Keyword Searchable Encryption Research Articles

A Certificateless Verifiable Bilinear Pair-Free Conjunctive Keyword Search Encryption Scheme for IoMT

With superior computing power and efficient data collection capability, Internet of Medical Things (IoMT) significantly improves the accuracy and convenience of medical work. As most communications are over open networks, it is critical to encrypt data to ensure confidentiality before uploading them to cloud storage servers (CSSs). Public key encryption with keyword search (PEKS) allows users to search for specific keywords in ciphertext and plays an essential role in IoMT. However, PEKS still has the following problems: 1. As a semi-trusted third party, the CSSs may provide wrong search results to save computing and bandwidth resources. 2. Single-keyword searches often produce many irrelevant results, which is undoubtedly a waste of computing and bandwidth resources. 3. Most PEKS schemes rely on bilinear pairings, resulting in computational inefficiencies. 4. Public key infrastructure (PKI)-based or identity-based PEKS schemes face the problem of certificate management or key escrow. 5. Most PEKS schemes are vulnerable to offline keyword guessing attacks, online keyword guessing attacks, and insider keyword guessing attacks. We present a certificateless verifiable and pairing-free conjunctive public keyword searchable encryption (CLVPFC-PEKS) scheme. An efficiency analysis shows that the performance advantage of the new scheme is far superior to that of the existing scheme. More importantly, we provide proof of security under the standard model (SM) to ensure the reliability of the scheme in practical applications.

KASE-AKA: Key-aggregate keyword searchable encryption against keyword guessing attack and authorization abuse

Key-Aggregate Searchable (KASE) can enable a data owner to delegate search rights over a set of data files to multiple users through a single aggregated authorization key in multi-user data sharing environments. Despite the elegance of the KASE concept, designing a KASE scheme that simultaneously prevents authorization from being abused and resists offline keyword guessing attacks is a formidable challenge. To respond the challenge, we propose a secure Key Aggregation Keyword Searchable Encryption against Keyword Guessing Attack and Authorization Abuse (KASE-AKA) scheme. Compared with existing KASE schemes, our KASE-AKA scheme has the following merits: (1) supporting dynamic update of user data search right through a user data search right list maintained by the semi-trust cloud server. (2) preventing the authorization from being abused since the authorization key (aggregate key) associates the user’s public key, a subset of access rights, and a common secret value that only the cloud and data owner can collaboratively generate. (3) providing resistance against offline keyword guessing attacks. Correctness proof, security analysis and performance evaluation demonstrate that the proposed KASE-AKA scheme is provably secure, highly efficient and more feasible in practical application scenarios.

REKS: Role-Based Encrypted Keyword Search With Enhanced Access Control for Outsourced Cloud Data

REKS: Role-Based Encrypted Keyword Search With Enhanced Access Control for Outsourced Cloud Data

An efficient multi-data owner cooperative resource sharing scheme against key regeneration in edge computing

In cloud storage, attribute-based keyword searchable encryption realizes multi-user fine-grained authorization access control and outsourcing data sharing. However, (1) resisting key regeneration is an urgent problem to be solved in practical applications of attribute-based keyword search; (2) the general attribute-based keyword search scheme ignores the application scenario where multiple data owners jointly manage files. In addition, the interaction of data between intelligent terminals and cloud servers has become more frequent, leading to issues such as central load, transmission efficiency, and data privacy protection in cloud computing. To address the above issues, we propose an attribute-based searchable encryption scheme with the multi-data owner based on edge computing. In this scheme, the Pedersen (k,n) secret sharing protocol and the Reciprocal protocol are used to realize the common management and sharing of data by the multi-data owner to enhance data security. Secondly, the attribute set and identity information of each user are embedded into the private key to prevent key regeneration and resist user collusion attacks. Thirdly, edge computing is introduced, and part of the storage and decryption work is outsourced to edge nodes to reduce the computing load of users and data transmission bandwidth. Security proof and performance analysis show that the proposed scheme has strong security and practicability in multi-user sharing scenarios such as Online Education with multi-data owners.

Searchable encryption algorithm in computer big data processing application

With the continuous development of computer technology, the amount of data has increased sharply, which has promoted more and more diversified data transportation and processing methods. At the same time, computer data analysis technology can effectively process data. This is reflected in the computer big data analysis technology not only can realize data visualization analysis, but also has data prediction and data quality management. The development of cloud computing network technology can not only provide convenience points for individuals, but also provide space for enterprises to store data. The emergence of keyword search encryption algorithms solves this problem. When users use keywords to search encryption algorithms, they can search for cipher text keywords to find the files or data they want in the cloud environment. At present, it has been widely used. In addition, this article also improves the keyword search plan and the user's query plan according to the dynamic changes of keywords, and proposes a user's multi-dynamic keyword search encryption plan. Through this program, users can search for encrypted files by keywords and change them, and the changed data will be dynamically updated. In this way, the program can realize multi-user data sharing, and can realize efficient search and dynamics.

Verifiable Keyword Search Encryption Scheme That Supports Revocation of Attributes

In recent years, searchable encryption technology and attribute encryption technology have been widely used in cloud storage environments, and attribute-based searchable encryption schemes can both achieve the retrieval of encrypted data and effectively solve the access control problem. Considering that existing attribute-based searchable encryption schemes for cloud storage only support keyword search and do not support attribute revocation, most of the schemes that support attribute revocation only consider the computational overhead of users and ignore the large amount of computational resources consumed by attribute authorization centers when updating keys. In addition, keyword search may lead to partial errors in the returned search results, leading to the wastage of computational and broadband resources. To solve these issues, this paper proposes an attribute-based searchable encryption scheme that supports attribute revocation and is verifiable. To realize fine-grained ciphertext search of encrypted data, support scenarios of dynamic changes of user attributes, and ensure that third-party servers perform the search process reliably and honestly while minimizing computation and storage costs, first, this paper implements attribute revocation with the attribute authorization center by creating a user revocation list and an attribute key revocation list. At the same time, the system updates the attribute key at the time of user search request, which effectively reduces the computational overhead. Second, a third-party auditor is introduced to ensure the correctness of the search results. Finally, the security of this paper is verified by theoretical analysis, and the efficiency and practicality of this paper are verified by comparing it to other schemes through simulation experiments.

Registered Keyword Searchable Encryption Based on SM9

The SM9 algorithm is an Identity-Based Encryption (IBE) algorithm independently made by China. The existing SM9 searchable encryption scheme cannot be effective against insider keyword guessing attacks and violates users’ data privacy. This article utilizes the SM9 encryption method to propose a Registered Public Keyword Searchable Encryption based on SM9 (RKSE-SM9), which uses the SM9 user keys in the registration keyword algorithm. For RKSE-SM9 to generate the keyword ciphertext or trapdoor, a secure server must first register the keyword, which effectively and reasonably protects users’ data and resists honest and curious cloud servers. From there, we also utilize Beaver’s triple to construct an improved registered keyword generation algorithm, defining and proving that the improved algorithm satisfies the concept of indistinguishability against registration keywords, achieving a higher level of privacy. In addition, compared with existing SM9 searchable encryption, our scheme proved to guarantee better security while reducing the computational efficiency by only 1%; compared with the existing registered keyword searchable encryption scheme, the overall operational efficiency increases by 63%.

A homomorphic approach for security and privacy preservation of Smart Airports

The concept of Smart Airport is emerging in the Aviation sector because of the industry 4.0 revolution. To provide the best facility to the air travelers, most of the airports have enhanced their infrastructure using smart automation and Cloud Services (CS), etc. which play a significant role in increasing the revenue of the aviation industry. As the use of digital technology at airports is increasing, they are becoming progressively vulnerable to cyber-attacks and data breaches. The data collected by the airports is stored in specialized cloud databases, which ensures the availability of the data at any time. However, cloud servers have been compromised several times which leads to a lack of trust by the consumers. To meet the privacy and security objectives of the data collected at the airports and stored in the cloud, this research proposes a Searchable Encryption (SE) scheme based on Partial Homomorphic Encryption (PHE). The proposed scheme allows users to search on the encrypted data stored in the cloud hence enhancing the usability of the encrypted data. In this paper, a Single Keyword Searchable Encryption (SKSE) scheme is presented which is implemented using Paillier Cryptosystem. The proposed scheme comprises of two variants (a) Secure SKSE (b) Efficient SKSE. The Secure SKSE scheme exploits the probabilistic properties of the Paillier cryptosystem, whereas, the Efficient SKSE scheme is lightweight as it is based on the deterministic properties of the Paillier cryptosystem. Both variants of SKSE scheme are deployed on a public cloud platform “Contabo” and tested on the real-world aviation data to assess the performance of both approaches. The security and performance analysis illustrates that the proposed Secure SKSE maintains a high-security level by providing probabilistic encryption and trapdoors. On the other hand, the Efficient SKSE is 84 times faster in terms of performance.

Fuzzy Keyword Searchable Encryption Scheme Based on Blockchain

Searchable encryption is a keyword-based ciphertext retrieval scheme, which can selectively retrieve encrypted documents on encrypted cloud data. Most existing searchable encryption schemes focus only on exact keyword searches and cannot return data of interest in fuzzy search. In addition, during the searchable encryption, the cloud server may return invalid results to the data user to save computing costs or for other reasons. At the same time, the user may refuse to pay the service fee after receiving the correct result. To solve the above problems, this paper proposes a fuzzy keyword searchable encryption scheme based on blockchain, which uses edit distance to generate fuzzy keyword sets and generates a secure index with verification tags for each fuzzy keyword set to verify the authenticity of the returned results. The penalty mechanism is introduced through the blockchain to realize the fairness of service payment between users and cloud servers. Security analysis shows that the scheme achieves non-adaptive semantic security. Performance analysis and functional comparison show that the scheme is effective and can meet the requirements of searching applications in the cloud environment.

Device-Oriented Keyword-Searchable Encryption Scheme for Cloud-Assisted Industrial IoT

Massive physical devices are deployed in the Industrial Internet of Things (IoT) to collect ambiance data while heavy storage and communication cost are imposed on these IoT devices. To overcome this constraint, cloud-assisted technologies are introduced to store and manage the collected data. In order to protect data quality and security, encryption is required before uploading data to remote clouds. Consequently, a search function is added to cloud services to find the specific data. However, traditional data searching schemes are constructed in user-oriented systems, where the search function is mainly involved with the relationship between data and users rather than data and devices. As a result, traditional search schemes are not suitable to find special IoT devices. On the other hand, the status of these devices is described by many attributes, e.g., temperature, clean water storage, and machine speed in an early warning system for industrial sewage disposal equipment. Hence, multi-keyword conjunctive queries for partial attributes should be introduced so as to find the target device more accurately and more efficiently. To address these challenges, we propose a new universal device-oriented keyword searchable encryption (Do-KSE) scheme for cloud-assisted IoT in this paper. Furthermore, the functions of a single and conjunctive keyword search are maintained to handle the device search requirement of partial attributes. We conduct extensive experiments to evaluate the proposed scheme. Experimental results show that our scheme has excellent performance because of the lightweight index and query trapdoor.

Reliable Data Sharing by Certificateless Encryption Supporting Keyword Search Against Vulnerable KGC in Industrial Internet of Things

Outsourcing Industrial Internet of Things (IIoT) data on the cloud extends the diversity of data analysis for decision making with minimized costs in communications and storage. However, it is adverse to the confidentiality of IIoT data from the owner as access control is performed by honest-but-curious platforms. Although the encryption strategy guarantees data security, it hinders deliverance due to its inbred all-or-nothing decryption. Certificateless encryption supporting keyword search eliminates the overhead of certificates and privileges to retrieve the required data through encrypted keyword search. However, most of the prior works are precarious against a malicious key generation center, which exposes data protected by users’ private keys. We design a certificateless secure data sharing by uniting the functionalities of encryption and access control on search. Our technique resists in/outside keyword guessing attacks and sustains on-demand user revocation. Besides, it achieves Girault’s Level-3 security in the standard model. Nonetheless, empirical performance analysis under a suitable scenario exhibits its feasibility compared to the other related schemes.

Blockchain-based attribute-based keyword searchable encryption for health cloud system

Blockchain-based attribute-based keyword searchable encryption for health cloud system

Blockchain-based attribute-based keyword searchable encryption for health cloud system

Blockchain-based attribute-based keyword searchable encryption for health cloud system

A blockchain-assisted framework for secure and reliable data sharing in distributed systems

The explosive growth of big data is pushing forward the paradigm of cloud-based data store today. Among other, distributed storage systems are widely adopted due to their superior performance and continuous availability. However, due to the potentially wide attacking surfaces of the public cloud, outsourcing data store inevitably raises new concerns on user privacy exposure and unauthorized data access. Besides, directly introducing a centralized third-party authority for query authorization management does not work because it still can be compromised. In this paper, we propose a blockchain-assisted framework that can support trustworthy data sharing services. In particular, data owners allow to outsource their sensitive data to distributed systems in encrypted form. By leveraging smart contracts of blockchain, a data owner can distribute secret keys for authorized users without extra round interaction to generate the permitted search tokens. Meanwhile, such blockchain-assisted framework naturally solves the trust issues of query authorization. Besides, we devise a secure local index framework to support encrypted keyword search with forward privacy and mitigate blockchain overhead. To validate our design, we implement the prototype and deploy it at Amazon Cloud. Extensive experiments demonstrate the security, efficiency, and effectiveness of the blockchain-assisted design.

Lightweight and fine‐grained access control for cloud–fog‐based electronic medical record sharing systems

SummaryThe electronic medical record (EMR) sharing systems promote medical services' efficiency, save human resources, and reduce energy consumption. A number of patients are ready to store their medical records in cloud. Nevertheless, owing to the medical record's privacy sensitivity, security problems are of critical importance in EMR sharing systems. This work presents a lightweight and fine‐grained access control with data security for EMR sharing by combining fog and cloud using symmetric encryption algorithm and attribute‐based encryption algorithm. Data owners encrypt the medical records with symmetric encryption and store them in cloud. The symmetric key is protected by ciphertext‐policy attribute‐based encryption and stored in fog. The keyword extracted from medical record is encrypted by data owner with key‐policy attribute‐based keyword search encryption and sent to fog. The requesters who satisfy with the keyword ciphertext's access policy can search for the keyword. They are capable of accessing the symmetric key if their attributes satisfy with the symmetric key ciphertext's access policy. The key management method and access control scheme guarantee the medical record's security and privacy. Security analysis demonstrates that our work is able to achieve privacy protection, secure search, fine‐grained access control, and collusion resistance.

Blockchain-Based Employment Contract System Architecture Allowing Encrypted Keyword Searches

We introduce a blockchain-based online employment contract system to protect the rights and interests of both employees and employers. In the proposed model, an employer and a worker can interactively create a new electronic online contract, and the mutually signed contract is saved on a contract blockchain so that the contract becomes certifiable but cannot be forged by the contract signers. In particular, the blockchain in our system provides transactional privacy to protect sensitive personal information such as social identifier, contact information, income, and so forth, contained in the contract. Since a remote cloud server must provide not only secure storage, accessibility, and availability of all signed contracts, but also increased security in the server, we propose a new encrypted keyword search mechanism with enhanced search accuracy. Each contract is associated with encrypted keywords generated from the names of contractual parties and must remain confidential and anonymous even to the server. Although, the contracts must always be accessible by the contract signers, only the cloud server should be able to retrieve each user’s contract without decrypting the contract or identifying the contract signer. To meet these requirements, we propose a new encrypted keyword search mechanism based on Gentry’s homomorphic encryption technology; the server can find each user’s contract when two encrypted arbitrary keywords are homomorphic to each other. Since the keywords in the proposed system are based on person names or business names, they are easily predictable, and, thereby, many synonyms for a keyword can exist. Therefore, the proposed encrypted keyword search takes into account not only the keywords but also the ownership of each contract; in this way, the proposed search scheme is secure against a keyword guessing attack and provides strong search accuracy against the keyword synonyms. As a result, users can only access their own contracts, and the cloud server can exactly retrieve the requester’s contracts. Implementations for the proposed system and corresponding analysis on its security and simulated performance are provided.

Multi-user Fuzzy Keyword Searchable Encryption Scheme Based on Certificateless Cryptosystem

Nowadays, the application prospect of cloud storage is more and more extensive, and the security problem of cloud storage has become one of the hotspots of research. Searchable encryption can make full use of the huge computing resources of cloud servers and solve the problem of secure search after data encryption and upload. However, the existing searchable encryption schemes have the problems of high computational cost, low security, and insufficient flexibility in the way of searching keywords. In order to solve these problems, we propose a new certificateless multi-user fuzzy keyword searchable encryption scheme, which introduces the key distribution center, effectively reduces the computational cost, solves the problem of certificate management and key escrow, and uses the optimized wildcard technology to realize the fuzzy search of multiple users, which is not only brings convenience to users, but also realizes flexible search methods. Finally, the analysis results show that our scheme has indistinguishable security under keyword guessing attacks. Simulation experiments and performance analysis results show that our scheme has higher computational efficiency.

Multi-keyword Fuzzy Search over Encrypted Cloud Storage Data

With the rapid development of the cloud computing, more and more users choose to store their encrypted data on the cloud server. Searchable encryption (SE) schemes capacitate legal users to retrieve encrypted data in the cloud server and the cloud server does not leak sensitive information about the encrypted data. In this paper, we use searchable symmetric encryption (SSE) to construct our scheme. SSE can be divided into exact keyword searchable encryption and fuzzy keyword searchable encryption. Fuzzy keyword searchable encryption scheme takes into account the minor clerical errors of users. When the query keyword does not match the index stored in the cloud server, the fuzzy keyword searchable encryption schemes can find the closest keyword and return the matching encrypted documents, which improves the availability of the cloud server. In this paper, we propose a multi-keyword fuzzy searchable encryption scheme by using locality sensitive hashing (LSH) and bloom filter which has high search accuracy.

Password-authenticated searchable encryption

We introduce Password Authenticated Searchable Encryption (PASE), a novel searchable encryption scheme where a single human-memorizable password can be used to outsource (encrypted) data with associated keywords to a group of servers and later retrieve this data through the encrypted keyword search procedure. PASE ensures that only the legitimate user who knows the initially registered password can perform these operations. In particular, PASE guarantees that no single server can mount an offline attack on the user’s password or learn any information about the encrypted keywords. The concept behind PASE protocols extends previous concepts behind searchable encryption by removing the requirement on the client to store high-entropy keys, thus making the protocol device-agnostic on the user side. In this paper, we model the functionality of PASE along with two security requirements (indistinguishability against chosen keyword attacks and authentication) and propose an efficient direct construction in a two-server setting those security we prove in the standard model under the Decisional Diffie–Hellman assumption. Our constructions support outsourcing and retrieval procedures based on multiple keywords and allow users to change their passwords without any need for the re-encryption of the outsourced data. Our theoretical efficiency comparisons and experimental performance and scalability measurements show that the proposed scheme is practical and offers high performance in relation to computations and communications on the user side. The practicality of our PASE scheme is further demonstrated through its implementation within a JavaScript-based web application that can readily be executed on any (mobile) browser and remains practical for commodity user devices such as laptops and smartphones.

A novel security mechanism using AES cryptography approach in cloud computing

SummaryFor a smart cloud computing system, security and privacy are the required factors. In recent days, the evolvement of cloud technology is immense, according to which several cloud service providers (CSPs) evolved. Each CSP has its infrastructure with its security policies. Even though still the security in cloud computing is an existing challenge, it is more important to maintain the trustiness of cloud environment among the cloud users. On this motto, we propose a novel tailored—advanced encryption standard (AES) Cryptographic Algorithm (TCA). AES is one of the popular cryptography algorithms. We indulged in increasing the performance of this algorithm by minimizing the time taken for the cryptography process. Here, the cryptography is processed with AES algorithm. In order to improve the efficiency of AES, a concept of a chunk file system is introduced. The input file is chunked into multiple which facilitates quick and effective encryption. To prove the efficiency of our proposed system, a comparison work is carried out with the existing algorithms lightweight keyword searchable encryption (LFSE) and cloud key management system (CKMS). The comparison work is based on the aspect of time taken during key generation, encryption and decryption. The obtained result is plotted, and comparison output clearly states our TCA's excellence in the aspect of efficiency compared to others.