SIAM Journal on Computing, Volume 50, Issue 5, Page 1501-1536, January 2021.
Searchable symmetric encryption (SSE) enables a client to store a database on an untrusted server while supporting keyword search in a secure manner. Despite the rapidly increasing interest in SSE technology, experiments indicate that the performance of the known schemes scales badly to large databases. Somewhat surprisingly, this is not due to their usage of cryptographic tools, but rather due to their poor locality (where locality is defined as the number of noncontiguous memory locations the server accesses with each query). The only known schemes that do not suffer from poor locality suffer either from an impractical space overhead or from an impractical read efficiency (where read efficiency is defined as the ratio between the number of bits the server reads with each query and the actual size of the answer). We construct the first SSE schemes that simultaneously enjoy optimal locality, optimal space overhead, and nearly optimal read efficiency. Specifically, for a database of size $N$, under the modest assumption that no keyword appears in more than $N^{1 - 1/\log \log N}$ documents, we construct a scheme with read efficiency $\tilde{O}(\log \log N)$. This essentially matches the lower bound of Cash and Tessaro (EUROCRYPT '14) showing that any SSE scheme must be suboptimal in either its locality, its space overhead, or its read efficiency. In addition, even without making any assumptions on the structure of the database, we construct a scheme with read efficiency $\tilde{O}(\log N)$. Our schemes are obtained via a two-dimensional generalization of the classic balanced allocations (``balls and bins'') problem that we put forward. We construct nearly optimal two-dimensional balanced allocation schemes, and then combine their algorithmic structure with subtle cryptographic techniques.

中文翻译：

---

可搜索对称加密：通过二维平衡分配的线性空间中的最优局部性

SIAM Journal on Computing，第 50 卷，第 5 期，第 1501-1536 页，2021 年 1 月。
可搜索对称加密 (SSE) 使客户端能够将数据库存储在不受信任的服务器上，同时以安全的方式支持关键字搜索。尽管对 SSE 技术的兴趣迅速增加，但实验表明，已知方案的性能无法很好地扩展到大型数据库。有点令人惊讶的是，这不是因为他们使用了加密工具，而是因为他们的局部性很差（其中局部性定义为服务器在每次查询时访问的非连续内存位置的数量）。唯一已知的不受不良局部性影响的方案要么存在不切实际的空间开销，要么存在不切实际的读取效率（其中读取效率定义为服务器每次查询读取的位数与实际大小之间的比率）回答）。我们构建了第一个同时享有最佳局部性、最佳空间开销和接近最佳读取效率的 SSE 方案。具体来说，对于大小为 $N$ 的数据库，在没有关键字出现在超过 $N^{1 - 1/\log \log N}$ 个文档中的适度假设下，我们构建了一个读取效率为 $\tilde{ O}(\log \log N)$。这基本上与 Cash and Tessaro (EUROCRYPT '14) 的下限相匹配，表明任何 SSE 方案在其位置、空间开销或读取效率方面都必须是次优的。另外，即使不对数据库的结构做任何假设，我们也构建了一个读效率为$\tilde{O}(\log N)$的方案。我们的方案是通过我们提出的经典平衡分配（“球和箱”）问题的二维概括获得的。