Generic Multi-keyword Ranked Search on Encrypted Cloud Data

As cloud computing becomes prevalent, more and more data owners are likely to outsource their data to a cloud server. However, to ensure privacy, the data should be encrypted before outsourcing. Symmetric searchable encryption allows users to retrieve keyword over encrypted data without decrypting the data. Many existing schemes that are based on symmetric searchable encryption only support single keyword search, conjunctive keywords search, multiple keywords search, or single phrase search. However, some schemes, i.e., static schemes, only search one phrase in a query request. In this paper, we propose a multi-phrase ranked search over encrypted cloud data, which also supports dynamic update operations, such as adding or deleting files. We used an inverted index to record the locations of keywords and to judge whether the phrase appears. This index can search for keywords efficiently. In order to rank the results and protect the privacy of relevance score, the relevance score evaluation model is used in searching process on client-side. Also, the special construction of the index makes the scheme dynamic. The data owner can update the cloud data at very little cost. Security analyses and extensive experiments were conducted to demonstrate the safety and efficiency of the proposed scheme.

Cross-lingual multi-keyword rank search with semantic extension over encrypted data

Based on Sun et al. ’s multi-client symmetric searchable encryption (SSE) scheme (at ESORICS 2016), and combining Zhao’s identity-concealed authenticated encryption (CCS 2016), a new SSE scheme with multi-data-owner functionalities is proposed. By setting two key generation centers, our scheme first implements multi-data-owner SSE. In particular, compared with Sun et al. ’s scheme, the new scheme not only meets the same security requirements stated by them, but also further strengthens the securities of the same category relevant scheme by providing identity-concealment, authentication of data user to server and confidentiality of search token. The identity-concealment aims to provide privacy protection (Forward ID-Privacy) for data users by hiding their identity information, while the authentication is to resist the camouflage attack by applying certificate-based mechanism to our scheme. In particular, the confidentiality of the search token provides replay-attack-resistant by encrypting the plaintext search token generated by data user. While in other works, the adversary can employ the previously generated plaintext search tokens to force the server to perform the same search queries. Furthermore, by efficiency analysis, our scheme reaches almost the same level of efficiency as Sun et al. ’s scheme.

We point out the risks of protecting relational databases via Searchable Symmetric Encryption (SSE) schemes by proposing an inference attack exploiting the structural properties of relational databases. We also show that record-injection attacks mounted on relational databases have worse consequences than their file-injection counterparts on unstructured databases. Moreover, we discuss some techniques to reduce the effectiveness of inference attacks exploiting the access pattern leakage existing in SSE schemes.

: Cloud storage has now become widely used for the management of sensitive documents, thereby casting a huge shadow over the user’s right to privacy and the security of his data. One of the earliest encryption methods is AES, which is the most widely used among the rest of the traditional methods, and it still provides confidentiality only but not secure searching over the encrypted data. The new research introduces a QKD + AES-based Symmetric Searchable Encryption (SSE) system applicable to dynamic datasets and thus allowing secure keyword-based search without compromising the privacy. Under this scheme, QKD is the method used to send the AES encryption keys to the client and server securely, and thus the quantum adversaries cannot either intercept or manipulate the keys. After that, the AES encryption holds the data securely, while the SHA-256 hashing for the indexing of keywords is employed which allows an efficient and secure search over the encrypted data to be done. The system, besides giving forward privacy which forbids the connection of new data to previous searches, also provides backward privacy which assures that deleted entries will not be accessible in future queries.

Searchable symmetric encryption (SSE) enables users to efficiently search ciphertext in the cloud and ensures the security of encrypted data. Recent works show that forward security is an important property in dynamic SSE. Many forward secure searchable symmetric encryption (FSSE) schemes supporting single-keyword search have been proposed. Only a few SSE schemes can satisfy the forward security and support conjunctive keyword search at the same time, which are realized by adopting inefficient or complicated cryptography tools. Very recently, Hu proposed a novel construction to achieve conjunctive-keyword search, that is, using inner-product encryption (IPE) to design a conjunctive-keyword FSSE scheme. However, IPE scheme is a conceptually complex and low efficient scheme. In this paper, we use a more efficient cryptographic tool, asymmetric scalar-product-preserving encryption (ASPE), to design an efficient and secure conjunctive-keyword FSSE scheme. To improve practicality, we design our scheme to support multi-user setting. Our scheme achieves sub-linear efficiency, and can easily be used in any single-keyword FSSE scheme to obtain a conjunctive-keyword FSSE scheme supporting multi-user. Compared with the current conjunctive-keyword FSSE scheme, our scheme has a better update and search efficiency.

Dynamic multi-client searchable symmetric encryption with support for boolean queries

Searchable symmetric encryption (SSE) scheme allows a data owner to perform search queries over encrypted documents using symmetric cryptography. SSE schemes are useful in cloud storage and data outsourcing. Most of the SSE schemes in existing literature have been proved to leak a substantial amount of information that can lead to an inference attack. This paper presents, a novel leakage resilient searchable symmetric encryption with periodic updation (LRSSEPU) scheme that minimizes extra information leakage, and prevents an untrusted cloud server from performing document mapping attack, query recovery attack and other inference attacks. In particular, the size of the keyword vector is fixed and the keywords are periodically permuted and updated to achieve minimum leakage. Furthermore, our proposed LRSSEPU scheme provides authentication of the query messages and restricts an adversary from performing a replay attack, forged query attack and denial of service attack. We employ a combination of identity-based cryptography (IBC) with symmetric key cryptography to reduce the computation cost and communication overhead. Our scheme is lightweight and easy to implement with very little communication overhead.

Searchable Symmetric Encryption (SSE) is a mechanism that facilitates search over encrypted data that is outsourced to an untrusted Server. SSE schemes offer practicality at the expense of some information leakage.The last two years, the first dynamic SSE (DSSE) schemes, i.e. schemes that support updates, that are both forward and backward private, were introduced. Two lines of design have been proposed. The first one contains the schemes that use an oblivious data structure, i.e. the Client hides the memory access pattern from the Server. This level of security comes at the expense of significant communication overheads as the oblivious memory access requires several communication roundtrips or the use of expensive primitives that limits the potential of practicality. The second line of design contains solutions that avoid oblivious data structures.In this paper, we introduce a new DSSE solution that offers both forward and the highest level of backward privacy. Our scheme is the first one that follows the first line of design and achieves this level of security with a constant and small number of communication roundtrips. We evaluate the scheme's performance and we show that it is practical.

Searchable symmetric encryption (SSE) for multi-owner model draws much attention as it enables data users to perform searches over encrypted cloud data outsourced by data owners. However, implementing secure and precise query, efficient search and flexible dynamic system maintenance at the same time in SSE remains a challenge. To address this, this paper proposes secure and efficient multi-keyword ranked search over encrypted cloud data for multi-owner model based on searching adversarial networks. We exploit searching adversarial networks to achieve optimal pseudo-keyword padding, and obtain the optimal game equilibrium for query precision and privacy protection strength. Maximum likelihood search balanced tree is generated by probabilistic learning, which achieves efficient search and brings the computational complexity close to \(\mathcal {O}(\log N)\). In addition, we enable flexible dynamic system maintenance with balanced index forest that makes full use of distributed computing. Compared with previous works, our solution maintains query precision above 95% while ensuring adequate privacy protection, and introduces low overhead on computation, communication and storage.

Database query evaluation over encrypted data can allow database users to maintain the privacy of their data while outsourcing data processing. Order-Preserving Encryption (OPE) and Order-Revealing Encryption (ORE) were designed to enable efficient query execution, but provide only partial privacy. More private protocols, based on Searchable Symmetric Encryption (SSE), Oblivious RAM (ORAM) or custom encrypted data structures, have also been designed. In this paper, we develop a framework to provide the first comprehensive comparison among a number of range query protocols that ensure varying levels of privacy of user data. We evaluate five ORE-based and five generic range query protocols. We analyze and compare them both theoretically and experimentally and measure their performance over database indexing and query evaluation. We report not only execution time but also I/O performance, communication amount, and usage of cryptographic primitive operations. Our comparison reveals some interesting insights concerning the relative security and performance of these approaches in database settings.

With the advent of cloud computing, many organizations and individuals are interested in outsourcing their complex data management to the public cloud for economic savings and ease of access. As sensitive information may have to be encrypted before outsourcing, the data utilization service based on plaintext keyword search is not suitable for the encrypted cloud data. In this paper, we propose a solution for ranked semantic keyword search (RSS) over encrypted cloud data. With the design of semantic extension, the proposed scheme could return not only the exactly matched files, but also the files including the terms semantically related to the query keyword. In the proposed scheme, the data owner generates a piece of file metadata for each file, and uploads the encrypted metadata set and file collection to the cloud server. After receiving a query request, the cloud server first finds out the keywords that are semantically related to the query keyword according to SRL. Then both the query keyword and the extensional words are used to retrieve the files. Eventually, the result files are returned in order according to the total relevance score. Detailed security analysis shows that our solution is privacy-preserving and secure under the previous searchable symmetric encryption (SSE) security definition. Experimental evaluation demonstrates the efficiency and effectives of the scheme.

The cloud-assisted intelligent systems have attracted extensive attention due to their powerful data analysis and computation capabilities. However, how to handle encrypted data remains a challenging problem in intelligent systems. A promising solution is searchable symmetric encryption (SSE), which enables a client to privately outsource their data to the cloud while preserving keyword search functionality. In practice, dynamic SSE is more practical and supports efficient data addition and deletion. Unfortunately, data update will leak some additional information which can be exploited to break data privacy. To address this issue, forward and backward secure SSE schemes are proposed to reduce the leakage of data update. That is, forward security guarantees that the newly updated documents cannot reveal the previously searched keywords, while backward security guarantees that the server cannot recover the deleted documents. However, the existing forward and backward secure SSE schemes mainly consider curious-but-honest server. How to verify the soundness and completeness of search results is still a challenge. In this paper, we propose a noninteractive verifiable dynamic SSE scheme with forward and backward security from two universal accumulators. Specifically, the server in our scheme only needs one roundtrip to return the nondeleted search results to the client, which saves the communication overhead dramatically. Besides, our scheme can achieve public verification that anyone can verify the search results but not only the client who has the private key. Finally, we give a formal security analysis and compare the proposed scheme with other related work, the results show that our scheme can achieve the desired security properties with practical efficiency.

In this article, we tackle for the first time the problem of dynamic memory-efficient Searchable Symmetric Encryption (SSE). In the term “memory-efficient” SSE, we encompass both the goals of local SSE, and page-efficient SSE. The centerpiece of our approach is a novel connection between those two goals. We introduce a map, called the Generic Local Transform, which takes as input a page-efficient SSE scheme with certain special features, and outputs an SSE scheme with strong locality properties. We obtain several results. (1) First, for page-efficient SSE with page size p, we build a dynamic scheme with storage efficiency \(\mathcal {O}({1})\) and page efficiency \(\widetilde{\mathcal {O}}\left( {\textrm{log}\, \textrm{log}\, (N/p)}\right) \), called \(\textsf{LayeredSSE}\). The main technical innovation behind \(\textsf{LayeredSSE}\) is a novel weighted extension of the two-choice allocation process, of independent interest. (2) Second, we introduce the Generic Local Transform, and combine it with \(\textsf{LayeredSSE}\) to build a dynamic SSE scheme with storage efficiency \(\mathcal {O}({1})\), locality \(\mathcal {O}({1})\), and read efficiency \(\widetilde{\mathcal {O}}\left( {\textrm{log}\,\textrm{log}\, N}\right) \), under the condition that the longest list is of size \(\mathcal {O}({N^{1-1/\textrm{log}\, \textrm{log}\, \lambda }})\). This matches, in every respect, the purely static construction of Asharov et al. presented at STOC 2016: dynamism comes at no extra cost. (3) Finally, by applying the Generic Local Transform to a variant of the Tethys scheme by Bossuat et al. from Crypto 2021, we build an unconditional static SSE with storage efficiency \(\mathcal {O}({1})\), locality \(\mathcal {O}({1})\), and read efficiency \(\mathcal {O}({\textrm{log}^\varepsilon N})\), for an arbitrarily small constant \(\varepsilon > 0\). To our knowledge, this is the construction that comes closest to the lower bound presented by Cash and Tessaro at Eurocrypt 2014.

Storage services allow data owners to store their huge amount of potentially sensitive data, such as audios, images, and videos, on remote cloud servers in encrypted form. To enable retrieval of encrypted files of interest, searchable symmetric encryption (SSE) schemes have been proposed. However, many schemes construct indexes based on keyword-file pairs and focus on boolean expressions of exact keyword matches. Moreover, most dynamic SSE schemes cannot achieve forward privacy and reveal unnecessary information when updating the encrypted databases. We tackle the challenge of supporting large-scale similarity search over encrypted feature-rich multimedia data, by considering the search criteria as a high-dimensional feature vector instead of a keyword. Our solutions are built on carefully-designed fuzzy Bloom filters which utilize locality sensitive hashing (LSH) to encode an index associating the file identifiers and feature vectors. Our schemes are proven to be secure against adaptively chosen query attack and forward private in the standard model . We have evaluated the performance of our scheme on real-world high-dimensional datasets, and achieved a search quality of 99 percent recall with only a few number of hash tables for LSH. This shows that our index is compact and searching is not only efficient but also accurate.