Formalizations of secrecy of encrypted databases against realistic attackers

Encrypted databases store data as ciphertexts. Encryption schemes with functionalities (such as deterministic and order-preserving schemes) are often used, in order to operate and compare the encrypted data directly. However, the secrecy of the data may decrease because information on plaintexts such as equivalence and order relationships are revealed from ciphertexts. In our previous study, we formalized secrecy against disclosure of ciphertexts in encrypted databases. The proposed secrecy is based on inference on databases: We simulate attacker's inference on specified secret information with and without the revealed information. When two inference results are the same, then secrecy of the specified information is regarded as preserved. However, this formalization does not capture how the secrecy decreases against realistic attackers, because computation power beyond probabilistic polynomial time is necessary for such inference. In this paper, we focus on the situation where a database instance is modeled as a sequence of tuples, rather than a set or a bag of tuples. Under this database model, we propose a formalization of the secrecy against realistic attackers with a probabilistic polynomial-time inference algorithm. The inference algorithm is derived naturally when the attackers infer on the encrypted databases with given information. Next, in order to make the formalization more general, we discuss secrecy against attackers who may use some auxiliary information depending on the database instance during inference. However, we prove that secrecy against such attackers cannot be achieved in the case where the entropy of the auxiliary information is not less than that of the sensitive information.