Attribute-based Keyword Search Research Articles

Traceable and revocable multi-authority attribute-based keyword search for cloud storage

Ciphertext-Policy Attribute-Based Keyword Search (CP-ABKS) provides data privacy and achieves fine-grained access control over encrypted data in the cloud. However, authorized users may misuse the secret key for financial benefits in a multi-user scenario. Thus, tracing those malicious users and revoking them from the system is essential. Alongside this, most existing schemes have only a single authority to generate the secret key, which may lead to misuse of the secret key. To address these problems, this paper proposes a traceable and revocable multi-authority attribute-based keyword search in the cloud. The scheme involves two authorities generating the user secret key to restrict any individual authority’s unauthorized access to cloud data. The scheme also traces malicious users and revokes them from the system. Further, we prove that the scheme is secure against chosen keyword attacks, chosen plaintext attacks, and traceability. And also verify the security against malicious authorities. The performance analysis shows that the proposed scheme is efficient in computation cost compared to the state-of-the-art schemes.

Attribute-based keyword search across encrypted cloud data with multiple authorities

Searchable Encryption (SE) is a crucial technique for cloud data security and usability (SE). When employing Ciphertext Policy Attribute-Based Encryption (CP-ABE) and the Ciphertext Policy Attribute-Based Keyword Search (CP-ABKS), encryption and access control may be done simultaneously. A single attribute authority is responsible for authenticating user certificates and delivering secret keys in current CP-ABKS systems. A single point of failure results in distributed cloud systems. To address these difficulties, we explain in this paper the MABKS system, which is designed to help cloud devices with limited computing and storage capabilities. The MABKS system has added capability for tracing and modifying malicious attribute authority. According to our detailed security investigation, the MABKS system is safe in both selective-matrix and selective-attribute models. Our trials using real-world datasets have shown the MABKS system's efficiency and usefulness.

Decryptable Attribute-Based Keyword Search on E-Health Cloud

Cloud computing provides lot of benefits to enterprises to offload their data and software services to cloud saving them lot of money that has to be spent on infrastructure setup cost. Enterprises wanted to offload their data to cloud and save on their infrastructure cost. But when offloading the data security and privacy is a important concern. In this work, we focus on the search on encrypted data and provide a effective solution for the search. Searchable symmetric encryption (SSE) allows retrieval of the encrypted data over cloud. We formulate the privacy issue from the aspect of similarity relevance and scheme robustness. We observe that serve-side ranking based on order-preserving encryption (OPE) inevitably leaks data privacy. To eliminate the leakage, we propose a secure-channel free ciphertext-policy decryptable attribute-based keyword search (CP-DABKS) scheme on eHealth cloud in the Internet of Things (IoT) platform. Additionally in CP-DABKS, we employ a vector space model and homomorphic encryption. The vector space model helps to provide sufficient search accuracy, and the homomorphic encryption enables users to involve in the ranking while the majority of computing work is done on the server side by operations only on ciphertext.

Multiauthority Attribute-Based Keyword Search over Cloud-Edge-End Collaboration in IoV

The development of cloud computing and edge computing makes it possible to store and share Internet of Vehicles (IoV) data on a large scale, which greatly contributes to traffic intelligence, but outsourced data confidentiality and user privacy cannot be guaranteed. The Ciphertext Policy Attribute-Based Encryption (CP-ABE) scheme can achieve both fine-grained access control and secure data sharing. However, existing CP-ABE schemes owns high computational complexity, and the adopted single attribute authority mode is burdensome to resource-limited IoV. Thus, this paper proposes a Multiauthority Attribute-Based Keyword Search over Cloud-Edge-End Collaboration (CEABKS-MA) system, leveraging the benefits of edge and cloud resources and effectively combining with the multiauthority structure to minimize the computation and storage pressure on resource-limited parties in the system. In addition, fine-grained keyword search with support for attribute update and lightweight encryption/decryption is extended. Finally, this paper demonstrates the security and efficiency of the CEABKS-MA system through rigorous security analysis and simulation experiments.

Blockchain-enabled multi-authorization and multi-cloud attribute-based keyword search over encrypted data in the cloud

With the arrival of the 5G era, fast and secure data sharing is attracting increased attention. Among of the presented solutions, keyword search plays an important role since it can identify users and search ciphertext without decryption. However, the existing searchable algorithms have many limitations, such as powerful central authority, match processes being only carried out on the cloud server, and center corruption and single point of failure being easy to cause. Presently, the fairness of the keyword search is still a challenge. To solve these problems, we present a multi-authority and multi-cloud keyword search scheme based on the consortium blockchain and attribute-based encryption. Under this framework, multi-cloud block storage technique is used to address the unreliability of cloud servers, where at least two ciphertext files are stored in blocks on multiple cloud servers. It can resist malicious leaks, ciphertext tampering, and deletion of ciphertext by cloud servers. Blockchain allows the proposed scheme to achieve the integrity and correctness of the encrypted data, which also solves the fairness of search results. Furthermore, the scheme realizes privacy protection by hiding the keyword and the access policy in the trapdoor matching process. Finally, the security analyses and performance comparisons show the advantages of the proposed scheme over the existing work.

FELT-ABKS: Fog-Enabled Lightweight Traceable Attribute-Based Keyword Search Over Encrypted Data

FELT-ABKS: Fog-Enabled Lightweight Traceable Attribute-Based Keyword Search Over Encrypted Data

An efficient and access policy-hiding keyword search and data sharing scheme in cloud-assisted IoT

By leveraging the cloud computing paradigm, the cloud-assisted Internet of Things (IoT) is able to offer the massive storage and highly available computation services for end-users. When the data collected from IoT devices is endlessly gathering to the cloud center, the data security become new challenges. Encrypting data is an effective measure to guarantee data confidentiality. However, traditional encryption techniques make the data searching and access control inoperative. Current attribute-based keyword search (ABKS) techniques provide a feasibility to achieve data searching and access control over encrypted data simultaneously. However, existing ABKS schemes leak sensitive information via clear access policy and may be unsuitable for certain IoT applications, where the access policies in data might contain private information of data owners such as the security number or the residential area of a resident in smart grids. In this work, we design an efficient and policy-hiding attribute-based keyword search and data sharing scheme (PH-ABKS-DS) in cloud-assisted IoT. To the best of our knowledge, this construction is the first PH-ABKS-DS with practical efficiency that is constructed on prime order group. We provide detailed correctness and security analyses for PH-ABKS-DS. Extensive experiments demonstrate that our proposed PH-ABKS-DS is correct and practical.

Self-Verifiable Attribute-Based Keyword Search Scheme for Distributed Data Storage in Fog Computing With Fast Decryption

Presently many searchable encryption schemes have been proposed for cloud and fog computing, which use fog nodes (or fog servers) to partly undertake some computational tasks. However, these related schemes still retain cloud servers to undertake most computational tasks, which result in large communication costs between edge devices and cloud servers. Therefore, in this paper we propose a self-verifiable attribute-based keyword search scheme for distributed data storage (SV-KSDS) in full fog computing, where each decryption operation on the data required by a user must meet the negotiated decryption rule between fog servers. Our SV-KSDS scheme first provides attribute-based distributed data storage among fog servers through the <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$(w, \sigma)$ </tex-math></inline-formula> threshold secret-sharing scheme, where fog servers can provide self-verifiable keyword search and data decryption for terminal users. Compared with the data storage in cloud computing, our scheme extends it to the distributed structure while providing fine-grained access control for distributed data storage through attribute-based encryption. The access control policy of our scheme is constructed on linear secret-sharing scheme, whose security is reduced to the decisional bilinear Diffie-Hellman assumption against chosen-keyword attack and the decisional <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">${q}$ </tex-math></inline-formula> -parallel bilinear Diffie-Hellman assumption against chosen-plaintext attack in the standard model. Based on theoretical analysis and practical testing, our SV-KSDS scheme generates less computation and communication costs, which further unloads some computational tasks from terminal users to fog servers so as to reduce computing costs of terminal users.

Verifiable online/offline multi-keyword search for cloud-assisted Industrial Internet of Things

Attribute-based encryption (ABE) and attribute-based keyword search (ABKS) facilitate fine-grained access and search control for cloud-assisted Industrial Internet of Things (IIoT). However, existing schemes suffer from the following drawbacks: (1) their computational overhead in data outsourcing and retrieval is exceptionally high; (2) they obtain wrong search results if one or more of the queried keywords are wrongly selected; (3) in most existing ABKS, the untrustworthiness of the cloud server is not taken into account, and the correctness of the search results is not verified; (4) existing verifiable ABKS schemes do not support search results verification without the main data, and verifiers have to first download the search results and then check their correctness. In this paper, we design a verifiable online/offline multi-keyword search (VMKS) scheme providing high-level solutions to the aforementioned problems. We use the healthcare setting as a case study, and we demonstrate how our VMKS can be deployed in cloud-assisted Healthcare IIoT (HealthIIoT). We prove the security of our VMKS in the standard model and under the hardness assumption of the decisional bilinear Diffie-Hellman (DBDH) problem. Empirical results demonstrate that our VMKS speeds up encryption and verification processes by more than 70% and 90%, respectively. Moreover, our scheme reduces the communication overhead in the verification phase by more than 80%.

Subversion-Resistant and Consistent Attribute-Based Keyword Search for Secure Cloud Storage

Secure cloud search service allows resource-constrained clients to effectively search over encrypted cloud storage. Towards enabling owner-enforced search authorization, the notion of attribute-based keyword search (ABKS) has been introduced and widely deployed in practice. To enhance traditional security of ABKS, two state-of-the-art solutions are presented to address keyword guessing attacks or setup inconsistency for secret key. Nevertheless, they have not simultaneously considered the following threats to a data user: (i) inconsistent secret key/cipher-index caused by outside dishonest authority and/or data owner; (ii) algorithm substitution attacks (ASA) launched by inside adversarial eavesdropping. These attacks may unfortunately lead to cloud data breach and user information exposure. To tackle such outside and inside threats, we introduce subversion-resistance and consistency for secure and fine-grained cloud document search services. In particular, we propose a consistent ABKS system with cryptographic reverse firewalls (CRF). Technically, we refer to verifiable functional encryption and employ non-interactive zero-knowledge proofs of discrete logarithm equality to ensure strong input consistency for ABKS. In addition, we build a trusted CRF zone for sanitizing algorithm outputs against ASA attacks. Moreover, we formalize the security model and formally prove security of our system. To clarify practical performance, we implement state-of-the-art solutions and our system in real cloud environment based on Enron dataset. The results show that our system achieves more enhanced security properties without obviously sacrificing performance. In particular, our system achieves comparable time and storage cost for document-index encryption and document search, as compared to state-of-the-art solutions.

Decentralized and expressive data publish-subscribe scheme in cloud based on attribute-based keyword search

Data publish-subscribe scheme is a valuable approach to share and retrieve data from cloud platforms selectively. However, the common practice of standard encryption hinders the effective keyword-based data subscription over outsourced data. Attribute-based keyword search (ABKS), which fulfills the functionality of attribute-based encryption and searchable encryption, is a promising cryptographic primitive to construct secure data publish-subscribe scheme. In this paper, for the first time, we propose a decentralized and expressive CP-ABKS scheme with computation outsourcing and collusion resistance. Then we construct a novel data publish-subscribe scheme based on the proposed CP-ABKS to realize secure and flexible data sharing among multiple users. Both the access and subscription policies are expressed with the Linear Secret Sharing Scheme structure that can be derived from any monotonic Boolean formula and any threshold gate. To protect the keyword privacy, the subscription policy is partially publicized, and a keyword localization method is designed to enable the server to reconstruct the subscription policy and execute the search protocol in linear time. Additionally, the proposed scheme adopts online/offline encryption and outsourced decryption in a fully decentralized setting. Security analysis and performance evaluation show that our scheme achieves a good balance between security goals and practical efficiency.

Privacy-Preserving Attribute-Based Keyword Search with Traceability and Revocation for Cloud-Assisted IoT

With the rapid development of cloud computing and Internet of Things (IoT) technology, it is becoming increasingly popular for source-limited devices to outsource the massive IoT data to the cloud. How to protect data security and user privacy is an important challenge in the cloud-assisted IoT environment. Attribute-based keyword search (ABKS) has been regarded as a promising solution to ensure data confidentiality and fine-grained search control for cloud-assisted IoT. However, due to the fact that multiple users may have the same retrieval permission in ABKS, malicious users may sell their private keys on the Internet without fear of being caught. In addition, most of existing ABKS schemes do not protect the access policy which may contain privacy information. Towards this end, we present a privacy-preserving ABKS that simultaneously supports policy hiding, malicious user traceability, and revocation. Formal security analysis shows that our scheme can not only guarantee the confidentiality of keywords and access policies but also realize the traceability of malicious users. Furthermore, we provide another more efficient construction for public tracing.

Fine-Grained Attribute-Based Multikeyword Search for Shared Multiowner in Internet of Things

At present, with the popularity of Internet of things (IoT), a huge number of datasets generated by IoT devices are being uploaded to the cloud storage in remote data management service, but a series of security and privacy defects also arises, where one of the best ways for preventing data disclosure is encryption. Among them, searchable encryption (SE) is considered to be a very attractive cryptographic technology, since it allows users to search records in an encrypted form and to protect user’s data on an untrusted server. For the sake of enhancing search permission, attribute-based keyword search (ABKS) is an efficient method to provide secure search queries and fine-grained access authentications over ciphertexts. However, most existing ABKS schemes concentrate on single keyword search, which usually returns redundant and irrelevant results, so it would cost some unnecessary computation and communication resources. Furthermore, existing work in the literature mostly only supports unshared multiowner where a specific data owner owns each file, which is not able to satisfy more desired expressive search. In this work, we propose a novel attribute-based multikeyword search for shared multiowner (ABMKS-SM) primitive in IoT to achieve enhanced access control for users; meanwhile, it can support multikeyword search over ciphertexts and give a formal security analysis in the adaptive against chosen keyword attack (IND-CKA) model. Finally, we have also implemented this prototype to show efficiency when compared with some previous schemes.

An IoT Attribute-Based Security Framework for Topic-Based Publish/Subscribe Systems

Publish/subscribe is a widely used paradigm in the Internet of Things (IoT). It allows a loose coupling between data producers and data consumers using a network of interconnected brokers. However, sensitive data could be exposed if a broker is compromised or if the broker itself is curious about the information that is exchanged. In this paper, we present a complete security framework for topic-based publish/subscribe systems to ensure both security and privacy at the broker level, going beyond the naive encryption of information while keeping the loose coupling between publishers and subscribers. Furthermore, the proposed solution enables user revocation at the broker level; i.e. a revoked user can no longer subscribe to published data. To achieve that, we propose a unified solution relying on attribute-based cryptography with: (1) Attribute-Based Encryption (ABE) for data encryption; (2) a new construction of Attribute-Based Keyword Search (ABKS) to allow the broker to perform an encrypted matching that enforces privacy; and (3) an Attribute-Based Signature (ABS) to enforce the data authentication.

Attribute-Based Keyword Search over the Encrypted Blockchain

To address privacy concerns, data in the blockchain should be encrypted in advance to avoid data access from all users in the blockchain. However, encrypted data cannot be directly retrieved, which hinders data sharing in the blockchain. Several works have been proposed to deal with this problem. However, the data retrieval in these schemes requires the participation of data owners and lacks finer-grained access control. In this paper, we propose an attribute-based keyword search scheme over the encrypted blockchain, which allows users to search encrypted files over the blockchain based on their attributes. In addition, we build a file chain structure to improve the efficiency of searching files with the same keyword. Security analysis proves the security of the proposed scheme. Theoretical analysis and experimental results in performance evaluation show that our scheme is feasible and efficient.

ABKS-SKGA: Attribute-based keyword search secure against keyword guessing attack

In order to guarantee security and privacy of sensitive data, attribute-based keyword search (ABKS) enables data owners to upload their encrypted data to cloud servers, and authorizes intended data users to retrieve it. Meanwhile, ABKS outsources heavy search work to cloud servers, which makes ABKS adaptive to mobile computing environment. However, as cloud servers can both generate keyword ciphertexts and run search algorithm, the existing most ABKS schemes are vulnerable to keyword guessing attack. In this paper, we show the fundamental cause that the existing ABKS schemes do not resist keyword guessing attack is any entity can generate keyword ciphertext. To solve the above problem, in the phase of keyword ciphertext generation, we use private key of data owner to sign keyword prior to generating keyword ciphertext. Therefore, any other entity does not forge keyword ciphertext, which can resist keyword guessing attack. We give the formal definition and security model of attributed-based keyword search secure against keyword guessing attack (ABKS-SKGA). Furthermore, we provide an ABKS-SKGA scheme. The ABKS-SKGA scheme is proved secure against chosen-plaintext attack (CPA). Performance analysis shows that the proposed scheme is practical.

Verifiable Attribute-based Keyword Search Encryption with Attribute Revocation for Electronic Health Record System

Considering the security requirements of electronic health record (EHR) system, we propose a ciphertext-policy attribute-based encryption scheme, which can support data retrieval, result verification and attribute revocation. In the proposed scheme, we make use of the BLS signature technique to achieve result verification for attribute-based keyword search encryption. In addition, key encrypting key (KEK) tree and re-encryption are utilized to achieve efficient attribute revocation. By giving thorough security analysis, the proposed scheme is proven to achieve: 1) Indistinguishability against selective ciphertext-policy and chosen plaintext attack under the decisional q-parallel bilinear Diffie-Hellman exponent hardness assumption; 2) Indistinguishability against chosen-keyword attack under the bilinear Diffie-Hellman assumption in the random oracle model. Moreover, the performance analysis results demonstrate that the proposed scheme is efficient and practical in electronic health record system.

An attribute-based keyword search for m-Health networks

m-Health stands for mobile health, where mobile devices are used for collecting and distributing health-related data. As the information related to personal health is sensitive in nature, so it should be encrypted first before storing it at the potentially untrusted servers. However, encryption severely affects basic sharing and search operations. To address these issues, a combination of attribute-based encryption and searchable encryption is devised, which enables secure fine-grained search over encrypted data. But the resultant technique incurs high computational complexity, which makes it unsuitable for resource-constrained mobile devices. So, in order to deploy it to mobile devices, searchable encryption should generate constant size secret keys and ciphertexts. However, in existing attribute-based keyword search (ABKS) schemes, the size of the secret key and the ciphertext is proportional to the number of attributes, thus resulting in linear complexity. In this paper, we have proposed a novel ABKS scheme with constant-size secret keys and ciphertexts, thus further reducing the computational cost. Our scheme uses a ciphertext-policy (CP) design framework and supports an AND gate access structure. Further, the proposed CP-ABKS scheme can be proved secure in the selective security model under augmented multi-sequence of exponents decisional Diffie-Hellman assumption.

Privacy-Preserving Attribute-Based Keyword Search in Shared Multi-owner Setting

Ciphertext-Policy Attribute-Based Keyword Search (CP-ABKS) facilitates search queries and supports fine-grained access control over encrypted data in the cloud. However, prior CP-ABKS schemes were designed to support unshared multi-owner setting, and cannot be directly applied in the shared multi-owner setting (where each record is accredited by a fixed number of data owners), without incurring high computational and storage costs. In addition, due to privacy concerns on access policies, most existing schemes are vulnerable to off-line keyword-guessing attacks if the keyword space is of polynomial size. Furthermore, it is difficult to identify malicious users who leak the secret keys when more than one data user has the same subset of attributes. In this paper, we present a privacy-preserving CP-ABKS system with hidden access policy in Shared Multi-owner setting (basic ABKS-SM system), and demonstrate how it is improved to support malicious user tracing (modified ABKS-SM system). We then prove that the proposed ABKS-SM systems achieve selective security and resist off-line keyword-guessing attack in the generic bilinear group model. We also evaluate their performance using real-world datasets.

A Key-Policy Attribute-Based Temporary Keyword Search scheme for Secure Cloud Storage

Temporary keyword search on confidential data in a cloud environment is the main focus of this research. The cloud providers are not fully trusted. So, it is necessary to outsource data in the encrypted form. In the attribute-based keyword search (ABKS) schemes, the authorized users can generate some search tokens and send them to the cloud for running the search operation. These search tokens can be used to extract all the ciphertexts which are produced at any time and contain the corresponding keyword. Since this may lead to some information leakage, it is more secure to propose a scheme in which the search tokens can only extract the ciphertexts generated in a specified time interval. To this end, in this paper, we introduce a new cryptographic primitive called key-policy attribute-based temporary keyword search (KP-ABTKS) which provide this property. To evaluate the security of our scheme, we formally prove that our proposed scheme achieves the keyword secrecy property and is secure against selectively chosen keyword attack (SCKA) both in the random oracle model and under the hardness of Decisional Bilinear Diffie-Hellman (DBDH) assumption. Furthermore, we show that the complexity of the encryption algorithm is linear with respect to the number of the involved attributes. Performance evaluation shows our scheme's practicality.