Leakage-abuse attacks against encrypted database systems exploit semantic leakage and pose a severe threat to the confidentiality of plaintext data and queries. To address this problem, we propose a zero-leakage encrypted database that rules out leakage-abuse attacks, which fundamentally rely on semantic leakage. We first distinguish between two kinds of zero-leakage security. Ideal zero-leakage forbids the disclosure of any information beyond public parameters, whereas restricted zero-leakage additionally permits the leakage of metadata (such as database size and query timing). We show that restricted zero-leakage is sufficient to thwart leakage-abuse attacks and is achievable in practice. We then formally define adaptive restricted zero-leakage security and present Aspire, an encrypted database that satisfies this notion. Aspire integrates probabilistic batch code and minimal perfect hashing to support efficient batch keyword queries and dynamic updates while revealing only non-semantic metadata. Experimental results demonstrate the practicality and efficiency of Aspire, showing that Aspire can achieve an amortized query latency of less than 1.38 ms (7.53 s for a batch of 5461 keyword queries), with an amortized communication cost of approximately 2.95 KB (16.1 MB in total), on a $2^{22}$ key-value pairs database.

翻译：暂无翻译