Searchable Symmetric Encryption Scheme Research Articles

TWo-IN-one-SSE: Fast, Scalable and Storage-Efficient Searchable Symmetric Encryption for Conjunctive and Disjunctive Boolean Queries

Searchable Symmetric Encryption (SSE) supports efficient yet secure query processing over outsourced symmetrically encrypted databases without the need for decryption. A longstanding open question has been the following: can we design a fast, scalable, linear storage and low-leakage SSE scheme that efficiently supports arbitrary Boolean queries over encrypted databases? In this paper, we present the design, analysis and prototype implementation of the first SSE scheme that efficiently supports conjunctive, disjunctive and more general Boolean queries (in both the conjunctive and disjunctive normal forms) while scaling smoothly to extremely large encrypted databases, and while incurring linear storage overheads and supporting extremely fast query processing in practice. We quantify the leakage of our proposal via a rigorous cryptographic analysis and argue that it achieves security against a well-known class of leakage-abuse and volume analysis attacks. Finally, we demonstrate the storage-efficiency and scalability of our proposed scheme by presenting experimental results of a prototype implementation of our scheme over large real-world databases.

Verifiable and Dynamic Multi-Keyword Search Over Encrypted Cloud Data Using Bitmap

Searchable Symmetric Encryption (SSE), which enables users to search over encrypted data without decryption, has gained increasing attention from both academic and industrial fields. However, existing SSE schemes either have low search efficiency or cannot support multi-keyword search, dynamic updates, and result verification simultaneously. To solve these problems, we propose a Verifiable and Dynamic Multi-keyword Search (VDMS) scheme over encrypted data by using the bitmap and RSA accumulator, which provides multi-keyword search over encrypted data in an efficient, verifiable and updated way. The bitmap is used as a data structure to build the indexes, which improves the search efficiency and reduces the storage space of the indexes. The RSA accumulator and bitmap are combined to verify the correctness of results. Formal security analysis proves that our VDMS is adaptively secure against Chosen-Keyword Attacks (CKA), and empirical experiments using a real-world dataset demonstrate that our VDMS is efficient and feasible in practical applications.

An Efficient Searchable Symmetric Encryption Scheme for Smart Grid Data

In recent years, the combination of power systems and IoT (Internet of things) has become a new generation of smart grid. Cloud computing is used to provide storage and computing services for smart grid data due to its convenience. Generally, searchable encryption technology is considered a feasible solution to guarantee data security and support search function. Li proposed a searchable symmetric encryption scheme based on pseudo-random function for smart grid data in 2019. In this paper, we propose a more efficient and more secure searchable symmetric encryption scheme for smart grid data. The scheme improves the search efficiency by introducing the Bloom filter and changing the structure of the index. Specifically, we first narrow the search scope and then perform a second search, which eliminates the false positive caused by the introduction of the Bloom filter. At the same time, we assign an ID to each piece of data (a row of data) in a tabular dataset, store the hash value of the ID (adding salt) in the index, and the search results are returned by the server contain none of the ID information, which improves security. Experiments on real data show that our scheme is 52% more efficient than the previous scheme.

SeUpdate: Secure Encrypted Data Update for Multi-User Environments

Searchable Symmetric Encryption (SSE) is a key tool for secure data processing. To date, most of the SSEs were studied alone, while an SSE supporting update operations over encrypted data remained a challenging problem due to various statistical attacks and multi-user environments. In this article, we propose <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">SeUpdate</i> , the first SSE scheme that simultaneously achieves keyword search and controlled update over encrypted data, with flexible read (search) and write (update) access control policies among multiple users. In <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">SeUpdate</i> , users do not need to share secret keys and a single query enables one to efficiently search all his authorized data. We formally define a security model, and prove our scheme have both forward and backward security. We note that the write permission of an SSE is realized for the first time. We further extend the basic scheme with dynamic access policy update and support of a large number of files. We also implement <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">SeUpdate</i> and some related work. The theoretical and experimental analyses demonstrate our scheme and its extension are practical and efficient.

Towards Multi-Client Forward Private Searchable Symmetric Encryption in Cloud Computing

As a useful cryptographic primitive, searchable symmetric encryption (SSE) has been intensively studied to achieve the secure and efficient retrieval of encrypted data. In order to process update operations, dynamic SSE schemes have been proposed. But recently, file-injection attack has threatened the security of traditional dynamic SSE protocols. Therefore, designing dynamic SSE schemes with forward privacy becomes a new demand to resist the above attack. Meanwhile, multi-client setting is another requirement in SSE techniques where multiple clients can be delegated and have access to the database. However, most of previous forward private schemes were constructed for single-client setting and cannot directly extended to multi-client environment efficiently. To solve the problem, we propose a forward private SSE scheme with support for multi-client in cloud computing. The proposed scheme is based on XOR-homomorphic function and involves two new data structures as private link and public search tree. Security proof demonstrates the proposed scheme can meet the desired secure features. We then conduct experimental evaluation of the proposed scheme and make comparison with related schemes. The result shows that the proposed scheme tends to have high efficiency.

Verifiable dynamic search over encrypted data in cloud‐assisted intelligent systems

The cloud-assisted intelligent systems have attracted extensive attention due to their powerful data analysis and computation capabilities. However, how to handle encrypted data remains a challenging problem in intelligent systems. A promising solution is searchable symmetric encryption (SSE), which enables a client to privately outsource their data to the cloud while preserving keyword search functionality. In practice, dynamic SSE is more practical and supports efficient data addition and deletion. Unfortunately, data update will leak some additional information which can be exploited to break data privacy. To address this issue, forward and backward secure SSE schemes are proposed to reduce the leakage of data update. That is, forward security guarantees that the newly updated documents cannot reveal the previously searched keywords, while backward security guarantees that the server cannot recover the deleted documents. However, the existing forward and backward secure SSE schemes mainly consider curious-but-honest server. How to verify the soundness and completeness of search results is still a challenge. In this paper, we propose a noninteractive verifiable dynamic SSE scheme with forward and backward security from two universal accumulators. Specifically, the server in our scheme only needs one roundtrip to return the nondeleted search results to the client, which saves the communication overhead dramatically. Besides, our scheme can achieve public verification that anyone can verify the search results but not only the client who has the private key. Finally, we give a formal security analysis and compare the proposed scheme with other related work, the results show that our scheme can achieve the desired security properties with practical efficiency.

Verifiable Conjunctive Dynamic Searchable Symmetric Encryption With Forward and Backward Privacy

Abstract Dynamic searchable symmetric encryption (DSSE) with forward and backward privacy makes it possible to perform search on the outsourced encrypted database efficiently while still allowing updates under acceptable leakage. Current forward and backward private DSSE (FB-DSSE) scheme proposed by Zuo et al. cannot support conjunctive keyword query and the cloud server needs to be honest-but-curious. Recent FB-DSSE scheme supporting conjunctive keyword query proposed by Patranabis et al. cannot verify search results. On the other hand, searchable symmetric encryption scheme proposed by Wang et al. that supports conjunctive keyword query and the verification of search results cannot achieve forward and backward privacy. The problem of constructing a verifiable conjunctive FB-DSSE scheme is still open. In this paper, we propose a verifiable conjunctive dynamic searchable symmetric encryption scheme (VCDSSE). VCDSSE is a FB-DSSE scheme that additionally supports the verification of search results and conjunctive keyword query. We revisit homomorphic MAC to enable efficient verification of search results, adopt the technique of oblivious cross-tags to achieve conjunctive keyword query and utilize state chain to ensure forward and backward privacy. The formal security analysis and performance evaluation demonstrate that VCDSSE is secure and practical as compared with Mitra scheme in terms of search time.

Research on the main methods and schemes of encryption with search capability

The growing popularity of data outsourcing to third-party cloud servers causes their owners to have serious concerns about their security due to possible data leakage. A well-known measure to solve this problem and ensure the confidentiality of data is to encrypt it. However, the use of traditional encryption techniques is faced with the problem of how to allow untrusted cloud servers to perform search operations, while the actual data transmitted must remain confidential. Searchable encryption is a powerful tool, a class of cryptographic techniques that attempts to solve this problem. Searchable encryption acts as a data management technique that allows data owners to store and manage their data on a third-party, untrusted cloud server, and allows the data user to delegate search functions to the cloud server to retrieve that data. Currently, there are a number of approaches to solving this problem, although there is still no dominant solution. Therefore, the paper presents an overview of current secure search solutions. The main searchable encryption techniques are considered, which allow you to perform search operations on encrypted data without disclosing any information about what is being searched. The strengths and weaknesses of the analyzed methods are highlighted. Models and architectures of existing secure search engines are analyzed, taking into account the peculiarities of their operation scenarios. The problem of confidentiality in searchable encryption schemes is discussed. A comparative analysis of the performance of several searchable symmetric encryption schemes is given. Various gaps in the area under consideration are identified, with indication of open research problems.

Achieving Secure and Efficient Dynamic Searchable Symmetric Encryption over Medical Cloud Data

In medical cloud computing, a patient can send her medical data to a cloud server from afar. Because medical data is highly sensitive, only authorized doctors are allowed to access it in this case. A frequent solution is to encrypt data before outsourcing it, with the patient simply sending the corresponding encryption key to the authorized doctors. However, due to the difficulties of digging through the encrypted data, the usability of outsourced medical data is severely limited. Over medical cloud data, we propose Secure and Efficient Dynamic Searchable Symmetric Encryption (SEDSSE) schemes. To begin, we propose a dynamic searchable symmetric encryption scheme that uses the secure k-Nearest Neighbor (kNN) and Attribute-Based Encryption (ABE) techniques to achieve two important security features: forward privacy and backward privacy, both of which are difficult to achieve in the field of dynamic searchable symmetric encryption. Then, to address the key sharing problem that plagues the kNN-based searchable encryption strategy, we suggest an improved technique. In terms of storage, search, and update complexity, our solutions outperform prior proposals. Extensive tests show that our approaches are efficient in terms of storage overhead, index building, trapdoor generation, and query.

Fast, Searchable, Symmetric Encryption Scheme Supporting Ranked Search

Searchable encryption (SE) is one of the effective techniques for searching encrypted data without decrypting it. This technique can provide a secure indexing mechanism for encrypted data and utilize a secure trapdoor to search for the encrypted data directly, thus realizing a secure ciphertext retrieval function. Existing schemes usually build a secure index directly on the whole dataset and implement the retrieval of encrypted data by implementing a secure search algorithm on the index. However, this approach requires testing many non-relevant documents, which diminishes the query efficiency. In this paper, we adopt a clustering method to preclassify the dataset, which can filter out quite a portion of irrelevant documents, thus improving the query. Concretely, we first partition the dataset into multiple document clusters using the k-means clustering algorithm; then, we design index building and searching algorithms for these document clusters; finally, by using the asymmetric scalar-product-preserving encryption (ASPE) scheme to encrypt the indexes and queries, we propose a fast searchable symmetric encryption scheme that supports ranked search. Detailed security analysis demonstrates that the proposed scheme can guarantee the data and query security of the search process. In addition, theoretical and experimental analysis indicates that our scheme outperforms other similar schemes in terms of query efficiency.

Towards efficient verifiable multi-keyword search over encrypted data based on blockchain.

Searchable symmetric encryption (SSE) provides an effective way to search encrypted data stored on untrusted servers. When the server is not trusted, it is indispensable to verify the results returned by it. However, the existing SSE schemes either lack fairness in the verification of search results, or do not support the verification of multiple keywords. To address this, we designed a multi-keyword verifiable searchable symmetric encryption scheme based on blockchain, which provides an efficient multi-keyword search and fair verification of search results. We utilized bitmap to build a search index in order to improve search efficiency, and used blockchain to ensure fair verification of search results. The bitmap and hash function are combined to realize lightweight multi-keyword search result verification, compared with the existing verification schemes using public key cryptography primitives, our scheme reduces the verification time and improves the verification efficiency. In addition, our scheme supports the dynamic update of files and realizes the forward security in update. Finally, formal security analysis proves that our scheme is secure against Chosen-Keyword Attacks (CKA), experimental analysis demonstrations that our scheme is efficient and viable in practice.

Rphx: Result Pattern Hiding Conjunctive Query Over Private Compressed Index Using Intel SGX

Deploying data storage and query service in an untrusted cloud server raises critical privacy and security concerns. This paper focuses on the fundamental problem of processing conjunctive keyword queries over an untrusted cloud in a privacy-preserving manner. Previous tree-based searchable symmetric encryption (SSE) schemes, such as <i>IBTree</i> and <i>VBTree</i>, can process conjunctive keyword queries in a secure and efficient way. However, these schemes cannot address &#x201C;Result Pattern (<i>RP</i>)&#x201D; leakage, which can be used to recover the keywords contained in a conjunctive keyword query. To combat this challenging problem, we propose a result pattern hiding conjunctive query scheme named <i>Rphx</i> using Intel SGX. In particular, we first propose a new &#x201C;SGX-aware&#x201D; compressed index named <i>VIBT</i> by combining variable-length bloom filter tree, matryoshka filter and online cipher. To achieve <i>RP</i> hiding, we then introduce a new tree-based SSE scheme named <i>Rphx</i> by deploying <i>VIBT</i> to Intel SGX. Security analysis shows that <i>Rphx</i> can enhance the security requirements by hiding <i>RP</i> leakage under the IND-CKA2 security model. Experimental results show that <i>VIBT</i> gains at least <inline-formula> <tex-math notation="LaTeX">$30\times $ </tex-math></inline-formula> improvement in storage efficiency and <i>Rphx</i> can achieve comparable search efficiency comparing with previous works.

Geometric Range Search on Encrypted Data With Forward/Backward Security

This article presents two dynamic symmetric searchable encryption schemes for geometric range search. Our constructions are the first to provide forward/backward security in the context of SSE-based schemes supporting geometric range search. Besides, we define a security notion called content privacy. This security notion captures the leakages that are critical in the context of geometric range search but not considered by forward/backward security. Content privacy eliminates the leakage on the updated points of the database during both search and update. Due to the inherent leakages associated with range queries, none of the existing related works can support content privacy, whereas the design of our constructions avoids such leakages. When compared to the state-of-the-art schemes, our constructions provide a higher level of security and practical efficiency supported by our experimental results.

Enabling Verifiable and Dynamic Ranked Search over Outsourced Data

Cloud computing as a promising computing paradigm is increasingly utilized as potential hosts for users&#x2019; massive dataset. Since the cloud service provider (CSP) is outside the users&#x2019; trusted domain, existing research suggests encrypting sensitive data before outsourcing and adopting Searchable Symmetric Encryption (SSE) to facilitate keyword-based searches over the ciphertexts. However, it remains a challenging task to design an effective SSE scheme that simultaneously supports <i>sublinear search time</i>, <i>efficient update and verification</i>, and <i>on-demand information retrieval</i>. To address this, we propose a Verifiable Dynamic Encryption with Ranked Search (VDERS) scheme that allows a user to perform top-<inline-formula><tex-math notation="LaTeX">$K$</tex-math><alternatives><mml:math><mml:mi>K</mml:mi></mml:math><inline-graphic xlink:href="liu-ieq1-2922177.gif"/></alternatives></inline-formula> searches on a <i>dynamic</i> document collection and verify the correctness of the search results in a secure and efficient way. Specifically, we first provide a basic construction, <inline-formula><tex-math notation="LaTeX">$\mathsf {VDERS}^0$</tex-math><alternatives><mml:math><mml:msup><mml:mi mathvariant="sans-serif">VDERS</mml:mi><mml:mn>0</mml:mn></mml:msup></mml:math><inline-graphic xlink:href="liu-ieq2-2922177.gif"/></alternatives></inline-formula>, where a <i>ranked inverted index</i> and a <i>verifiable matrix</i> are constructed to enable verifiable document insertion in top-<inline-formula><tex-math notation="LaTeX">$K$</tex-math><alternatives><mml:math><mml:mi>K</mml:mi></mml:math><inline-graphic xlink:href="liu-ieq3-2922177.gif"/></alternatives></inline-formula> searches. Then, an advanced construction, <inline-formula><tex-math notation="LaTeX">$\mathsf {VDERS}^{\star }$</tex-math><alternatives><mml:math><mml:msup><mml:mi mathvariant="sans-serif">VDERS</mml:mi><mml:mi>&#x2605;</mml:mi></mml:msup></mml:math><inline-graphic xlink:href="liu-ieq4-2922177.gif"/></alternatives></inline-formula>, is devised to further support document deletion with a reduced communication cost. Extensive experiments on real datasets demonstrate the efficiency and effectiveness of our VDERS scheme.

Achieve Efficient and Privacy-Preserving Compound Substring Query over Cloud

The cloud computing technique, which was initially used to mitigate the explosive growth of data, has been required to take both data privacy and users’ query functionality into consideration. Searchable symmetric encryption (SSE) is a popular solution that can support efficient attribute queries over encrypted datasets in the cloud. In particular, some SSE schemes focus on the substring query, which deals with the situation that the user only remembers the substring of the queried attribute. However, all of them just consider substring queries on a single attribute, which cannot be used to achieve compound substring queries on multiple attributes. This paper aims to address this issue by proposing an efficient and privacy-preserving SSE scheme supporting compound substring queries. In specific, we first employ the position heap technique to design a novel tree-based index to support substring queries on a single attribute and employ pseudorandom function (PRF) and fully homomorphic encryption (FHE) techniques to protect its privacy. Then, based on the homomorphism of FHE, we design a filter algorithm to calculate the intersection of search results for different attributes, which can be used to support compound substring queries on multiple attributes. Detailed security analysis shows that our proposed scheme is privacy-preserving. In addition, extensive performance evaluations are also conducted, and the results demonstrate the efficiency of our proposed scheme.

A Verifiable Symmetric Searchable Encryption Scheme Based on the AVL Tree

Abstract Verifiable symmetric searchable encryption is a keyword search technology that supports verification of search results. Many schemes improve search performance by dividing each keyword label into segments and storing them in a Trie-tree at the expense of high storage. And the index will degenerate into a linear linked list when all keyword labels have the same prefix except for the last segment. But it will greatly affect the search efficiency. In this paper, we propose a verifiable symmetric searchable encryption scheme based on the AVL Tree (abbreviated as VSSE-AVL), which uses complete keyword labels to build the index. Compared with the Trie-tree index, VSSE-AVL not only balances storage and search performance, but also avoids degradation. To verify the correctness and completeness of empty search results, we store path information in each leaf node and node with only one child node. Considering the substitution attack, we bind the file identifier and the file so that the client will find out once the server returns inconsistent search results. Rigorous security analysis shows VSSE-AVL satisfies privacy and verifiability. Compared with the verifiable SSE-2 with the same security, the experimental evaluation shows that our proposed scheme performs better on storage, search and verification.

Lightweight Searchable Public-Key Encryption with Forward Privacy over IIoT Outsourced Data

As more data from Industrial Internet of Things (IIoT) devices are been outsourced to the cloud, the need to ensure/achieve data privacy will be increasingly pressing. Searchable public-key encryption is a promising tool to achieve data privacy without sacrificing data usability. However, most existing searchable public-key encryption schemes are either inefficient (e.g., expensive in terms of encryption and searching keywords) or lack the required (security) features such as forward privacy. To address these limitations, we propose a lightweight searchable public-key encryption with forward privacy. Specifically, the scheme allows us to achieve forward privacy in a public-key cryptography (i.e., asymmetric) setting, and has the same search performance as a number of practical searchable symmetric encryption schemes. The formal security analysis shows that the proposed scheme is chosen-keyword attack resilient and achieves forward privacy. Finally, the experimental results on a real-world dataset demonstrate that the proposed scheme is highly efficient and scalable in IIoT applications.

Achieve efficient position-heap-based privacy-preserving substring-of-keyword query over cloud

The cloud computing technique, which was initially used to mitigate the explosive growth of data, has been required to take both data privacy and users’ query functionality into consideration. Symmetric searchable encryption (SSE) is a popular solution to supporting efficient keyword queries over encrypted data in the cloud. However, most of the existing SSE schemes focus on the exact keyword query and cannot work well when the user only remembers the substring of a keyword, i.e., substring-of-keyword query. This paper aims to investigate this issue by proposing an efficient and privacy-preserving substring-of-keyword query scheme over cloud. First, we employ the position heap technique to design a novel tree-based index to match substrings with corresponding keywords. Then based on the tree-based index, we introduce our substring-of-keyword query scheme, which contains two consecutive phases. The first phase queries the keywords that match a given substring, and the second phase queries the files that match a keyword in which people are really interested. In addition, detailed security analysis and experimental results demonstrate the security and efficiency of our proposed scheme.

Backward Private Searchable Symmetric Encryption with Improved Locality

Searchable symmetric encryption (SSE) enables clients to outsource their encrypted documents into a remote server and allows them to search the outsourced data efficiently without violating the privacy of the documents and search queries. Dynamic SSE schemes (DSSE) include performing update queries, where documents can be added or removed at the expense of leaking more information to the server. Two important privacy notions are addressed in DSSE schemes: forward and backward privacy. The first one prevents associating the newly added documents with previously issued search queries. While the second one ensures that the deleted documents cannot be linked with subsequent search queries. Backward has three formal types of leakage ordered from strong to weak security: Type-I, Type-II, and Type-III. In this paper, we propose a new DSSE scheme that achieves Type-II backward and forward privacy by generating fresh keys for each search query and preventing the server from learning the underlying operation (del or add) included in update query. Our scheme improves I/O performance and search cost. We implement our scheme and compare its efficiency against the most efficient backward privacy DSSE schemes in the literature of the same leakage: MITRA and MITRA*. Results show that our scheme outperforms the previous schemes in terms of efficiency in dynamic environments. In our experiments, the server takes 699ms to search and return (100,000) results.

A blockchain-based dynamic searchable symmetric encryption scheme under multiple clouds

A blockchain-based dynamic searchable symmetric encryption scheme under multiple clouds