Iterative Attacks on Searchable Symmetric Encryption Based on Statistical Information

Abstract

This invention relates to a statistical information-based method for resisting searchable symmetric encryption iterative attacks. The attack of this invention requires minimal background knowledge, passively observing user and server query behavior, and can achieve higher recovery accuracy in a shorter time, balancing attack efficiency and recovery accuracy. Specifically, it includes the following steps: the attacker knows part of the user's query and its corresponding results, i.e., KnownQ, and then the attacker passively observes a series of interactions between the server and the client, such as queries, to obtain observation information. obs Furthermore, the attacker possesses a document set with a keyword distribution similar to that of the documents stored on the server, and extracts the auxiliary information needed for the attack from these documents. to Then the attacker will extract information from the observation data. obs Extract the trapdoor co-occurrence matrix from auxiliary information. to The keyword co-occurrence matrix is ​​extracted. The attacker uses the two co-occurrence matrices to make an initial prediction and obtain the initial keyword-trapdoor matching matrix P. Elements in KnownQ are removed. Through continuous iteration, statistical information is refined to improve the accuracy of the attack. Furthermore, the Hungarian algorithm is used to reduce the computational complexity of the quadratic allocation problem, thereby improving the execution efficiency of the attack.

Description

Technical Field

[0001] This invention relates to a network security technology, specifically a statistical information-based method for resisting searchable symmetric encryption iterative attacks. Background Technology

[0002] The system model consists of two entities: a client and a server. The client stores a dataset. To save local storage, the client wants to upload the dataset to the server but is concerned about privacy and wants it to retain query capabilities. Therefore, the client uses the SSE (Secure Sequence) scheme. The server provides storage services but is not trusted by the client. The server is honest but curious; it adheres to protocol specifications but is also interested in the stored data. It passively observes the client to obtain sensitive information. The adversary server wants to guess the keywords corresponding to each query token issued by the client. When the attacker has enough observational information to guess all the keywords extracted from each encrypted document, the attack becomes a database recovery attack.

[0003] While SSE schemes use encrypted documents and encrypted indexes to prevent adversaries from guessing the keywords matching the query token, most SSE schemes sacrifice some privacy protection performance in order to improve efficiency. This results in the leakage of information, allowing adversaries to exploit specific leaks for query recovery attacks.

[0004] Existing SSE (Search Engine Optimization) schemes exhibit two typical types of leakage: access pattern leakage and search pattern leakage. Access pattern leakage reveals the list of identifiers for documents matching the query trapdoor, indicating the number of documents containing the query keywords. Search pattern leakage can be used to determine if two queries are identical, i.e., whether their corresponding keywords are the same. For a document with a unique keyword, if the query keywords are the same, the search operations are identical, making it easier for adversaries to identify them. This information can also be used to infer the search frequency of a particular keyword.

[0005] Based on the types of adversaries targeting searchable symmetric encryption schemes, attacks can be categorized into active and passive attacks. A representative example of an active attack is file injection, where the attacker needs the ability to insert documents into a database, such as an adversary sending emails and storing them in the target dataset. The attacker can select commonly used keywords to construct attack documents, and by observing which specific queries these documents match, the adversary can deduce the keywords corresponding to the query. Passive attacks, on the other hand, rely solely on the adversary's background knowledge and observational information obtained through passively observing server-side queries. Active attacks require excessive privileges and are not practical in real-world scenarios; therefore, current academic research focuses on passive attacks.

[0006] Existing passive attacks can be categorized into truth value attacks and statistical information-based attacks based on the level of leakage required by the adversary. Truth value attacks require the attacker to obtain partial or complete information about the database or user queries; such attacks are also known as "leakage abuse attacks." Statistical information-based attacks, on the other hand, rely on statistical information obtained by observing database or client query behavior (such as query trapdoor co-occurrence matrices extracted from observed queries); such attacks are also known as "inference attacks."

[0007] Existing real-value attacks against searchable symmetric encryption are designed to be executed as known-data attacks, some of which use similar documents as auxiliary information to recover queries. However, under this setup, the accuracy of these attacks is generally less than 20%. This means that these attacks are only effective when executed as real-value attacks. The auxiliary information required for real-value attacks is difficult to obtain in real-world scenarios, thus limiting their practical application. Existing similar-data attacks can utilize statistical information extracted from similar documents to execute query recovery attacks. However, most statistical attacks with high recovery accuracy require a long execution time because query recovery solves a secondary problem. Furthermore, most query recovery attacks based on statistical information fail to achieve both the desired accuracy and high execution efficiency, resulting in poor attack effectiveness. Summary of the Invention

[0008] The purpose of this invention is to provide a statistical information-based method for resisting searchable symmetric encryption iterative attacks, thereby addressing the problem that existing methods for resisting searchable symmetric encryption attacks cannot balance the efficiency and accuracy of attack schemes when there is limited background knowledge.

[0009] The objective of this invention is achieved as follows: a statistical information-based method for resisting searchable symmetric encryption iterative attacks, comprising the following steps:

[0010] S1. Attackers passively observe the interaction between the server and the client to obtain observation information. Extracting auxiliary information from a set of similar documents Attackers obtain information from observations. Extract the trapdoor co-occurrence matrix from auxiliary information. Extract the keyword co-occurrence matrix. Before the attack begins, the adversary will use known queries... Eliminate known information from the candidate keyword set and candidate trapdoor set, and then... Each iteration processes and releases data. The system identifies trapdoor-keyword pairings and then recalculates these pairings using statistical information. The iteration concludes with the final prediction matrix.

[0011] S2. Take the candidate keywords and candidate trapdoors that need to be recalculated as input, supplemented by observation information. Auxiliary information and the fixed allocation matrix Using an optimal linear solver based on the Hungarian algorithm, the idle allocation matrix between the remaining keys and trapdoors is calculated. .

[0012] Furthermore, the specific operation steps of step S1 are as follows:

[0013] S1-1, Retrieve including known queries Number of iterations The ratio of trapdoors that need to be released in each iteration Including observation information and auxiliary information ;

[0014] S1-2. Starting from the initialization steps, the attacker will obtain auxiliary information. Retrieve known queries The knowledge is used to eliminate elements with known pairings in the candidate key set trapdoor before the iteration begins;

[0015] S1-3. Fix the position of the key-trapdoor with known pairing relationship in the allocation matrix to 1;

[0016] S1-4. Next, using a linear solver, the filtered candidate trapdoor set, candidate keyword set, auxiliary information, and observation information are taken as input to obtain an initial prediction relationship, which is the initial allocation matrix.

[0017] S1-5. At the beginning of each iteration, based on the parameters... And the allocation matrix, randomly selecting certain fixed query trapdoors Size is Release the remaining candidate trapdoors Then fix with Keywords with pairing relationships Then release the remaining candidate keyword set corresponding to the candidate query traps. Fixed query traps and keywords that have a pairing relationship with it. The allocation matrix between them is ;

[0018] S1-6, will , , , , , and The remaining candidate trapdoors are recalculated as input to the linear solver. With remaining candidate keywords Based on the pairing relationships, calculate the free allocation matrix between them. ;

[0019] S1-7. At the end of each iteration, a fixed allocation matrix will be used. and the recalculated free allocation matrix Combined, a new allocation prediction matrix is ​​formed for use in the next iteration.

[0020] Furthermore, the specific operation method of S2 is as follows:

[0021] S2-1. Given the auxiliary information and the assignment matrix, assume the observation information is a deterministic model, such as... The scheme in this paper starts from observation information. The capacity matrix V is calculated from the auxiliary information. Extract the capacity matrix The maximum likelihood estimate of the assignment matrix can be written as:

[0022] (3)

[0023] S2-2. To better select parameters c and d, we assume that the generation of the dataset is independent, and formula (3) is rewritten as:

[0024] (4)

[0025] S2-3, Assuming a specific trapdoor That is Its corresponding keyword is That is This is consistent with the information about Nd and The probability follows a binomial distribution, where Nd is the total number of documents in the dataset, and for off-diagonal elements... We use symbols Assuming all elements in V are independent, and ignoring summations related to the allocation matrix, we can... Written as:

[0026]

[0027] S2-4. Based on the above formula, we set the parameters c and d of the linear solver as follows:

[0028]

[0029] S2-5. Using a linear solver based on the Hungarian algorithm, calculate the pairing relationships between the remaining trapdoors and keys, and obtain their free allocation matrix. .

[0030] The most critical component of the attack algorithm in this invention is the linear solver, which, through SolveLiner, specifies how the adversary will utilize auxiliary information. Observational information and fixed allocation matrix To calculate and update the allocation matrix P. Since the optimization problem only applies to... And because It is certain, therefore It is a constant multiplied by Therefore, it can be rewritten as a linear assignment problem (LAP). It means using keywords Assigned to the trapdoor The expenditure is linearly allocated; it is separated out only to distinguish the coefficients of the linear and quadratic terms. c and d are derived from auxiliary information. and observation information The calculation yielded the result.

[0031] In this invention, This represents the dataset indexed by the client. This represents the total number of documents in the dataset. This invention uses an index to represent these documents (including encrypted and plaintext documents). This represents a set of similar documents that are not indexed but whose distribution is similar to that of indexed documents, with a size of [size missing]. This information could be used by adversaries to aid their attacks. This invention randomly shuffles documents during each initialization process, so using the index does not reveal the content of any document corresponding to that index. Each document is appended with a set of extracted keywords, which belong to the keyword space. The client encrypts each document in the dataset, encrypts the index using the user's private key, and uploads the encrypted database and index to the server. When the client wants to query a specific keyword... At that time, the client will first determine based on Generate a search trapdoor It then sends it to the server. The server uses an encrypted search index to calculate the query token. This operation will reveal the access pattern, that is, the index of documents matching the query. The text uses a vector... To represent a trapdoor Access mode, size is If the article If it matches this query, then The Middle One element is set to 1, otherwise it is 0. This invention uses... Let m represent the set of all unique trapdoors observed by the enemy.

[0032] Most statistical query recovery attacks observe data such as query information before execution, including the trapdoors required for each client query and the index of all documents matching those trapdoors returned by the server. The adversary calculates summary statistics from this data, typically including capacity information. This invention defines the statistically obtained capacity information as a matrix V, with a size of... , of which Line number The column indicates that both query tokens are matched. and The total number of documents is calculated using the following formula: This is also known as the trapdoor co-occurrence matrix. Similarly, the adversary itself has a set of similar documents that are similar in distribution to the indexed documents. The enemy can also extract a clue from this auxiliary information. Size is Observational information This information is obtained from the adversary's observation of server and client behavior, primarily containing the relationship between encrypted documents and query trapdoors, while supplementary information... The similar document set in the matrix consists of plaintext documents and contains information about the relationship between plaintext documents and keywords; it is also known as the keyword co-occurrence matrix. This indicates that it contains keywords simultaneously. and The probability that a document appears in the dataset.

[0033] This invention uses For example, This indicates that the attacker believes it is related to a query trap. The corresponding keywords are This mapping relationship can be represented by an n×m matrix P:

[0034]

[0035] This invention uses Let P represent the set containing all reasonable mappings P.

[0036] The attack scheme of this invention also requires the aforementioned known data queries, that is, the attacker knows the keywords corresponding to some queries before executing the attack. The known query dataset is defined as follows:

[0037]

[0038] For existing known data queries, attackers can use leaked documents to launch attacks, but this requires that the leaked documents not be deleted by the server. Once the server detects these leaked documents and removes their indexes, it can defend against these known data queries. However, the attack proposed in this invention will not be affected and can still be executed.

[0039] Most query recovery attacks can be defined as optimization problems, where the attacker attempts to find a P-matrix relating keywords to query trapdoors, minimizing a certain objective function. These problems are typically linear or quadratic problems with respect to P. A linear recovery query attack can be formulated as:

[0040]

[0041] The enemy can The computational cost is used to find the optimal solution to the problem. Constants in the formula... The representative will use keywords Assigned to the trapdoor Expenses.

[0042] The same secondary query recovery attack can be described as:

[0043]

[0044] in, It is to use keywords Assigned to query trapdoor and keywords Assigned to query trapdoor The shared costs. Existing attacks following this formula rely on suboptimal heuristics to find solutions.

[0045] Query recovery attacks based on the Linear Allocation Problem (LAP) can find the optimal solution using efficient solvers. However, solvers for the Quadratic Allocation Problem (QAP) often provide suboptimal and heuristic solutions, and LAP cannot utilize quadratic terms in the QAP that may contain valuable information for query recovery. This invention proposes a query recovery attack, RSAN, which relies on an efficient LAP solver to iteratively solve the QAP. Compared to other QAP solvers, it is more suitable for query recovery.

[0046] This invention is a statistical information-based attack that requires very little background knowledge. It passively observes the query behavior of users and servers and achieves a higher recovery accuracy in a shorter time than other methods, balancing the efficiency of the attack with the accuracy of the recovery.

[0047] This invention uses a small number of known queries (which can be detected and deleted by the server) and a co-occurrence matrix to efficiently execute the attack; this helps improve the recovery accuracy of the invention. The keyword co-occurrence matrix is ​​calculated from similar documents, and the token co-occurrence matrix is ​​calculated from observation information. This invention uses a linear solver to iteratively find a solution to the quadratic query recovery attack. The accuracy of the attack is improved by using the output of the previous iteration. These two characteristics greatly shorten the execution time of the attack, making it several orders of magnitude faster than other attacks, while also ensuring the recovery accuracy of the attack.

[0048] The attack on RSAN in this invention only requires documents with keyword distributions similar to the indexed documents to achieve a recovery accuracy of approximately 95%. Attackers only need to know 1% of the known queries to achieve this. Compared to other statistical data-based attacks, the attack in this invention offers superior execution efficiency and recovery accuracy. Attached Figure Description

[0049] Figure 1 This is an example diagram of a single iteration in an attack strategy.

[0050] Figure 2 The following is a comparison of the effects of RSAN and Score attacks; where (a) is the Enron dataset and (b) is the Lucene dataset.

[0051] Figure 3 This is a comparative example graph of RSAN and other statistical attacks; where (a) is recovery accuracy and (b) is execution time. Detailed Implementation

[0052] The invention will now be described in further detail with reference to the accompanying drawings.

[0053] This invention addresses searchable symmetric encryption iterative attack methods by comprising the following steps:

[0054] S1. Attackers passively observe the interaction between the server and the client to obtain observation information. Extracting auxiliary information from a set of similar documents Attackers obtain information from observations. Extract the trapdoor co-occurrence matrix from auxiliary information. Extract the keyword co-occurrence matrix. Before the attack begins, the adversary will use known queries... Eliminate known information from the candidate keyword set and candidate trapdoor set, and then... Each iteration processes and releases data. The process involves identifying trapdoor-keyword pairings, then recalculating these pairings using statistical information. The iteration concludes with the final prediction matrix. The specific operation is as follows:

[0055] S1-1, Retrieve including known queries Number of iterations The ratio of trapdoors that need to be released in each iteration Including observation information and auxiliary information ;

[0056] S1-2. Starting from the initialization steps, the attacker will obtain auxiliary information. Retrieve known queries The knowledge is used to eliminate elements with known pairings in the candidate key set trapdoor before the iteration begins;

[0057] S1-3. Fix the position corresponding to the key -trapdoor in the allocation matrix P to 1;

[0058] S1-4. Next, using a linear solver, the filtered candidate trapdoor set, candidate keyword set, auxiliary information, and observation information are taken as input to obtain an initial prediction relationship, which is the initial allocation matrix P.

[0059] S1-5. At the beginning of each iteration, based on the parameters... And the allocation matrix P, randomly select certain fixed query trapdoors Size is Release the remaining candidate trapdoors Then fix with Keywords with pairing relationships Then release the remaining candidate keyword set corresponding to the candidate query traps. ;

[0060] S1-6, will , , , , , and As input to the linear solver, the idle key is recalculated. and empty trapdoor Based on the pairing relationships, calculate the free allocation matrix between them. ;

[0061] S1-7. At the end of each iteration, a fixed allocation matrix will be used. and the recalculated free allocation matrix Combined, a new allocation prediction matrix is ​​formed for use in the next iteration.

[0062] S2. Take the candidate keywords and candidate trapdoors that need to be recalculated as input, supplemented by observation information. Observational information and the fixed allocation matrix Using an optimal linear solver based on the Hungarian algorithm, the idle allocation matrix between the remaining keys and trapdoors is calculated. The specific operating method is as follows:

[0063] S2-1. Given the auxiliary information and the assignment matrix, assume the observation information is a deterministic model, such as... The scheme in this paper starts from observation information. The capacity matrix V is calculated from the auxiliary information. Extract the capacity matrix The maximum likelihood estimate of the assignment matrix P can be written as:

[0064] (3)

[0065] S2-2. To better select parameters c and d, we assume that the generation of the dataset is independent, and formula (3) is rewritten as:

[0066] (4)

[0067] S2-3, Assuming a specific trapdoor That is Its corresponding keyword is That is This is consistent with the information about Nd and The probability binomial distribution, for off-diagonal elements We use symbols Assuming all elements in V are independent, and ignoring summations related to the allocation matrix P, we can... Written as:

[0068]

[0069] S2-4. Based on the above formula, we set the parameters c and d of the linear solver as follows:

[0070]

[0071] S2-5. Using a linear solver based on the Hungarian algorithm, calculate the pairing relationships between the remaining trapdoors and keys, and obtain their free allocation matrix. .

[0072] The most critical component of the attack algorithm in this invention is the linear solver, which, through SolveLiner, specifies how the adversary will utilize auxiliary information. Observational information and fixed allocation matrix To calculate and update the allocation matrix P. Since the optimization problem only applies to... And because It is certain, therefore It is a constant multiplied by Therefore, it can be rewritten as a linear assignment problem (LAP). It means using keywords Assigned to the trapdoor The expenditure is linearly allocated; it is separated out only to distinguish the coefficients of the linear and quadratic terms. c and d are derived from auxiliary information. and observation information The calculation yielded the result.

[0073] In this invention, This represents the dataset indexed by the client. This represents the total number of documents in the dataset. This invention uses an index to represent these documents (including encrypted and plaintext documents). This represents a set of similar documents that are not indexed but whose distribution is similar to that of indexed documents, with a size of [size missing]. This information could be used by adversaries to aid their attacks. This invention randomly shuffles documents during each initialization process, so using the index does not reveal the content of any document corresponding to that index. Each document is appended with a set of extracted keywords, which belong to the keyword space. The client encrypts each document in the dataset, encrypts the index using the user's private key, and uploads the encrypted database and index to the server. When the client wants to query a specific keyword... At that time, the client will first determine based on Generate a search trapdoor It then sends it to the server. The server uses an encrypted search index to calculate the query token. This operation will reveal the access pattern, that is, the index of documents matching the query. The text uses a vector... To represent a trapdoor Access mode, size is If the article If it matches this query, then The Middle One element is set to 1, otherwise it is 0. This invention uses... Let m represent the set of all unique trapdoors observed by the enemy.

[0074] Most statistical query recovery attacks observe data such as query information before execution, including the trapdoors required for each client query and the index of all documents matching those trapdoors returned by the server. The adversary calculates summary statistics from this data, typically including capacity information. This invention defines the statistically obtained capacity information as a matrix V, with a size of... , of which Line number The column indicates that both query tokens are matched. and The total number of documents is calculated using the following formula: This is also known as the trapdoor co-occurrence matrix. Similarly, the adversary itself has a set of similar documents that are similar in distribution to the indexed documents. The enemy can also extract a clue from this auxiliary information. Size is Observational information This information is obtained from the adversary's observation of server and client behavior, primarily containing the relationship between encrypted documents and query trapdoors, while supplementary information... The similar document set in the matrix consists of plaintext documents and contains information about the relationship between plaintext documents and keywords; it is also known as the keyword co-occurrence matrix. This indicates that it contains keywords simultaneously. and The probability that a document appears in the dataset.

[0075] This invention uses For example, This indicates that the attacker believes it is related to a query trap. The corresponding keywords are This mapping relationship can be represented by an n×m matrix P:

[0076]

[0077] This invention uses Let P represent the set containing all reasonable mappings P.

[0078] The attack scheme of this invention also requires the aforementioned known data queries, that is, the attacker knows the keywords corresponding to some queries before executing the attack. The known query dataset is defined as follows:

[0079]

[0080] For existing known data queries, attackers can use leaked documents to launch attacks, but this requires that the leaked documents not be deleted by the server. Once the server detects these leaked documents and removes their indexes, it can defend against these known data queries. However, the attack proposed in this invention will not be affected and can still be executed.

[0081] Most query recovery attacks can be defined as optimization problems, where the attacker attempts to find a P-matrix relating keywords to query trapdoors, minimizing a certain objective function. These problems are typically linear or quadratic problems with respect to P. A linear recovery query attack can be formulated as:

[0082]

[0083] The enemy can The computational cost is used to find the optimal solution to the problem. Constants in the formula... The representative will use keywords Assigned to the trapdoor Expenses.

[0084] The same secondary query recovery attack can be described as:

[0085]

[0086] in, It is to use keywords Assigned to query trapdoor and keywords Assigned to query trapdoor The shared costs. Existing attacks following this formula rely on suboptimal heuristics to find solutions.

[0087] The attack scheme was written in Python 3.8 and ran on Ubuntu 18.04 with 32GB of memory and an i5-10400 CPU (2.9GHz). The attack experiments used the same public datasets as most SSE schemes: the Enron dataset with 30,109 emails and the Lucene dataset with 63,597 emails. To test the attack's performance on different datasets, the Lucene dataset was used in some cases. The Natural Language Toolkit (NLTK) was used to perform basic natural language processing on the datasets: extracting keywords from emails and excluding stop words from the corpus. The Refined Score Attack was initially chosen as a comparison scheme because it requires the same auxiliary information as RSAN. Similarly, RSAN was compared with other attacks based on the aforementioned statistics. Each experiment was run 30 times to obtain the average recovery accuracy for more reliable data.

[0088] like Figure 2 As shown in (a), the scheme compares the accuracy of RSAN and Refined Score Attack in recovering different numbers of queries. To ensure fairness, the parameters for both experiments were kept consistent. The Enron dataset was randomly divided according to a set ratio, with 40% of the documents serving as a similar document dataset needed by the adversary; the remaining 60% served as the document dataset needed by the client. Each point in the line graph represents the average accuracy after executing the attack 30 times using the same parameters. The experiment provided each adversary with 1% of the known queries to help them execute the attack more effectively. In all cases, RSAN was at least 10% more accurate than Refined Score Attack. Notably, when the number of queries was increased to 2000, the gap increased to approximately 19%.

[0089] As the number of queries increases, the size of the candidate keyword set grows larger and larger, making it more difficult to recover from an attack. Figure 2 (a) well confirms this analysis. Refined Score Attack determines the matching degree between tokens and keywords based on the distance between the keyword vector and the token vector. As the number of queries increases, more likely token-keyword pairs with close proximity may appear, making it difficult for the attacker to determine which pair to choose. RSAN's solution is to continuously change the distribution of elements in matrix P, relying on iterative statistical information to make matrix P more accurate, such as... Figure 2As shown in (a), RSAN exhibits minimal fluctuations in recovery attack accuracy for different query counts, with the difference between the best and worst results being almost negligible. The shading near the broken line represents the standard deviation of accuracy; the larger the shading area, the more significant the difference in accuracy between each attack. Our attack accuracy under different parameters is around 98%, which is significantly better than the precision attack, and the shading area of ​​our solution is also much smaller.

[0090] exist Figure 2 In (b) of the experiment, the keyword space was fixed at 3000, and the number of different queries was expanded from 500 to 3000. For example... Figure 2 As shown in (b), the larger the query set, the higher the attack accuracy of RSAN; this indicates that the attack can efficiently utilize background knowledge because the broader the query set, the more knowledge the adversary possesses. Furthermore, this characteristic can also be derived from RefinedScore Attack. The Lucene dataset contains 63K emails; this means that emails in Lucene contain richer vocabulary and more content. When the number of known queries is minimal (e.g., query set = 500), the accuracy of RefinedScoreAttack fluctuates greatly; this is where the accuracy difference between the two attacks is most significant, reaching up to 12%. When the query set expands to 3K, the attack of this invention completes in approximately 1200 seconds, while the execution time of the RefinedScore Attack is 10000 seconds, making the invention an order of magnitude faster.

[0091] Figure 3 (a) shows the recovery accuracy of different statistical query recovery attacks on 500 queries. Different colored bars represent different attacks. The lower bound of the bar is the minimum accuracy after 30 rounds of attack, and the upper bound is the maximum accuracy after 30 rounds of attack. Each point on the blue line represents the average recovery accuracy after 30 rounds of attack. The red bars represent the recovery accuracy of SAP; SAP attacks require both capacity and frequency information to achieve optimal results. However, since this paper does not consider frequency information, the average accuracy of SAP is only 5.18%. The green column represents the accuracy of IKK. The scheme sets different cooling parameters to perform IKK attacks: P cool = 0.99, 0.999, 0.9999, 0.99999. The initial attack temperature is T=200. Iteration stops when the temperature falls below the set threshold. We can see the cooling parameters. The closer IKK is to 1, the higher its accuracy. When the value is 0.99, the average attack accuracy is only 0.5%, while when... When the value is 0.99999, the average attack accuracy reaches 67.12%, showing a significant improvement; this is because... The larger the value, the slower the temperature drops, the more iterations the IKK attack will have, and the more accurate the final prediction will be.

[0092] Purple represents GraphM, with an average accuracy of 52.84%. Its accuracy is higher than SAP and IKK, which has smaller cooling parameters, but computing the entire trapdoor set and key set requires enormous computational cost; its runtime is much longer than SAP, approaching that of IKK. Yellow represents the attack on RSAN by this scheme. As can be seen, after 30 rounds, the difference between RSAN's best and worst cases is very small. RSAN (pct=0.25, iters=100, KnownQ=5) has an average accuracy of 97.72% after 30 executions, significantly outperforming other query recovery attacks based on statistical information. Figure 3 (b) represents the execution time of each attack; it can be seen that in order to achieve higher recovery accuracy, both IKK and GraphM must sacrifice efficiency for improved accuracy. The RSAN of this invention is one to two orders of magnitude faster than other statistical attacks.

[0093] As described above, this invention is a highly effective attack on RSAN. The attack leverages documents with keyword distributions similar to indexed documents and known queries to efficiently and accurately recover the query. This invention recovers the query formula for a quadratic optimization problem and finds the optimal solution through iterative use of an optimal linear solver. RSAN achieves 95% accuracy using only similar documents. A similar attack, Refined Score Attack, under the same settings, achieves less than 90% accuracy. Compared to other statistically based attacks, IKK achieves the highest recovery accuracy at 67.12%, with a runtime of up to 10 seconds. 3 In comparison, RSAN achieves a recovery accuracy of 97.5% after 100 iterations in just 19.71 seconds, two orders of magnitude faster. This invention is also several orders of magnitude faster than other statistical attacks. All real-value attacks require the adversary to know some or all of the encrypted document's information to achieve a significant recovery speed. Even so, they still cannot reach 90%. However, such a scenario is severely unrealistic, making real-value attacks impractical in real-world applications. Unlike real-value attacks, this invention requires only 1% of the known queries as background knowledge. The server can also detect and remove known queries without affecting the accuracy of this invention.

Claims

1. A method of resisting attacks based on statistical information for searchable symmetric encryption iterative attacks, characterized in that, Comprising the following steps: S1, attacker passively observes the interaction between server and client to obtain observation information extract auxiliary information from similar document set ; attacker extracts trapdoor co-occurrence matrix from observation information extracts keyword co-occurrence matrix from auxiliary information Before the attack, the enemy releases known information in the candidate keyword set and the candidate trapdoor set, and through second iteration processing, each time release a trapdoor-keyword pair relationship, and then use statistical information to recalculate the pair relationship between these released trapdoors and keywords, and the final prediction matrix is given at the end of iteration; S2, input candidate keys and candidate trapdoors that need to be recalculated, supplemented by observation information , auxiliary information and fixed allocation matrix , calculate the free allocation matrix between the remaining keys and trapdoors by using the optimal linear solver based on the Hungarian algorithm ; The specific operation of step S1 is: S1-1, obtaining a known query , number of iterations , ratio of traps to release per iteration observation information and auxiliary information ; S1-2, from the initialization step, the attacker acquires the knowledge of the known queries from the auxiliary information and then eliminates the elements of the candidate keyword set trapdoor that have known pairings before the iteration begins.​ S1-3, fixing the position corresponding to the keyword-trap pair with known pairing relationship in the allocation matrix as 1; S1-4, using a linear solver, taking the screened candidate trap set, candidate keyword set, auxiliary information and observation information as input, obtaining an initial prediction relationship, that is, an initial allocation matrix; S1-5, at the beginning of each iteration, according to the parameters and the assignment matrix, randomly select some query traps to be fixed , the size of which is ; release the remaining candidate traps , then fix the candidate keywords corresponding to the query traps that have a pairing relationship with the query traps , and release the remaining candidate keywords corresponding to the candidate query traps ; the assignment matrix between the fixed query traps and the keywords that have a pairing relationship with them is ; S1-6, to , , , , , and as the input of the linear solver, recalculate the remaining candidate trapdoor and the pair relationship of the remaining candidate keyword , calculate the free allocation matrix between them ; S1-7, at the end of each iteration, the fixed allocation matrix and the re-computed free allocation matrix are combined to form a new allocation matrix for use in the next iteration.

2. The method of claim 1, wherein the statistical information based approach against iterative attacks on searchable symmetric encryption is used to defend against attacks, characterized in that, The specific operation mode of step S2 is: S2-1, given the side information and the allocation matrix, assuming the observation information is a deterministic model, the capacity matrix V is calculated from the observation information and the capacity matrix V is extracted from the side information and the capacity matrix V is extracted from the side information The maximum likelihood estimation of the allocation matrix is written as: （3） S2-2, for selecting the parameters c and d of the linear solver, assuming that the generation of the data set is independent, formula (3) is rewritten as: （4） S2-3, assuming a particular trapdoor , whose corresponding key is , is a binomial distribution of the likelihood of , Nd being the total number of documents in the dataset, for the off-diagonal elements , using the notation ; assuming that all elements in V are independent, and ignoring the summation with respect to the assignment matrix, we write ​ ， S2-4, according to the above formula, the parameters c and d of the linear solver are set as: ， S2-5, compute the remaining trap-door and key pairings using a linear solver based on the Hungarian algorithm and obtain the free allocation matrix between them .

Images