An Efficient Two-Server Ranked Dynamic Searchable Encryption Scheme

Abstract

Searchable encryption (SE) allows users to search over encrypted data without decrypting. In most existing SE schemes, server returns all matched files without relevance ranking, and the update mechanism are suffering with high communication and computation cost, which are not efficient enough to satisfy the real-life dynamic scenario. Addressing the above issues, we proposed TS-RDSE-a Two-Server Ranked Dynamic Searchable Encryption scheme. We integrate orthogonal vector and efficient homomorphic encryption cryptosystems to build a vector-level dynamic secure index, which simultaneously supports efficient dynamic update operations like deletion and insertion of files flexibly. Moreover, in order to rank the search results by relevance without decryption, we build a secure sorting protocol based on the widely-used tf-idf weighting formula and addition property of partial homomorphic encryption, which achieves accurate sorting for the search results while protecting the privacy of relevance scores. We give a comprehensive analysis of the correctness of TS-RDSE in the aspect of searching and sorting with mathematical proofs. The security analysis shows that TS-RDSE is secure against adaptive dynamic chosen-keyword attacks (CKA2) by honest-but-curious adversaries in random oracle model. The performance analysis shows that TS-RDSE has both a very light user workload and a moderate server workload, and it is superior to the existing approaches in terms of functionalities and expansibility. Extensive experiments on the real-world dataset validate our analysis and show that TS-RDSE is suitable for the real world cloud storage environment. INDEX TERMS Searchable encryption, dynamic update, homomorphic encryption, secure sorting. I. MOTIVATION The correctness of TS-RDSE implies that, for all security parameters k, all keys (K , SK , PK) generated by KeyGen(1 k), for all (γ , c) outputs by Setup(K , PK , f), and for all sequences of search or update operations on γ , Sort(S 1 (Search(S 1 (T okenGen(PK , K , W), γ); S 2 (SK)), PK); S 2 (SK)) will always outputs the correct ranked results R s , that is, not only satisfies the search request, but is sorted according to the corresponding weight scores. C. SECURITY DEFINITION The security definition for TS-RDSE is formalized by the four leakage functions L 1 , L 2 , L 3 and L 4 , which denote the information leaked to S 1 and S 2 in different phases.

Leveraging Searchable Encryption through Homomorphic Encryption: A Comprehensive Analysis

“…However, despite this, a considerable percentage of SE schemes utilize FHE due to its potential benefits (38% use FHE for 57% of systems using PHE). Finally, we also observed that more than a half of the schemes that rely on a PHE scheme use either the Paillier cryptosystem [52,59,64,65,69], a combination of the Paillier cryptosystem with GM [63,71], or the Paillier cryptosystem with threshold decryption [67]. The reason that so many approaches choose to use the Paillier cryptosystem (or any other variations) is the simplicity and security of the scheme, as well as the number of existing implementations freely available.…”

“…In the same year, Li et al [64], proposed a two-server ranked dynamic SE scheme (TS-RDSE), meant for a single-user setting, which supports multi-keyword search. This scheme uses two cloud servers to perform the searching and sorting, with one of them being responsible for storing the encrypted data and the other one for storing the secret key.…”

“…Before 2021, three dynamic SE schemes that use HE to provide index updates were proposed, namely the TSED scheme proposed by Elizabeth et al [71], a variant of this scheme, named VSED [63], and the TS-RDSE scheme proposed by Li et al [64]. These schemes are designed for a single-user setting.…”

“…Paillier EC El Gamal XOR Boneh PCTD GM BCP FV BGV FHOPE BFV DGHV [52] x [53] x [54] x [55] x [56] x [57] x [11] [58] x [59] x [60] x [61] x [62] [63] x x [64] x [65] x [66] x [67] x [68] x [69] x [70] x [7] x [71] x x [72] x…”

“…Among all studied schemes, there is only one that uses a technique other than TF-IDF to rank their search results, namely the double score weighting formula (firstly proposed by Boucenna et al [77] and used in the work of Boucenna et al [68]). Another important observation, now regarding schemes that allow for top-k results, is that the majority of these schemes do not allow it in a direct and single round of communication, i.e., most schemes either rely on PIR [60,67], or they include another entity in the framework, such as a coprocessor [63,71], a collaborate server [64] or a private cloud [62], which have access to the private key and are responsible for ranking search results.…”