Dynamic Searchable Symmetric Encryption with Forward and Backward Privacy

Dynamic searchable symmetric encryption (DSSE) is helpful to users with limited storage. In DSSE, the users are able to perform search and update queries on the ciphertext which stored on the cloud server. However, DSSE may suffer from file-injection attacks and leak information after deletion. In order to solve these problems, DSSE schemes with forward security and/or backward security have been proposed. In this paper, we propose two efficient DSSE schemes. The first one supports forward security using binary tree as the basic data structure. The second one uses puncturable encryption to achieve both forward and backward privacy.

With the development of cloud computing, data sharing has a new effective method, i.e., outsourced to cloud platform. In this case, since the outsourced data may contain privacy, they only allow to be accessed by the authorized users. Encrypting the data before outsourcing is a commonly used approach, where the data owners only need to send the corresponding encryption key to the authorized users. However, in such approach it is difficult to use the data since the encrypted data obsoletes comprehensive search functionalities of plaintext keyword search. In this paper, we leverage the secure k-nearest neighbor to propose a secure dynamic searchable symmetric encryption scheme. Our scheme can achieve two important security features, i.e., forward privacy and backward privacy which are very challenging in Dynamic Searchable Symmetric Encryption (DSSE) area. In addition, we evaluate the performance of our proposed scheme compared with other DSSE schemes. The comparison results demonstrate the efficiency of our proposed scheme in terms of the storage, search and update complexity.

Searchable symmetric encryption (SSE) has been proposed that enables the clients to outsource their private encrypted data onto the cloud server and later the data can be searched with limited information leakage. However, existing surveys have not covered most recent advances on SSE technique. To fill the gap, we make a survey on state-of-the-art representative SSE schemes in cloud environment. We mainly focus on dynamic SSE schemes with forward and backward privacy, two vital security elements to maintain query privacy during data update operations. Specifically, we discuss about SSE protocols based on query expressiveness, including single keyword search, conjunctive keyword search, range search, disjunctive keyword search and verifiable search. Finally, through comparison on query expressiveness, security and efficiency, we demonstrate the strengths and weaknesses of the existing SSE protocols.

Searchable Symmetric Encryption (SSE) is a mechanism that facilitates search over encrypted data that is outsourced to an untrusted Server. SSE schemes offer practicality at the expense of some information leakage.The last two years, the first dynamic SSE (DSSE) schemes, i.e. schemes that support updates, that are both forward and backward private, were introduced. Two lines of design have been proposed. The first one contains the schemes that use an oblivious data structure, i.e. the Client hides the memory access pattern from the Server. This level of security comes at the expense of significant communication overheads as the oblivious memory access requires several communication roundtrips or the use of expensive primitives that limits the potential of practicality. The second line of design contains solutions that avoid oblivious data structures.In this paper, we introduce a new DSSE solution that offers both forward and the highest level of backward privacy. Our scheme is the first one that follows the first line of design and achieves this level of security with a constant and small number of communication roundtrips. We evaluate the scheme's performance and we show that it is practical.

Searchable symmetric encryption (SSE) is an important technique for cloud computing. SSE allows encrypted critical data stored on an untrusted cloud server to be searched using keywords, returning correct data, but the keywords and data content are unknown by the server. However, an SSE database is not practical because the data is generally frequently modified even when stored on a remote server, since the server cannot update the encrypted data without decryption. Dynamic searchable symmetric encryption (DSSE) is designed to support this requirement. DSSE allows adding or deleting encrypted data on the server without decryption. Many DSSE systems have been proposed, based on link-list structures or blind storage (a new primitive). Each has advantages and drawbacks regarding function, extensibility, and efficiency. For a real system, the most important aspect is the tradeoff between performance and security. Therefore, we implemented several DSSE systems to compare their efficiency and security, and identify the various disadvantages with a view to developing an improved system.

An efficient conjunctive keyword searchable encryption for cloud-based IoT systems

The cloud-assisted intelligent systems have attracted extensive attention due to their powerful data analysis and computation capabilities. However, how to handle encrypted data remains a challenging problem in intelligent systems. A promising solution is searchable symmetric encryption (SSE), which enables a client to privately outsource their data to the cloud while preserving keyword search functionality. In practice, dynamic SSE is more practical and supports efficient data addition and deletion. Unfortunately, data update will leak some additional information which can be exploited to break data privacy. To address this issue, forward and backward secure SSE schemes are proposed to reduce the leakage of data update. That is, forward security guarantees that the newly updated documents cannot reveal the previously searched keywords, while backward security guarantees that the server cannot recover the deleted documents. However, the existing forward and backward secure SSE schemes mainly consider curious-but-honest server. How to verify the soundness and completeness of search results is still a challenge. In this paper, we propose a noninteractive verifiable dynamic SSE scheme with forward and backward security from two universal accumulators. Specifically, the server in our scheme only needs one roundtrip to return the nondeleted search results to the client, which saves the communication overhead dramatically. Besides, our scheme can achieve public verification that anyone can verify the search results but not only the client who has the private key. Finally, we give a formal security analysis and compare the proposed scheme with other related work, the results show that our scheme can achieve the desired security properties with practical efficiency.

Symmetric Searchable Encryption (SSE) schemes enable users to search over encrypted data hosted on an untrusted server. Recently, there has been a lot of interest in forward and backward private SSE. The notion of forward privacy guarantees that updates to the encrypted structure do not reveal their association to any query made in the past. Backward privacy, on the other hand, guarantees that queries do not reveal their association to deleted documents. But strong backward private schemes are known to be inefficient in terms of both communication and computation. One avenue for improvement is leveraging the power of trusted execution environments such as Intel SGX inside the untrusted server to improve some of these inefficiencies. In this work, we propose the first SGX-supported dynamic SSE constructions that are forward-private as well as backward-private. To the best of our knowledge, while there is some work on SGX-supported Oblivious RAM (ORAM) and static SSE, there is no work on SGX-supported dynamic SSE. We propose three constructions that cover all types of backward privacy in literature that are very efficient compared to the state of the art backward private schemes. Our communication complexity is always the number of current documents matching the query and we show that there is no need for 'total obliviousness' in constructions for the strongest notion of backward privacy.

Efficient searchable symmetric encryption for storing multiple source dynamic social data on cloud

Dynamic multi-client searchable symmetric encryption with support for boolean queries

: Cloud storage has now become widely used for the management of sensitive documents, thereby casting a huge shadow over the user’s right to privacy and the security of his data. One of the earliest encryption methods is AES, which is the most widely used among the rest of the traditional methods, and it still provides confidentiality only but not secure searching over the encrypted data. The new research introduces a QKD + AES-based Symmetric Searchable Encryption (SSE) system applicable to dynamic datasets and thus allowing secure keyword-based search without compromising the privacy. Under this scheme, QKD is the method used to send the AES encryption keys to the client and server securely, and thus the quantum adversaries cannot either intercept or manipulate the keys. After that, the AES encryption holds the data securely, while the SHA-256 hashing for the indexing of keywords is employed which allows an efficient and secure search over the encrypted data to be done. The system, besides giving forward privacy which forbids the connection of new data to previous searches, also provides backward privacy which assures that deleted entries will not be accessible in future queries.

The passport is an expandable document in which key personal, social care and clinical information is recorded. Everyday people move to difference places whether abroad or within the country and some people it might happen they forgot their health passport or they are not registered in any health sectors as a result it might be difficult to have treatment without a health passport. So we designed a Cloud health passport system which is secure, fast and private which will be helpful, using block chain algorithm to allow continuous updating by family and health professionals, acting as a ‘live’ synchronized record of changing need, service. The passport is set up by the patient (or their agreed representative) and carried on their mobile device across different healthcare settings using Dynamic Searchable Symmetric Encryption (DSSE). It stores demographic details and pertinent clinical information. By having a digital record of this information, valuable patient (and administrative) time is not wasted at registration, improving the patient experience. By incorporating an individual health identifier, it allows a patient to be readily identified across any healthcare setting. The option of storing the dates of upcoming appointments could lead to a reduction in the out-patient non-attendance rate currently estimated at 15%. The increased likelihood that important clinical information is filed to the correct patient record frees up more time for direct patient care.

Searchable symmetric encryption (SSE) enables users to efficiently search ciphertext in the cloud and ensures the security of encrypted data. Recent works show that forward security is an important property in dynamic SSE. Many forward secure searchable symmetric encryption (FSSE) schemes supporting single-keyword search have been proposed. Only a few SSE schemes can satisfy the forward security and support conjunctive keyword search at the same time, which are realized by adopting inefficient or complicated cryptography tools. Very recently, Hu proposed a novel construction to achieve conjunctive-keyword search, that is, using inner-product encryption (IPE) to design a conjunctive-keyword FSSE scheme. However, IPE scheme is a conceptually complex and low efficient scheme. In this paper, we use a more efficient cryptographic tool, asymmetric scalar-product-preserving encryption (ASPE), to design an efficient and secure conjunctive-keyword FSSE scheme. To improve practicality, we design our scheme to support multi-user setting. Our scheme achieves sub-linear efficiency, and can easily be used in any single-keyword FSSE scheme to obtain a conjunctive-keyword FSSE scheme supporting multi-user. Compared with the current conjunctive-keyword FSSE scheme, our scheme has a better update and search efficiency.

Searchable Symmetric Encryption (SSE) allows a client to search over the encrypted database, which protects privacy while maintaining the searchability of the data. Later, Dynamic SSE (DSSE) has been introduced, which supports the update of the encrypted database. However, most existing DSSE schemes either achieve less security level or support single keyword queries only. To tackle this problem, this thesis gives enhanced security definition and introduces several different DSSE schemes with enhanced security and supporting richer queries.

Storage services allow data owners to store their huge amount of potentially sensitive data, such as audios, images, and videos, on remote cloud servers in encrypted form. To enable retrieval of encrypted files of interest, searchable symmetric encryption (SSE) schemes have been proposed. However, many schemes construct indexes based on keyword-file pairs and focus on boolean expressions of exact keyword matches. Moreover, most dynamic SSE schemes cannot achieve forward privacy and reveal unnecessary information when updating the encrypted databases. We tackle the challenge of supporting large-scale similarity search over encrypted feature-rich multimedia data, by considering the search criteria as a high-dimensional feature vector instead of a keyword. Our solutions are built on carefully-designed fuzzy Bloom filters which utilize locality sensitive hashing (LSH) to encode an index associating the file identifiers and feature vectors. Our schemes are proven to be secure against adaptively chosen query attack and forward private in the standard model . We have evaluated the performance of our scheme on real-world high-dimensional datasets, and achieved a search quality of 99 percent recall with only a few number of hash tables for LSH. This shows that our index is compact and searching is not only efficient but also accurate.