Searchable Symmetric Encryption Scheme Research Articles

A provably lightweight and secure DSSE scheme, with a constant storage cost for a smart device client.

Outsourcing data to remote cloud providers is becoming increasingly popular amongst organizations and individuals. A semi-trusted server uses Searchable Symmetric Encryption (SSE) to keep the search information under acceptable leakage levels whilst searching an encrypted database. A dynamic SSE (DSSE) scheme enables the adding and removing of documents by performing update queries, where some information is leaked to the server each time a record is added or removed. The complexity of structures and cryptographic primitives in most existing DSSE schemes makes them inefficient, in terms of storage, and query requests generate overhead costs on the Smart Device Client (SDC) side. Achieving constant storage cost for SDCs enhances the viability, efficiency, and easy user experience of smart devices, promoting their widespread adoption in various applications while upholding robust privacy and security standards. DSSE schemes must address two important privacy requirements: forward and backward privacy. Due to the increasing number of keywords, the cost of storage on the client side is also increasing at a linear rate. This article introduces an innovative, secure, and lightweight Dynamic Searchable Symmetric Encryption (DSSE) scheme, ensuring Type-II backward and forward privacy without incurring ongoing storage costs and high-cost query generation for the SDC. The proposed scheme, based on an inverted index structure, merges the hash table with linked nodes, linking encrypted keywords in all hash tables. Achieving a one-time O(1) storage cost without keyword counters on the SDC side, the scheme enhances security by generating a fresh key for each update. Experimental results show low-cost query generation on the SDC side (6,460 nanoseconds), making it compatible with resource-limited devices. The scheme outperforms existing ones, reducing server-side search costs significantly.

Fast Multi-User Searchable Encryption with Forward and Backward Private Access Control

Untrusted servers are servers or storage entities lacking complete trust from the data owner or users. This characterization implies that the server hosting encrypted data may not enjoy full trust from data owners or users, stemming from apprehensions related to potential security breaches, unauthorized access, or other security risks. The security of searchable encryption has been put into question by several recent attacks. Currently, users can search for encrypted documents on untrusted cloud servers using searchable symmetric encryption (SSE). This study delves deeply into two pivotal concepts of privacy within dynamic searchable symmetric encryption (DSSE) schemes: forward privacy and backward privacy. The former serves as a safeguard against the linkage of recently added documents to previously conducted search queries, whereas the latter guarantees the irretrievability of deleted documents in subsequent search inquiries. However, the provision of fine-grained access control is complex in existing multi-user SSE schemes. SSE schemes may also incur high computation costs due to the need for fine-grained access control, and it is essential to support document updates and forward privacy. In response to these issues, this paper suggests a searchable encryption scheme that uses simple primitive tools. We present a multi-user SSE scheme that efficiently controls access to dynamically encrypted documents to resolve these issues, using an innovative approach that readily enhances previous findings. Rather than employing asymmetric encryption as in comparable systems, we harness low-complexity primitive encryption tools and inverted index-based DSSE to handle retrieving encrypted files, resulting in a notably faster system. Furthermore, we ensure heightened security by refreshing the encryption key after each search, meaning that users are unable to conduct subsequent searches with the same key and must obtain a fresh key from the data owner. An experimental evaluation shows that our scheme achieves forward and Type II backward privacy and has much faster search performance than other schemes. Our scheme can be considered secure, as proven in a random oracle model.

SWiSSSE: System-Wide Security for Searchable Symmetric Encryption

This paper initiates a new direction in the design and analysis of searchable symmetric encryption (SSE) schemes. We provide the first comprehensive security model and definition for SSE that takes into account leakage from the entirety of the SSE system, including not only from access to encrypted indices but also from access to the encrypted database documents themselves. Such system-wide leakage is intrinsic in end-to-end SSE systems, and can be used to break almost all state-of-the-art SSE schemes (Gui et al., IEEE S&P 2023). We then provide a static SSE construction meeting our new security notion. The proposed SSE scheme involves a combination of novel techniques: bucketization to hide volumes of responses to queries, and delayed, pseudorandom write-backs to disrupt access pattern. Our implementation and analysis of the proposed scheme demonstrates that it offers very strong security against general classes of (system-wide) leakage-abuse attacks with moderate overhead. Our scheme scales smoothly to databases containing hundreds of thousand of documents and millions of keyword-document pairs. To the best of our knowledge, this is the first end-to-end SSE scheme that effectively suppresses system-wide leakage while maintaining practical efficiency.

Reducing Paging and Exit Overheads in Intel SGX for Oblivious Conjunctive Keyword Search

Paging and exit overheads have been proven to be the performance bottlenecks when adopting Searchable Symmetric Encryption (SSE) with trusted hardware such as Intel SGX for keyword search. This problem becomes more serious when incorporating ORAM and SGX to design oblivious SSE schemes such as POSUP [1] and Oblidb [2] which can defend against inference attacks. The main reason comes from high round communication complexity of ORAM and constrained trusted memory created by SGX. To overcome this performance bottleneck, we propose a set of novel SSE constructions with realistic security/performance trade-offs. Our core idea is to encode the keyword-identifier pairs into a bloom filter to reduce the number of ORAM operations during the search procedure. Specifically, Construction 1 loads the bloom filter into the enclave sequentially, which outperforms about <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$1.7\times$</tex-math></inline-formula> when the dataset is large compared with the performance of the baseline that directly combines ORAM and SGX. To further improve the performance of Construction 1, Construction 2 classifies keywords into groups and stores these groups in different bloom filters. By additionally leaking the keywords in search token belonging to which groups, Construction 2 outperforms Construction 1 by <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$16.5\sim 36.8\times$</tex-math></inline-formula> and provides an improvement of at least one order over state-of-the-art oblivious protocols.

Efficient and Expressive Search Scheme over Encrypted Electronic Medical Records

In recent years, there has been rapid development in computer technology, leading to an increasing number of medical systems utilizing electronic medical records (EMRs) to store their clinical data. Because EMRs are very private, healthcare institutions usually encrypt these data before transferring them to cloud servers. A technique known as searchable encryption (SE) can be used by healthcare institutions to encrypt EMR data. This technique enables searching within the encrypted data without the need for decryption. However, most existing SE schemes only support keyword or range searches, which are highly inadequate for EMR data as they contain both textual and digital content. To address this issue, we have developed a novel searchable symmetric encryption scheme called SSE-RK, which is specifically designed to support both range and keyword searches, and it is easily applicable to EMR data. We accomplish this by creating a conversion technique that turns keywords and ranges into vectors. These vectors are then used to construct index tree building and search algorithms that enable simultaneous range and keyword searches. We encrypt the index tree using a secure K-Nearest Neighbor technique, which results in an effective SSE-RK approach with a search complexity that is quicker than a linear approach. Theoretical and experimental study further demonstrates that our proposed scheme surpasses previous similar schemes in terms of efficiency. Formal security analysis demonstrates that SSE-RK protects privacy for both data and queries during the search process. Consequently, it holds significant potential for a wide range of applications in EMR data. Overall, our SSE-RK scheme, which offers improved functionality and efficiency while protecting the privacy of EMR data, generally solves the shortcomings of the current SE schemes.

Less payment and higher efficiency: A verifiable, fair and forward-secure range query scheme using blockchain

Searchable symmetric encryption (SSE) has recently been under the spotlight in a cloud data storage system due to its high efficiency. SSE allows a client to outsource his private data while maintaining data searchability. To ensure the correctness of query results, verifiable SSE has attracted a lot of attention from both academia and industry to enable reliable encrypted search over the untrusted cloud server. However, most traditional verifiable SSE schemes focus on point queries instead of range queries. Moreover, no effective countermeasures are available to prevent clients from maliciously rejecting the correct result for denying the payment. In this paper, we take the first step to study verifiable range queries with fairness and forward security. First, to support efficient range query over numerical values, we propose Prefix Tree-like Keyword Set (PTKS), a novel data structure to largely reduce the number of search tokens. Specifically, the number of search tokens is up to a logarithmic value (e.g., 7) of the query range width (e.g., [0, 1000]) with PTKS. Then, we propose a double-layer verification mechanism including client-side verification and on-chain verification via the smart contract on the blockchain to achieve cost-effective fair verification. In addition, our range query scheme supports forward-secure update operations. Based on these, we propose a blockchain-based verifiable, fair and forward-secure range query scheme. Finally, extensive experiments demonstrate the efficiency of our scheme.

Refined statistical attacks against searchable symmetric encryption using non-indexed documents

Searchable symmetric encryption(SSE) schemes allow clients to search encrypted data stored on remote servers but ensure efficient retrieval by revealing specific information about the queries, such as access patterns. Honest but curious servers can then use these leakages to infer keywords queried by users. However, most attack schemes can only achieve considerable recovery accuracy(over 30%) under favorable conditions. When the auxiliary information is weak, the inference attack schemes using statistical information can achieve the same or even better recovery accuracy. In this paper, an attack based on statistical information is proposed. Our attack iteratively solves the quadratic recovery query problem using a linear optimization solver. With a tiny number of known queries(which can be deleted by the server), the query recovery accuracy can reach about 95% without knowing the exact background knowledge of the documents stored by the client. This process not only makes our scheme outperforms other attack schemes in accuracy but also makes our attack execution more efficient than other schemes, up to a maximum difference of 1000 seconds. The attack can still achieve considerable accuracy even when the defense is applied to the SSE scheme; defenses can help the SSE scheme obfuscate the pattern leakages.

Fast and private multi-dimensional range search over encrypted data

For businesses looking to outsource their data to remote servers, cloud-based data storage is a popular choice. It is popular due to its flexibility, cost-effectiveness, and widespread availability. However, ensuring the confidentiality of data is a critical challenge that must be addressed. As a response to this issue, searchable encryption techniques have been developed. These techniques enable search queries to be performed on encrypted data while still keeping the plaintext confidential. While most existing symmetric searchable encryption schemes are designed for one-dimensional data records or document-keyword inverted indices, this paper introduces MDRSSE, a novel symmetric searchable encryption scheme specifically tailored for multi-dimensional range search. MDRSSE stands out as one of the pioneering SSE schemes to support multi-dimensional range search efficiently, without incurring undetermined additional communication or computation costs. By employing a single round of communication between the client and server, MDRSSE enables an honest-but-curious server to respond to multi-dimensional range queries without gaining knowledge of the data records or revealing the search query. Notably, MDRSSE boasts the lowest overall search complexity compared to existing state-of-the-art symmetric searchable encryption schemes designed for multi-dimensional range search. Extensive experimental tests were conducted to validate the robustness and practicality of our proposed scheme. The results demonstrate that, for a dataset consisting of 100K records with 12 dimensions (with each leaf node holding 500 records), it takes only 2.2 seconds to generate the encrypted dataset, and the overall setup phase completes within 2.5 seconds. Furthermore, for a range query encompassing 50 nodes, the search time is less than 2 ms and 3 ms for the client and server, respectively. MDRSSE achieves semantic security under the IND-CPA assumption, all without requiring additional storage size at the server.

Intelligent privacy preserving deep learning model for securing IoT healthcare system in cloud storage

Nowadays the existing legacy management-based healthcare system maintains and processes a large amount of health-related data. The widespread adoption of the Internet of Things (IoT) and its progressive development have promised the way for the development of IoT-enabled healthcare with impressive data processing and big data storage capabilities. Intelligent medical healthcare intends to offer a framework to remotely monitor users’ health-related data as the Industrial Internet of Things (IIoT) develops. Because they are stored on a cloud server, the data are still susceptible to manipulation and privacy breaches. The Keras Xception Deep Learning System (KX-DLS) with Dynamic Searchable Symmetric Encryption (DSSE) scheme is a revolutionary IoT-based deep learning intelligent privacy-preserving system that is advantageous for digital healthcare and its functionalities to handle security-related challenges. The dataset is being used to pre-train the system, and users’ personal information is kept separate in a secure location. Without knowing any personal information about the users, we analyse health-related data stored in the cloud and build a sophisticated security framework based on a deep learning model. With the most extensive collection of security features, our framework for learning intelligent privacy preservation optimizes the system to guarantee high data integrity and few privacy breaches. As a result, it may be useful in situations where users employ mobile devices with limited resources to engage a healthcare cloud system for extensive virtual health services, and the results of this research show that it has been a better-secured model in comparison with state-of-the-art previous techniques.

Owner-free Distributed Symmetric Searchable Encryption Supporting Conjunctive Queries

Symmetric Searchable Encryption (SSE), as an ideal primitive, can ensure data privacy while supporting retrieval over encrypted data. However, existing multi-user SSE schemes require the data owner to share the secret key with all query users or always be online to generate search tokens. While there are some solutions to this problem, they have at least one weakness, such as non-supporting conjunctive query, result decryption assistance of the data owner, and unauthorized access. To solve the above issues, we propose an O wner-free Di stributed S ymmetric searchable encryption supporting C onjunctive query (ODiSC). Specifically, we first evaluate the Learning-Parity-with-Noise weak Pseudorandom Function (LPN-wPRF) in dual-cloud architecture to generate search tokens with the data owner free from sharing key and being online. Then, we provide fine-grained conjunctive query in the distributed architecture using additive secret sharing and symmetric-key hidden vector encryption. Finally, formal security analysis and empirical performance evaluation demonstrate that ODiSC is adaptively simulation-secure and efficient.

Verifiable and Searchable Symmetric Encryption Scheme Based on the Public Key Cryptosystem

With the rapid development of Internet of Things technology and cloud computing technology, all industries need to outsource massive data to third-party clouds for storage in order to reduce storage and computing costs. Verifiable and dynamic searchable symmetric encryption is a very important cloud security technology, which supports the dynamic update of private data and allows users to perform search operations on the cloud server and verify the legitimacy of the returned results. Therefore, how to realize the dynamic search of encrypted cloud data and the effective verification of the results returned by the cloud server is a key problem to be solved. To solve this problem, we propose a verifiable dynamic encryption scheme (v-PADSSE) based on the public key cryptosystem. In order to achieve efficient and correct data updating, the scheme designs verification information (VI) for each keyword and constructs a verification list (VL) to store it. When dynamic update operations are performed on the cloud data, it is easy to quickly update the security index through obtaining the latest verification information in the VL. The safety and performance evaluation of the v-PADSSE scheme proved that the scheme is safe and effective.

Towards Privacy Preserving in 6G Networks: Verifiable Searchable Symmetric Encryption Based on Blockchain

The blockchain-based searchable symmetric encryption (SSE) scheme allows the retrieval and verification of outsourced data on cloud servers in sixth generation (6G) networks while ensuring the privacy of data. However, existing schemes are challenging to comprehensively meet the requirements of 6G-based intelligent application systems for low latency, high security, and high reliability. To address these limitations, we present VSSE, a novel blockchain-based SSE scheme designed for 6G-based intelligent application systems. Our scheme constructs a state chain structure to resist file injection attacks, thereby ensuring forward privacy. Moreover, we execute the search and verification operations separately on the cloud server and blockchain, while introducing a bitmap index structure and message authentication code (MAC) technology to achieve efficient searching and dynamic verification. Notably, VSSE also includes access control functionality, permitting only authorized users to access relevant files. The combination of remarkable efficiency and strong security establishes our VSSE as an ideal solution suitable for implementation in G-based intelligent application systems.

Efficient dynamic multi-client searchable encryption supporting fuzzy search

Searchable symmetric encryption (SSE) enables the client to outsource its encrypted database to the untrusted server, while maintaining the ability to efficiently search over it. However, most of the existing solutions focus mainly on exact keyword search. That is, it will fail to fetch the desired result even though mild typos. To this end, SSE with fuzzy keyword search has attracted considerable concerns in the literature. We note that the current works support merely single-client setting. How to design fuzzy keyword search-based SSE scheme in the multi-client setting is still open. In this work, we first introduce a dynamic multi-client fuzzy keyword search scheme by employing Intel SGX, which can achieve forward privacy at the expense of multiple trapdoors communication. The proposed construction can reduce client-side computation and communication overload with the aid of Intel SGX. Furthermore, we present an enhanced multi-client fuzzy keyword search scheme that achieves forward privacy even in the presence of the corrupted user. The evaluation of security and efficiency indicates that our schemes are capable of meeting the desired security level and are well-suited for real-world applications.

A dynamic conjunctive keywords searchable symmetric encryption scheme for multiple users in cloud computing

With the continuous advancement of cloud computing technology, massive amounts of heterogeneous data are being outsourced to cloud servers. Dynamic searchable symmetric encryption (DSSE) is widely used for dynamically updating and searching ciphertext. Although many DSSE schemes have been developed in recent years, few can satisfy the requirement for multi-keyword search. To address this problem, we proposed a novel Dynamic Searchable Symmetric Encryption scheme supporting Multiple users and Multiple keywords (MMDSSE) in this paper, specifically designed for the multi-keyword cloud computing paradigm, while also enabling multi-user search capability. To achieve multi-keyword search, a tag is computed using an iso-or operation that records the relationship between the keyword and identifier. In addition, a unique key is assigned by the data owner to each user with different file access rights. This allows users to gain fine-grained control over the ciphertext, and the essential security properties, including forward and backward privacy, can be achieved accordingly. Furthermore, this scheme is resistant to collusion attacks. Finally, the experiment was simulated on the IDEA platform using the Java language. The experimental results demonstrate that this scheme performs well.

A search optimized blockchain‐based verifiable searchable symmetric encryption framework

SummaryOutsourcing storage and computation to cloud servers have become a trend. Although searchable symmetric encryption (SSE) had handled the data privacy issue caused by honest‐but‐curious servers, a semi‐honest server may return incomplete or incorrect results when users search for their encrypted data. To against such servers, scholars have recently used blockchain/Ethereum‐based SSE schemes which utilize the public, that is, active nodes, to verify the search process. However, the search operation in existing schemes is very expansive in terms of fee and time. In this paper, we propose a new blockchain‐based searchable encryption framework with search optimized, that is, free of charge, quicker, and more private, at the cost of some extra storage. Besides, we design a general and efficient verification algorithm for our framework, which makes the search verifiable. In addition, we deploy an instance of our framework on an official Ethereum test network, and the experimental results and evaluations demonstrate the advantage of our framework.

CASE-SSE: Context-Aware Semantically Extensible Searchable Symmetric Encryption for Encrypted Cloud Data

Traditional searchable symmetric encryption (SSE) schemes rarely support context-aware semantic extension, and then lead to the searched results being incomplete or deviating from the user’s query intention. To address this problem, a new context-aware semantically extensible searchable symmetric encryption based on Word2vec model (CASE-SSE) is proposed to achieve context-aware semantic extension in this article. The proposed scheme utilizes outsourced datasets as corpora to extract all keywords for training the Word2vec model, and the trained results is the ontology knowledge base that can be used to extend the semantics of query keywords directly. Further, to facilitate multi-keyword search using the extended query vector, we use the <inline-formula><tex-math notation="LaTeX">$k$</tex-math></inline-formula> -means clustering algorithm to classify outsourced datasets. We then construct an AVL-tree index and an inverted index based on the classified results, thereby achieving efficient context-aware semantically extensible SSE. The security analysis indicates it is secure and effective. The experimental results show that our scheme is superior in both efficiency and accuracy.

Towards Efficient Verifiable Boolean Search Over Encrypted Cloud Data

Symmetric Searchable Encryption (SSE) schemes facilitate searching over encrypted data, and have been extensively explored to improve function, efficiency or security. There are, however, additional functions that we need to consider in a real-world setting. For example, forward and backward privacy are required to adequately secure newly added documents and deleted documents in Dynamic SSE (DSSE) schemes, and support boolean search (that allows users to search over encrypted data using basic boolean operations) to achieve improved efficiency and retrieval accuracy. Therefore, in this paper we first construct the Verifiable Boolean Search over encrypted data (VBS), and then improve VBS to achieve Forward and Backward privacy (VBS-FB). Finally, we formally prove the security of our proposed schemes, and evaluate their performance using real-world datasets.

TWo-IN-one-SSE: Fast, Scalable and Storage-Efficient Searchable Symmetric Encryption for Conjunctive and Disjunctive Boolean Queries

Searchable Symmetric Encryption (SSE) supports efficient yet secure query processing over outsourced symmetrically encrypted databases without the need for decryption. A longstanding open question has been the following: can we design a fast, scalable, linear storage and low-leakage SSE scheme that efficiently supports arbitrary Boolean queries over encrypted databases? In this paper, we present the design, analysis and prototype implementation of the first SSE scheme that efficiently supports conjunctive, disjunctive and more general Boolean queries (in both the conjunctive and disjunctive normal forms) while scaling smoothly to extremely large encrypted databases, and while incurring linear storage overheads and supporting extremely fast query processing in practice. We quantify the leakage of our proposal via a rigorous cryptographic analysis and argue that it achieves security against a well-known class of leakage-abuse and volume analysis attacks. Finally, we demonstrate the storage-efficiency and scalability of our proposed scheme by presenting experimental results of a prototype implementation of our scheme over large real-world databases.

Verifiable and Dynamic Multi-Keyword Search Over Encrypted Cloud Data Using Bitmap

Searchable Symmetric Encryption (SSE), which enables users to search over encrypted data without decryption, has gained increasing attention from both academic and industrial fields. However, existing SSE schemes either have low search efficiency or cannot support multi-keyword search, dynamic updates, and result verification simultaneously. To solve these problems, we propose a Verifiable and Dynamic Multi-keyword Search (VDMS) scheme over encrypted data by using the bitmap and RSA accumulator, which provides multi-keyword search over encrypted data in an efficient, verifiable and updated way. The bitmap is used as a data structure to build the indexes, which improves the search efficiency and reduces the storage space of the indexes. The RSA accumulator and bitmap are combined to verify the correctness of results. Formal security analysis proves that our VDMS is adaptively secure against Chosen-Keyword Attacks (CKA), and empirical experiments using a real-world dataset demonstrate that our VDMS is efficient and feasible in practical applications.

An Efficient Searchable Symmetric Encryption Scheme for Smart Grid Data

In recent years, the combination of power systems and IoT (Internet of things) has become a new generation of smart grid. Cloud computing is used to provide storage and computing services for smart grid data due to its convenience. Generally, searchable encryption technology is considered a feasible solution to guarantee data security and support search function. Li proposed a searchable symmetric encryption scheme based on pseudo-random function for smart grid data in 2019. In this paper, we propose a more efficient and more secure searchable symmetric encryption scheme for smart grid data. The scheme improves the search efficiency by introducing the Bloom filter and changing the structure of the index. Specifically, we first narrow the search scope and then perform a second search, which eliminates the false positive caused by the introduction of the Bloom filter. At the same time, we assign an ID to each piece of data (a row of data) in a tabular dataset, store the hash value of the ID (adding salt) in the index, and the search results are returned by the server contain none of the ID information, which improves security. Experiments on real data show that our scheme is 52% more efficient than the previous scheme.