d-privacy

Here, \(`d`\) represents the Hamming distance in the access-pattern vector. By the parameter \(`d`\), the generalized \(`\epsilon - differential \quad privacy`\) definition is designed (add \(`d`\) as a parameter of \(`e^{\epsilon d}`\)).

d-private Access-pattern Obfuscation Mechanism

Add the two following part to SSE:
  • Obfuscate the access patterns: Add false positives and false negatives to the search results.
  • To handle the correctness issue: Introduce redundancy to the document collection using erasure codes.
The way to establish d-privacy APO

Define an access-pattern obfuscation mechanism \(`K`\) : \(`X \rightarrow Y`\) gives \(`\epsilon d_{h}-privacy`\), iff \(`\forall x,x' \in X`\) and \(`\forall S \subseteq Y`\) (using the Hamming distance \(`d_h`\))

Pr[K(x)\in S]\leqslant e^{\epsilon d_h(x,x')} \times Pr[K(x') \in S]

Define an obfuscation mechanism \(`K_f`\) such that, given an access pattern \(`x \in X`\), it outputs any \(`y \in Y`\) with probability

Pr[K_f(x)=y]=Pr[x|y]=\prod^n_{i=1}Pr[y_i|x_i]

Where

Pr[y_i=1|x_i=1]=p \qquad Pr[y_i=1|x_i=0]=q
Pr[y_i=0|x_i=1]=1-p \quad Pr[y_i=0|x_i=0]=1-q

Enforce two constraints on p and q to make the mechanism practical:

  • \(`Pr[y_i = 1|x_i = 0] < Pr[y_i = 1|x_i = 1]`\): non-matching shard should have a lower probability to be retrieved than a matching shard;
  • \(`Pr[y_i = 1|x_i = 0] < Pr[y_i = 0|x_i = 1]`\): non-matching shard should have a lower probability to be flipped than a matching shard.

Means that \(`q < p`\) and \(`q < 1-p`\). And find out that \(`\epsilon = ln(\frac{p}{q})`\).

By using the (m,k) erasure code, six parameter optimization conditions are established, and the values of all the variables required are obtained.

Workloads

  • Defined d-privacy for access patterns of general SSE schemes.
  • Proposed a d-private access-pattern obfuscation mechanism that is compatible with existing SSE schemes.
  • Implemented a prototype of the proposed obfuscation mechanism.

Evaluation

Based on the Enron Email Dataset.

Security

  • Baseline IKK attack on SSE with and without access-pattern obfuscation method.
  • Improved IKK attack (Adversary can successfully figure out which shards belong to the same documents) on SSE with and without access-pattern obfuscation method.

Performance

  • Storage and Communication Overhead
  • Precision
  • Runtime Overhead (build SSE local)

转载于:https://www.cnblogs.com/tinoryj/p/10607412.html

weixin_30522183
关注
论文阅读：Auditing differentially private machine learning: How private is private SGD?
weixin_43641509的博客
09-18 388
Audit 正式版论文链接 预收论文链接（更加详细） 视频链接 Differential privacy gives a strong worst-case guarantee of individual privacy: a differentially private algorithm ensures that, for any set of training examples, no attacker, no matter how powerful attack, can not learn mu
Differentially Private Asynchronous Federated Learning for Mobile Edge Computing in Urban Informatic
Devil_B的博客
05-13 2057
Differentially Private Asynchronous Federated Learning for Mobile Edge Computing in Urban Informatics阅读笔记文献背景及解决问题车联网中的联邦学习具体方案总结与思考 文献背景及解决问题 由于无线网络带宽和计算资源的限制，车辆很难使用大量数据来进行提高服务质量的机器学习，比如自动驾驶和交通预测。本文设计了一种在车联网环境下的联邦学习方案，实现了具有差分隐私的异步联邦学习。 联邦学习在车联网中的挑战： 1.车辆的
论文阅读：Differentially Private Access Patterns for Searchable Symmetric Encryption
c630843901的博客
12-23 767
文章目录研究贡献研究内容OSSE在SSE上做的改进Erasue CodingFunc APO总结 研究贡献 为一般的SSE方案的访问模式定义了d-private 提出了一种与现有的SSE方案兼容的d-private access-pattern混淆机制 实现了一个所提出的模糊机制的原型 研究内容 OSSE在SSE上做的改进 可搜索对称加密（SSE）介绍 SSE流程图 OSSE流程图 可以看到OSSE与SSE的区别在于 在进行安全索引构建和文件加密前，使用ErasueCode.Enc来混淆访问模式
论文阅读--SAP-SSE: Protecting Search Patterns and Access Patterns in Searchable Symmetric Encryption
c630843901的博客
03-17 3361
文章目录一.论文成果二. 主要流程1. Setup2. Authorizationindex shuffle protocol***index redistribution protocol*** 一.论文成果 首次同时隐藏了access pattern和search pattern 可以将加密文件放在一般的数据库（多用户可以访问） 提供了一个可配置的安全策略来平衡安全性和效率 二. 主要流程 系统结构 1. Setup User management center 选择一个安全参数，并初始化公共参
论文阅读：Obfuscated Access and Search Patterns in Searchable Encryption
c630843901的博客
12-07 3332
文章目录研究贡献背景知识简单介绍背景知识 研究贡献 在SSE上提出了OSSE，OSSE有以下4个特点： 同时混淆了访问模式和搜索模式 它在单轮通信中运行查询，根据数据库和查询分布的不同，其开销可以小到一个常量 计算复杂度为O(nlog n/log log n),开销较大，但可通过并发提高效率 OSSE需要一个（非常小的）不变的客户端存储，相对于ORAM需要一个O(log2n)的存储 实例化了SSE中的查询和文档的差异隐私的概念 实验表明，即使OSSE被调整为提供高效率（和低差异隐私参数），方案仍然
[PaperNote] Confidential Computing Direction
treblez's blog
05-30 794
用来记录Confidential Computing方向论文的阅读笔记。 文章目录occlum前置知识lib os组成安全性分析实现 occlum 前置知识 SGX（software guard extensions）创建一个用户私有的空间存储隐私数据，叫做enclaves（飞地） 将库操作系统libos引入到SGX中，从而应用程序能够使用很少的更改就能够获得足够的安全性。 SGX应该能够支持多线程，但是现存的SGX libos不能兼顾效率和安全。occlum是一种兼顾效率与安全的sgx libos
2. Learning Differentially Private Recurrent Language Models
doing a 责任心 dataer
04-09 310
率先将差分隐私技术应用到联邦平均算法；中心化差分隐私；客户端进行参数裁剪；聚合模型时使用差分隐私(高斯机制)；user-level privacy；DP-FedAvg 和 DP-FedSGD
Secure Spatial Query with Differentially Private Access Pattern
02-08
The spatial transformation mechanism (e.g., space-filling curves) enables the spatial query in the encypted ... Several researches have demonstrated that the access pattern can be used to recover the c
Locally Differentially Private Protocols for Frequency Estimation
weixin_43641509的博客
10-25 2073
本文相对上一篇Locally Differential for Frequency Estimation 的主要区别在于： Wang et al.针对频率估计了一个抽象框架 **Pure Protocol** ，用于概括之前的几种LDP协议，并帮助优化LDP协议。
LEARNING DIFFERENTIALLY PRIVATE RECURRENT LANGUAGE MODELS
daxuan1881的博客
07-28 752
为了在Bert模型获得差分隐私，也是利用了最简单的组合定理。第一篇文章将差分隐私应用在了大型的循环神经网络模型当中，保护LSTM语言模型的敏感信息，在联邦场景下下，添加用户级别的差分隐私，应用到下一个单词的预测中。从现在看来这篇文章的技术点其实很简单，但是之前把差分隐私和NLP结合起来的文章，隐私预算都是大于3的，这篇文章基于Bert模型，采用医学数据集MIMIC对模型进行修正，进行并行计算和较大的batchsize将隐私预算缩减至1，并且还能达到比较好的一个性能，这个就是文章最大的贡献。...
NDSS 2021 论文泛读
^_^
10-22 1万+
会议论文列表：https://dblp.uni-trier.de/db/conf/ndss/ndss2021.html 只挑了几个感兴趣的session过了一遍，还是发现了不少有意思的文章。 文章目录程序分析模糊测试侧信道智能家居软件防御嵌入式安全可信计算 程序分析 Towards Measuring Supply Chain Attacks on Package Managers for Interpreted Languages. 简介：qualitative assessment！（定性评估） 包管理
密码学&机器学习~Paper sharing
qq_33509110的博客
04-25 3710
(1)分享在CSS2021上看的比较相关的paper Cert-RNN: Towards Certifying the Robustness of Recurrent Neural Networks (CSS2021), 认证方向，应用在两种RNNs模型（RNN, LSTM）上。本能感觉认证可以和攻击防御结合，当然本文也是这样做的。 Locally Private Graph Neural Networks (CSS2021), 基于差分隐私的图网络隐私保护计算，和我做的隐私保护计算方向契合，但是我不做差
Searchable Symmetric Encryption Scheme——对称密文检索
碎片
12-05 6279
引言： 在IT界，大数据安全和密码学的高级实现似乎很难找到，很简单的一个例子是：倒排索引的实现有很多，但是在加密基础上再次实现密文检索和倒排索引却是寥寥无几，这篇博文基于对称密文实现检索。 数据集 真实数据集： http://archive.ics.uci.edu/ml/datasets/Bag+of+Words Enron Emails，NIPS full papers，NYTimes news...
联邦学习之差分隐私
威化饼的一隅
10-17 8739
联邦学习过程   联邦学习以轮为单位，每个轮内包含模型分发、本地训练和全局更新这3个阶段。 1. 模型分发   在模型分发阶段，服务器按照一定标准，选择参与本轮联邦学习的设备，例如下图中选中了3个设备，向它们分发全局模型。 2. 本地训练   在本地训练阶段，每个设备加载当前全局模型，使用自己的训练数据训练，得到新的本地模型。 3. 全局更新   在全局更新阶段，每个设备向服务器上传模型更新值，服务器收集更新值进行聚合，得到聚合结果，更新全局模型。 下一轮，服务器会将新的全局模型发送给选中的设备
paper issues
Adam 的专栏 -- 一步一脚印
04-25 826
21页，图2.2横纵坐标没有说明 36页，Fig.2.12 Work flow of 3-Finger MRake receiver 改为五号，现在为小四 42页，Fig.2.15 Code errors of three receivers change with different multipath delays 现在为小四 43页，Fig.2.16 Code errors of th
differential privacy 差分隐私入门 (一)
热门推荐
Enjoyeer的博客
01-30 2万+
对差分隐私比较感兴趣，看了几篇文章，了解一下大概的思想。现在决定重新看一下，发现有些文章内容不是很懂，干脆就一边翻译一边看了，不懂的地方我会加下划线，如果有人看到了，还请不吝指教。（如果未来有人看到我这篇翻译，请在2018年9月份之前告诉我，在21世纪20年代，什么职业最火） （注：文章是Cynthia Dwork的《Differential Privacy》） 差分隐私 Cynthia
Searchable Symmetric Encryption (SSE)介绍
c630843901的博客
11-27 2351
文章目录SSE有关的符号定义1：可搜索的对称加密方案(SSE) SSE有关的符号 ∆表示所有关键字的集合，其中|∆|表示关键字集合的大小 D为文档，id(D)为文档编号（与内容无关），我们也可以把一个文档D看作是关键字的列表，w ∈ D 代表D有关键字w ’D是多个文件的数据集，‘D[i]是数据集中的i个元素。假设id(D[i]) = i 'D(w)是包含关键字w的所有文档列表 I是安全索引 定义1：可搜索的对称加密方案(SSE) 一个SSE方案是以下四种多项式时间算法的集合 Keygen(1λ)：
Complete the code for Differentially Private Stochastic Gradient Descent. a. Fill in the code for per-example clipping and adding Gaussian noise. b. Implement the privacy budget composition. Calculate the privacy budget of the training process, which means calculating $\epsilon$ based on the variance of Gaussian noise $\sigma^2$ and the given $\delta = 10^{-5}$ in different epochs. You can use basic composition to complete the code. If you correctly apply the Moments Accountant method, you will receive bonus points. import numpy as np from scipy import optimize from scipy.stats import norm import math """ Optionally you could use moments accountant to implement the epsilon calculation. """ def get_epsilon(epoch, delta, sigma, sensitivity, batch_size, training_nums): """ Compute epsilon with basic composition from given epoch, delta, sigma, sensitivity, batch_size and the number of training set. """ return epsilon
最新发布
06-12
Here is the completed code for Differentially Private Stochastic Gradient Descent, including per-example clipping and adding Gaussian noise as well as privacy budget composition: ```python import numpy as np from scipy import optimize from scipy.stats import norm import math def per_example_clipping(grad, clip_factor): """ Clip the gradient per example with a given clip factor. """ return np.clip(grad, -clip_factor, clip_factor) def add_gaussian_noise(grad, sigma): """ Add Gaussian noise to the gradient with a given standard deviation. """ return grad + np.random.normal(0, sigma, grad.shape) def get_epsilon(epoch, delta, sigma, sensitivity, batch_size, training_nums): """ Compute epsilon with basic composition from given epoch, delta, sigma, sensitivity, batch_size and the number of training set. """ steps = math.ceil(training_nums / batch_size) * epoch epsilon = sigma * math.sqrt(2 * math.log(1.25 / delta)) / sensitivity return epsilon * steps def dp_sgd(X, y, epochs, batch_size, clip_factor, sigma, delta): n, d = X.shape w = np.zeros(d) for epoch in range(epochs): for i in range(0, n, batch_size): X_batch = X[i:i+batch_size] y_batch = y[i:i+batch_size] grad = np.mean(X_batch * (sigmoid(X_batch.dot(w)) - y_batch).reshape(-1, 1), axis=0) clipped_grad = per_example_clipping(grad, clip_factor) noise_grad = add_gaussian_noise(clipped_grad, sigma) w -= noise_grad epsilon = get_epsilon(epoch+1, delta, sigma, clip_factor/batch_size, batch_size, n) print("Epoch {}: Epsilon = {}".format(epoch+1, epsilon)) return w ``` The `per_example_clipping` function clips the gradient per example with a given clip factor. The `add_gaussian_noise` function adds Gaussian noise to the gradient with a given standard deviation. The `get_epsilon` function computes epsilon with basic composition from given epoch, delta, sigma, sensitivity, batch_size and the number of training set. The `dp_sgd` function performs Differentially Private Stochastic Gradient Descent. For each epoch, it loops over the training set in batches and computes the gradient of the loss function using the sigmoid function. It then clips the gradient per example, adds Gaussian noise to the clipped gradient, and updates the weight vector. Finally, it computes the privacy budget using the `get_epsilon` function and prints it out. Note that the `get_epsilon` function uses basic composition to compute the privacy budget. It calculates the total number of steps based on the number of epochs and the batch size, and then uses the formula for epsilon with basic composition to compute the privacy budget for each epoch. It is worth noting that basic composition may not provide the tightest bound on privacy, and using the Moments Accountant method may provide a tighter bound.
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值