Controllable privacy preserving search based on symmetric predicate encryption in cloud storage

Abstract

Predicate encryption is a novel cryptographic primitive that provides fine-grained control over the accesses to encrypted data. It is often used in secure cloud storage and biometric matching. In this manuscript, we first propose a variant of symmetric predicate encryption, which provides controllable privacy preserving search functionalities, including revocable delegated search and un-decryptable delegated search. Due to these functionalities, the owner of a cloud storage can easily control the lifetimes and search privileges of cloud data.

Introduction

Recently, cloud computing prevails over the whole world. One of the most important and popular services of cloud computing is cloud storage service, such as Amazon’s S3  [1] and Microsoft’s Azure storage services  [2]. A lot of sensitive data will be stored into the cloud, so that the security of the cloud should be guaranteed  [3], [4], [5], [6], [7], [8]. Due to data privacy, it is necessary for users to encrypt their sensitive data before storing them into the cloud. However, there exist some shortcomings in the setting of traditional encryption. When a secret key owner wants to search some data that are stored in the cloud storage, he may perform one of the two following possible ways.

• He downloads all encrypted data from the cloud server, and then decrypts and searches them. If the encrypted data are huge or the client is a mobile user, it will be very inefficient and inconvenient.

• He sends his key to the cloud server which performs the decryption and search procedures. It causes a serious problem that the cloud server obtains the secret key.

Therefore, the above ways are not feasible. In order to avoid these drawbacks, predicate encryption schemes  [9], [10], [11], [12], [13], [14], [15], [16], [17], [18] were proposed. Predicate encryption is a new cryptographic primitive that provides fine-grained control over the accesses to encrypted data. In the setting of predicate encryption, any messages can be encrypted with a set of attributes. The secret key owner can generate a secret token corresponding to a predicate, and he can also delegate search privilege to a person by giving the secret token to the person. The person can take the secret token to make a search query. The cloud server receives the search query from the secret key owner or the above person, and then searches the matched ciphertexts if and only if the set of attributes of the ciphertexts satisfies the predicate of the secret token.

Like traditional encryptions, there are two categories in predicate encryption. [9], [17] are symmetric predicate encryption schemes. [10], [11], [12], [13], [15], [16], [18] are asymmetric predicate encryption schemes. Generally speaking (but not absolutely), the symmetric predicate encryption can be used in secure cloud storage and the asymmetric predicate encryption can be used in encrypted mail search, biometric matching and credit card payment gateways.

In 2009, Shen et al.  [17] proposed the first symmetric predicate encryption scheme. Blundo et al.  [9] proposed another symmetric scheme which works in groups of a prime order. This scheme is more efficient than  [17] which is performed in the groups of a composed order.

In the category of asymmetric setting, Boneh and Waters  [10] proposed the conception and a basic construction of predicate encryption. In EUROCRYPT 2008, Katz et al.  [12] proposed the first predicate encryption scheme over ${\mathbb{Z}}_N$ which can support inner products, and therefore it can provide more complex queries. In the following year, Wei and Ye  [16] extended the construction of Katz et al.’s scheme and applied this extension to anonymous authentication. In ICALP 2008, Shi and Waters  [18] proposed the first hierarchical predicate encryption scheme, and Okamoto and Takashima  [15] proposed the second hierarchical scheme that can support inner products. Li et al. proposed a search mechanism for encrypted personal health records in  [19] which is based on the Okamoto–Takashima scheme  [15]. Li et al.’s scheme allows delegation and revocation of the search privilege. The method adds a time attribute in the indexes and privileges. However, there exists a problem in this method. The sender must actively update all corresponding personal health records and the indexes, or the revocation of search privileges will fail and users might be able to continue retrieving some personal health records. In 2008, the proposed scheme of Iovino and Persiano  [11] is the first construction which can be performed in the groups of a prime order, so it is more efficient than the other schemes performed in the groups of a composed order. In ASIACRYPT 2009, Katz and Yerukhimovich  [13] discussed the black-box constructions of predicate encryption based on trapdoor permutations. They showed both negative and positive results. In EUROCRYPT 2010, Lewko et al.  [14] proposed fully secure functional encryption schemes which include an attribute-based encryption scheme and a predicate encryption scheme for inner products. Compared with other predicate encryption schemes which are proven to be secure in the selective-attribute model, these two proposed schemes are proven to be secure in the standard model by using a new security proof technique named dual system encryption  [20], [21].

Contribution: current privacy preserving search schemes over encrypted cloud storage services do not provide effective revocation for search privileges. Aiming at symmetric predicate encryptions and cloud storage requirements, we propose controllable privacy preserving search in cloud storage. This scheme is based on  [9] whose efficiency is much better than  [17]. Our controllable privacy preserving search scheme has two new features. One is revocable delegated search which makes it possible for the secret key owner to control the lifetime of the delegation. The other is un-decryptable delegated search. Due to this feature, a delegated person cannot decrypt the returned matched ciphertexts even though he has the delegated privilege of search.