High Recovery with Fewer Injections: Practical Binary Volumetric Injection Attacks against Dynamic Searchable Encryption

TL;DR

This paper introduces two new binary volumetric injection attacks, BVA and BVMA, that efficiently recover keywords from dynamic searchable encryption with fewer injections, outperforming existing methods in real-world datasets.

Contribution

The paper presents novel binary volumetric injection attacks that require fewer injections and effectively bypass existing defenses in dynamic searchable encryption.

Findings

Achieve over 80% keyword recovery in optimal cases

Recover roughly 60% of keywords with fewer than 20 injections

Effectively bypasses defenses like threshold countermeasure and static padding

Abstract

Searchable symmetric encryption enables private queries over an encrypted database, but it also yields information leakages. Adversaries can exploit these leakages to launch injection attacks (Zhang et al., USENIX'16) to recover the underlying keywords from queries. The performance of the existing injection attacks is strongly dependent on the amount of leaked information or injection. In this work, we propose two new injection attacks, namely BVA and BVMA, by leveraging a binary volumetric approach. We enable adversaries to inject fewer files than the existing volumetric attacks by using the known keywords and reveal the queries by observing the volume of the query results. Our attacks can thwart well-studied defenses (e.g., threshold countermeasure, static padding) without exploiting the distribution of target queries and client databases. We evaluate the proposed attacks empirically in real-world datasets with practical queries. The results show that our attacks can obtain a high recovery rate (>80%) in the best case and a roughly 60% recovery even under a large-scale dataset with a small number of injections (<20 files).