SecGraph: Towards SGX-based Efficient and Confidentiality-Preserving Graph Search

TL;DR

SecGraph addresses secure, efficient graph search on dynamically updated, outsourced graphs by leveraging SGX to proxy-token generation, a compact LDCF-encoded XSet to replace expensive exponentiations, and a dynamic Twin-TSet to support updates. The design yields one-roundtrip search communication, sub-linear membership checks within SGX, and dynamic graph support with formal leakage and security proofs. Optimizations SecGraph-G, SecGraph-P, and SecGraph-A further boost throughput by reducing sub-filter loads and enabling parallel checks, with experimental results showing up to 208x faster search and up to 540x lower communication than the prior state-of-the-art PeGraph. The work demonstrates practical, confidentiality-preserving graph search over dynamic graphs and provides a foundation for extending to broader query types in outsourced graph services.

Abstract

Graphs have more expressive power and are widely researched in various search demand scenarios, compared with traditional relational and XML models. Today, many graph search services have been deployed on a third-party server, which can alleviate users from the burdens of maintaining large-scale graphs and huge computation costs. Nevertheless, outsourcing graph search services to the third-party server may invade users' privacy. PeGraph was recently proposed to achieve the encrypted search over the social graph. The main idea of PeGraph is to maintain two data structures XSet and TSet motivated by the OXT technology to support encrypted conductive search. However, PeGraph still has some limitations. First, PeGraph suffers from high communication and computation costs in search operations. Second, PeGraph cannot support encrypted search over dynamic graphs. In this paper, we propose an SGX-based efficient and confidentiality-preserving graph search scheme SecGraph that can support insertion and deletion operations. We first design a new proxy-token generation method to reduce the communication cost. Then, we design an LDCF-encoded XSet based on the Logarithmic Dynamic Cuckoo Filter to reduce the computation cost. Finally, we design a new dynamic version of TSet named Twin-TSet to enable encrypted search over dynamic graphs. We have demonstrated the confidentiality preservation property of SecGraph through rigorous security analysis. Experiment results show that SecGraph yields up to 208x improvement in search time compared with PeGraph and the communication cost in PeGraph is up to 540x larger than that in SecGraph.

Figures (7)

• Figure 1: Illustration of the data structure LDCF and three associated operations.
• Figure 2: A toy example for illustrating a social graph.
• Figure 3: Insertion performance in distinct datasets.
• Figure 4: Search performance in distinct datasets.
• Figure 5: Enclave storage cost in distinct datasets.

Theorems & Definitions (3)

• Definition 1
• theorem thmcountertheorem
• proof