Ciphertext Retrieval Research Articles

A dynamic authorizable ciphertext image retrieval algorithm based on security neural network inference.

In this paper, we propose a dynamic authorizable ciphertext image retrieval scheme based on secure neural network inference that effectively enhances the security of image retrieval while preserving privacy. To ensure the privacy of the original image and enable feature extraction without decryption operations, we employ a secure neural network for feature extraction during the index construction stage of encrypted images. Additionally, we introduce a dynamic authenticatable ciphertext retrieval algorithm to enhance system flexibility and security by enabling users to quickly and flexibly retrieve authorized images. Experimental results demonstrate that our scheme guarantees data image privacy throughout the entire process from upload to retrieval compared to similar literature schemes. Furthermore, our scheme ensures data availability while maintaining security, allowing users to conveniently perform image retrieval operations. Although overall efficiency may not be optimal according to experimental results, our solution satisfies practical application needs in cloud computing environments by providing an efficient and secure image retrieval solution.

Blockchain-enabled data sharing for IoT: A lightweight, secure and searchable scheme

With the popularity of Internet of Things (IoT) applications, data sharing among IoT devices has become more frequent. Many researchers have proposed fine-grained access control schemes and searchable encryption algorithms to support privacy-preserving data sharing. But there still exist two challenges. First, the existing schemes are computationally intensive, making them unsuitable for resource-limited IoT terminals. Second, they rely on a central server to honestly conduct search operations, making them unable to tackle malicious servers. To this end, we propose a blockchain-enabled data-sharing scheme for IoT that supports lightweight, secure, and searchable data sharing. We design an outsourcing attribute-based encryption algorithm to alleviate the overhead of resource-limited IoT terminals, which reduces the local encryption and decryption to a constant level. Instead of relying on central servers, we leverage smart contract to execute ciphertext retrieval, ensuring the accuracy of search results. Formal security analysis demonstrates that the proposed scheme is chosen-plaintext secure under the DBDH assumption. Experimental simulation shows that it reduces the search time by at least 79.9%, the encryption and decryption complexities to both O(1).

Ciphertext Retrieval With Identity Bidirectional Authentication and Matrix Index in IoT

Ciphertext Retrieval With Identity Bidirectional Authentication and Matrix Index in IoT

Fine-Grained Encrypted Image Retrieval in Cloud Environment

With the growing emphasis on privacy awareness, there is an increasing demand for privacy-preserving encrypted image retrieval and secure image storage on cloud servers. Nonetheless, existing solutions exhibit certain shortcomings regarding retrieval accuracy, the capacity to search large images from smaller ones, and the implementation of fine-grained access control. Consequently, to rectify these issues, the YOLOv5 technique is employed for object detection within the image, capturing them as localized images. A trained convolutional neural network (CNN) model extracts the feature vectors from the localized images. To safeguard the encrypted image rules from easy accessibility by third parties, the image is encrypted using ElGamal. In contrast, the feature vectors are encrypted using the skNN method to achieve ciphertext retrieval and then upload this to the cloud. In pursuit of fine-grained access control, a role-based multinomial access control technique is implemented to bestow access rights to local graphs, thereby achieving more nuanced permission management and heightened security. The proposed scheme introduces a comprehensive cryptographic image retrieval and secure access solution, encompassing fine-grained access control techniques to bolster security. Ultimately, the experiments are conducted to validate the proposed solution’s feasibility, security, and accuracy. The solution’s performance across various facets is evaluated through these experiments.

Blockchain-Aided Privacy-Preserving Medical Data Sharing Scheme for E-Healthcare System

Due to the massive applications of Internet of Things (IoT) and the prevalence of wearable devices, e-healthcare systems are widely deployed in medical institutions. As a significant carrier of medical data, electronic medical record (EMR) is convenient to be stored and retrieved, which greatly simplifies the experience of medical treatment and cuts down the trivial work of paramedics. However, EMRs usually include much sensitive information such as patients’ identification numbers or home addresses that may be easily captured by unauthorized doctors and cloud servers. Based on this concern, e-healthcare systems can make use of attribute-based encryption (ABE) to protect private information while achieving fine-grained access control of encrypted EMRs. Whereas, most ABE schemes do not support both policy hiding and keyword search. To address the above issues, we propose an inner product searchable encryption scheme with multi-keyword search (MK-IPSE) based on blockchain to provide full privacy preservation and efficient ciphertext retrieval for EMRs. Inner product encryption (IPE) can not only specify access permissions such that only users with matched attributes can get the target files, but also support access policy hiding. Besides, the proposed scheme combines searchable encryption (SE) and federated blockchain (FB) to implement efficient and stable multi-keyword search. Compared with the existing schemes, MK-IPSE shows better performance on computation and storage. Additionally, security analysis demonstrates that our scheme can resist IND-CKA and collusion attacks.

Online/offline attribute-based searchable encryption revised: Flexibility, security and efficiency

Attribute-based encryption with keyword search (ABKS) is a versatile public-key encryption system that supports access control and ciphertext retrieval. However, it often involves complex computations for ciphertext generation. To overcome this challenge, researchers have proposed several online/offline ABKS (OOABKS) schemes. These schemes optimize online ciphertext generation by pre-generating intermediate ciphertexts in an offline manner.However, we find some limitations of existing OOABKS schemes: (1) Some schemes lack flexibility because the intermediate ciphertext is embedded with an access structure and therefore it cannot be used to generate a final ciphertext encrypted under another access structure. (2) Other schemes fail to achieve the basic security requirement.In this work, we conduct a comprehensive analysis of existing OOABKS schemes. Next, we propose a revised OOABKS scheme that offers provable security based on the well-known Bethencourt et al.’s attribute-based encryption scheme. Our scheme retains the advantages of online/offline ciphertext generation in previous OOAKBS schemes while addressing their limitations. Experiment results show that our revised scheme achieves comparable efficiency to previous OOABKS schemes without sacrificing flexibility or security.

EStore: A User-Friendly Encrypted Storage Scheme for Distributed File Systems.

In this paper, we propose a user-friendly encrypted storage scheme named EStore, which is based on the Hadoop distributed file system. Users can make use of cloud-based distributed file systems to collaborate with each other. However, most data are processed and stored in plaintext, which is out of the owner's control after it has been uploaded and shared. Meanwhile, simple encryption guarantees the confidentiality of uploaded data but reduces availability. Furthermore, it is difficult to deal with complex key management as there is the problem whereby a single key encrypts different files, thus increasing the risk of leakage. In order to solve the issues above, we put forward an encrypted storage model and a threat model, designed with corresponding system architecture to cope with these requirements. Further, we designed and implemented six sets of protocols to meet users' requirements for security and use. EStore manages users and their keys through registration and authentication, and we developed a searchable encryption module and encryption/decryption module to support ciphertext retrieval and secure data outsourcing, which will only minimally increase the calculation overhead of the client and storage redundancy. Users are invulnerable compared to the original file system. Finally, we conducted a security analysis of the protocols to demonstrate that EStore is feasible and secure.

An image compression and encryption scheme for similarity retrieval

With the development of cloud computing, people usually outsource encrypted images for saving storage and protecting privacy. However, traditional image encryption methods not only hinder the availability of images such as similarity retrieval, but also degrade the compression performance. To address this issue, we propose a retrievable image compression and encryption method(RICE). RICE takes into account the contradiction of image compression, availability and security, then propose a cascaded information bottleneck model, which includes the compression information bottleneck and the security and availability information bottleneck. The former is converted into a rate distortion problem and its optimal solution is sought by a convolutional neural network(CNN)-based compression network which includes channel space attention module and discrete wavelet transform(DWT) module. To solve the later, we propose a feature partition method to find a retrieval subset that balances the contradiction between security and availability, and design a DNA-based deterministic encryption method for this subset to support ciphertext retrieval. The ciphertext of the retrieved subset is sent to the proposed similarity search fully connected network(SimFcNet) to improve the retrieval accuracy. The remaining subset is encrypted by Non-deterministic encryption to further improve security. In general, the method RICE we proposed supports similarity retrievable in compressed domain ciphertext, and can achieve excellent performance. Experimental results show that our method is 36.56% higher than JPEG2000 at compression ratio of 60:1 in MS-SSIM, the accuracy of ciphertext retrieval can reach 0.828, and the security of ciphertext is close to that of traditional encryption methods.

An efficient and scalable vaccine passport verification system based on ciphertext policy attribute-based encryption and blockchain

Implementing a trust and secure immunity or vaccine passport verification system is now crucial for many countries. The system typically aims to enable the secure access control and verification of vaccination records which will be used by trusted parties. However, the issues related to the system scalability in supporting a large number of data access requests, the enforcement of the user consent for data sharing, and the flexibility in delegating the access capability to trusted parties have not been resolved by existing works. In this paper, we propose a Universal Vaccine Passport Verification System (UniVAC) to support a decentralized, scalable, secure, and fine-grained, access control for Covid-19 vaccine passport data sharing and verification. At a core of our scheme, we employ the ciphertext policy attribute-based encryption (CP-ABE) to support secure and fine-grained access control and use the blockchain to record access transactions and provide data indexing. Furthermore, we propose a ciphertext retrieval method based on regional blockchain segmentation and introduce the outsourced CP-ABE decryption as a part of the proxy re-encryption (PRE) process to enable scalable and secure ciphertext delivery of the encrypted vaccine passport under the requestor’s public key. Finally, we conducted the extensive experiments in real cloud environment and the results showed that our proposed scheme is more efficient and scalable than related works.

Multi-sensor network tracking research utilizing searchable encryption algorithm in the cloud computing environment.

Presently, the focus of target detection is shifting towards the integration of information acquired from multiple sensors. When faced with a vast amount of data from various sensors, ensuring data security during transmission and storage in the cloud becomes a primary concern. Data files can be encrypted and stored in the cloud. When using data, the required data files can be returned through ciphertext retrieval, and then searchable encryption technology can be developed. However, the existing searchable encryption algorithms mainly ignore the data explosion problem in a cloud computing environment. The issue of authorised access under cloud computing has yet to be solved uniformly, resulting in a waste of computing power by data users when processing more and more data. Furthermore, to save computing resources, ECS (encrypted cloud storage) may only return a fragment of results in response to a search query, lacking a practical and universal verification mechanism. Therefore, this article proposes a lightweight, fine-grained searchable encryption scheme tailored to the cloud edge computing environment. We generate ciphertext and search trap gates for terminal devices based on bilinear pairs and introduce access policies to restrict ciphertext search permissions, which improves the efficiency of ciphertext generation and retrieval. This scheme allows for encryption and trapdoor calculation generation on auxiliary terminal devices, with complex calculations carried out on edge devices. The resulting method ensures secure data access, fast search in multi-sensor network tracking, and accelerates computing speed while maintaining data security. Ultimately, experimental comparisons and analyses demonstrate that the proposed method improves data retrieval efficiency by approximately 62%, reduces the storage overhead of the public key, ciphertext index, and verifiable searchable ciphertext by half, and effectively mitigates delays in data transmission and computation processes.

Privacy leakage of certificateless public key authenticated searchable encryption via frequency analysis: Attacks and revises

Certificateless public key authenticated searchable encryption (CLPASE) is a versatile asymmetric searchable encryption that enables ciphertext retrieval, resists inside keyword guessing attacks, and avoids both certificate management problem and key escrow problem. However, most existing CLPASE schemes are vulnerable to frequency analysis which can extract keywords from user-generated trapdoors (i.e., search queries) and thus compromise user’s search privacy.In this paper, we give a detailed analysis showing that most CLPASE schemes reveal the underlying frequency distribution of the target keywords in the trapdoors searched by users, regardless of whether the trapdoor generation algorithm is deterministic or not. The analysis shows that frequency analysis has become a significant threat to users’ search privacy in the CLPASE system. To address this issue, we provide a concrete CLPASE scheme against frequency analysis. We then compare our scheme with previous CLPASE schemes in terms of features and performance evaluation. As a result, our scheme provides higher guarantee for user’s search privacy with comparable efficiency.

Efficient Secure Privacy Preserving Multi Keywords Rank Search over Encrypted Data in Cloud Computing

Verifiable multi keywords rank searchable encryption is an important technique to retrieve encrypted data in a cloud server and verify the validity of search results. The cloud server is malicious it may return incorrect search results or system fault. Thus, how to design verifiable secure multi keywords ranked search of outsourced encrypted data is an unsolved problem. Therefore, in this paper, we leverage the (T-SNE) techniques to reduce dimensionality and feathers transformation. Then adopt similar keywords clustering groups grouping strategy to construct an enhanced inverted index. Which links to coordinate matching techniques to improve accurate multi-keyword rank searches for practical user experience. Then Paillier Homorphic Encryption (P.H.E) and HMAC technique is adopted for search index encryption and keyword search verification to explore verifiable multi keywords rank search over encrypted data in the cloud server. The time cost of ranking score computation and search efficiency can be improved in two approaches, keywords grouping idea and no dummy keywords are added in query and documents vector. Thus, our scheme realizes verifiable multi keywords search exact ciphertext retrieval. We evaluated the performance of our proposed scheme using real-world datasets that ensure adequate security and privacy.

Attribute-based multi-user collaborative searchable encryption in COVID-19

With the outbreak of COVID-19, the government has been forced to collect a large amount of detailed information about patients in order to effectively curb the epidemic of the disease, including private data of patients. Searchable encryption is an essential technology for ciphertext retrieval in cloud computing environments, and many searchable encryption schemes are based on attributes to control user‘s search permissions to protect their data privacy. The existing attribute-based searchable encryption (ABSE) scheme can only implement the situation where the search permission of one person meets the search policy and does not support users to obtain the search permission through collaboration. In this paper, we proposed a new attribute-based collaborative searchable encryption scheme in multi-user setting (ABCSE-MU), which takes the access tree as the access policy and introduces the translation nodes to implement collaborative search. The cooperation can only be reached on the translation node and the flexibility of search permission is achieved on the premise of data security. ABCSE-MU scheme solves the problem that a single user has insufficient search permissions but still needs to search, making the user’s access policy more flexible. We use random blinding to ensure the confidentiality and security of the secret key, further prove that our scheme is secure under the Decisional Bilinear Diffie–Hellman (DBDH) assumption. Security analysis further shows that the scheme can ensure the confidentiality of data under chosen-keyword attacks and resist collusion attacks.

VR-PEKS: A Verifiable and Resistant to Keyword Guess Attack Public Key Encryption with Keyword Search Scheme

Public key encryption with keyword search (PEKS) allows users to perform keyword searches of ciphertext on untrusted cloud storage servers, protecting data privacy while sharing data. However, it faces several security problems in practical applications. First, an attacker can launch a keyword guessing attack to obtain keywords of interest to users, causing the leakage of their sensitive information. Second, untrusted cloud servers may return incorrect or incomplete results. In addition, with the continuous development of quantum computers, existing PEKS schemes face the problem of quantum attacks. Since cloud servers are mostly untrusted, verifiable search has become a hot research topic among scholars. However, most of the current schemes are based on bilinear pairing constructions, which are vulnerable to quantum attacks. To solve these problems, we propose a new ciphertext retrieval scheme based on fully homomorphic encryption (FHE), called VR-PEKS. This scheme implements verifiable search and is able to solve the problems of keyword guessing attacks and quantum attacks. We propose to improve the security of the scheme by using the oblivious pseudorandom function to randomize keywords and then encrypt them using FHE. An encrypted verified index structure is constructed and exposed by the data owner, enabling the data recipient to achieve verification of the correctness and integrity of the retrieved results without relying on a trusted third party. We demonstrate the security of the proposed scheme in a stochastic prediction model, and prove that our scheme satisfies keyword ciphertext indistinguishability and keyword trapdoor indistinguishability under adaptive keyword selection attacks. The comparison shows that our scheme is secure and feasible.

Secure and Efficient Certificateless Searchable Authenticated Encryption Scheme Without Random Oracle for Industrial Internet of Things

Today, the development of the Industrial Internet of Things (IIoT) has led to a rapid increase in industrial data. More and more industrial enterprises outsource local data to cloud service providers. To ensure the security of user data, encryption technology is necessary. Certificateless searchable authenticated encryption (CLSAE) can solve the problem of ciphertext retrieval for the IIoT. The security of most of the existing CLSAE schemes is proved in the random oracle model, but these schemes may have security risks in real application scenarios. We provide a new CLSAE scheme, which can resist both inside and outside keyword guessing attacks, and its security is proved in the standard model. We compare the scheme proposed in this article with other existing CLSAE schemes. Not using expensive operations, the new scheme is more efficient and more in line with the needs of the IIoT.

A more efficient public-key authenticated encryption scheme with keyword search

To realize ciphertext retrieval without decryption in the public key settings, Boneh et al. in 2004 proposed a cryptographic primitive named Public-key Encryption with Keyword Search (PEKS) and proposed the first PEKS scheme. Following Boneh et al.’s work, various PEKS schemes were proposed; however, most schemes are vulnerable to inside keyword guessing attacks (IKGA). Huang and Li proposed a new primitive named Public-key Authenticated Encryption with Keyword Search (PAEKS) in 2017, which resists the IKGA in the setting of only one test server. Their main idea to resist IKGA is to require the data sender to authenticate the ciphertext while encrypting a keyword. However, in the era of big data, as the number of encrypted files increases, huge storage overhead and heavy retrieval costs become problems in PAEKS. In this paper, we proposed a new PAEKS scheme that costs low storage space and supports fast search. We introduced the ciphertext deduplication into PAEKS to reduce storage space and leveraged the inverted index to accelerate the retrieval process. We simulated the proposed scheme and several related schemes with a desktop computer. The experiment results show that our proposed scheme is of lower storage overhead and higher retrieval efficiency compared with related schemes.

A Searchable Encryption with Forward/Backward Security and Constant Storage

Dynamic searchable encryption satisfies users’ needs for ciphertext retrieval on semi-trusted servers, while allowing users to update server-side data. However, cloud servers with dynamically updatable data are vulnerable to information abuse and file injection attacks, and current public key-based dynamic searchable encryption algorithms are often complicated in construction and high in computational overhead, which is not efficient for practical applications. In addition, the client’s storage costs grow linearly with the number of keywords in the database, creating a new bottleneck when the size of the keyword set is large. To solve the above problems, a dynamic searchable encryption scheme that uses a double-layer structure, while satisfying forward and backward security, is proposed. The double-layer structure maintains a constant client-side storage cost while guaranteeing forward and backward security and further reduces the algorithm overhead by avoiding bilinear pairings in the encryption and decryption operations. The analysis results show that the scheme is more advantageous in terms of security and computational efficiency than the existing dynamic searchable encryption scheme under the public key cryptosystem. It is also suitable for the big data communication environment.

MDS2-C3PF: A Medical Data Sharing Scheme with Cloud-Chain Cooperation and Policy Fusion in IoT

The Internet of Things (IoT) and cloud technologies have significantly facilitated healthcare. In such a context, medical data are collected by the terminals from the patients, manipulated, and stored on the cloud by hospitals (doctors). This brings asymmetry problems in medical data access control, processing, and storage between doctors and patients, which results in medical data sharing face many challenges such as privacy leakage and malicious feedback from cloud servers on queries. To solve these asymmetry problems, this paper proposes a medical data sharing scheme with cloud-chain cooperation and policy fusion in the IoT. Regarding asymmetrical access control rights, a conflict resolution and fusion algorithm that enables co-authorization of medical data by the doctor and the patient is introduced. To balance the symmetry of medical data storage and processing, a cloud-chain cooperation ciphertext retrieval method is proposed by means of two-stage joint searching from cloud servers and the blockchain, which can not only detect malicious medical data feedback from cloud servers, but also improve the data search efficiency. The security analysis showed that this scheme satisfies the confidentiality and verifiability of the retrieved information, and the feasibility of the proposed scheme was demonstrated through experiments.

Fuzzy Keyword Searchable Encryption Scheme Based on Blockchain

Searchable encryption is a keyword-based ciphertext retrieval scheme, which can selectively retrieve encrypted documents on encrypted cloud data. Most existing searchable encryption schemes focus only on exact keyword searches and cannot return data of interest in fuzzy search. In addition, during the searchable encryption, the cloud server may return invalid results to the data user to save computing costs or for other reasons. At the same time, the user may refuse to pay the service fee after receiving the correct result. To solve the above problems, this paper proposes a fuzzy keyword searchable encryption scheme based on blockchain, which uses edit distance to generate fuzzy keyword sets and generates a secure index with verification tags for each fuzzy keyword set to verify the authenticity of the returned results. The penalty mechanism is introduced through the blockchain to realize the fairness of service payment between users and cloud servers. Security analysis shows that the scheme achieves non-adaptive semantic security. Performance analysis and functional comparison show that the scheme is effective and can meet the requirements of searching applications in the cloud environment.

TCA-PEKS: Trusted certificateless authentication public-key encryption with keyword search scheme in cloud storage

Public key encryption with keyword search (PEKS) technology is capable of achieving accurate ciphertext retrieval while protecting data privacy. However, curious or malicious semi-trusted cloud servers can cause privacy breaches, which then creates a trust problem for ciphertext management and searching. To address this problem, we propose a trusted certificateless authentication public-key encryption with a keyword search scheme in cloud storage (TCA-PEKS), which ensuring trusted retrieval, simultaneously resolves the problems of key escrow and certificate management that exist in PEKS. In the scheme, the security of the ciphertext storage and verifications are strengthened based on blockchain non-tampering features, which assists users in verifying the correctness of a file. In particular, we construct an open and transparent smart contract to limit the malicious behaviour of cloud servers, in which the user’s complete private key splits the secret value and the partial private key, further guaranteeing the correctness of the retrieval process. Finally, the scheme is proven to satisfy ciphertext and trapdoor indistinguishability under the random oracle model, and the performance evaluation results show that the scheme is highly efficient.