Verifiable dynamic searchable encryption

Abstract

Using regular encryption schemes to protect the privacy of the outsourced data implies that the client should sacrifice functionality for security. Searchable symmetric encryption (SSE) schemes encrypt the data in a way that the client can later search and selectively retrieve the required data. Many SSE schemes have been proposed, starting with static constructions, and then dynamic and adaptively secure constructions but usually in the honest-but-curious model.We propose a verifiable dynamic SSE scheme that is adaptively secure against malicious adversaries. Our scheme supports file modification, which is essential for efficiently working with large files, in addition to the ability to add/delete files. While our main construction is proven secure in the random oracle model (ROM), we also present a solution secure in the standard model with full security proof. Our experiments show that our scheme in the ROM performs a search within a few milliseconds, verifies the result in another few milliseconds, and has a proof overhead of 0.01% only. Our standard model solution, while being asymptotically slower, is still practical, requiring only a small client memory (e.g., ≃ 488 KB) even for a large file collection (e.g., ≃ 10 GB), and necessitates small tokens (e.g., ≃ 156 KB for search and ≃ 362 KB for file operations).the token or the files), and the search pattern, which indicates whether two or more of the tokens were for the same query [1]. A secure SSE scheme leaks nothing more.Previous studies on cloud storage mainly considered efficient integrity verification [11][12][13][14][15][16][17][18]. Our goal in this paper is to achieve integrity and confidentiality simultaneously, while preserving the efficient search functionality in outsourced storage scenarios. We propose a verifiable dynamic SSE scheme that is secure against malicious servers, with the ability to efficiently add/delete/modify (parts of) encrypted files, and with security fully proven via simulation in both the random oracle model and the standard model. Related workThe oblivious RAM (ORAM) [19] supports search on the outsourced data while hiding the access pattern.However, as the usage of ORAM (one block per access) differs from that of the SSE (many blocks per access), it cannot fully prevent access or search pattern leakage in SSE [20]. Early works and definitionsGoh [21] introduced the secure index as an efficient data structure for keyword search. The scheme is secure against chosen-keyword attacks (CKA1). Chang and Mitzenmacher [22] proposed the simulation-based notion of security. Curtmola et al. [1] stated that both CKA1 [21] and simulation-based [22] definitions are not adequate, and gave a stronger definition (CKA2). Dynamic dataThe problem in the dynamic setting is that once an update operation is performed, the server gains extra information related to previous queries. The server can learn whether or not the newly added files contain the keywords that have already been queried for (even though the keyword is encrypted and the server d...