Search Token Research Articles

Secure Blockchain Assisted Attribute-Based Keyword Search for Collaborative E-Healthcare

In the age of technological advancement, collaborative E-healthcare emerges as a transformative system eliminating traditional location and accessibility barriers in healthcare services. Here, Searchable Encryption (SE) plays a key role in enabling healthcare providers to outsource encrypted medical data and search services to third parties like cloud servers, thereby reducing storage and management expenses. This intermediary approach poses challenges of single-point failure, privacy breaches, and potentially untrustworthy results. State-of-the-art public key-based SE methods use a cloud-assisted architecture that doesn’t support reliable and practical searches with fine-grained permissions. Also, such systems require additional support to address potential privacy leakages and ensure data availability at the storage server. To address these concerns, we propose a B lockchain-assisted E fficient and S ecure K eyword S earch (BESKS) scheme to enforce fine-grained keyword search privilege control while achieving practical search complexity. Our scheme employs a ciphertext policy attribute-based keyword search mechanism where keywords are encrypted using expressive access policies to build an inverted index structure. The encrypted indexes are stored on the blockchain while encrypted medical documents are stored on InterPlanetary File System (IPFS) nodes to enhance availability and ensure the reliability and scalability of our approach. Our scheme utilizes blockchain-based smart contract for efficient, secure search operations and ensures financial fairness in fine-grained searches. Search tokens are generated based on user attributes and query keywords to facilitate private searches on-chain. To enhance the search process, our secure index enables exact match for a query keyword in constant time to ensure expensive authorization operations are performed only once. Theoretical analysis suggests that our BESKS is more efficient and secure than state-of-the-art schemes. Prototype implementation results on the Ethereum blockchain network further validate its feasibility for real-world applications, demonstrating the scheme's practical applicability in collaborative E-Healthcare systems.

Selective Information Flow for Transformer Tracking

Fully transformer-based one-stream trackers have demonstrated outstanding performance on challenging benchmark datasets over the past three years. These trackers enable bidirectional information flow between all target template and search region tokens to compute attention features without assessing its impact on the tracker’s discriminative capability. Our study found that the information flow from a large portion of background tokens in the search region diminishes the importance of the target-specific features of the template. Moreover, previous transformer-based trackers fail to consider cues from the dynamic background region, even though it contains information about distracting similar objects. To address the identified limitations in transformer tracking, we propose a novel Selective Information Flow Tracking (SIFTrack) framework to enhance the tracker’s discriminative capability by selectively allowing information flow between different types of token groups. In the early encoder layers of the proposed SIFTrack, interactions from all search tokens to target template tokens are blocked to enrich target-specific feature extraction. In the deeper encoder layers, search tokens are partitioned into target and non-target tokens based on their attention scores. Then, bidirectional flow from target search tokens to template tokens is allowed to capture the appearance changes of the target. In addition, by including tokens from the dynamic background, SIFTrack effectively avoids distractor objects by capturing cues from the area surrounding the target. The proposed SIFTrack demonstrated outstanding performance in challenging benchmarks, particularly excelling in the one-shot tracking benchmark GOT-10k, achieving an average overlap of 74.6%. The code, models, and results of this work are available at https://github.com/JananiKugaa/SIFTrack.

CoD-DSSE: A practical efficient dynamic searchable symmetric encryption with lightweight clients

Dynamic searchable symmetric encryption(DSSE) combines dynamic update with searchable encryption, allowing users to not only achieve keyword retrieval, but also dynamically update encrypted data stored on semi-trusted cloud server, effectively protecting user’s privacy. However, the majority of existing DSSE schemes exhibit inefficiencies in practical applications because of their complex structure. In addition, to store the status of keywords, the storage requirements of the client increase proportionally with the number of keyword/document pairs. Therefore, the client storage will be overwhelmed when confronted with a substantial increase in the volume of keyword/document pairs. To solve these issues, we propose a practical efficient dynamic searchable symmetric encryption scheme with lightweight clients—CoD-DSSE. A novel index structure similar to a chest of drawers is proposed in CoD-DSSE, which allows users to efficiently search all document indexes through XOR operations and keeps the keyword status on the server to lightweight clients. Furthermore, we use a random number generator to construct new search tokens for forward security and achieve backward security by using a Bloom filter to store the deleted document index, which can significantly reduce communication costs. The experimental and security analyses show that CoD-DSSE is efficient and secure in practice.

Multi-modal interaction with token division strategy for RGB-T tracking

RGB-T tracking takes visible and infrared images as inputs, which is an extended application of multi-modal fusion in the field of visual object tracking. The complementarity between visible and infrared modalities can enhance the robustness of tracker in complex scenes. Cross-modal interaction can facilitate the fusion and synergy of different modalities, but most previous methods lack clear target information in multi-modal fusion, leading to some undesired cross-relation in interaction. To reduce these undesired cross-relations, we propose a Multi-modal Interaction scheme Guided by Token Division strategy (MIGTD). This scheme divides the input multi-modal tokens into several categories and restricts the interaction between tokens by setting different rules. The above operation is implemented in parallel through an attention masking strategy. To accurately classify search tokens, an instance segmentation task with box-supervised loss is employed. We conduct extensive experiments on three popular benchmark datasets, RGBT234, LasHeR and VTUAV. The experimental results indicate that the tracker proposed in this article reach the world’s advanced level in performance.

An improved finegrained ciphertext policy based temporary keyword search on encrypted data for secure cloud storage

We present a temporary keyword search over sensitive and confidential health data in a cloud environment. The cloud constitutes a semi-trusted domain, making it necessary for data owners to secure their data before outsourcing it through techniques like encryption. Attribute-based keyword search techniques tend to perform a search operation using a search token generated by an authorized user. These search tokens can lead to serious privacy threats, as they can extract all ciphertexts that may have been generated along with their keyword. Therefore, restricting search tokens to extract ciphertexts generated within a time interval is a more promising solution. In this paper, we present a novel ciphertext policy fine-grained temporary keyword that prevents the misuse of these search tokens. Further, it mitigates the risk of insider threats within healthcare organizations by limiting the window of opportunity for unauthorized access to minimum. To assess the security, our proposed scheme is formally proven to be secure against Selectively Chosen Keyword Attacks in the generic bilinear group model. Additionally, we demonstrate that the encryption algorithm’s complexity is linear in relation to the number of attributes. Our scheme’s significance and practicality are revealed by the performance evaluation.

Reducing Paging and Exit Overheads in Intel SGX for Oblivious Conjunctive Keyword Search

Paging and exit overheads have been proven to be the performance bottlenecks when adopting Searchable Symmetric Encryption (SSE) with trusted hardware such as Intel SGX for keyword search. This problem becomes more serious when incorporating ORAM and SGX to design oblivious SSE schemes such as POSUP [1] and Oblidb [2] which can defend against inference attacks. The main reason comes from high round communication complexity of ORAM and constrained trusted memory created by SGX. To overcome this performance bottleneck, we propose a set of novel SSE constructions with realistic security/performance trade-offs. Our core idea is to encode the keyword-identifier pairs into a bloom filter to reduce the number of ORAM operations during the search procedure. Specifically, Construction 1 loads the bloom filter into the enclave sequentially, which outperforms about <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$1.7\times$</tex-math></inline-formula> when the dataset is large compared with the performance of the baseline that directly combines ORAM and SGX. To further improve the performance of Construction 1, Construction 2 classifies keywords into groups and stores these groups in different bloom filters. By additionally leaking the keywords in search token belonging to which groups, Construction 2 outperforms Construction 1 by <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$16.5\sim 36.8\times$</tex-math></inline-formula> and provides an improvement of at least one order over state-of-the-art oblivious protocols.

Less payment and higher efficiency: A verifiable, fair and forward-secure range query scheme using blockchain

Searchable symmetric encryption (SSE) has recently been under the spotlight in a cloud data storage system due to its high efficiency. SSE allows a client to outsource his private data while maintaining data searchability. To ensure the correctness of query results, verifiable SSE has attracted a lot of attention from both academia and industry to enable reliable encrypted search over the untrusted cloud server. However, most traditional verifiable SSE schemes focus on point queries instead of range queries. Moreover, no effective countermeasures are available to prevent clients from maliciously rejecting the correct result for denying the payment. In this paper, we take the first step to study verifiable range queries with fairness and forward security. First, to support efficient range query over numerical values, we propose Prefix Tree-like Keyword Set (PTKS), a novel data structure to largely reduce the number of search tokens. Specifically, the number of search tokens is up to a logarithmic value (e.g., 7) of the query range width (e.g., [0, 1000]) with PTKS. Then, we propose a double-layer verification mechanism including client-side verification and on-chain verification via the smart contract on the blockchain to achieve cost-effective fair verification. In addition, our range query scheme supports forward-secure update operations. Based on these, we propose a blockchain-based verifiable, fair and forward-secure range query scheme. Finally, extensive experiments demonstrate the efficiency of our scheme.

Updatable searchable symmetric encryption: Definitions and constructions

Searchable symmetric encryption (SSE) allows a client to search over encrypted data. To address the real threat of key compromise in practice, this work initiates the study of key rotation for SSE and introduces the notion of updatable SSE (USSE). In USSE, a client can issue a single update token that permits the server to convert existing encrypted data from the old key to the new key. In particular,•we formalize the syntax of USSE and define the security model that captures the inference of key, search token, update token and encrypted data with bi-/uni-/no-directional key updates and bi-/uni-directional encrypted data updates.•we present a USSE scheme that supports conjunctive queries with sub-linear complexity, and prove its security with no-directional key update and bi-directional encrypted data update. We also give extensions for concerning different key/encrypted data updates.•we implement our USSE schemes and evaluate the performance with real-world dataset, which illustrates that our schemes achieve practically acceptable computational overhead and communication cost. Technically, our formalization of USSE is inspired by updatable encryption (UE); our USSE schemes are obtained by a semi-generic transformation from Cash et al.'s SSE and UE. The transformation itself only relies on DL and DBDH assumptions. We believe that the transformation is of independent interest and applicable to other scenarios where the SSE systems follow the structure of Cash et al.'s work.

Owner-free Distributed Symmetric Searchable Encryption Supporting Conjunctive Queries

Symmetric Searchable Encryption (SSE), as an ideal primitive, can ensure data privacy while supporting retrieval over encrypted data. However, existing multi-user SSE schemes require the data owner to share the secret key with all query users or always be online to generate search tokens. While there are some solutions to this problem, they have at least one weakness, such as non-supporting conjunctive query, result decryption assistance of the data owner, and unauthorized access. To solve the above issues, we propose an O wner-free Di stributed S ymmetric searchable encryption supporting C onjunctive query (ODiSC). Specifically, we first evaluate the Learning-Parity-with-Noise weak Pseudorandom Function (LPN-wPRF) in dual-cloud architecture to generate search tokens with the data owner free from sharing key and being online. Then, we provide fine-grained conjunctive query in the distributed architecture using additive secret sharing and symmetric-key hidden vector encryption. Finally, formal security analysis and empirical performance evaluation demonstrate that ODiSC is adaptively simulation-secure and efficient.

An Attribute-Based Searchable Encryption Scheme for Cloud-Assisted IIoT

The searchable encryption is a particular case of structured encryption, which has been intensively researched in the secure cloud storage system. By constructing structured secure index such as encrypted multi-maps (EMM), encrypted inverted index (EII), etc., searchable encryption can achieve efficient keyword search over encrypted data set. However, existing searchable encryption constructions do not take search permissions into consideration, resulting in the lack of a mechanism of the data access control, which may not be suitable for IIoT applications, since an integrated industrial system contains all kinds of data with rigorous access permissions. In this paper, we construct an attribute-based searchable encryption construction for cloud-assisted IIoT application scenario. By designing the novel access policy based structured secure index and the attribute-based search token, our construction achieves fine-grained keyword search privilege control over encrypted IIoT data as well as the same search complexity as the traditional searchable encryption. To the best of our knowledge, this is the first Attribute-Based Searchable Encryption (ABSE) construction. We provide the correctness and security proofs for our construction. Experimental evaluation results in a real-world data set show the correctness and the practical search efficiency of the proposed ABSE.

An efficient, secure and verifiable conjunctive keyword search scheme based on rank metric codes over encrypted outsourced cloud data

Public key encryption with keyword search (PEKS) is a cryptographic primitive that allows a secure search for desired keywords of data users by a cloud server using a search token. To the best of our knowledge, we propose the first practical, semantic secure, and post-quantum PEKS scheme based on rank metric codes. The proposed scheme is secure against keyword guessing attack, reaction attack, and key exposure, and enjoys conjunctive keyword search, verifiability of search results using Bloom filter and garbled Bloom filter. We implement the scheme with C++ programming language on a desktop computer. At the security level of 256 bits, the scheme performs all the necessary steps for encryption, keyword search, and verification of search results for one keyword in 22.5 milliseconds. Furthermore, the public key length at this security level is about 5 kilobytes. We show that the scheme is more efficient than the existing relevant post-quantum ones.

MFPSE: Multi-user Forward Private Searchable Encryption with dynamic authorization in cloud computing

Dynamic Searchable Symmetric Encryption (DSSE) allows users to outsource data with ciphertext format to untrusted servers and supports the operations of data adding and deleting, which is adopted in common usage by government and business. Recently, the primitive of Forward Privacy in DSSE has drawn great public interest owing to its beneficial feature, which is that it can guard against the newly uploaded files from linking to previous search tokens. However, most of existing Forward Private Searchable Encryption (FPSE) schemes focus on single-user environment, which means that only the users themselves can utilize the data, greatly limits the wide application in cloud computing. To our knowledge, it is difficult to migrate the FPSE schemes to multi-user network. First, to realize forward privacy, the data owner should share the entire key group to the legitimate users, which means the users have the privilege of tampering or deleting data rather than query only; secondly, some FPSE schemes use the special structures and cannot be directly developed to multi-user network. Inspired by this, we present a scheme of multi-user forward private searchable encryption with dynamic authorization. The proposed scheme is based on a new structure of Multi-user State Chain and involves dynamic keyword-oriented authorization management. We prove our scheme can meet the secure characteristics, then conduct the performance evaluation and experiments. The results demonstrate that compared with the existing solutions, our scheme is superior in efficiency and practicability.

Forward Secure Public Key Encryption with Keyword Search for Outsourced Cloud Storage

Cloud storage has become a primary industry in remote data management service but also attracts security concerns, where the best available approach for preventing data disclosure is encryption. Among them the public key encryption with keyword search (PKSE) is considered to be a promising technique, since clients can efficiently search over encrypted data files. That is, a client first generates a search token when to query data files, the cloud server uses the search token to proceed the query over encrypted data files. However, a serious attack is raised when PKSE meets cloud. Formally speaking, the cloud server can learn the information of a newly added encrypted data file containing the keyword that previously queried by using the search tokens it has received, and can further discover the privacy information. To address this issue, we propose a forward secure public key searchable encryption scheme, in which a cloud server cannot learn any information about a newly added encrypted data file containing the keyword that previously queried. To better understand the design principle, we introduce a framework for constructing forward secure public key searchable encryption schemes based on attribute-based searchable encryption. Finally, the experiments show our scheme is efficient.

Blockchain-Assisted Secure Fine-Grained Searchable Encryption for a Cloud-Based Healthcare Cyber-Physical System

The concept of sharing of personal health data over cloud storage in a healthcare-cyber physical system has become popular in recent times as it improves access quality. The privacy of health data can only be preserved by keeping it in an encrypted form, but it affects usability and flexibility in terms of effective search. Attribute-based searchable encryption (ABSE) has proven its worth by providing fine-grained searching capabilities in the shared cloud storage. However, it is not practical to apply this scheme to the devices with limited resources and storage capacity because a typical ABSE involves serious computations. In a healthcare cloud-based cyber-physical system (CCPS), the data is often collected by resource-constraint devices; therefore, here also, we cannot directly apply ABSE schemes. In the proposed work, the inherent computational cost of the ABSE scheme is managed by executing the computationally intensive tasks of a typical ABSE scheme on the blockchain network. Thus, it makes the proposed scheme suitable for online storage and retrieval of personal health data in a typical CCPS. With the assistance of blockchain technology, the proposed scheme offers two main benefits. First, it is free from a trusted authority, which makes it genuinely decentralized and free from a single point of failure. Second, it is computationally efficient because the computational load is now distributed among the consensus nodes in the blockchain network. Specifically, the task of initializing the system, which is considered the most computationally intensive, and the task of partial search token generation, which is considered as the most frequent operation, is now the responsibility of the consensus nodes. This eliminates the need of the trusted authority and reduces the burden of data users, respectively. Further, in comparison to existing decentralized fine-grained searchable encryption schemes, the proposed scheme has achieved a significant reduction in storage and computational cost for the secret key associated with users. It has been verified both theoretically and practically in the performance analysis section.

A blockchain-assisted framework for secure and reliable data sharing in distributed systems

The explosive growth of big data is pushing forward the paradigm of cloud-based data store today. Among other, distributed storage systems are widely adopted due to their superior performance and continuous availability. However, due to the potentially wide attacking surfaces of the public cloud, outsourcing data store inevitably raises new concerns on user privacy exposure and unauthorized data access. Besides, directly introducing a centralized third-party authority for query authorization management does not work because it still can be compromised. In this paper, we propose a blockchain-assisted framework that can support trustworthy data sharing services. In particular, data owners allow to outsource their sensitive data to distributed systems in encrypted form. By leveraging smart contracts of blockchain, a data owner can distribute secret keys for authorized users without extra round interaction to generate the permitted search tokens. Meanwhile, such blockchain-assisted framework naturally solves the trust issues of query authorization. Besides, we devise a secure local index framework to support encrypted keyword search with forward privacy and mitigate blockchain overhead. To validate our design, we implement the prototype and deploy it at Amazon Cloud. Extensive experiments demonstrate the security, efficiency, and effectiveness of the blockchain-assisted design.

Forward Privacy Preservation in IoT-Enabled Healthcare Systems

In recent years, Internet of Things (IoT)-enabled health monitoring wearable devices have become a trend in healthcare systems, regularly collecting vital sign data from patients and uploading them to the cloud. Through on-demand search queries, data are shared with third-party healthcare service providers to monitor patients' health status and provide timely diagnoses. To ensure privacy and security, patient health data should be encrypted before being uploaded to the cloud. The cloud can give search encryption services. However, current searchable encryption (SE) technologies still have problems with forward privacy security and verifiability. This article proposes an IoT-cloud-enabled healthcare data system incorporating a SE method with forward privacy and verifiability. By designing a trapdoor permutation function, we render the resulting output indistinguishable from meaningless random data to the adversary. Thus, the adversary cannot judge the relationship between a newly inserted record and a past search token, and therefore, the system realizes forward privacy or forward secrecy. We propose a multikeyword search verification mechanism based on a pseudo-random function. Our approach solves verifying the correctness of search results in the top-k search scenario with partial search results. <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><b>A</b></i> formal security analysis proves that our scheme achieves forward privacy preservation, which can help guarantee healthcare data privacy. Additionally, a performance evaluation shows that our method is efficient and effective, providing an information security system to preserve patient privacy in IoT-enabled healthcare systems.

Efficient SSE With Forward ID-Privacy and Authentication in the Multi-Data-Owner Settings

Based on Sun et al. ’s multi-client symmetric searchable encryption (SSE) scheme (at ESORICS 2016), and combining Zhao’s identity-concealed authenticated encryption (CCS 2016), a new SSE scheme with multi-data-owner functionalities is proposed. By setting two key generation centers, our scheme first implements multi-data-owner SSE. In particular, compared with Sun et al. ’s scheme, the new scheme not only meets the same security requirements stated by them, but also further strengthens the securities of the same category relevant scheme by providing identity-concealment, authentication of data user to server and confidentiality of search token. The identity-concealment aims to provide privacy protection (Forward ID-Privacy) for data users by hiding their identity information, while the authentication is to resist the camouflage attack by applying certificate-based mechanism to our scheme. In particular, the confidentiality of the search token provides replay-attack-resistant by encrypting the plaintext search token generated by data user. While in other works, the adversary can employ the previously generated plaintext search tokens to force the server to perform the same search queries. Furthermore, by efficiency analysis, our scheme reaches almost the same level of efficiency as Sun et al. ’s scheme.

A Dynamic Searchable Symmetric Encryption Scheme for Multiuser with Forward and Backward Security

Dynamic Searchable Symmetric Encryption for Multiuser (M-DSSE) is an advanced form of symmetric encryption. It extends the traditional symmetric encryption to support the operations of adding and deleting the encrypted data and allow an authenticated group of data users to retrieve their respective desired encrypted data in the dynamic database. However, M-DSSE would suffer from the privacy concerns regarding forward and backward security. The former allows an attacker to identify the keywords contained in the added data by lunching file-injection attacks, while the latter allows to utilize the search results and the deleted data to learn the content. To our knowledge, these privacy concerns for M-DSSE have not been fully considered in the existing literatures. Taking account of this fact, we focus on the dynamic searchable symmetric encryption for multiuser meeting the needs of forward and backward security. In order to propose a concrete scheme, the primitives of Pseudorandom Functions (PRF) and the Homomorphic Message Authenticator (HMAC) are employed to construct the inverted index and update the search token. The proposed scheme is proven secure in the random model. And the performance analysis shows that the proposed scheme achieves the enhanced security guarantees at the reasonable price of efficiency.

Privacy-Preserving Multi-Keyword Searchable Encryption for Distributed Systems

As cloud storage has been widely adopted in various applications, how to protect data privacy while allowing efficient data search and retrieval in a distributed environment remains a challenging research problem. Existing searchable encryption schemes are still inadequate on desired functionality and security/privacy perspectives. Specifically, supporting multi-keyword search under the multi-user setting, hiding search pattern and access pattern, and resisting keyword guessing attacks (KGA) are the most challenging tasks. In this article, we present a new searchable encryption scheme that addresses the above problems simultaneously, which makes it practical to be adopted in distributed systems. It not only enables multi-keyword search over encrypted data under a multi-writer/multi-reader setting but also guarantees the data and search pattern privacy. To prevent KGA, our scheme adopts a multi-server architecture, which accelerates search response, shares the workload, and lowers the key leakage risk by allowing only authorized servers to jointly test whether a search token matches a stored ciphertext. A novel subset decision mechanism is also designed as the core technique underlying our scheme and can be further used in applications other than keyword search. Finally, we prove the security and evaluate the computational and communication efficiency of our scheme to demonstrate its practicality.

Multi-user search on the encrypted multimedia database: lattice-based searchable encryption scheme with time-controlled proxy re-encryption

Multimedia cloud storage which saves the huge storage overhead of local devices has attracted considerable attention. However, due to the lack of physical control of data, the privacy protection of data on the multimedia cloud has become one of the main concerns of users. Public-key encryption with keywords search (PEKS) is a technique that can keep the privacy and searchability of data in the cloud. In this paper, we present a PEKS with time-controlled proxy re-encryption model which allows the data owner to delegate the access right of the encrypted multimedia database to other users, to achieve the time-controlled multi-user search. Furthermore, it is designed to resist keywords guessing attack and support conjunctive keywords search. Compared with previous works which require a time server to generate a time seal for the generation of the search token, this model embeds the time information of accessing the encrypted database into public and secret key pairs of data users, which saves the managing overhead and reduces the security risks resulting from an extra server. In addition, most existing PEKS schemes were constructed based on the hardness of classical mathematical problems which can be broken by quantum computers. To address this issue, a lattice-based PEKS scheme based on the above model is proposed, which can be considered as the candidate for protecting multimedia data security in the quantum era.