Blockchain-based searchable encryption with efficient result verification and fair payment

Searchable encryption is an efficient and secure solution that can perform search operation in ciphertext on cloud servers. It is widely used by a growing number of businesses and individuals. However, most existing searchable encryption schemes typically overestimate the security level of the cloud server, which is an untrusted and centralized third party in fact. The emergence of blockchain technology solves the trustworthiness problem of the third party with features such as decentralization, verifiability and immutability. The combination of searchable encryption and blockchain technology uses the smart contract instead of the cloud server to execute ciphertext search task, which improves security and efficiency of search significantly. We propose a Fuzzy Multi-keyword Search Scheme for Encrypted Cloud Data based on Multi-chain Network (FMSM). FMSM is a distributed searchable encryption scheme since we adopt a multi-chain architecture. It not only supports fuzzy multi-keyword search and dynamic updates for encrypted cloud data, but also supports parallel processing of data. In FMSM, counting bloom filter and MinHash algorithm are used to construct index vectors and query vectors on the corresponding two chains, besides, the search is done on a third chain. All of these calculation tasks are executed in the way of distributed computing, which makes the index construction and search process more efficient and the sorting results more accurate. The security analysis and performance evaluation show that the FMSM has high security, reliability, search efficiency and accuracy.

Blockchain-assisted verifiable certificate-based searchable encryption against untrusted cloud server for Industrial Internet of Things

Searchable encryption (SE) allows users to efficiently retrieve data from encrypted cloud data, but most of the existing SE solutions only support precise keyword search. Fuzzy searchable encryption agrees with practical situations well in the cloud environment, as search keywords that are misspelled to some extent can still generate search trapdoors that are as effective as correct keywords. In scenarios where multiple users can search for ciphertext, most fuzzy searchable encryption schemes ignore the security issues associated with malicious cloud services and are inflexible in multi-user scenarios. For example, in medical application scenarios where malicious cloud servers may exist, diverse types of files need to correspond to doctors in the corresponding departments, and there is a lack of fine-grained access control for sharing decryption keys for different types of files. In the application of medical cloud storage, malicious cloud servers may return incorrect ciphertext files. Since diverse types of files need to be guaranteed to be accessible by doctors in the corresponding departments, sharing decryption keys with the corresponding doctors for different types of files is an issue. To solve these problems, a verifiable fuzzy searchable encryption with blockchain-assisted multi-user scenarios is proposed. Locality-sensitive hashing and bloom filters are used to realize multi-keyword fuzzy search, and the bigram segmentation algorithm is optimized for keyword conversion to improve search accuracy. To realize fine-grained access control in multi-user scenarios, ciphertext-policy attribute-based encryption (CP-ABE) is used to distribute the shared keys. In response to the possibility of malicious servers tampering with or falsifying users’ search results, the scheme leverages the blockchain’s technical features of decentralization, non-tamperability, and traceability, and uses smart contracts as a trusted third party to carry out the search work, which not only prevents keyword-guessing attacks within the cloud server, but also solves the verification work of search results. The security analysis leads to the conclusion that the scheme is secure under the adaptively chosen-keyword attack.

Forward secure searchable encryption (FSSE) scheme allows one data user to search on encrypted databases while resisting the file injection attack. The data utilization can be further improved by extending the single-user scenario to the multi-user scenario. However, there are some issues needed to be considered when a data owner shares data with multiple data users. First, the public cloud server can not be completely trusted as it may be dishonest returning incorrect or incomplete results. Second, authorized users may trade their private keys for financial benefit. To our knowledge, state-of-the-art searchable encryption schemes only consider part of the following desirable features: the verifiability of results, the resistance to file injection attacks, the traceability and revocation of malicious users who abuse their private keys in the multi-user setting. Based on these motivations, we first propose enabling traceable and verifiable multi-user FSSE, which achieves the above functionalities. Besides, we carry out the security proof which demonstrates that our scheme can meet the requirements of security. We also assess the performance from theoretical analysis and experimental analysis, which shows that compared with other similar schemes, our scheme has richer functionalities with comparable efficiency.

Cloud computing has become increasingly popular because of the benefits it provides. However, the security of the data stored in a remote cloud has become a major concern. For privacy concerns, searchable encryption (SE), which supports searching over encrypted data, has been proposed and developed rapidly in secure Boolean search and similarity search. However, most SE schemes can only support single data owner which is opposite to the condition in the cloud environment. In this paper, we employed locality-sensitive hashing (LSH) and bilinear map to deal with a privacy preserving similarity search for multiple data owners. In our scheme, data users can encrypt their data using their own secret keys. And the data users can perform the similarity search without knowing any information about the secret keys which belong to the data owners. We formally analyzed the security strength of our scheme. Extensive experiments on actual datasets showed that our scheme is extremely effective and efficient.

JCDC: A blockchain-based framework for secure data storage and circulation in JointCloud

Searchable (symmetric) encryption allows encryption while still enabling search for keywords. Its immediate application is cloud storage where a client outsources its files while the (cloud) service provider should search and selectively retrieve those. Searchable encryption is an active area of research and a number of schemes with different efficiency and security characteristics have been proposed in the literature. Any scheme for practical adoption should be efficient -- i.e. have sub-linear search time --, dynamic -- i.e. allow updates -- and semantically secure to the most possible extent. Unfortunately, efficient, dynamic searchable encryption schemes suffer from various drawbacks. Either they deteriorate from semantic security to the security of deterministic encryption under updates, they require to store information on the client and for deleted files and keywords or they have very large index sizes. All of this is a problem, since we can expect the majority of data to be later added or changed. Since these schemes are also less efficient than deterministic encryption, they are currently an unfavorable choice for encryption in the cloud. In this paper we present the first searchable encryption scheme whose updates leak no more information than the access pattern, that still has asymptotically optimal search time, linear, very small and asymptotically optimal index size and can be implemented without storage on the client (except the key). Our construction is based on the novel idea of learning the index for efficient access from the access pattern itself. Furthermore, we implement our system and show that it is highly efficient for cloud storage.

Data sharing is a main application of cloud computing. Some existing solutions are proposed to provide flexible access control for outsourced data in the cloud. However, few attentions have been paid to group-oriented data sharing when multiple data owners want to share their private data for cooperative purposes. In this paper, we put forward a new paradigm, referred to as secure, scalable and efficient multi-owner (SSEM) data sharing in clouds. The SSEM integrates identity-based encryption and asymmetric group key agreement to enable group-oriented access control for data owners in a many-to-many sharing pattern. Moreover, with SSEM, users can join in or leave from the group conveniently with the privacy of both group data and user data. We proposed the key-ciphertext homomorphism technique to construct an SSEM scheme with short ciphertexts. The security analysis shows that our SSEM scheme achieves data security against unauthorized accesses and collusion attacks. Both theoretical and experimental results confirm that our proposed scheme takes users little costs to share and access outsourced data in a group manner.

SEPS: Efficient public-key based secure search over outsourced data

Searchable public key encryption allows data owners to store the encrypted data in the cloud server and the users can directly search over the encrypted data in the cloud server to obtain the desired data. However, in such situation, for example, in the process of network transmission, the data can be damaged due to the incorrect operation caused by the data owner or other unexpected circumstances, leading to serious consequences that the transmitted data is not consistent with the original data. Thus, the searchable public key encryption scheme with data integrity checking is necessary. In this paper, we implement the data integrity checking and further improve the security and integrity of the scheme. We first propose the concrete scheme and then analyze the security and the performance of the scheme.

In the big data era, it is vital to allocate the vast amount of data to heterogeneous users with different interests. To clinch this goal, various agents including data owners, collectors, and users should cooperate to trade data efficiently. However, the data agents (data owners, collectors, and users) are selfish and seek to maximize their own utilities instead of the overall system efficiency. As such, a sophisticated mechanism is imperative to guide the agents to distribute data efficiently. In this paper, the data trading problem of a data market with multiple data owners, collectors, and users is formulated and an iterative auction mechanism is proposed to coordinate the trading. The proposed mechanism guides the selfish data agents to trade data efficiently in terms of social welfare and avoids direct access of the agents’ private information. We theoretically prove that the proposed mechanism can achieve the socially optimal operation point. Moreover, we demonstrate that the mechanism satisfies appealing economic properties such as individual rationality and weakly balanced budget. Then, we expand the mechanism to nonexclusive data trading, in which the same data can be dispensed to multiple collectors and users. Simulations as well as real data experiments validate the theoretical properties of the mechanism.

The sharing of electronic health records (EHRs) has great positive significance for research of disease and doctors' diagnosis. In recent years, cloud-based electronic medical record sharing scheme has brought a lot of conveniences, but the centralization of cloud exposes threats inevitably to data security and privacy preservation. Blockchain technology can be seen as a promising solution to address these problems on account of its unique propertis of decentration, anonymity, unforgeability and verifiability. In this paper, we propose a blockchain based secure and privacy-preserving EHR sharing protocol. Data requester can search desired keyword from data provider to find relevant EHRs on the EHR consortium blockchain and get the re-encryption ciphertext from cloud server after getting the data owner's authorization. The scheme mainly uses searchable encryption and conditional proxy re-encryption to realize data security, privacy preservation, and access control. Furthermore, proof of authorization is designed as the consensus mechanism for consortium blockchain to guarantee system's availability. Security analysis demonstrates that the proposed protocol can achieve security goals. Besides, we emulate the cryptographic primitives and implement the proposed scheme on Ethereum platform. Performance evaluation shows that the proposed scheme has high computational efficiency.

Outsourcing medical data and their search services to a third party cloud have been a popular trend for many medical practices, because using healthcare cloud services can help cut down the cost of Electronic Health Records (EHR) systems in terms of front-end ownership cost and IT maintenance burdens. Healthcare cloud applications need searchable encryption with the following two capabilities for protecting data privacy and access privacy: (1) the healthcare providers need to share the encrypted data with authorized users and enable querying over encrypted data, and (2) they also need to keep the query keywords and associated search operations private such that healthcare data hosting service providers cannot gain access to unauthorized content or trace and infer sensitive data stored in the healthcare cloud. This survey paper describes the notion of searchable encryption (SE) in the context of healthcare applications and characterize the SE use cases into four scenarios in healthcare. Then we provide a comprehensive overview of the four representative SE techniques: searchable symmetric encryption (SSE), public key encryption with keyword search (PEKS), attribute-based encryption with keyword search (ABKS), and proxy re-encryption with keyword search (PRES) according to different EHR retrieving scenarios and requirements. We categorize and compare the different SE schemes in terms of their security, efficiency, and functionality. The survey is designed to benefit both experienced researchers in the computer science (CS) field and non-specialists who are domain scientists or healthcare professionals with limited CS and information security background. Thus, we are in favor of technological overview of the state of art searchable encryption models and the underlying key techniques, instead of detailed proofs and constructions of the respective SE algorithms. We describe how the existing SE schemes relate to and differ from one another, and point out the connections between the SE techniques and the security and privacy requirements of healthcare applications and the open research problems.

Searchable encryption (SE) enables data users to securely search encrypted data stored in untrusted cloud servers. However, most SE schemes allow for leakages of access and search patterns to maximize efficiency and functionality. Recent attacks have shown that adversaries can recover query keywords with prior knowledge of the database by exploiting these leakages. Unfortunately, the existing schemes that protect access and search patterns result in frequent communications and high computational costs. Furthermore, complex calculation processes also raise challenges for verifying search results. To address these concerns, we first design an efficient conjunctive SE scheme with search and access pattern privacy using private set intersection. In the proposed scheme, we utilize random numbers to obfuscate the values of polynomials and randomly divide the results into two parts, which simplifies the search process, improves search efficiency, and eliminates the need for time-consuming ciphertext multiplication operations. We also extend this scheme to support search result verifiability. Specifically, by embedding a random number as the root of the return polynomial, we achieve verifiability of search results. Furthermore, we prove the security of both schemes employing the simulation-based method. Finally, we implement the schemes in a real database and thorough performance analyses demonstrate their efficiency.

With the development of cloud computing, data sharing has a new effective method, i.e., outsourced to cloud platform. In this case, since the outsourced data may contain privacy, they only allow to be accessed by the authorized users. Encrypting the data before outsourcing is a commonly used approach, where the data owners only need to send the corresponding encryption key to the authorized users. However, in such approach it is difficult to use the data since the encrypted data obsoletes comprehensive search functionalities of plaintext keyword search. In this paper, we leverage the secure k-nearest neighbor to propose a secure dynamic searchable symmetric encryption scheme. Our scheme can achieve two important security features, i.e., forward privacy and backward privacy which are very challenging in Dynamic Searchable Symmetric Encryption (DSSE) area. In addition, we evaluate the performance of our proposed scheme compared with other DSSE schemes. The comparison results demonstrate the efficiency of our proposed scheme in terms of the storage, search and update complexity.