Unus pro omnibus: Multi-Client Searchable Encryption via Access Control

Unus pro omnibus: Multi-Client Searchable Encryption via Access Control

Speakers: Jiafan Wang

Conference: NDSS Symposium

YouTube: (no public video)

Overview

This article delves into "Unus pro omnibus: Multi-Client Searchable Encryption via Access Control," a talk presented by Jiafan Wang at the NDSS Symposium. The core focus of this research is to address the critical challenge of enabling secure, multiparty collaboration on sensitive data stored on untrusted cloud servers. While encryption is fundamental for data protection in such environments, traditional methods often impede essential operations like indexing and searching, which are indispensable for collaborative projects. This work introduces Delegatable Searchable Encryption (DSE), a novel framework designed to bridge these gaps, embodying the spirit of "one for all" by allowing a data owner to set up keys once, after which clients can operate independently.

The talk highlights the limitations of existing searchable encryption schemes, such as Searchable Symmetric Encryption (SSE), Public-Key Encryption with Keyword Search (PEKS), and even more recent Hybrid Searchable Encryption (HSE), none of which fully address the complexities of a multi-writer, multi-reader (M/M) setting while maintaining robust security and efficiency. DSE aims to provide a comprehensive solution that offers sublinear search times, standard forward privacy, and strong security measures against new integrity threats from malicious clients and keyword-guessing attacks. Its significance lies in its ability to enable practical and secure cloud-based collaboration for sensitive data, where fine-grained access control and resilient operations are paramount.

Background

[▶ Watch: Introduction and challenges in multi-client searchable encryption (0:00)]()

The pervasive adoption of cloud computing necessitates robust cryptographic solutions to protect sensitive data. However, the utility of encrypted data is severely limited if it cannot be efficiently searched or indexed, a fundamental requirement for most collaborative applications. This tension between confidentiality and functionality forms the bedrock of searchable encryption research.

Existing solutions in the field have primarily focused on more constrained settings:

• Searchable Symmetric Encryption (SSE): Schemes like those by Curtmola et al. or Stefanov et al. are typically optimized for a single-writer, single-reader scenario. They excel in search performance, often achieving search times linear in the size of the result set, and provide strong forward privacy, ensuring that old search tokens cannot compromise the privacy of future updates. However, extending SSE to multi-client environments is fraught with challenges. It demands intricate synchronization of different token versions among clients and lacks inherent resilience against threats posed by corrupt clients.
• Public-Key Encryption with Keyword Search (PEKS): Schemes such as Boneh et al.'s naturally support multiple writers because any party with the public key can independently generate ciphertexts. This flexibility, however, comes at a significant cost. The absence of a global indexing structure means that searching often requires testing a search token against each ciphertext in the database, leading to search times that are linear in the entire database size. Furthermore, PEKS inherently struggles with forward privacy, as encryptors have no mechanism to be informed about the need to encrypt differently to invalidate old search tokens. PEKS is also vulnerable to keyword-guessing attacks.
• Hybrid Searchable Encryption (HSE): Proposed by Wang and Chow in 2022, HSE marked a notable advancement for the multi-writer/single-reader setting. It achieves sublinear search performance and offers epoch-based forward privacy, meaning previously issued search tokens are invalidated periodically. However, HSE incurs an additive overhead of public-key operations that scales linearly with the number of active keywords. Its forward privacy is also weaker than standard forward privacy, as it only invalidates tokens periodically, not within the same epoch as the search token generation. Crucially, HSE imposes a substantial burden by requiring all writers to periodically refresh parts of their encrypted databases at each epoch.

DSE builds upon the core ideas of dynamic SSE but introduces significant upgrades for the M/M setting. In dynamic SSE, a single client maintains a search counter (sct_w) and an update counter (uct_w) for each keyword w. The uct_w is kept secret to ensure forward privacy, preventing old search tokens from revealing future updates, while sct_w can be inferrable by the server for efficient searches. For updates, a client generates a pseudorandom function (PRF) key to derive an index key (IK_w) from (w, sct_w). Data is stored at an address determined by PRF(uct_w, IK_w), and uct_w is incremented. For searches, the client provides IK_w to the server, which uses it to locate ciphertexts. sct_w is incremented after each search.

DSE's M/M upgrades include:

1. The database owner delegates IK_w to authorized clients. A global state containing sct_w for all keywords is published by the server.
2. A novel primitive, Shiftable Multi-Recipient Encryption (SME), is introduced to securely and obliviously maintain uct_w among multiple clients. SME is an efficient public-key encryption scheme allowing homomorphic shifting of uct_w ciphertexts, which are then re-randomized.
3. To differentiate readers and writers, the owner sets up an Identity-Based Encryption (IBE) instance for each keyword. The IBE secret key for w is delegated only to eligible readers. Updates are IBE-encrypted under the identity sct_w.

Key Findings

[▶ Watch: Introducing Delegatable Searchable Encryption (DSE) goals and benefits (1:45)]()

The DSE framework represents a significant leap forward in searchable encryption, addressing long-standing challenges in multi-writer, multi-reader environments. The key findings and contributions include:

• First M/M Searchable Encryption with Sublinear Search and Standard Forward Privacy: DSE is the pioneering solution to simultaneously achieve optimal search time (sublinear in database size, linear in result size), robust multi-client support, and standard forward privacy, which is a stronger guarantee than epoch-based privacy.
• Introduction of Delegatable Searchable Encryption (DSE): This novel framework supports keyword search and updates through a one-time delegation of permissions by the data owner. This "unus pro omnibus" approach simplifies key management and client operations.
• Novel Primitive: Shiftable Multi-Recipient Encryption (SME): A cornerstone of DSE, SME is a new public-key encryption scheme specifically designed for obliviously maintaining update counters (uct_w) among multiple clients. It supports homomorphic shifting and expansion, crucial for DSE's functionality and privacy.
• Optimized Public-Key Operations via Microscopic Hybrid Encryption: Recognizing that M/M solutions inherently require public-key operations, DSE minimizes their use. It employs a microscopic hybrid encryption approach where a writer IBE-encrypts key material only once. Subsequent operations for optimal search efficiency leverage symmetric keys, leading to a significant performance advantage. Searching only requires one IBE decryption per contributing writer to retrieve the first result.
• DSE-I for Robust Integrity Guarantees: An enhanced version, DSE-I, integrates an equivocable commitment scheme (Pedersen commitment) and an argument of knowledge (AoK). This ensures that the global state is correctly modified and that all update and search tokens are well-formed and submitted by honest clients, even in the presence of malicious adversaries.
• Mitigation of Keyword-Guessing Attacks: By delegating keyword-specific secrets required for encryption and searching, DSE effectively resolves the vulnerability to keyword guessing, an inherent weakness found in PEKS and HSE schemes.
• Formal Security Definitions for M/M Setting: The research provides comprehensive formal security definitions tailored for the M/M context, including adaptive security for both curious and honest server models, a strong notion of forward privacy, and a formal definition of integrity, previously lacking in the literature.
• Demonstrated Order-of-Magnitude Performance Improvement: Empirical evaluations on real-world datasets, such as the Enron corpus, show DSE to be significantly more efficient than state-of-the-art M/S solutions like FP-HSE, achieving search times more than 240 times shorter.

These findings collectively establish DSE as a practical, secure, and highly efficient solution for complex collaborative environments in untrusted cloud settings.

Technical Deep Dive

[▶ Watch: Novel primitives: Shiftable Multi-Recipient Encryption (SME) and IBE (2:45)]()

DSE's robust design for multi-writer, multi-reader searchable encryption relies on a sophisticated interplay of cryptographic primitives and a carefully constructed system architecture. The framework is presented in two main variants: DSE-F (the forward-private framework) and DSE-I (the integrity-enhanced version).

System Model and Adversary Model

DSE involves three primary parties:

1. Server: Provides storage, maintains the encrypted database (EDB), and publishes the global state (st).
2. Database Owner: Initializes the system, generates master keys, and delegates search (W_Q) and/or update (W_G) rights for specific keyword sets to clients.
3. Multiple Clients: Become readers and/or writers for designated keywords after delegation. A writer inserts keyword-document tuples (w, id), while a reader retrieves document identifiers matching their search-permitted keywords. Neither clients nor the server own the data; the database owner does.

The adversary model is comprehensive, extending beyond traditional SSE schemes where only the server is corrupt. In DSE, an adversary can corrupt the server (either curious or honest-but-curious) and multiple clients with varying access rights. Corrupt parties aim to derive information beyond the defined leakage functions. Malicious clients might attempt to submit faulty requests to tamper with the global state or database, preventing honest clients' updates from being searchable. DSE explicitly defines integrity to counter such misbehavior.

Key Hierarchy and Setup

The database owner uses a master secret key (msk) as the root of trust to derive all other keys. For any keyword w:

• R_IBEw is derived from F(msk, (IBE, w)), which generates (PK_IBEw, SK_IBEw) via IBE.KG.
• R_SMEw is derived from F(msk, (SME, w)), generating (PK_SMEw, SK_SMEw) via SME.KG.
• SK_EDBw (the PRF key for the index) is derived from F(msk, (EDB, w)).

The Setup algorithm initializes msk, an empty active keyword space W, and generates PPSME (SME public parameters). An initial SME ciphertext ctx_W for all keywords is created, and Sctr, PK_IBE, PK_SME are initialized to zero. The encrypted database EDB, a cache for search results (CDB), and a search starting index (SSI) are initialized as empty dictionaries. The global state st bundles (Sctr, PK_IBE, PK_SME)_W and ctx_W.

Shiftable Multi-Recipient Encryption (SME)

A cornerstone of DSE is the novel Shiftable Multi-Recipient Encryption (SME), specifically tailored to securely and obliviously maintain update counters (uct_w) among multiple clients.

Definition 4 (Shiftable Multi-Recipient Encryption): An SME scheme operates over a message space (M, +), a ciphertext space (C, +), and a recipient space R. It comprises PPT algorithms:

• Setup(1): Generates public parameters pp.
• KG(1): Generates a key pair (pk, sk).
• Init(1): Generates an initial ciphertext ctx_empty for an empty set of recipients. ctx_A encrypts messages for recipient set A.
• Expand(SKA, ctx_B): Expands ctx_B (for recipients B) to ctx_AUB (for A U B), given decryption keys SKA for A, where A and B are disjoint. Newly expanded slots encrypt 0_M.
• Enc(PKA, MA): Encrypts a set of messages MA for recipient set A using encryption keys PKA, outputting ctx_A.
• Shift(ctx, ctx'): Takes two ciphertexts ctx and ctx' (encrypting MA and M'A respectively) and outputs ctx'' encrypting the shifted messages MA + M'A (entry-wise addition).
• Dec(SKA, ctx_B): Decrypts ctx_B using decryption keys SKA to retrieve messages MA.

SME possesses two key properties:

1. Shiftable: It supports homomorphic addition over the message space, allowing an encrypted message m to be shifted by an offset m' by encrypting m' for the same slot and adding the two ciphertexts.
2. Expandable: It allows extending a multi-recipient ciphertext to include more recipients using their secret keys.

Crucially, SME must also be Shift Non-Committing (Definition 5), meaning a PPT simulator can simulate the result of homomorphic shifting on any ciphertext without knowing which slots are shifted or the offsets. This property is vital for adaptive security.

SME Construction (based on multi-recipient ElGamal):

Let G be a group of prime order q where the decisional Diffie-Hellman (DDH) assumption holds.

• KG(1): Secret key sk is x, public key pk is x.
• Init(1): Initializes ctx_g as (r, 0), where r is a random element.
• Enc(PKA, MA): For recipients A with public keys x_i and messages m_i, outputs ctx_A = (r, r x_i + m_i).
• Expand(SKA, ctx_B): Given SKA (x_i for i in A) and ctx_B = (c_0, c_i), expands to ctx_AUB by setting c_i := c_0 x_i for i in A.
• Shift(ctx, ctx'): Given ctx = (c_0, c_i) and ctx' = (c_0', c_i'), computes ctx'' = (c_0 + c_0', c_i + c_i') (entry-wise addition).
• Dec(SKA, ctx_B): Given SKA (x_i for i in A) and ctx_B = (c_0, c_i), decrypts m_i := c_i - c_0 x_i for i in A.

This SME scheme is highly efficient, with online computation primarily involving modular additions once small-exponent exponentiation for counter values is precomputed. It is proven correct and CPA-secure under DDH, and shift non-committing in the generic group model.

DSE-F: Forward-Private Framework Algorithms

• Delegate(st, msk, W_Q, W_G): The owner delegates rights. For each w in W_G, R_SMEw, R_IBEw, SK_EDBw are derived. (PK_SMEw, SK_SMEw) and (PK_IBEw, SK_IBEw) are generated. For newly delegated keywords, ctx_W is expanded, and Sctrw is initialized to 0. The client receives sk containing SK_IBEW_Q, SK_EDBW_G, SK_SMEW_G.
• UpdtTkn(st, sk, IDW_G): A writer generates an update token. The client decrypts W_G slots of global ctx_W using SK_SMEW_G to obtain UctrW_G. For each w in W_G, IK_EDBw is derived. For each id in IDw, ADDRi is derived from F(IK_EDBw, Uctrw + 1), and VALi is IBE.Enc(PK_IBEw, Sctrw, IDw). A new SME ciphertext ctx_W_new is created using SME.Enc(PK_SME, T_W_G), where T_W_G indicates the offset. The token u consists of (ctx_W_new, ADDR, VAL).
• Updt(st, EDB, u): The server processes u. For each (ADDRi, VALi), VALi is inserted into EDB at ADDRi. The global ctx_W is shifted using SME.Shift(ctx_W, ctx_W_new).
• SrchTkn(st, sk, W_Q): A reader generates a search token. The client decrypts W_Q slots of global ctx_W using SK_SMEW_Q to obtain UctrW_Q. For each w in W_Q, DK_IBEw is derived from IBE.Ext(SK_IBEw, Sctrw), and IK_EDBw is derived from F(SK_EDBw, Sctrw). The token s consists of (DK_IBE, IK_EDB, Uctr)W_Q.
• Srch(st, EDB, s): The server performs a search. It initializes IDW_Q. For each w in W_Q: if it's the first search, SSIw is 1; otherwise, previous results are from CDBw. For i from SSIw to Uctrw, addr is F(IK_EDBw, i), val is retrieved from EDBaddr and decrypted using IBE.Dec(DK_IBEw, val). The decrypted id is added to IDw. SSIw is updated to Uctrw + 1, and CDBw is updated. The global Sctr for W_Q is incremented.

DSE-I: Instrument for Integrity

DSE-I enhances DSE-F with robust integrity guarantees against malicious clients. It ensures that the global state is correctly modified and that all tokens are well-formed and accompanied by a proof, which the server verifies.

• Setup and Delegation: The owner performs additional setup for an equivocable commitment scheme φ (Pedersen commitment) and an argument of knowledge (AoK) Π. The global state st includes the common reference string crs for Π. For each w, an additional randomness Rw is derived, and SK_EDBw is committed as COMw := φ.Com(SK_EDBw; Rw), which is included in st.
• Update in DSE-I: When a writer generates an update token u, they must generate a well-formedness proof π for ctx_W in u using Π.Prove(). This proof ensures: (1) the offset vector is binary, (2) its encrypted representation is correctly formed, and (3) ctx_W correctly encrypts it. The server verifies π using Π.Vf() before shifting ctx_W.
• Search in DSE-I: Similarly, a reader generating a search token s must generate a well-formedness proof π for IK_EDBW_Q. This proof ensures: (1) COMw is a valid commitment to SK_EDBw using Rw, and (2) IK_EDBw is correctly derived. The server verifies π before adding the characteristic vector for W_Q to Sctr.

The overhead of Π is proportional to the size of the statement and witness, O(|W_Q|) for search and O(|W_G|) for update. DSE-I retains the same asymptotic complexities as DSE-F. Theorem 3 states that DSE-I is adaptively secure and forward-private if the underlying primitives are non-committing, φ is equivocable, and Π is a zero-knowledge AoK. Theorem 4 asserts its integrity if Π is an AoK, φ is hiding and binding, and SME is CPA-secure, ensuring honest updates are always retrievable.

Demo / Proof of Concept

[▶ Watch: Optimizing performance with microscopic hybrid encryption (3:45)]()

While the talk did not present a live demonstration in the traditional sense, the practical viability and efficiency of DSE were thoroughly validated through an extensive implementation and evaluation using synthetic and real-world datasets. This serves as the empirical proof of concept for the proposed cryptographic framework.

The implementation was developed in Python, leveraging the Charm-Crypto library for cryptographic and group operations. Specifically, an MNT224 curve was used for pairing-based cryptography, which is a common choice for performance-sensitive applications requiring bilinear pairings. The experiments were conducted on a standard desktop machine equipped with an Intel Core i7-4790 3.60GHz CPU and 16GB RAM, reflecting a typical enterprise environment rather than specialized hardware.

Standard and custom cryptographic primitives were carefully selected and integrated:

• Pedersen commitment was employed for the commitment scheme φ in DSE-I, known for its hiding and binding properties.
• The custom-designed Shiftable Multi-Recipient Encryption (SME) scheme, a core contribution of this work, was implemented as described in the technical deep dive.
• Boneh-Franklin IBE 7 was chosen for the identity-based encryption component, a well-established IBE scheme.
• HMAC-SHA-256 was used as the underlying Pseudorandom Function (PRF), with pk_PRF(sk, m) defined as H(m)sk, where H is a full domain hash.
• The argument system from Lai et al. 28 was adopted for the argument of knowledge (AoK) Π in DSE-I, providing the necessary integrity proofs.
• The microscopic hybrid encryption technique, central to optimizing public-key operations, was applied throughout the implementation.

For a fair and clear evaluation, the benchmarks explicitly did not utilize any CDB-cache. This ensured that the measured search times accurately reflected the core cryptographic computations and scheme overheads, rather than being skewed by caching benefits.

Evaluation and Results (Synthetic Datasets)

Delegation Time (Table II): Measured for varying keyword sets l (200 to 1000).

• For l=200, DSE-F took 1.27 seconds, DSE-I took 1.61 seconds.
• For l=1000, DSE-F took 6.34 seconds, DSE-I took 8.13 seconds.

DSE-I consistently showed slightly higher delegation times due to the additional integrity proofs.

Search Performance (Figure 16):

• Independence from Database Size (Figure 16a): With 10 writers and 1000 active keywords, search time was independent of database size (2^16 to 2^20). Searching for 2000 results consistently took around 100 milliseconds.
• Independence from Active Keyword Space (Figure 16b): With a fixed database (2^16) and 10 writers, search time was independent of active keyword space (200 to 1000).
• Linearity with Contributive Writers (Figure 16c): Searching for 9000 documents, search time was linear in the number of contributive writers. 10 writers took ~100 ms, increasing to ~500 ms for 50 writers. This validated the microscopic hybrid encryption strategy.
• Linearity with Result Size (Figure 16d): With 10 writers, search time grew linearly with the number of matches. 2,000 results took ~100 ms, while 10,000 results took ~500 ms.

Overall, all synthetic searches completed within 1 second, demonstrating high efficiency. The performance gap between DSE-F and DSE-I was consistent, reflecting the AoK overhead.

Update Performance (Figure 17):

• DSE-F (Figure 17a): Update time grew with both the number of update tuples and the active keyword space W. E.g., updating 1 keyword with W=1000 took around 500 milliseconds.
• DSE-I (Figure 17b): Update time was primarily dominated by W due to the Π proofs, being almost independent of the number of tuples in a single update. This suggests DSE-I is more efficient per tuple for larger batches.

DSE-F is efficient for daily cloud storage, while DSE-I, with its integrity overhead (around 10 seconds for a large batch), is suitable for archiving and auditing.

Evaluation and Results (Enron Dataset)

To provide a real-world perspective, DSE was benchmarked against the Enron dataset (0.5 million emails, 146 clients, top 500 keywords, 4.1 million keyword-email tuples), comparing it with FP-HSE, the state-of-the-art multi-writer/single-reader solution.

• Delegation Time: Average delegation per client was 2.77 seconds for DSE-F and 3.42 seconds for DSE-I, well within practical limits.
• Update Time Per Client (Figure 18a):
• FP-HSE incurred significant, fluctuating update times due to its epoch-based forward privacy requiring clients to rebuild parts of their encrypted database, linear in the number of ever-written keywords.
• DSE-F and DSE-I were significantly faster. DSE-I, despite integrity proofs, completed updates within 30 seconds, acceptable for daily backups.
• Search Time Per Keyword (Figure 18b):
• DSE-F and DSE-I were significantly faster than FP-HSE.
• DSE's optimized search performs public-key operations linear only in the **number of writers updating the searched keywords**.
• FP-HSE, conversely, performs decryption attempts on a token set linear in the **number of ever-written keywords by all writers**, leading to much higher overhead.
• Concretely, DSE-F and DSE-I search time was more than 240 times shorter than FP-HSE on the Enron dataset, demonstrating an order-of-magnitude practical superiority.

These comprehensive evaluations confirm DSE's practical efficiency and superior performance, particularly in real-world collaborative scenarios.

Defensive Implications

[▶ Watch: New security definitions for multi-writer, multi-reader constructions (5:20)]()

The introduction of Delegatable Searchable Encryption (DSE) provides significant advantages for defenders operating in cloud-based collaborative environments where sensitive data must remain secure while being searchable and updatable by multiple authorized parties. DSE offers a robust framework that directly translates into several key defensive implications:

1. Enhanced Data Confidentiality on Untrusted Clouds: DSE ensures that sensitive data remains encrypted on the cloud server, providing strong confidentiality guarantees. Defenders can confidently store data in untrusted cloud environments knowing that the data is protected even if the server is compromised (in a curious-but-honest server model).
2. Fine-Grained Access Control with One-Time Delegation: The system allows a database owner to delegate specific search (W_Q) and update (W_G) rights for particular keywords to individual clients. This fine-grained control is crucial for managing access in complex organizational structures, minimizing the risk of unauthorized data exposure. The "one-time delegation" model simplifies key management for the data owner, reducing ongoing administrative burden and potential points of failure.
3. Stronger Forward Privacy Guarantees: DSE achieves standard forward privacy, a more robust form of privacy compared to the epoch-based privacy found in other schemes like HSE. This means that if an adversary compromises a search token, they cannot learn about any future updates to the associated keywords. This is critical for long-term data security and compliance, ensuring that historical compromises do not perpetually jeopardize new data.
4. Robust Integrity Against Malicious Clients (DSE-I): The DSE-I variant provides explicit integrity guarantees using arguments of knowledge. This is a crucial defense against insider threats or compromised clients who might attempt to tamper with the encrypted database or global state. DSE-I ensures that only well-formed and authorized update and search tokens are processed, guaranteeing that honest clients' updates are always searchable and the system state remains consistent. This is particularly valuable in environments with a mix of trusted and potentially untrusted client endpoints.
5. Mitigation of Keyword-Guessing Attacks: By delegating keyword-specific secrets, DSE inherently protects against keyword-guessing attacks, a vulnerability common in PEKS and HSE schemes. This enhances the security posture by preventing adversaries from inferring keywords by repeatedly testing guesses against ciphertexts.
6. Efficient and Scalable Collaboration: DSE's sublinear search performance, which is linear only in the number of contributive writers and result size (not the entire database size or active keyword space), enables efficient collaboration even with a large number of participants and a growing dataset. This efficiency means that security does not come at the cost of usability, making secure cloud collaboration practical for daily operations.
7. Strategic Deployment Based on Security Needs: Defenders can choose between DSE-F and DSE-I based on their specific security requirements. DSE-F offers high efficiency for daily cloud storage needs where strong forward privacy is paramount. DSE-I, while incurring a slightly higher overhead, is ideal for applications requiring verifiable integrity, such as archiving, auditing, or highly sensitive enterprise data, especially when batching large data updates is common.
8. Foundation for Future Security Enhancements: DSE's SSE-like index design allows for easier adaptation of existing SSE enhancements, such as techniques for backward privacy (hiding deleted updates) or volume hiding (concealing search result sizes), though these require further dedicated research to integrate seamlessly without additional roundtrips.

In conclusion, DSE offers a comprehensive and practical solution for secure multi-client data interaction on untrusted cloud platforms. Defenders should consider DSE for applications requiring high confidentiality, fine-grained access control, strong forward privacy, and verifiable integrity in collaborative cloud environments.

Key Takeaways

• DSE is the first multi-writer, multi-reader (M/M) searchable encryption scheme to achieve sublinear search times and standard forward privacy, addressing a critical gap in secure cloud collaboration.
• The framework introduces Delegatable Searchable Encryption (DSE) and a novel primitive, Shiftable Multi-Recipient Encryption (SME), which is crucial for obliviously maintaining update counters among multiple clients.
• DSE employs a microscopic hybrid encryption approach to optimize public-key operations, resulting in search times linear only in the number of contributive writers and result size, not the entire database or active keyword space.
• DSE-I, an integrity-enhanced variant, leverages Pedersen commitments and arguments of knowledge to provide robust protection against malicious clients attempting to corrupt the database or global state, ensuring honest updates are always retrievable.
• Empirical evaluation against the Enron dataset demonstrates an order-of-magnitude performance improvement, with DSE-F and DSE-I achieving search times over 240 times shorter than state-of-the-art M/S solutions like FP-HSE.
• DSE provides formal security definitions for the M/M setting, including adaptive security, strong forward privacy, and integrity, and effectively mitigates keyword-guessing attacks inherent in previous public-key schemes.

About the Speaker(s)

Jiafan Wang is a researcher in the field of cryptography, whose work focuses on advanced encryption schemes, particularly in the domain of searchable encryption and secure multi-party computation. As evidenced by this presentation at the NDSS Symposium, Wang's research contributes to developing practical and theoretically sound solutions for secure data handling in untrusted cloud environments, with a strong emphasis on multi-user scenarios and robust security properties like forward privacy and integrity.