Dynamic Searchable Symmetric Encryption Research Articles

A provably lightweight and secure DSSE scheme, with a constant storage cost for a smart device client.

Outsourcing data to remote cloud providers is becoming increasingly popular amongst organizations and individuals. A semi-trusted server uses Searchable Symmetric Encryption (SSE) to keep the search information under acceptable leakage levels whilst searching an encrypted database. A dynamic SSE (DSSE) scheme enables the adding and removing of documents by performing update queries, where some information is leaked to the server each time a record is added or removed. The complexity of structures and cryptographic primitives in most existing DSSE schemes makes them inefficient, in terms of storage, and query requests generate overhead costs on the Smart Device Client (SDC) side. Achieving constant storage cost for SDCs enhances the viability, efficiency, and easy user experience of smart devices, promoting their widespread adoption in various applications while upholding robust privacy and security standards. DSSE schemes must address two important privacy requirements: forward and backward privacy. Due to the increasing number of keywords, the cost of storage on the client side is also increasing at a linear rate. This article introduces an innovative, secure, and lightweight Dynamic Searchable Symmetric Encryption (DSSE) scheme, ensuring Type-II backward and forward privacy without incurring ongoing storage costs and high-cost query generation for the SDC. The proposed scheme, based on an inverted index structure, merges the hash table with linked nodes, linking encrypted keywords in all hash tables. Achieving a one-time O(1) storage cost without keyword counters on the SDC side, the scheme enhances security by generating a fresh key for each update. Experimental results show low-cost query generation on the SDC side (6,460 nanoseconds), making it compatible with resource-limited devices. The scheme outperforms existing ones, reducing server-side search costs significantly.

SDTA: Secure Decentralized Trading Alliance for Electronic Medical Data

Abstract Massive medical data are indispensable for training diagnostic models to provide high-quality health monitoring services. The methods for sharing data in existing works involve securely and essentially copying data but often overlook the integration and efficiency of data storage, exchange and application. In this paper, we propose a Secure Decentralized Trading Alliance (SDTA) to encompass the entire process holistically. With monetary incentives, we formulate a chain-net structure for recording data digests and authentic transactions, thereby transforming data sharing into data trading without duplicating data storage. Data privacy is promised by encryption. To manage and employ encrypted medical data, users can update and search their encrypted data using an index and keywords, subsequently retrieving data within the SDTA framework. It is realized by a novel dynamic searchable symmetric encryption (SSE) with an $l$-level access strategy, which confines users to data pertinent solely to them, thus circumventing unnecessary data leakage. We scrutinize the storage efficiency and prove the fairness and security of SDTA. Finally, we generate datasets of varying sizes, where the time required to search for a single keyword is approximately 0.04 s with 1 000 000 (keyword, identifier) pairs, showing it quite acceptable.

Exploiting Hidden Information Leakages in Backward Privacy for Dynamic Searchable Symmetric Encryption

Dynamic searchable symmetric encryption (DSSE) enables searches over encrypted data as well as data dynamics such as flexible data addition and deletion operations. A major security concern in DSSE is how to preserve forward and backward privacy, which are typically achieved by removing the linkability between the newly added data and previous queries, and between the deleted data and future queries, respectively. After information leakage types were formally defined for different levels of backward privacy (i.e., Type-I, II, III), many backward private DSSE schemes have been constructed under the definitions. However, we observed that the backward privacy can be violated by leveraging additional secondary leakage, which is typically leaked in specific constructions of schemes in spite of their theoretical guarantees. In this paper, in order to understand the security gap between the theoretical definitions and practical constructions, we conduct an in-depth analysis of the root cause for the secondary leakage, and demonstrate how it can be abused to violate Type-II backward privacy (e.g., the exposure of the deletion history) of DSSE constructions in practice. We then propose a novel Type-II backward private DSSE scheme based on Intel SGX, which is resilient to the secondary leakage abuse attack. According to the comparative analysis of our scheme with the state-of-the-art SGX-based DSSE schemes, Bunker-B (EuroSec’19) and SGX-SE1 (ACNS’20), our scheme shows higher efficiency in terms of the search latency with a negligible utility loss under the same security level (cf. Bunker-B) while showing similar efficiency with a higher security level (cf. SGX-SE1). Finally, we formally prove that our scheme guarantees Type-II backward privacy.

Forward Private Verifiable Dynamic Searchable Symmetric Encryption With Efficient Conjunctive Query

Forward Private Verifiable Dynamic Searchable Symmetric Encryption With Efficient Conjunctive Query

Fast Multi-User Searchable Encryption with Forward and Backward Private Access Control

Untrusted servers are servers or storage entities lacking complete trust from the data owner or users. This characterization implies that the server hosting encrypted data may not enjoy full trust from data owners or users, stemming from apprehensions related to potential security breaches, unauthorized access, or other security risks. The security of searchable encryption has been put into question by several recent attacks. Currently, users can search for encrypted documents on untrusted cloud servers using searchable symmetric encryption (SSE). This study delves deeply into two pivotal concepts of privacy within dynamic searchable symmetric encryption (DSSE) schemes: forward privacy and backward privacy. The former serves as a safeguard against the linkage of recently added documents to previously conducted search queries, whereas the latter guarantees the irretrievability of deleted documents in subsequent search inquiries. However, the provision of fine-grained access control is complex in existing multi-user SSE schemes. SSE schemes may also incur high computation costs due to the need for fine-grained access control, and it is essential to support document updates and forward privacy. In response to these issues, this paper suggests a searchable encryption scheme that uses simple primitive tools. We present a multi-user SSE scheme that efficiently controls access to dynamically encrypted documents to resolve these issues, using an innovative approach that readily enhances previous findings. Rather than employing asymmetric encryption as in comparable systems, we harness low-complexity primitive encryption tools and inverted index-based DSSE to handle retrieving encrypted files, resulting in a notably faster system. Furthermore, we ensure heightened security by refreshing the encryption key after each search, meaning that users are unable to conduct subsequent searches with the same key and must obtain a fresh key from the data owner. An experimental evaluation shows that our scheme achieves forward and Type II backward privacy and has much faster search performance than other schemes. Our scheme can be considered secure, as proven in a random oracle model.

Dynamic Searchable Symmetric Encryption With Strong Security and Robustness

Dynamic Searchable Symmetric Encryption With Strong Security and Robustness

Intelligent privacy preserving deep learning model for securing IoT healthcare system in cloud storage

Nowadays the existing legacy management-based healthcare system maintains and processes a large amount of health-related data. The widespread adoption of the Internet of Things (IoT) and its progressive development have promised the way for the development of IoT-enabled healthcare with impressive data processing and big data storage capabilities. Intelligent medical healthcare intends to offer a framework to remotely monitor users’ health-related data as the Industrial Internet of Things (IIoT) develops. Because they are stored on a cloud server, the data are still susceptible to manipulation and privacy breaches. The Keras Xception Deep Learning System (KX-DLS) with Dynamic Searchable Symmetric Encryption (DSSE) scheme is a revolutionary IoT-based deep learning intelligent privacy-preserving system that is advantageous for digital healthcare and its functionalities to handle security-related challenges. The dataset is being used to pre-train the system, and users’ personal information is kept separate in a secure location. Without knowing any personal information about the users, we analyse health-related data stored in the cloud and build a sophisticated security framework based on a deep learning model. With the most extensive collection of security features, our framework for learning intelligent privacy preservation optimizes the system to guarantee high data integrity and few privacy breaches. As a result, it may be useful in situations where users employ mobile devices with limited resources to engage a healthcare cloud system for extensive virtual health services, and the results of this research show that it has been a better-secured model in comparison with state-of-the-art previous techniques.

Toward Forward and Backward Private Dynamic Searchable Symmetric Encryption Supporting Data Deduplication and Conjunctive Queries

In Internet of Things (IoT) application scenarios such as intelligent logistics, secure data access control and sharing based on dynamic searchable symmetric encryption (DSSE) has become a research hotspot in recent years. DSSE is an encryption technology which gratifies the above requirements, while protecting the sensitive data during the operation. The existing DSSE schemes do not achieve data deduplication and conjunctive queries concurrently, and exist problems such as complex update process, inflexible query method and privacy disclosure, etc. For this purpose, the paper proposes dynamic searchable symmetric encryption for data deduplication and conjunctive queries (DSSE-DC), and constructs a concrete DSSE-DC scheme. Our scheme uses symmetric encryption with homomorphic addition and bitmap index to develop a secure and reliable search architecture, and updates through modular addition. Meanwhile, we add a deduplication mechanism to realize data deduplication which avoids the waste of cloud storage resources. Furthermore, we introduce the idea of inner product matching to achieve efficient conjunctive queries. The adaptive security of DSSE-DC scheme is proved in the random oracle model. Whilst our scheme satisfies forward and backward privacy. In comparison to the existing DSSE schemes for conjunctive queries, our scheme has advantage in update and search performances, which is applicable to IoT applications like intelligent logistics.

Verifiable and Searchable Symmetric Encryption Scheme Based on the Public Key Cryptosystem

With the rapid development of Internet of Things technology and cloud computing technology, all industries need to outsource massive data to third-party clouds for storage in order to reduce storage and computing costs. Verifiable and dynamic searchable symmetric encryption is a very important cloud security technology, which supports the dynamic update of private data and allows users to perform search operations on the cloud server and verify the legitimacy of the returned results. Therefore, how to realize the dynamic search of encrypted cloud data and the effective verification of the results returned by the cloud server is a key problem to be solved. To solve this problem, we propose a verifiable dynamic encryption scheme (v-PADSSE) based on the public key cryptosystem. In order to achieve efficient and correct data updating, the scheme designs verification information (VI) for each keyword and constructs a verification list (VL) to store it. When dynamic update operations are performed on the cloud data, it is easy to quickly update the security index through obtaining the latest verification information in the VL. The safety and performance evaluation of the v-PADSSE scheme proved that the scheme is safe and effective.

A dynamic conjunctive keywords searchable symmetric encryption scheme for multiple users in cloud computing

With the continuous advancement of cloud computing technology, massive amounts of heterogeneous data are being outsourced to cloud servers. Dynamic searchable symmetric encryption (DSSE) is widely used for dynamically updating and searching ciphertext. Although many DSSE schemes have been developed in recent years, few can satisfy the requirement for multi-keyword search. To address this problem, we proposed a novel Dynamic Searchable Symmetric Encryption scheme supporting Multiple users and Multiple keywords (MMDSSE) in this paper, specifically designed for the multi-keyword cloud computing paradigm, while also enabling multi-user search capability. To achieve multi-keyword search, a tag is computed using an iso-or operation that records the relationship between the keyword and identifier. In addition, a unique key is assigned by the data owner to each user with different file access rights. This allows users to gain fine-grained control over the ciphertext, and the essential security properties, including forward and backward privacy, can be achieved accordingly. Furthermore, this scheme is resistant to collusion attacks. Finally, the experiment was simulated on the IDEA platform using the Java language. The experimental results demonstrate that this scheme performs well.

Efficient Strong Privacy-Preserving Conjunctive Keyword Search Over Encrypted Cloud Data

Searchable symmetric encryption (SSE) supports keyword search over outsourced symmetrically encrypted data. Dynamic searchable symmetric encryption (DSSE), a variant of SSE, further enables data updating. Most DSSE works with conjunctive keyword search primarily consider forward and backward privacy. Ideally, the server should only learn the result sets involving all keywords in the conjunction. However, existing schemes suffer from keyword pair result pattern (KPRP) leakage, revealing the partial result sets containing two of query keywords. We propose the first DSSE scheme to address aforementioned concerns that achieves strong privacy-preserving conjunctive keyword search. Specifically, our scheme can maintain forward and backward privacy and eliminate KPRP leakage, offering a higher level of security. The search complexity scales with the number of documents stored in the database in several existing schemes. However, the complexity of our scheme scales with the update frequency of the least frequent keyword in the conjunction, which is much smaller than the size of the entire database. Besides, we devise a least frequent keyword acquisition protocol to reduce frequent interactions between clients. Finally, we analyze the security of our scheme and evaluate its performance theoretically and experimentally. The results show that our scheme has strong privacy preservation and efficiency.

Result-pattern-hiding Conjunctive Searchable Symmetric Encryption with Forward and Backward Privacy

Dynamic searchable symmetric encryption (DSSE) enables the data owner to outsource its database (document sets) to an untrusted server and make searches and updates securely and efficiently. Conjunctive DSSE can process conjunctive queries that return the documents containing multiple keywords. However, a conjunctive search could leak the keyword pair result pattern (KPRP), where attackers can learn which documents contain any two keywords involved in the query. File-injection attack shows that KPRP can be utilized to recover searched keywords. To protect data effectively, DSSE should also achieve forward privacy, i.e., hides the link between updates to previous searches, and backward privacy, i.e., prevents deleted entries being accessed by subsequent searches. Otherwise, the attacker could recover updated/searched keywords and records. However, no conjunctive DSSE scheme in the literature can hide KPRP in sub-linear search efficiency while guaranteeing forward and backward privacy. In this work, we propose the first sub-linear KPRP-hiding conjunctive DSSE scheme (named HDXT) with both forward and backward privacy guarantees. To achieve these three security properties, we introduce a new cryptographic primitive: Attribute-updatable Hidden Map Encryption (AUHME). AUHME enables HDXT to efficiently and securely perform conjunctive queries and update the database in an oblivious way. In comparison with previous work that has weaker security guarantees, HDXT shows comparable, and in some cases, even better performance.

Towards Efficient Verifiable Boolean Search Over Encrypted Cloud Data

Symmetric Searchable Encryption (SSE) schemes facilitate searching over encrypted data, and have been extensively explored to improve function, efficiency or security. There are, however, additional functions that we need to consider in a real-world setting. For example, forward and backward privacy are required to adequately secure newly added documents and deleted documents in Dynamic SSE (DSSE) schemes, and support boolean search (that allows users to search over encrypted data using basic boolean operations) to achieve improved efficiency and retrieval accuracy. Therefore, in this paper we first construct the Verifiable Boolean Search over encrypted data (VBS), and then improve VBS to achieve Forward and Backward privacy (VBS-FB). Finally, we formally prove the security of our proposed schemes, and evaluate their performance using real-world datasets.

Multi-User Dynamic Searchable Symmetric Encryption With Corrupted Participants

We study the problem of multi-user dynamic searchable symmetric encryption (DMUSSE) where a data owner stores its encrypted documents on an untrusted remote server and wishes to selectively allow multiple users to access them by issuing keyword search queries. Specifically, we consider the case where some of the users may be corrupted and <i>colluding with the server</i> to extract additional information about the dataset (beyond what they have access to). We provide the first formal security definition for the dynamic setting as well as forward and backward privacy definitions. We then propose <inline-formula><tex-math notation="LaTeX">$\mu$</tex-math></inline-formula> <small>SE</small> , the first provably secure DMUSSE scheme and instantiate it in two versions, one based on oblivious data structures and one based on update queues, with different performance trade-offs. Furthermore, we extend <inline-formula><tex-math notation="LaTeX">$\mu$</tex-math></inline-formula> <small>SE</small> to support verifiability of results. To achieve this, users need a secure digest initially computed by the data owner and changed after every update. We efficiently accommodate this, without relying on a trusted third party, by adopting a blockchain-based approach for the digests’ dissemination and deploy our schemes over the permissioned Hyperledger Fabric blockchain. We prototype both versions and experimentally evaluate their practical performance, both as stand-alone systems and running on top of Hyperledger Fabric.

Backward private dynamic searchable encryption with update pattern

Symmetric Searchable Encryption (SSE) realizes to outsource data to an untrusted server privately. Dynamic SSE (DSSE) is a practical application which supports data addition and deletion. However, these update operations incur leakage during search and update queries. Therefore, forward and backward privacy were introduced to address the update and search operation leakage in DSSE. Forward privacy was extensively studied in the literature. Backward privacy with three types of revealing level was studied little. The strongest backward privacy was achieved by the expensive tools, impractical! Wheras the practical DSSEs gained weak backward privacy only. In this paper, we present a practical DSSE scheme to achieve stronger backward security—backward privacy with update pattern. We take advantage of key-homomorphic pseudorandom functions and our scheme requires only 1 roundtrip to get search result.

Towards Multi-Client Forward Private Searchable Symmetric Encryption in Cloud Computing

As a useful cryptographic primitive, searchable symmetric encryption (SSE) has been intensively studied to achieve the secure and efficient retrieval of encrypted data. In order to process update operations, dynamic SSE schemes have been proposed. But recently, file-injection attack has threatened the security of traditional dynamic SSE protocols. Therefore, designing dynamic SSE schemes with forward privacy becomes a new demand to resist the above attack. Meanwhile, multi-client setting is another requirement in SSE techniques where multiple clients can be delegated and have access to the database. However, most of previous forward private schemes were constructed for single-client setting and cannot directly extended to multi-client environment efficiently. To solve the problem, we propose a forward private SSE scheme with support for multi-client in cloud computing. The proposed scheme is based on XOR-homomorphic function and involves two new data structures as private link and public search tree. Security proof demonstrates the proposed scheme can meet the desired secure features. We then conduct experimental evaluation of the proposed scheme and make comparison with related schemes. The result shows that the proposed scheme tends to have high efficiency.

Preserving Security, Privacy of Health Passport Over Patient in Cloud

The passport is an expandable document in which key personal, social care and clinical information is recorded. Everyday people move to difference places whether abroad or within the country and some people it might happen they forgot their health passport or they are not registered in any health sectors as a result it might be difficult to have treatment without a health passport. So we designed a Cloud health passport system which is secure, fast and private which will be helpful, using block chain algorithm to allow continuous updating by family and health professionals, acting as a ‘live’ synchronized record of changing need, service. The passport is set up by the patient (or their agreed representative) and carried on their mobile device across different healthcare settings using Dynamic Searchable Symmetric Encryption (DSSE). It stores demographic details and pertinent clinical information. By having a digital record of this information, valuable patient (and administrative) time is not wasted at registration, improving the patient experience. By incorporating an individual health identifier, it allows a patient to be readily identified across any healthcare setting. The option of storing the dates of upcoming appointments could lead to a reduction in the out-patient non-attendance rate currently estimated at 15%. The increased likelihood that important clinical information is filed to the correct patient record frees up more time for direct patient care.

Verifiable dynamic search over encrypted data in cloud‐assisted intelligent systems

The cloud-assisted intelligent systems have attracted extensive attention due to their powerful data analysis and computation capabilities. However, how to handle encrypted data remains a challenging problem in intelligent systems. A promising solution is searchable symmetric encryption (SSE), which enables a client to privately outsource their data to the cloud while preserving keyword search functionality. In practice, dynamic SSE is more practical and supports efficient data addition and deletion. Unfortunately, data update will leak some additional information which can be exploited to break data privacy. To address this issue, forward and backward secure SSE schemes are proposed to reduce the leakage of data update. That is, forward security guarantees that the newly updated documents cannot reveal the previously searched keywords, while backward security guarantees that the server cannot recover the deleted documents. However, the existing forward and backward secure SSE schemes mainly consider curious-but-honest server. How to verify the soundness and completeness of search results is still a challenge. In this paper, we propose a noninteractive verifiable dynamic SSE scheme with forward and backward security from two universal accumulators. Specifically, the server in our scheme only needs one roundtrip to return the nondeleted search results to the client, which saves the communication overhead dramatically. Besides, our scheme can achieve public verification that anyone can verify the search results but not only the client who has the private key. Finally, we give a formal security analysis and compare the proposed scheme with other related work, the results show that our scheme can achieve the desired security properties with practical efficiency.

Verifiable Conjunctive Dynamic Searchable Symmetric Encryption With Forward and Backward Privacy

Abstract Dynamic searchable symmetric encryption (DSSE) with forward and backward privacy makes it possible to perform search on the outsourced encrypted database efficiently while still allowing updates under acceptable leakage. Current forward and backward private DSSE (FB-DSSE) scheme proposed by Zuo et al. cannot support conjunctive keyword query and the cloud server needs to be honest-but-curious. Recent FB-DSSE scheme supporting conjunctive keyword query proposed by Patranabis et al. cannot verify search results. On the other hand, searchable symmetric encryption scheme proposed by Wang et al. that supports conjunctive keyword query and the verification of search results cannot achieve forward and backward privacy. The problem of constructing a verifiable conjunctive FB-DSSE scheme is still open. In this paper, we propose a verifiable conjunctive dynamic searchable symmetric encryption scheme (VCDSSE). VCDSSE is a FB-DSSE scheme that additionally supports the verification of search results and conjunctive keyword query. We revisit homomorphic MAC to enable efficient verification of search results, adopt the technique of oblivious cross-tags to achieve conjunctive keyword query and utilize state chain to ensure forward and backward privacy. The formal security analysis and performance evaluation demonstrate that VCDSSE is secure and practical as compared with Mitra scheme in terms of search time.

Achieving Secure and Efficient Dynamic Searchable Symmetric Encryption over Medical Cloud Data

In medical cloud computing, a patient can send her medical data to a cloud server from afar. Because medical data is highly sensitive, only authorized doctors are allowed to access it in this case. A frequent solution is to encrypt data before outsourcing it, with the patient simply sending the corresponding encryption key to the authorized doctors. However, due to the difficulties of digging through the encrypted data, the usability of outsourced medical data is severely limited. Over medical cloud data, we propose Secure and Efficient Dynamic Searchable Symmetric Encryption (SEDSSE) schemes. To begin, we propose a dynamic searchable symmetric encryption scheme that uses the secure k-Nearest Neighbor (kNN) and Attribute-Based Encryption (ABE) techniques to achieve two important security features: forward privacy and backward privacy, both of which are difficult to achieve in the field of dynamic searchable symmetric encryption. Then, to address the key sharing problem that plagues the kNN-based searchable encryption strategy, we suggest an improved technique. In terms of storage, search, and update complexity, our solutions outperform prior proposals. Extensive tests show that our approaches are efficient in terms of storage overhead, index building, trapdoor generation, and query.