Attribute-based Keyword Search Research Articles

TRA-PS: Accountable data Pub/Sub service with fast and fine-grained controllable subscription

The Cloud-based data publish/subscribe (Pub/Sub) service presents a selective manner for publishers and subscribers to share and receive data, where confidentiality and authorized access to the data are the fundamental security properties. Therefore, the methodology of attribute-based keyword search (ABKS) was applied that recently considered bilateral access control between the publisher and subscriber. However, existing data Pub/Sub solutions fail to take into account the following features: (i) the efficient revocation of subscribers; (ii) the traceability and auditability of subscriptions; (iii) the excessive time cost of decryption procedure. Therefore, we propose TRA-PS, an accountable data Pub/Sub service that implements efficient revocation, traceability, and public auditability for subscriptions. Technically, we refine the secret key of subscriber in the classic ABKS schemes with associating its identity information and binding accountability module. In addition, we implement TRA-PS and evaluate its practical performance compared to state-of-the-art work in the real cloud environment. Besides achieving accountable property, TRA-PS significantly diminishes the decryption time cost (number of attributes/keywords is 25) by 91.8%, independent of the number of attributes/keywords.

Multi-Authority Attribute Based Keyword Search Over Encrypted Cloud Data

To guarantee data security and usability in the cloud simultaneously, Searchable Encryption (SE) is an important technique. Using Ciphertext-Policy Attribute-Based Encryption (CP-ABE), the Ciphertext-Policy Attribute-Based Keyword Search (CP-ABKS) scheme can achieve keyword-based retrieval and fine-grained access control at a time. However, the single attribute authority in existing CP-ABKS schemes is done with costly user certificate verification and secret key distribution. In addition, this results in a single-point performance bottleneck in distributed cloud systems. Thus, in this paper, we present a secure Multi-authority CP-ABKS (MABKS) system to address such limitations and minimize the computation and storage burden on resource-limited devices in cloud systems. In addition, the MABKS system is extended to support malicious attribute authority tracing and attribute update. Our meticulous security analysis shows that the MABKS system is selectively secure in both selective-matrix and selective-attribute models. Our experimental results using real-world datasets demonstrate the efficiency and utility of the MABKS system in practical applications. Keywords: Searchable encryption, attribute-based encryption, multi-authority, access control, selective-matrix model, selective-attribute model.

An improved finegrained ciphertext policy based temporary keyword search on encrypted data for secure cloud storage

We present a temporary keyword search over sensitive and confidential health data in a cloud environment. The cloud constitutes a semi-trusted domain, making it necessary for data owners to secure their data before outsourcing it through techniques like encryption. Attribute-based keyword search techniques tend to perform a search operation using a search token generated by an authorized user. These search tokens can lead to serious privacy threats, as they can extract all ciphertexts that may have been generated along with their keyword. Therefore, restricting search tokens to extract ciphertexts generated within a time interval is a more promising solution. In this paper, we present a novel ciphertext policy fine-grained temporary keyword that prevents the misuse of these search tokens. Further, it mitigates the risk of insider threats within healthcare organizations by limiting the window of opportunity for unauthorized access to minimum. To assess the security, our proposed scheme is formally proven to be secure against Selectively Chosen Keyword Attacks in the generic bilinear group model. Additionally, we demonstrate that the encryption algorithm’s complexity is linear in relation to the number of attributes. Our scheme’s significance and practicality are revealed by the performance evaluation.

An efficient multi-data owner cooperative resource sharing scheme against key regeneration in edge computing

In cloud storage, attribute-based keyword searchable encryption realizes multi-user fine-grained authorization access control and outsourcing data sharing. However, (1) resisting key regeneration is an urgent problem to be solved in practical applications of attribute-based keyword search; (2) the general attribute-based keyword search scheme ignores the application scenario where multiple data owners jointly manage files. In addition, the interaction of data between intelligent terminals and cloud servers has become more frequent, leading to issues such as central load, transmission efficiency, and data privacy protection in cloud computing. To address the above issues, we propose an attribute-based searchable encryption scheme with the multi-data owner based on edge computing. In this scheme, the Pedersen (k,n) secret sharing protocol and the Reciprocal protocol are used to realize the common management and sharing of data by the multi-data owner to enhance data security. Secondly, the attribute set and identity information of each user are embedded into the private key to prevent key regeneration and resist user collusion attacks. Thirdly, edge computing is introduced, and part of the storage and decryption work is outsourced to edge nodes to reduce the computing load of users and data transmission bandwidth. Security proof and performance analysis show that the proposed scheme has strong security and practicability in multi-user sharing scenarios such as Online Education with multi-data owners.

Multi-Client Boolean File Retrieval With Adaptable Authorization Switching for Secure Cloud Search Services

Secure cloud search services provide a cost-effective way for resource-constrained clients to search encrypted files in the cloud, where data owners can customize search authorization. Despite providing fine-grained authorization, traditional attribute-based keyword search (ABKS) solutions generally support single keyword search. Towards expressive queries over encrypted data, multi-client searchable symmetric encryption (MC-SSE) was introduced. However, current search authorizations of existing MC-SSEs:(i) cannot support dynamic updating; (ii) are (semi-)black-box implementations of attribute-based encryption; (iii) incur significant cost during system initialization and file encryption. To address these limitations, we present AasBirch, an MC-SSE system with fast fine-grained authorization that supports adaptable authorization switching from one policy to any other one. AasBirch achieves constant-size storage and lightweight time cost for system initialization, file encryption and file searching. We conduct extensive experiments based on Enron dataset in real cloud environment. Compared to state-of-the-art MC-SSE with fine-grained authorization, AasBirch achieves 30∼200× smaller public parameter and secret key size, with the assumed least frequent keyword in a query ( <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">s</i> -term) as 21. Moreover, it runs 10∼20× faster for file encryption and >20× faster for file searching. In addition, AasBirch outperforms 80,000× (resp. 7,850×) faster with <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">s</i> -term = 1 (resp. = 21), as compared to classic dynamic ABKS system.

MKSS: An Effective Multi-authority Keyword Search Scheme for edge–cloud collaboration

The rapid development of cloud computing motivates Internet of Things users to outsource their data to enjoy value-added cloud services: data storage, data sharing, etc. To provide reliable but searchable results, searchable encryption (e.g., Ciphertext-Policy Attribute-Based Keyword Search (CP-ABKS)) become an area of active research. One major drawback of existing CP-ABKS designs lies in the private key being generated and distributed by a trusted Central Authority (CA), which is a single point of failure/attack. Another limitation is that the cloud server may return forged or incomplete query results to the data user. This paper proposes a novel Multi-authority Keyword Search Scheme for edge–cloud collaboration (MKSS). To protect the security of the private key, we design a private key generation algorithm based on secure multi-party computation. To preserve the integrity of search results, we construct an efficient verification algorithm that detects forged or incomplete results. We evaluate the security and performance of our protocol using real-world datasets to demonstrate robustness and efficiency. Our construction advances the existing body of research towards secure and efficient keyword search protocols in cloud systems.

Fast and Privacy-Preserving Attribute-Based Keyword Search in Cloud Document Services

Currently, various encryption techniques have been employed to protect the documents in cloud storage. In particular, attribute-based keyword search (ABKS) is a practical encryption primitive that can realize fine-grained access control and keyword based searching over encrypted documents. However, the search time in most of the existing ABKS schemes increases linearly with the size of document collection, which hinders the wide application of ABKS in cloud computing. To this end, we propose FAKS, a fast and privacy-preserving attribute-based keyword search system for cloud document services. Specifically, FAKS builds a Bloom filter tree structure from the document collection, which avoids matching keywords by traversing the entire collection. Then we introduce an attribute-based authenticated index retrieval (ABAIR) scheme to encrypt the Bloom filters in the tree node and retrieve the documents with the encrypted Bloom filters of the query keywords. Further, we give a concrete construction of FAKS from ABAIR to execute the keyword matching operations sublinearly in a top-down manner, and prove the security of FAKS against chosen keyword attack and keyword guessing attack. Finally, we conduct extensive experiments over the Wikipedia dataset, which show better and more stable search efficiency of FAKS compared to existing schemes.

Privacy Protection Data Retrieval Scheme With Inverted Index for IoT Based on Blockchain

In the 6G era, Internet of things (IoT) devices can form a blockchain network, which also faces the problems of data sharing. And the data transmitted and stored through the network has the risk of privacy leaking. Encrypting the shared data can satisfy the need of the privacy, and retrieving the encrypted data can make the data used efficiently.However, to enable users to retrieve encrypted data and perform fine-grained authorization on their encrypted files is still a great challenge. Although attribute-based keyword search (ABKS) is a well-received solution to the challenge, there are still privacy and efficiency issues if the traditional ABKS schemes are directly used in blockchain data sharing. In order to solve the problems, this paper proposes privacy protection data retrieval scheme with an inverted index which is an application of attribute-based encryption. Firstly, our scheme is proved secure against the outside keyword guessing attack (KGA) and chosen keyword attack (CKA) under semi-trusted model. Secondly, the scheme returns a multi-keywords ranked result. Thirdly, we analyze the efficiency of our scheme, and verify it by simulation.The results show that our scheme has improvement in efficiency and can meet the data sharing needs of the blockchain network composed of IoT devices.

Practical and Dynamic Attribute-Based Keyword Search Supporting Numeric Comparisons Over Encrypted Cloud Data

The attribute-based keyword search (ABKS), which simultaneously achieves searching and fine-grained access control over encrypted data, is frequently applied in cloud computing environments characterized by data storage and sharing. Recently, inspired by attribute-based encryption (ABE) and searchable encryption (SE) primitives, several ABKS schemes have been presented. However, almost all existing ABKS schemes actually only provide an attribute-based keyword equality match function and do not have a structural index to support practical search efficiency and dynamic data updates in real-world applications. To the best of our knowledge, this study is the first to realize an attribute-based keyword search construction supporting numerical comparison expressions with the practical search efficient and dynamic data update capacity (ABKS-NICEST), based on our proposed attribute-based keyword secure search scheme supporting numerical comparison expressions (ABKS-NICE) and an <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">exclusive OR-chain</i> -based inverted index structure. To the best of our knowledge, ABKS-NICEST is the first attributed-based keyword search scheme with practical search efficiency and dynamic data update capacity. In addition, numerical values are an important and common attribute, so providing comparison expressions among numerical values can greatly enhance the expressivity of access policy. Therefore, we use the prefix membership verification technique to design a method to support any numeric comparison expression in a flexible and uniform manner. Through theoretical and experimental evaluations, we determine that ABKS-NICEST is the most efficient ABKS scheme.

Verifiable attribute-based keyword search scheme over encrypted data for personal health records in cloud

Personal health record (PHR) is a medical model in which patients can upload their medical records and define the access control by themselves. Since the limited local storage and the development of cloud computing, many PHR services have been outsourced to the cloud. In order to ensure the privacy of electronic medical records, patients intend to encrypt their health records before uploading them. However, encrypted PHR can not be accessed directly and not be retrieved by legitimate users. To solve these issues, in this article we propose a new searchable encryption scheme with ciphertext-policy attributes, which achieves fine-grained access control and exact keyword search over encrypted PHRs. Moreover, in our proposed scheme, the receiver can verify the integrity of the search result that the cloud server returns. Finally, we simulate our scheme, and the experiments show that our scheme has high practicability for cloud-based healthcare systems and has high efficiency in aspects of keyword search and results verification.

An Attribute-Based Keyword Search Scheme for Multiple Data Owners in Cloud-Assisted Industrial Internet of Things

The cloud-assisted industrial Internet of Things (IIoT) architecture can sustain highly available computation and massive storage services for modern industrial systems. When data owners store IIoT data to remote cloud platforms, the data security will face tough challenges. Cryptographic technologies endow an ability to guarantee data confidentiality. However, traditional encryption techniques make data access control and data searching malfunctioning. Recently emerging attribute-based keyword search (ABKS) primitive achieves fine-grained access control and effective data searching over ciphertexts. However, existing ABKS schemes only consider single data owner scenarios and may be an inappropriate choice for IIoT applications, where there exists multiple data owners for an integrated industrial system. Directly extending state-of-the-art single owner schemes to ones for multiowner environment will impose a complicated key management issue. We present an ABKS scheme for multiowners in the cloud-assisted IIoT architecture. By designing a novel master key generation and private key aggregation mechanism with desired communication overheads, our scheme eliminates the complex key management issue in the multiowner model. Formal security proof demonstrates that our scheme is secure against the cloud server. Experimental evaluations also demonstrate its correctness and practicality.

Attribute-Based Expressive and Ranked Keyword Search Over Encrypted Documents in Cloud Computing

Attribute-based keyword search (ABKS) has been proposed to realize fine-grained access control and provide search service in cloud computing. However, most ABKS schemes focus on single or conjunctive keyword search, while the recent Boolean keyword search schemes only support monotonic query formula mainly involving AND, OR and threshold operators. How to support more expressive Boolean query formulas and return the corresponding accurate search results to users have become challenges for practical ABKS over ciphertexts. In this paper, we introduce an attribute-based expressive and ranked keyword search scheme over encrypted documents named ABERKS, which allows authorized users to submit expressive Boolean query formulas involving AND, OR, NOT and threshold operators. ABERKS utilizes a non-monotonic access tree structure to construct the query formula, and further leverages extended Boolean model to rank the search results. Specifically, the users are able to define the weights in the query formula, and get the relevance score of each matched ciphertext if the attributes and keywords are both satisfied. We prove the security of ABERKS against chosen keyword attack under selective ciphertext policy model and against keyword guessing attack, and also conduct extensive experiments to show the efficiency and practicality of ABERKS.

Lightweight Fine-Grained Multiowner Search over Encrypted Data in Cloud-Edge Computing

Edge computing, as an extension of cloud computing, outsources encrypted sensitive data to edge nodes to decrease latency and improve broadband efficiency. Although attribute-based keyword search (ABKS) can ensure the security of outsourced data and promote fine-grained access control of data, deficiencies still exist under the general ABKS scheme in the cloud, as follows: shared files owned by a single data owner, inflexible access control, key escrow problem, and high computational overhead. We propose an attribute-based multidata owner searchable encryption scheme in cloud-edge computing with effective policy update to address these problems. The two-level access control is used to realize the common management and fine-grained sharing of data by the multidata owner. All user keys are jointly generated by the central authority and attribute authority, and a key escrow is no longer required. Moreover, partial encryption and decryption calculations are shifted from resource-constrained data owners and users to edge nodes. Furthermore, our scheme not only supports policy update but also realizes the dynamic updating of the index. The security proof and performance analysis show that the scheme has strong security and practicality in the edge computing environment.

Privacy-Protecting Attribute-Based Conjunctive Keyword Search Scheme in Cloud Storage

&lt;p&gt;Cloud storage has been deployed in various real-world applications. But how to enable Internet users to search over encrypted data and to enable data owners to perform fine-grained search authorization are of huge challenge. Attribute-based keyword search (ABKS) is a well-studied solution to the challenge, but there are some drawbacks that prevent its practical adoption in cloud storage context. First, the access policy in the index and the attribute set in the trapdoor are both in plaintext, they are likely to reveal the privacy of data owners and users. Second, the current ABKS schemes cannot provide multi-keyword search under the premise of ensuring security and efficiency. We explore an efficient way to connect the inner product encryption with the access control mechanism and search process in ABKS, and propose a privacy-protecting attribute-based conjunctive keyword search scheme. The proposed scheme provides conjunctive keyword search and ensures that the access policy and attribute set are both fully hidden. Formal security models are defined and the scheme is proved IND-CKA, IND-OKGA, access policy hiding and attribute set hiding. Finally, empirical simulations are carried out on real-world dataset, and the results demonstrate that our design outperforms other existing schemes in security and efficiency.&lt;/p&gt; &lt;p&gt;&amp;nbsp;&lt;/p&gt;

Multi-Keyword Searchable and Verifiable Attribute-Based Encryption Over Cloud Data

In cloud data sharing systems, Searchable Encryption (SE) schemes ensure data confidentiality with retrieving, but it faces several issues in practice. First, most of the previous Ciphertext-Policy Attribute-Based Keyword Search (CP-ABKS) systems enable users to initiate search requests with a single keyword, which results in many inaccurate results to be returned, thereby wasting computing and bandwidth resources. Second, untrusted cloud servers may return a small portion of incomplete search results to compress communication overhead. Besides, most CP-ABKS schemes only support an unshared multi-owner setting, which incurs a large amount of computational and storage overhead. Furthermore, when the keyword space is a polynomial, most of the previous schemes suffer from offline keyword guessing attacks. To address these issues, we focus on a multi-keyword search scheme which supports the verification of search results without losing efficiency by combining Ciphertext Policy Attribute-Based Encryption (CP-ABE) technology under the shared multi-owner mechanism. We show the security of our scheme, which achieves selective security against offline keyword guessing attacks and guarantees the unforgeability of signatures. The comparison of experimental results illustrates that our scheme is effective and enjoys superior functionalities than the most relevant solutions.

Online/Offline Attribute-Based Boolean Keyword Search For Internet Of Things

Abstract With the rapid development of Internet of Things (IoT) and cloud computing, a large amount of IoT data has been stored and shared in cloud servers. However, sensitive IoT data may be leaked by untrusted cloud servers, which is a key problem hindering the development of IoT-cloud systems. To solve this problem, searchable encryption has been presented, which enables IoT devices to encrypt the collected data before uploading them to the cloud and make retrievals over the encrypted data by keyword queries. In this paper, we will study attribute-based keyword search (ABKS), which relieves us from cumbersome key management and provides a fine-grained access control. However, since the existing ABKS schemes are all constructed by bilinear pairings, which incurs high computational costs, they are not suitable for resource-constrained IoT devices. In this article, we propose an online/offline attribute-based boolean keyword search scheme, which can significantly reduce the online computing costs of IoT devices. In addition, our scheme can support boolean keyword search for data users, which has more flexible keyword expressivity than the existing online/offline ABKS schemes. We simulate our scheme and the experimental results show that it is both efficient and practical for the real IoT-cloud systems.

Traceable and revocable multi-authority attribute-based keyword search for cloud storage

Ciphertext-Policy Attribute-Based Keyword Search (CP-ABKS) provides data privacy and achieves fine-grained access control over encrypted data in the cloud. However, authorized users may misuse the secret key for financial benefits in a multi-user scenario. Thus, tracing those malicious users and revoking them from the system is essential. Alongside this, most existing schemes have only a single authority to generate the secret key, which may lead to misuse of the secret key. To address these problems, this paper proposes a traceable and revocable multi-authority attribute-based keyword search in the cloud. The scheme involves two authorities generating the user secret key to restrict any individual authority’s unauthorized access to cloud data. The scheme also traces malicious users and revokes them from the system. Further, we prove that the scheme is secure against chosen keyword attacks, chosen plaintext attacks, and traceability. And also verify the security against malicious authorities. The performance analysis shows that the proposed scheme is efficient in computation cost compared to the state-of-the-art schemes.

Attribute-based keyword search across encrypted cloud data with multiple authorities

Searchable Encryption (SE) is a crucial technique for cloud data security and usability (SE). When employing Ciphertext Policy Attribute-Based Encryption (CP-ABE) and the Ciphertext Policy Attribute-Based Keyword Search (CP-ABKS), encryption and access control may be done simultaneously. A single attribute authority is responsible for authenticating user certificates and delivering secret keys in current CP-ABKS systems. A single point of failure results in distributed cloud systems. To address these difficulties, we explain in this paper the MABKS system, which is designed to help cloud devices with limited computing and storage capabilities. The MABKS system has added capability for tracing and modifying malicious attribute authority. According to our detailed security investigation, the MABKS system is safe in both selective-matrix and selective-attribute models. Our trials using real-world datasets have shown the MABKS system's efficiency and usefulness.

Decryptable Attribute-Based Keyword Search on E-Health Cloud

Cloud computing provides lot of benefits to enterprises to offload their data and software services to cloud saving them lot of money that has to be spent on infrastructure setup cost. Enterprises wanted to offload their data to cloud and save on their infrastructure cost. But when offloading the data security and privacy is a important concern. In this work, we focus on the search on encrypted data and provide a effective solution for the search. Searchable symmetric encryption (SSE) allows retrieval of the encrypted data over cloud. We formulate the privacy issue from the aspect of similarity relevance and scheme robustness. We observe that serve-side ranking based on order-preserving encryption (OPE) inevitably leaks data privacy. To eliminate the leakage, we propose a secure-channel free ciphertext-policy decryptable attribute-based keyword search (CP-DABKS) scheme on eHealth cloud in the Internet of Things (IoT) platform. Additionally in CP-DABKS, we employ a vector space model and homomorphic encryption. The vector space model helps to provide sufficient search accuracy, and the homomorphic encryption enables users to involve in the ranking while the majority of computing work is done on the server side by operations only on ciphertext.

Multiauthority Attribute-Based Keyword Search over Cloud-Edge-End Collaboration in IoV

The development of cloud computing and edge computing makes it possible to store and share Internet of Vehicles (IoV) data on a large scale, which greatly contributes to traffic intelligence, but outsourced data confidentiality and user privacy cannot be guaranteed. The Ciphertext Policy Attribute-Based Encryption (CP-ABE) scheme can achieve both fine-grained access control and secure data sharing. However, existing CP-ABE schemes owns high computational complexity, and the adopted single attribute authority mode is burdensome to resource-limited IoV. Thus, this paper proposes a Multiauthority Attribute-Based Keyword Search over Cloud-Edge-End Collaboration (CEABKS-MA) system, leveraging the benefits of edge and cloud resources and effectively combining with the multiauthority structure to minimize the computation and storage pressure on resource-limited parties in the system. In addition, fine-grained keyword search with support for attribute update and lightweight encryption/decryption is extended. Finally, this paper demonstrates the security and efficiency of the CEABKS-MA system through rigorous security analysis and simulation experiments.