Structural Leakage in Graph Encryption: Attacks and Defenses

Abstract: Graph encryption schemes (GES) enable secure outsourcing of graph data while supporting efficient queries. This report provides a comprehensive analysis of structural leakage in GES for single-pair shortest path (SPSP) queries, integrating findings from two recent works. First, we analyze PathGES, a scheme designed to resist query recovery attacks through heavy-light decomposition (HLD) and canonical fragment encoding. Our analysis reveals that PathGES suffers from significant imbalances in HLD decomposition, with over 99% of token-path mappings being one-to-one on real-world datasets, enabling both the Falzon-Paterson attack and side-channel inference of path lengths. Second, we present Fragment Tree attack that exploits these structural weaknesses to recover query contents, achieving up to 10.24% exact recovery on sparse graphs. Third, we introduce BlindGES, an enhanced scheme incorporating a Merge-and-Divide mechanism and two-level multimap index that reduces one-to-one mappings to below 20%, cuts setup time by 50%, reduces storage overhead by 32%, and limits path length leakage to under 1%. This report systematically presents attack methodologies, defense mechanisms, security proofs, and experimental evaluations on seven real-world datasets.

• The paper demonstrates that PathGES remains vulnerable because over 99% of its fragments map one-to-one to paths, enabling up to 10.24% exact query recovery and path-length inference for at least 84% of queries.
• The Fragment Tree attack reconstructs query structure through fragment-tree and query-tree isomorphism, but its effectiveness varies with graph density and often requires plaintext graph knowledge or auxiliary side information.
• The paper introduces BlindGES, which uses Merge-and-Divide segmentation to reduce one-to-one mappings below 20%, cut storage to 66.6 GB from 97.99 GB, halve setup time, and lower path-length inference below 1%.

Background and Motivation

Graph encryption schemes (GES) built on structured encryption (STE) allow clients to outsource graph data to an untrusted server while supporting sublinear-time queries. For single-pair shortest path (SPSP) queries, the line of work began with GKT (Ghosh–Kamara–Tamassia), which stores a shortest-path matrix as a dictionary of tokens and ciphertexts (2608.13981). GKT's central weakness is a strict one-to-one mapping between tokens and paths: during a query, the server observes every token along the traversed path together with their concatenation relationships. Falzon and Paterson exploited this via canonical names and path names computed over SDSP trees, recovering up to 21.9% of query plaintexts on Gnutella datasets and reducing roughly 50% of queries to at most three candidates.

PathGES (Falzon et al., CCS 2024) was proposed specifically to defeat this attack by combining heavy-light decomposition (HLD) of SDSP trees with canonical segment encoding—padding fragments to power-of-two lengths so that one token may map to multiple paths—and a two-level multimap index ($M_1$ encrypted with EMM-RR, $M_2$ with EMM-RH). The paper under review delivers two complementary contributions: BreakingGES, a Fragment Tree attack demonstrating that PathGES's defenses fail in practice, and BlindGES, a redesigned scheme that removes the structural leakage while improving efficiency.

Structural Weaknesses of PathGES

The paper's core empirical finding is that PathGES's defense mechanism is largely inert on real-world graphs. HLD produces heavily imbalanced decompositions: across seven datasets spanning densities from 0.0002 to 0.995, over 98% of decomposed fragments have length 1 or 2, and over 99% have length 1, 2, or 3 (e.g., 99.99% on facebook-combined, 99.88% on p2p-Gnutella08). Since fragments of length $2^0$, $2^1$, and $2^2$ are already canonical segments, at least 99% of tokens map to exactly one path fragment—the very property PathGES was designed to eliminate. The consequence is that shortest paths composed entirely of short segments have their total length directly exposed.

Two additional leakage channels compound this problem:

• Side-channel leakage via EMM-RH volume: because canonical fragments have power-of-two lengths, ciphertext sizes exhibit regularity. An adversary can calibrate against the smallest observed ciphertext (corresponding to length-1 paths) and infer path lengths from response sizes. Experiments show that for at least 84% of 100,000 random queries, the response satisfies $S = 65 \cdot L$, directly exposing the shortest path length. This leakage is not captured by PathGES's declared leakage function $\mathcal{L}^{PathGES}_Q$.
• Subpath structure leakage: canonical fragments embed nested sub-paths, so retrieving $M_1$ for one query reveals shortest-path information about other vertex pairs sharing the same long token.

The implication is direct: PathGES fails its stated design goal of resisting query recovery, and its security claim holds only against an idealized adversary model that ignores these channels.

The Fragment Tree Attack

The attack operates under an honest-but-curious server model with knowledge of the plaintext graph—the same assumptions used in prior work—and proceeds in three stages.

Fragment tree construction. From each SDSP tree $T_r$, the server runs HLD to obtain disjoint fragments, then preprocesses long fragments into sub-fragments of lengths $1, 2, 4, \ldots$ sharing the same endpoint. Fragments become nodes; directed edges encode concatenation relations ($M_2$0), rooted at the fragment containing the destination.

Query tree construction. Because $M_2$1 uses response-revealing EMM-RR, the server reconstructs it fully after observing enough queries. A bucket-based multi-round local sorting algorithm orders token sets by size ($M_2$2), exploiting the invariant that each location in $M_2$3 contains exactly one more token than locations in $M_2$4. Query trees are then generated layer-by-layer, with edges connecting each token to its immediate predecessor.

Isomorphism-based matching. The theoretical core is a proof that fragment trees and query trees are isomorphic when their path names coincide: Lemma 5.1 establishes fragment-to-fragment correspondence under isomorphism, Theorem 5.3 characterizes isomorphism via perfect subtree matching, and Theorem 5.2 shows that equality of path names is both necessary and sufficient for isomorphism. Matching tokens to fragments by path name yields query recovery; structurally indistinguishable subtrees yield small candidate sets instead.

Empirically, the attack achieves up to 10.24% exact query recovery on p2p-Gnutella04 (12.1M of 118M queries), 9.50% on p2p-Gnutella08, and 8.81% on p2p-Gnutella25—roughly 30–50% of the effectiveness the Falzon–Paterson attack achieves against undefended GKT on four datasets. An additional ~10% of queries are narrowed to 2–5 candidates. Performance degrades sharply on dense graphs: only 0.048% exact recovery on Ca-GrQc (density 0.995), where homogeneous topology makes path names nearly identical. This density dependence is a genuine limitation: sparse graphs are precisely where the attack succeeds, and approximate recovery often requires external side information (e.g., known sources or popular destinations) to be converted into exact recovery.

BlindGES Defense

BlindGES addresses the root causes identified above through a Merge-and-Divide mechanism. Length-1 fragments in each $M_2$5 are merged into composite paths using a dummy vertex '$M_2$6', after which merged and non-merged paths are divided into fixed-length segments of sizes $M_2$7 and $M_2$8 respectively (with overlap between consecutive non-merged segments to preserve connectivity, and padding with dummy vertex '$M_2$9'). Segments populate $2^0$0; $2^0$1 maps SPSP query tokens to the segment tokens needed for reconstruction, with entries shuffled. Crucially, the segments stored per $2^0$2 entry need not concatenate into a contiguous path, eliminating the redundant-path leakage of PathGES.

Security is formalized in the real/ideal paradigm: setup leakage is $2^0$3, and query leakage reduces to a query pattern matrix $2^0$4 plus a bipartite structure pattern $2^0$5 over $2^0$6 labels and encrypted segments. A hybrid argument over six games, invoking the simulators of the underlying EMM-RR and EMM-RH primitives, proves adaptive $2^0$7-security. Because all stored fragments have exactly two possible lengths, the volume side channel is closed: fewer than 1% of queries admit path-length inference, versus at least 84% for PathGES.

Performance results favor BlindGES decisively. With $2^0$8, $2^0$9:

Metric	PathGES	BlindGES
One-to-one mappings	>99%	<20%
Setup time (p2p-Gnutella04)	143.7 min	73.9 min
Encrypted storage (p2p-Gnutella04)	97.99 GB	66.6 GB
Path-length inference	≥84% of queries	<1%
Query response time	~0.8 ms	≤0.4 ms

On the three largest datasets, setup time is halved and encrypted database size drops to 59–67% of PathGES, attributable to removal of duplicate canonical fragments. Query and reveal times remain at millisecond level.

Limitations and Open Questions

Both contributions carry stated constraints. The Fragment Tree attack requires full knowledge of the plaintext graph and unrestricted observation of query tokens; its effectiveness collapses on dense graphs (0.048% on Ca-GrQc) due to path-name homogeneity, and approximate recovery frequently depends on auxiliary side information. BlindGES requires manual selection of $2^1$0 and $2^1$1, which may be suboptimal across graph types; its setup phase still costs ~74 minutes on p2p-Gnutella04; and its security proof inherits any weaknesses in the underlying EMM-RR/EMM-RH primitives. Both schemes assume static graphs, leaving dynamic updates unaddressed. Open questions include adaptive parameter tuning based on graph structure, decomposition methods beyond HLD for networks where heavy edges are scarce, integration of differential privacy for formal side-channel guarantees, and whether the isomorphism-based attack generalizes to other structured encryption schemes.

Conclusion

This paper demonstrates that the structural leakage motivating PathGES's design persists almost undiminished in practice: HLD imbalance leaves over 99% of token-path mappings one-to-one, enabling a provably grounded isomorphism-based query recovery attack (up to 10.24% exact recovery on sparse graphs) and pervasive path-length inference (≥84% of queries). The proposed BlindGES scheme closes these channels through Merge-and-Divide segmentation and a shuffled two-level index, simultaneously improving security and reducing setup cost and storage relative to PathGES. The combined result establishes that leakage-abuse resistance in graph encryption must be evaluated against the actual distribution of decomposed structures on real-world graphs, not merely against worst-case token-mapping arguments.