Encrypted search system design for email client-side encryption

1. A method comprising:

receiving, at data processing hardware of a user device associated with a user, a search query for a keyword, the keyword appearing in one or more encrypted emails within a corpus of encrypted emails stored on an untrusted storage device;

accessing, by the data processing hardware, a count table to obtain a count of unique emails within the corpus of encrypted emails that include the keyword;

generating, by the data processing hardware, a delegatable pseudorandom function (DPRF) based on the keyword, a private cryptographic key, and the count of unique emails that include the keyword; and

delegating, by the data processing hardware, at least a portion of the DPRF to the untrusted storage device, the delegated at least the portion of the DPRF when received by the untrusted storage device causing the untrusted storage device to:

evaluate the delegated at least the portion of the DPRF;

access an encrypted search index associated with the corpus of encrypted emails stored on the untrusted storage device;

determine one or more encrypted emails within the corpus of encrypted emails associated with the delegated at least the portion of the DPRF based on the encrypted search index; and

return, to the user device, an identifier for each encrypted email of at least a portion of the one or more encrypted emails associated with the delegated at least the portion of the DPRF.

2. The method of claim 1 , wherein:

the count table is encrypted with a second private cryptographic key available only to the user, and

the encrypted count table is stored on the untrusted storage device.

3. The method of claim 2 , wherein:

the encrypted count table comprises a plurality of buckets, each bucket storing one or more counts of unique emails within the corpus of encrypted emails that include a respective keyword, and

accessing the count table to obtain the count of unique emails within the corpus of encrypted emails that include the keyword comprises sending a bucket request indicating a specific bucket of the plurality of buckets to the untrusted storage device, the bucket request when received by the untrusted storage device causing the untrusted storage device to return, to the user device, each count stored within the specific bucket.

4. The method of claim 3 , wherein when the untrusted storage device returns each count stored within the specific bucket, the untrusted storage device also returns each count associated with one or more other buckets, the one or more other buckets dynamically associated with the specific bucket.

5. The method of claim 4 , wherein the untrusted storage device returns each count associated with the one or more other buckets dynamically associated with the specific bucket based on a total number of counts in the specific bucket.

6. The method of claim 2 , further comprising assigning, by the data processing hardware, each count to a respective bucket based on an output of a second DPRF.

7. The method of claim 1 , wherein accessing the count table to obtain the count of unique emails within the corpus of encrypted emails that include the keyword comprises downloading at least a portion of the count table from the untrusted storage device.

8. The method of claim 1 , further comprising, for each unique keyword of a new encrypted email uploaded by the user into the corpus of encrypted emails stored on the untrusted storage device:

determining, by the data processing hardware, whether to add a new keyword to the count table based on a probability, the new keyword not currently present in the count table;

when the data processing hardware determines to add the new keyword:

adding, by the data processing hardware, the new keyword and a new keyword count to the count table;

generating, by the data processing hardware, a unique keyword hash based on the private cryptographic key, the corresponding unique keyword, and the new keyword count;

generating, by the data processing hardware, a hash pair comprising the unique keyword hash and an encrypted email identifier associated with the new encrypted email uploaded by the user; and

sending, by the data processing hardware, the hash pair to the untrusted storage device.

9. The method of claim 8 , further comprising, when the data processing hardware determines to not add the new keyword:

generating, by the data processing hardware, a unique keyword hash based on the private cryptographic key, the corresponding unique keyword, and a random keyword count;

generating, by the data processing hardware, a hash pair comprising the unique keyword hash and an encrypted email identifier associated with the new encrypted email uploaded by the user; and

sending, by the data processing hardware, the hash pair to the untrusted storage device.

10. The method of claim 8 , wherein the probability is one in fifty that the new keyword is to be added to the count table.

11. A system comprising:

data processing hardware of a user device associated with a user; and

memory hardware in communication with the data processing hardware, the memory hardware storing instructions that when executed on the data processing

receiving a search query for a keyword, the keyword appearing in one or more encrypted emails within a corpus of encrypted emails stored on an untrusted storage device;

accessing a count table to obtain a count of unique emails within the corpus of encrypted emails that include the keyword;

generating a delegatable pseudorandom function (DPRF) based on the keyword, a private cryptographic key, and the count of unique emails that include the keyword, and

delegating at least a portion of the DPRF to the untrusted storage device, the delegated at least the portion of the DPRF when received by the untrusted storage device causing the untrusted storage device to:

evaluate the delegated at least the portion of the DPRF;

access an encrypted search index associated with the corpus of encrypted emails stored on the untrusted storage device;

determine one or more encrypted emails within the corpus of encrypted emails associated with the delegated at least the portion of the DPRF based on the encrypted search index; and

return, to the user device, an identifier for each encrypted email of at least a portion of the one or more encrypted emails associated with the delegated at least the portion of the DPRF.

12. The system of claim 1 , wherein;

the count table is encrypted with a second private cryptographic key available only to the user, and

the encrypted count table is stored on the untrusted storage device.

13. The system of claim 12 , wherein:

the encrypted count table comprises a plurality of buckets, each bucket storing one or more counts of unique emails within the corpus of encrypted emails that include a respective keyword, and

accessing the count table to obtain the count of unique emails within the corpus of encrypted emails that include the keyword comprises sending a bucket request indicating a specific bucket of the plurality of buckets to the untrusted storage device, the bucket request when received by the untrusted storage device causing the untrusted storage device to return, to the user device, each count stored within the specific bucket.

14. The system of claim 13 , wherein when the untrusted storage device returns each count stored within the specific bucket, the untrusted storage device also returns each count associated with one or more other buckets, the one or more other buckets dynamically associated with the specific bucket.

15. The system of claim 14 , wherein the untrusted storage device returns each count associated with the one or more other buckets dynamically associated with the specific bucket based on a total number of counts in the specific bucket.

16. The system of claim 12 , wherein the operations further comprise assigning each count to a respective bucket based on an output of a second DPRF.

17. The system of claim 11 , wherein accessing the count table to obtain the count of unique emails within the corpus of encrypted emails that include the keyword comprises downloading at least a portion of the count table from the untrusted storage device.

18. The system of claim 11 , wherein the operations further comprise, for each unique keyword of a new encrypted email uploaded by the user into the corpus of encrypted emails stored on the untrusted storage device;

determining whether to add a new keyword to the count table based on a probability, the new keyword not currently present in the count table,

when the data processing hardware determines to add the new keyword:

adding the new keyword and a new keyword count to the count table,

generating a unique keyword hash based on the private cryptographic key, the corresponding unique keyword, and the new keyword count;

generating a hash pair comprising the unique keyword hash and an encrypted email identifier associated with the new encrypted email uploaded by the user; and

sending the hash pair to the untrusted storage device.

19. The system of claim 18 , wherein the operations further comprise, when the data processing hardware determines to not add the new keyword:

generating a unique keyword hash based on the private cryptographic key, the corresponding unique keyword, and a random keyword count;

generating a hash pair comprising the unique keyword hash and an encrypted email identifier associated with the new encrypted email uploaded by the user; and

sending the hash pair to the untrusted storage device.

20. The system of claim 18 , wherein the probability is one in fifty that the new keyword is to be added to the count table.