Conjunctive Keyword Search Research Articles

Enabling Efficient, Verifiable, and Secure Conjunctive Keyword Search in Hybrid-Storage Blockchains

Enabling Efficient, Verifiable, and Secure Conjunctive Keyword Search in Hybrid-Storage Blockchains

A Certificateless Verifiable Bilinear Pair-Free Conjunctive Keyword Search Encryption Scheme for IoMT

With superior computing power and efficient data collection capability, Internet of Medical Things (IoMT) significantly improves the accuracy and convenience of medical work. As most communications are over open networks, it is critical to encrypt data to ensure confidentiality before uploading them to cloud storage servers (CSSs). Public key encryption with keyword search (PEKS) allows users to search for specific keywords in ciphertext and plays an essential role in IoMT. However, PEKS still has the following problems: 1. As a semi-trusted third party, the CSSs may provide wrong search results to save computing and bandwidth resources. 2. Single-keyword searches often produce many irrelevant results, which is undoubtedly a waste of computing and bandwidth resources. 3. Most PEKS schemes rely on bilinear pairings, resulting in computational inefficiencies. 4. Public key infrastructure (PKI)-based or identity-based PEKS schemes face the problem of certificate management or key escrow. 5. Most PEKS schemes are vulnerable to offline keyword guessing attacks, online keyword guessing attacks, and insider keyword guessing attacks. We present a certificateless verifiable and pairing-free conjunctive public keyword searchable encryption (CLVPFC-PEKS) scheme. An efficiency analysis shows that the performance advantage of the new scheme is far superior to that of the existing scheme. More importantly, we provide proof of security under the standard model (SM) to ensure the reliability of the scheme in practical applications.

Response-Hiding and Volume-Hiding Verifiable Searchable Encryption with Conjunctive Keyword Search

Response-Hiding and Volume-Hiding Verifiable Searchable Encryption with Conjunctive Keyword Search

Server-Assisted Data Sharing System Supporting Conjunctive Keyword Search for Vehicular Social Networks

Server-Assisted Data Sharing System Supporting Conjunctive Keyword Search for Vehicular Social Networks

Reducing Paging and Exit Overheads in Intel SGX for Oblivious Conjunctive Keyword Search

Paging and exit overheads have been proven to be the performance bottlenecks when adopting Searchable Symmetric Encryption (SSE) with trusted hardware such as Intel SGX for keyword search. This problem becomes more serious when incorporating ORAM and SGX to design oblivious SSE schemes such as POSUP [1] and Oblidb [2] which can defend against inference attacks. The main reason comes from high round communication complexity of ORAM and constrained trusted memory created by SGX. To overcome this performance bottleneck, we propose a set of novel SSE constructions with realistic security/performance trade-offs. Our core idea is to encode the keyword-identifier pairs into a bloom filter to reduce the number of ORAM operations during the search procedure. Specifically, Construction 1 loads the bloom filter into the enclave sequentially, which outperforms about <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$1.7\times$</tex-math></inline-formula> when the dataset is large compared with the performance of the baseline that directly combines ORAM and SGX. To further improve the performance of Construction 1, Construction 2 classifies keywords into groups and stores these groups in different bloom filters. By additionally leaking the keywords in search token belonging to which groups, Construction 2 outperforms Construction 1 by <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$16.5\sim 36.8\times$</tex-math></inline-formula> and provides an improvement of at least one order over state-of-the-art oblivious protocols.

Attribute Based Conjunctive Keywords Search With Verifiability and Fair Payment Using Blockchain

Attribute Based Conjunctive Keywords Search With Verifiability and Fair Payment Using Blockchain

A certificateless authenticated searchable encryption with dynamic multi-receiver for cloud storage

The searchable encryption schemes (PEKS, IBEKS, and CLPEKS) based on public-key cryptography (i.e., PKI-based, Identity-based, and Certificateless) enable the data users to accomplish searches on encrypted data stored in cloud storage by a cloud server. However, these schemes have three fundamental challenges: (1) Impervious to Keyword Guessing Attacks (KGAs) and File Injection Attacks (FIA), (2) Keyword privacy in query-trapdoor and encryption-keywords algorithms, and (3) Support for conjunctive keyword search in dynamic multi-user environments. Consequently, the authors produced Certificateless Authenticated Searchable Encryption with Dynamic Multi-receiver (CLASEDM). It also provides two security models that enable keyword privacy in encryption-keyword and query-trapdoor: Chosen keyword to Encryption-keyword attack (CKE) and Chosen keyword to Query-trapdoor attack (CKQ). And the authentication in the encryption of the keywords method also defends against KGA and FIA attacks. Afterward, the authors perform a conjunctive keyword search and add or remove the data recipient from the document’s access list. Finally, the performance analysis shows the CLASEDM scheme outperforming the related systems in comparative and experimental studies.

Key-aggregate searchable encryption supporting conjunctive queries for flexible data sharing in the cloud

Searchable encryption (SE) meets users' demand for the keyword search on encrypted data. Key-aggregate searchable encryption (KASE) improves data owners' ability to selectively share encrypted data with users. In KASE, the data owner encrypts different documents/document classes with distinct keys and can share any selected subset of documents by simply transmitting an aggregate key to the user. The user only uploads an aggregate trapdoor to the server for querying these shared documents. However, the existing KASE schemes have some limitations: the security definition is incomplete, only single-keyword search is supported, and the provable security scheme relies on the random oracle model. For these reasons, in this paper, we propose the Key-Aggregate Searchable Encryption supporting Conjunctive Queries (KASE-CQ) framework and its two security models: indistinguishability against selective-document chosen keyword attack and existential unforgeability against selective-document chosen keyword attack. These models reflect the indistinguishability of ciphertext and the unforgeability of the aggregate key, respectively. Our system supports flexible data sharing and the conjunctive keyword search on encrypted data. Furthermore, we design a concrete KASE-CQ construction, which can be proven secure in the standard model. We also demonstrate that our construction is secure against the insider trapdoor attack presented by Zhou et al. [40]. Finally, performance analysis and comparisons with Cui et al.'s scheme [10] illustrate the superior efficiency of our scheme.

Efficient Strong Privacy-Preserving Conjunctive Keyword Search Over Encrypted Cloud Data

Searchable symmetric encryption (SSE) supports keyword search over outsourced symmetrically encrypted data. Dynamic searchable symmetric encryption (DSSE), a variant of SSE, further enables data updating. Most DSSE works with conjunctive keyword search primarily consider forward and backward privacy. Ideally, the server should only learn the result sets involving all keywords in the conjunction. However, existing schemes suffer from keyword pair result pattern (KPRP) leakage, revealing the partial result sets containing two of query keywords. We propose the first DSSE scheme to address aforementioned concerns that achieves strong privacy-preserving conjunctive keyword search. Specifically, our scheme can maintain forward and backward privacy and eliminate KPRP leakage, offering a higher level of security. The search complexity scales with the number of documents stored in the database in several existing schemes. However, the complexity of our scheme scales with the update frequency of the least frequent keyword in the conjunction, which is much smaller than the size of the entire database. Besides, we devise a least frequent keyword acquisition protocol to reduce frequent interactions between clients. Finally, we analyze the security of our scheme and evaluate its performance theoretically and experimentally. The results show that our scheme has strong privacy preservation and efficiency.

Secure channel free public key authenticated encryption with multi-keyword search on healthcare systems

A significant amount of electronic health records (EHRs) have been kept in the cloud due to the quick development of healthcare information systems. However, storing EHRs in the cloud may raise security and data privacy issues. Because of the privacy of a patient’s medical data, storing it on a cloud server requires encryption. Public-key encryption with keyword search (PEKS) solves the problem of retrieval on ciphertext, thus avoiding the problem of plaintext information leakage. However, most PEKS schemes are susceptible to inside keyword guessing attacks (KGA). Besides, transmitting the trapdoor to the cloud server requires a secure channel, which is impractical in healthcare information systems. Roughly speaking, PEKS does not protect the privacy of trapdoor and it is expensive to establish secure channels. In this paper, we propose a secure-channel free public key authenticated encryption with multi-keyword search (SCF-PAEMKS) scheme. The proposed SCF-PAEMKS scheme supports conjunctive keyword search, meanwhile satisfying multi-ciphertext indistinguishability (MCI) and multi-trapdoor privacy (MTP) simultaneously. The efficiency analysis and experimental results show that our SCF-PAEMKS scheme enjoys a better performance compared with related schemes.

Attribute-Based Expressive and Ranked Keyword Search Over Encrypted Documents in Cloud Computing

Attribute-based keyword search (ABKS) has been proposed to realize fine-grained access control and provide search service in cloud computing. However, most ABKS schemes focus on single or conjunctive keyword search, while the recent Boolean keyword search schemes only support monotonic query formula mainly involving AND, OR and threshold operators. How to support more expressive Boolean query formulas and return the corresponding accurate search results to users have become challenges for practical ABKS over ciphertexts. In this paper, we introduce an attribute-based expressive and ranked keyword search scheme over encrypted documents named ABERKS, which allows authorized users to submit expressive Boolean query formulas involving AND, OR, NOT and threshold operators. ABERKS utilizes a non-monotonic access tree structure to construct the query formula, and further leverages extended Boolean model to rank the search results. Specifically, the users are able to define the weights in the query formula, and get the relevance score of each matched ciphertext if the attributes and keywords are both satisfied. We prove the security of ABERKS against chosen keyword attack under selective ciphertext policy model and against keyword guessing attack, and also conduct extensive experiments to show the efficiency and practicality of ABERKS.

Searchable Encryption With Autonomous Path Delegation Function and Its Application in Healthcare Cloud

Outsourcing medical data to healthcare cloud has become a popular trend. Since medical data of patients contain sensitive personal information, they should be encrypted before outsourcing. However, information retrieval methods based on plaintext cannot be directly applied to encrypted data. In this paper, we present a new cryptographic primitive named conjunctive keyword search with secure channel free and autonomous path delegation function (AP-SCF-PECKS), which can be applied in scenarios where patients want to search for and autonomous delegate their private medical information without revealing their private key. Particularly, the proposed solution allows patients to set up multi-hop delegation path with their preferences, and the delegated doctors in the path can search for and access the patient's private medical information with priority from high to low. Patients can ensure that authorized doctors are always trustworthy, and unauthorized users cannot obtain the private medical information of patients. Moreover, the scheme supports the conjunctive keyword search, secure channel free, and is secure against chosen keyword attack, chosen ciphertext attack, and keyword guessing attack. The security of proposed scheme has been formally proved in the standard model. Finally, the performance evaluations demonstrate that the overhead of proposed scheme are modest for healthcare cloud scenarios.

Privacy-Protecting Attribute-Based Conjunctive Keyword Search Scheme in Cloud Storage

&lt;p&gt;Cloud storage has been deployed in various real-world applications. But how to enable Internet users to search over encrypted data and to enable data owners to perform fine-grained search authorization are of huge challenge. Attribute-based keyword search (ABKS) is a well-studied solution to the challenge, but there are some drawbacks that prevent its practical adoption in cloud storage context. First, the access policy in the index and the attribute set in the trapdoor are both in plaintext, they are likely to reveal the privacy of data owners and users. Second, the current ABKS schemes cannot provide multi-keyword search under the premise of ensuring security and efficiency. We explore an efficient way to connect the inner product encryption with the access control mechanism and search process in ABKS, and propose a privacy-protecting attribute-based conjunctive keyword search scheme. The proposed scheme provides conjunctive keyword search and ensures that the access policy and attribute set are both fully hidden. Formal security models are defined and the scheme is proved IND-CKA, IND-OKGA, access policy hiding and attribute set hiding. Finally, empirical simulations are carried out on real-world dataset, and the results demonstrate that our design outperforms other existing schemes in security and efficiency.&lt;/p&gt; &lt;p&gt;&amp;nbsp;&lt;/p&gt;

Efficient Expressive Attribute-Based Encryption with Keyword Search over Prime-Order Groups

Attribute-based encryption with keyword search (ABEKS) is a novel cryptographic paradigm that can be used to implement fine-grained access control and retrieve ciphertexts without disclosing the sensitive information. It is a perfect combination of attribute-based encryption (ABE) and public key encryption with keyword search (PEKS). Nevertheless, most of the existing ABEKS schemes have limited search capabilities and only support single or simple conjunctive keyword search. Due to the weak search capability and inaccurate search results, it is difficult to apply these schemes to practical applications. In this paper, an efficient expressive ABEKS (EABEKS) scheme supporting unbounded keyword universe over prime-order groups is designed, which supplies the expressive keyword search function supporting the logical connectives of “AND” and “OR”. The proposed scheme not only leads to low computation and communication costs, but also supports unbounded keyword universe. In the standard model, the scheme is proven to be secure under the chosen keyword attack and the chosen plaintext attack. The comparison analysis and experimental results show that it has better performance than the existing EABEKS schemes in the storage, computation and communication costs.

A designated tester-based certificateless public key encryption with conjunctive keyword search for cloud-based MIoT in dynamic multi-user environment

One of the essential technologies in the medical industry for achieving high performance and accuracy is the Medical Internet of Things (MIoT). The MIoT technology processes a large amount of patient information in real-time. And therefore, it poses a high risk of leaking personal information. Furthermore, as data is sent over public networks, security is critical in MIoT. To overcome the above issues, we developed a designated tester-based Certificateless Public-key Encryption with Conjunctive Keyword search for cloud-based MIoT in dynamic multi-user environment (dCL-PECK). This study explores three features: (1). A secure channel is not necessary to transfer the data from the data-user (i.e., data owner or data receiver) to the designated tester (i.e., medical cloud server) and allows only the designated tester to execute the test algorithm. (2). Data is encrypted only once for multiple data users and supports conjunctive keyword search. (3). Users are added and revoked dynamically. Furthermore, the proposed scheme is provably secure under ciphertext indistinguishable against inside and outside adversaries and trapdoor indistinguishable against outside adversaries. Finally, theoretical and experimental analyses have been performed, demonstrating that the proposed system is better than similar Certificateless Keyword Search (CLKS) systems. As a result, we feel that it is suitable for cloud-based MIoT.

An efficient, secure and verifiable conjunctive keyword search scheme based on rank metric codes over encrypted outsourced cloud data

Public key encryption with keyword search (PEKS) is a cryptographic primitive that allows a secure search for desired keywords of data users by a cloud server using a search token. To the best of our knowledge, we propose the first practical, semantic secure, and post-quantum PEKS scheme based on rank metric codes. The proposed scheme is secure against keyword guessing attack, reaction attack, and key exposure, and enjoys conjunctive keyword search, verifiability of search results using Bloom filter and garbled Bloom filter. We implement the scheme with C++ programming language on a desktop computer. At the security level of 256 bits, the scheme performs all the necessary steps for encryption, keyword search, and verification of search results for one keyword in 22.5 milliseconds. Furthermore, the public key length at this security level is about 5 kilobytes. We show that the scheme is more efficient than the existing relevant post-quantum ones.

Device-Oriented Keyword-Searchable Encryption Scheme for Cloud-Assisted Industrial IoT

Massive physical devices are deployed in the Industrial Internet of Things (IoT) to collect ambiance data while heavy storage and communication cost are imposed on these IoT devices. To overcome this constraint, cloud-assisted technologies are introduced to store and manage the collected data. In order to protect data quality and security, encryption is required before uploading data to remote clouds. Consequently, a search function is added to cloud services to find the specific data. However, traditional data searching schemes are constructed in user-oriented systems, where the search function is mainly involved with the relationship between data and users rather than data and devices. As a result, traditional search schemes are not suitable to find special IoT devices. On the other hand, the status of these devices is described by many attributes, e.g., temperature, clean water storage, and machine speed in an early warning system for industrial sewage disposal equipment. Hence, multi-keyword conjunctive queries for partial attributes should be introduced so as to find the target device more accurately and more efficiently. To address these challenges, we propose a new universal device-oriented keyword searchable encryption (Do-KSE) scheme for cloud-assisted IoT in this paper. Furthermore, the functions of a single and conjunctive keyword search are maintained to handle the device search requirement of partial attributes. We conduct extensive experiments to evaluate the proposed scheme. Experimental results show that our scheme has excellent performance because of the lightweight index and query trapdoor.

Forward Secure Public-key Authenticated Encryption with Conjunctive Keyword Search

Abstract Public key encryption with keyword search is a promising primitive which enables search over encrypted data in secure data outsourcing services. In traditional construction, the associated keywords may be recovered from a given trapdoor by a malicious server through keyword guessing attacks. Therefore, the notion of public-key authenticated encryption with keyword search (PAEKS) was introduced, where a sender encrypts (and authenticates) the keywords using a receiver’s public key and its secret key. In this paper, we consider the forward security for PAEKS and introduce a new primitive: forward secure public-key authenticated encryption with keyword search (FS-PAEKS), which captures the information leakage risk from previously issued queries due to the updates on the outsourced data. Technically, we embed a non-interactively agreed key into the cipher-keyword generation algorithm, and bind the cipher-keyword and the trapdoor with a set converted from algorithm-generation time. Finally, we present an efficient FS-PAEKS scheme supporting conjunctive query, and prove its forward security against chosen keyword attacks and keyword guessing attacks. To illustrate practical performance, we implement our FS-PAEKS and related PAEKS schemes based on Enron dataset in real cloud environment.

Forward privacy multikeyword ranked search over encrypted database

Dynamic searchable encryption (SE) aims at achieving varied search function over encrypted database in dynamic setting, which is a trade-off in efficiency, security, and functionality. Recent work proposes a file-injection attack which can successfully attack by utilizing some information leaked in the update process. To mitigate this attack, some SE schemes with forward privacy are proposed. However, these schemes are designed to achieve single keyword or conjunctive keyword search, which cannot support multikeyword search. Moreover, these schemes do not consider the function of results ranking. In this paper, we propose a forward privacy multikeyword ranked search scheme over encrypted database. We design a forward privacy multikeyword search scheme based on the classic MRSE scheme. Our scheme makes the cloud cannot obtain the actual match results of the past query with the newly updated files by adding the well-chosen dummy elements to the original index and query vectors. We rank the search results based on the matched keyword number and the T F × I D F $TF\times IDF$ rule in the dynamic setting. Our scheme uses only the symmetric encryption primitive. We implement our scheme for COVID-19 data set and the experimental evaluation results show that the proposed scheme is secure and efficient.

Lattice-based public-key encryption with conjunctive keyword search in multi-user setting for IIoT

Lattice-based public-key encryption with conjunctive keyword search in multi-user setting for IIoT