Towards Multi-user Searchable Encryption Scheme with Support for SQL Queries

Abstract

Due to the tremendous benefits of cloud computing, organizations are highly motivated to store electronic records on clouds. However, outsourcing data to cloud servers separates it from physical control, resulting in data privacy disclosure. Although encryption enhances data confidentiality, it also complicates the execution of encrypted database operations. In this paper, we propose a multi-user shared searchable encryption scheme that supports multi-user selective authorization and secure access to encrypted databases. First, we apply the Diffie-Hellman protocol to a trapdoor generate algorithm to facilitate fine-grained search control without incremental conversions. Second, we utilize a private key to generate an encrypted index by bilinear mapping, which makes it impossible for an adversary to obtain trapdoor keywords by traversing the keyword space and to carry out keyword guessing attacks. Third, we use double-layered encryption to encrypt a symmetric decryption key. Only the proxies whose attributes are matched with the access control list can obtain the key of decrypted data. Through theoretical security analysis and experimental verifications, we show that our scheme can provide secure and efficacious ciphertext retrieval without the support of a secure channel.

Appendix: Security of secret keys

We define Game 2 according to the security of OWE IBE[27].

Game 2: The adversary A does not know the master key MSK. Besides, A can make Skeygen and DecryKey queries.

Setup. The challenger runs the Init algorithm and sends the parameters params to adversary A. It maintains the MSK itself.

Phase 1. The adversary forms the following queries.

• On Skeygen query (S,ID_i,g^y,MSK). The adversary A issues private key queries for {ID₁,...,ID_m}. The challenger performs the corresponding algorithm to generate the attribute private key ak_i by the attributes of ID_i. It gives the key ak_i to A.

• On DecryKey query (c,ID_i,y,g^x). The challenger responds by performing the corresponding algorithm to generate the attribute private key ak_i to the ID_i. It then decrypts the ciphertext c by running the algorithm DecryKey and returns the plaintext to A.

Challenge. When Phase 1 ends, the adversary outputs a ID∉{ID₁,...,ID_m} to challenger. The challenger opts a random K ∈{0, 1}^N and encrypts it by using ID. Then the ciphertext c is returned to A.

Phase 2. The adversary issues more queries {ID_m+ 1,...,ID_n} adaptively with the constraint that ID∉{ID_m+ 1,...,ID_n}. The challenger responds as in Phase 1.

Guess. The adversary A outputs a guess $K^{\prime }\in \{0,1\}^{N}$ and wins the game if $K^{\prime }=K$. The advantage of A winning is defined as

$$ Adv(A) = |Pr[K = K^{\prime}]-1/2| $$

Definition 3

If polynomially adversary A wins Game 2 with a negligible advantage, then the scheme is semantically secure.

Proof

Let A be a PPT adversary with an advantage ε in Game 2. Suppose q_D is the number of executing Skeygen queries and the number of executing DecryKey queries. Then there is an emulator B that has an advantage at least ε against OWE IBE in O(time(A)).

The emulator B uses the adversary A to gain advantage ε against OWE IBE. In the Init process, the emulator B returns A the parameters params, and the interactions between B and A are as follows. □

Phase 1. When adversary A issues Skeygen query (S,ID_i,g^y,MSK), emulator B gets the attribute private key ak_i corresponding to the attribute public key by runs the algorithm Skeygen. Then B sends it to adversary A.

When adversary A issues DecryKey query (c,ID_i,y,g^x), the emulator B decrypts the encrypted 𝜗 of c. Then B uses 𝜗 and the attribute private key ak_i to decrypt the remaining data. Finally, B sends the results to adversary A.

Challenge. When the adversary A decides that Phase 1 ends, it opts an identity $ID^{\prime }$ to challenge. Note that $ID^{\prime }$ did not appear in any query of Phase1.

After receiving the $ID^{\prime }$, emulator B chooses a random K ∈{0, 1}^N and uses $ID^{\prime }$ to encrypt K. Then B encrypts the 𝜗 of $c^{\prime }$ and returns it to adversary A.

Phase 2. The adversary A forms more queries as follows.

• Skeygen query ($ID^{*}\neq \{ID ,ID^{\prime }\}$). the emulator B responds as in Phase1.

• DecryKey query ($ID^{*}\neq \{ID,ID^{\prime }\}$ and $c^{*}\neq \{c,c^{\prime }$}). The emulator B responds as in Phase1. These queries might be responsed adaptively as in Phase1.

Guess. Adversary A outputs a guess $K^{\prime }$ and wins the game if $K^{\prime } = K$. The advantage of A against our scheme is the same as that of B against OWE IBE. The probability for B against OWE IBE is $\varepsilon ^{\prime }=\varepsilon /q_{D} n<1/2q_{D}n$. Therefore, the probability that our encryption scheme is secure is at least (1 − 1/2q_Dn) in Game 2.