An Improved Scheme for Range Queries on Encrypted Data

Transcription

1 Inernaonal Worshop on Cloud Compung and Informaon Secury (CCIS 03 An Improved Scheme for Range Queres on Encryped Daa Ye Xong, Dau Gu, Hanng Lu Lab of Crypography and Compuer Secury Shangha Jao Tong Unversy Shangha, Chna Emal: {nengzhzh, dgu, Absrac W e prevalence of cloud compung, more and more daa are ousourced o e unrused cloud servers, hch rases a secury ssue a ho can daa oners ensure e prvacy of er daa n cloud A sraghforard ay s o encryp e daa before uploadng, bu ll face ne challenge hen daa oners need o search on er encryped daa Searchable encrypon ll help o solve s problem by enablng e cloud servers o perform searchng for e daa oners hle no learnng any nformaon abou e daa and e searchng crera Range query on large encryped daa se s one of e mos dffcul pars of searchable encrypon In s paper, e proposed a novel scheme hch mproves e secury and avods any false posve And e evaluaon shos a our scheme reduces clen sorage and reman effcency compared e exsng schemes eyords-searchable Encrypon; Range Query; Cloud Secury I INTRODUCTION The erm of cloud compung refers o massve compung and sorage resources offerng on-demand servces over a ne-or Hoever e cloud users ll face e prvacy problem afer er daa s sen o e cloud Usually ousourced daa s encryped o preserve s prvacy and negry Ths brngs a challenge of ho o do search operaon on ousourced daa n e encryped form A rval soluon s o send all e encryped daa n cloud bac o e clen, en decryp o do e search operaon on planex Ths soluon oblvous conans drabac on effcency The opc of searchable encrypon dedcaes o solve e problem of searchng on encryped cloud daa bo n effcen and secure ay Typcal searchable encrypon [0] [3] research abou e searchng on a documen se o ge e documens a conan specfed eyords Curmola nroduced a represenave scheme of ypcal searchable encrypon [3] He proposed o revsed secury models, non-adapve secure and adapve secure, and also provded o consrucons machng ese o models We ll modfy hs secury models o propose a secury model for range queres on encryped daa Range queres on ousourcng daabases s anoer ell suded opc of searchable encrypon [] [4] Be dfferen e ypcal searchable encrypon, range queres on encryped daa dedcaes o solve e searchng on some arbues by a query range, hch s usually represened by a arbue le[,00] The cloud reurns e resuls and compung hch sasfy e query range For example, an nerne servce provder may ousource eb logs o cloud He may an o query s daa o analyze raffc paerns by dae ranges and IP address ranges specfed as 854 ec The arbue based encrypon (ABE s a publc-ey encrypon [5] [6] hch reas e query range as an arbue n ABE, offers provable secury for asymmerc encrypon, bu s ype of soluon suffers from hgh compuaon overhead Order-preservng encrypon-based echnques [8] [9] hch ensure a order amongs planex daa s preserved n e cpherex doman These soluons acheve effcency bu e leaage of relave order among cpherex doman may be exploed by e adversary o compromse e secury Prefx-preservng encrypon [] encryps e query-arbue of each record such a a prefx shared n o planexs s preserved n e correspondng cpherexs, hch means e cpherexs share a same leng prefx planexs The prefx-preservng cpherexs lead e scheme o lea nformaon abou euple order rapdly Bucezaon-based echnques [] [4] use dsrbuonal properes of e daase o paron and ndex em for effcen queryng Ths soluon can eep a mnmum dsclosure and acheve effcency bu suffers from varous lmaons such a buce ndces mus be sored and searched locally a e clen se Wha s more, s scheme ll nduce false posves [] proposed a scheme usng symmerc scalar-produc preservng encrypon o buld a herarchcal encryped ndex, s scheme can search effcenly bu sll conans false posves Our conrbuon In s paper, e mae e follong conrbuons We propose a scheme based on a secure ndex for range queres on encryped daa hch mproves e secury and avods any false posve We modfy Curmola s [3] non-adapve secure secury model o sugges an nonadapve secure secury model for range queres on encryped daa Ths model has a srong secury a many exsng schemes for range queres on encryped daa can no sasfy We ll prove a our scheme can sasfy e non-adapve secure secury model of range queres on encryped daa Our scheme sacrfces some sorage on cloud o mprove secury, bu our scheme deduces e clen cos bo n 03 The auors - Publshed by Alans Press 497

2 sorageand our scheme remans effcency compared e exsng schemes Wha s more, our scheme ll no nduce any false posve Table shos e comparson of our consrucon some compeng schemes As e able shos, our consrucon ges advanage especally a e clen compuaon and clen sorage We beleve a our scheme can acheve e hghes secury among e exsng schemes A src analyss ll be compleed n our fuure or Alough supporng dynamc operaons such as add or delee operaon for e range queres encrypon s dffcul for many schemes We fnd a slgh modfcaon our scheme can suppor dynamc operaons ell II RELATED WOR Arbue Based Encrypon The arbue based encrypon (ABE [5] [6] s a publc-ey encrypon a a user s eys and cpherexs are assocaed ses of descrpve arbues and a parcular ey can decryp a parcular cpherex only f e cardnaly of e nersecon of er labeled arbues exceeds a ceran reshold W slgh modfcaon, ABE can be appled o e scenaro of range query encrypon These schemes provde provable secury for ousourced daa and queres, bu a lmaon of ABE s a arbues are revealed n cpherex, hch s no accepable n e cloud scenaro And e compuaon on publc-ey encrypon may led o suffer from hgh compuaon overhead s anoer lmaon Order-Preservng Symmerc Encrypon In [8] [9], Boldyreva e al proposed e Order-Preservng Symmerc Encrypon (OPSE In OPSE e cpherex preserves e order propery of planex For example, E m denoes e encrypon of planex m, m en E > E m m m f as a resul n OPSE The auors shoed a e hghes secury of OPSE s ndsngushably under ordered chosen planex aacs (IND-OCAP Hoever e auors proved a no OPSE scheme could reach e IND-OCPA secury Alough ey proposed anoer secury defnon, OPSE sll reveals e orderng of encryped uples, hch can lead o subsanal prvacy loss Bucezaon-Based Technques In [] [4], Hore e al proposed a scheme based on a bucezaon echnques hch paron e daa no a se of buces Each buce s assgned a random ndex ag mang every elemen n a buce ndsngushable from anoer The ndces of buces are ep n e clen sde To process a range query, en clen have o ranslae e query o ags of buces by ndces The cloud reurn e correspondng buces usng such ags An oblvous lmaon of bucezaon-based echnques s a ll nduce false posves hch means a a query response ncludes all e uples n all machng buces Anoer lmaon s a clen has o rean e ndces a hs se And e ndex search complexy n clen sde ll ncrease lnearly e number of buces III DEFINITION OF RANGE QUERIES ON ENCRYPTED DATA We use curmola's [3] defnon bu mae some modfcaons a exend e search crera from sngle eyord search o range query search A Basc Noaons n r Number of uples Planex of uple, n R All planex uples se, r r, e, r n Encryped uple(euple, n E All euples, e e,, I, e n Secure ndex A query range denoed by o values W A query range se,,,, q A rapdoor of query range R A uple se sasfed e query range E A euple se sasfed e rapdoor B Defnon of Index Based Range Queres On Encryped Daa We defne a scheme based on a secure ndex for range queres on encryped daa hch s composed of fve polynomal-me algorms (Geney, Encryp, Trapdoor, Search, Decryp such a :s a probablsc ey generaon Gen algorm a s run by e user o seup e scheme I aes as npu a secury parameer, and oupus a secre ey I, E Encryp, R: a probablsc algorm run by e clen o encryp uple se R I aes e secre ey and e uple se o be encryped R as npus And e resuls of s algorm are composed of o pars: a secure ndex I and an encryped uple se E = e, e,, e n, e s e encryped form(euple of r n The secure ndex and e cpherex of uple se ll be sen o e server afer generaon Trapdoor, : a deermnsc algorm run by e clen o buld a rapdoor on e query range The rapdoor ll be sen o e server afer generaon E Search I, : a deermnsc algorm run by e server o mae a search I aes a secure ndex I and a rapdoor as npus, and e search resuls E, hch means e uple se a mach e query range 498

3 r Decryp e, : a deermnsc algorm run by e clen o decryp e cpherex of a sngle uple An scheme based on secure ndex for range queres on encryped daa s correc f for all N, for all oupu by Gen, for all I, oupu by Encryp all, for Search n e I,e, for I,Trpdr E Decryp e r C Secury Defnon of Range Query On Encryped Daa Curmola [3] nroduced o secury models, nonadapve secure and adapve secure of SSE(Searchable Symmerc Encrypon scheme These models provde srong secury guaranee for SSE We ll propose a smlar secury model for range queres on encryped daa based on e non-adapve secury model of SSE Properes Bucezaon Order-Preservng Enc Prefx-Preservng Enc Our scheme Clen Compuaon O(n/B O(δ O(slog D O(p Clen Sorage(Bs O(n/B O(δlog D +log(n O(log(N O(log(N Server Compuaon O(n/B O( C +log(n O( C +log(nlog D O( D Query Send Sze(Bs O(C/B O(log D O(log D O(log D False Posve yes no no no Table Coss comparson o exsng schemes n s e number of uples, B s e buce sze of bucezaon scheme, C s e resul se sze s and p are coss of symmerc encrypon and permuaon operaons, respecvely δ for OP E s small unnon relaon o n N s a b number Hsory A q-query hsory over a uple se R n H R, W uples s defned as q query ranges W,,, q, hle s a sequence of Access Paern The access paern nduced by a q- query hsory H ( R, W, s e uple H R R,,, R q Search Paern The search paern nduced by a q-query hsory H R, W for, j q, e elemen n e s f e par value of query elemen n e ro and, s a symmerc marx σ(h such a ro and are same j column j, e j column s f one of e par value of query s same one of e par value of query j, and 0 oerse Trace The race nduced by a q-query hsory H R, W, s a sequence H n, H, H Non-Adapve semanc secury for range queres on encryped daa Le RQED = (Geney, Encryp, Trapdoor, Search, Decryp be a scheme for range queres on encryped daa over R, be a secury parameer, A be an adversary, and S be a smulaor Consder e follong probablsc expermens: Real RQED, A Geney( ( sa, H A( parse H as (R, W (I, E Encryp (, R for ( q Trapdoor, le T (, oupu V ( Sm REQD, A,, ( sa, H A( V S( ( H oupu V and s A ( q (I, E, T and s A A scheme for range queres on encryped daa s semancally secure f for all polynomal-sze adversary A, ere exss a polynomal-sze smulaor S such a for all polynomal-sze dsngushers D : IV Pr[D( V, sa : ( V, sa Real Pr[D( V,s : ( V,s Sm A Basc Idea A A RQED, A A( ]- ( ] negl( RQED, OUR CONSTRUCTION OF RANGE QUERIES ON ENCRYPTED DATA Many of curren soluons of range queres on encryped daa append some exra daa encryped uples hch s used o do range queres drecly on cpherexs The appended daa encryped uples usually preserve some propery of planexs hch may lead o nformaon leaage, such as e orderng of encryped uples revealed n e 499

4 Order Preservng Symmerc Encrypon (OPSE scheme So e decde o use a secure ndex hch may brng exra sorage bu mae encryped uples ndsngushable each oer Ths avods subsanal prvacy loss We suppose a e clen sde has a able R conssng of n uples need o be ousourced o cloud The clen ll do range queres on one of e arbue Q The query range denoed by, ll be sen o cloud afer ang e rapdoor operaon Fgure s an smple example 3 uples, e ll en buld a secure ndex on, and do range queres on e arbue group We buld e ndex I ro by ro e follong r e buld a ro n I o save e seps For each uple relaon beeen query-arbue value of r and all possble values of Q n a hdden manner, and each ro conans some paddng bs o hde e query-arbue value of r Frs e randomly generae a hdden b v Le q be each possble elemen of Q Q For each possble value of r less or equal o q If e query-arbue value of We use v o denoe, hch means e se e correspondng elemen of I o v Oerse e use v mod o denoe Fgure sho e resul afer ang above seps on able n Fgure The arbue space of arbue group conssng of 4 dsnc values {,,3,4} Fgure An example able needed o be encryped Encryp Tuples We encryp e uples smply useng some semancally secure encrypon algorm le AES For each uple n R e encryp o euple by s bloc cpher Then e save all euples n a e array E Here e do no hde e real poson of uples n R so e euples reman e same poson n E of correspondng uples n R Buld Secure Index The secure ndex I sored on cloud s acually a bnary marx Suppose Q denoes dsnc value appeared n e arbue space of Q An elemen of I s a bnary number one b Each elemen of I represens e query-arbue value relaonshp beeen a r and a elemen of Q For example, f e uple arbue value of r s bgger an some arbue value n e arbue space, en one of e elemen n I s se o 0 or o denoe s relaon The elemen value s 0 or, hch s chosen randomly o hde e real relaon Le Q Q Then I be e elemen number of consss of n ros and Q 4 columns The ro of I represens a uple s arbue relaon o every elemen n Q and some paddng bs The column of I represens e relaon beeen a elemen n Q all uples or only a paddng b array We alays use e 0 column o denoe negave nfny for all e values no n Q Q And We and less an e mnmum value n alays use e Q nfny for all e values no n maxmum value n Q oo column o denoe e posve Q and bgger an e Fgure Secure ndex for uple group = (v = 0 Afer seng relaon value for all arbue values e pad each ro exra 0 or so a e number of 0 and e number of n each ro are bo equvalen o Q The paddng resul s shon n Fgure 3 We complee ese seps for e hole able Then e use a randompermuaon funcon o re-array e columns of I Fgure 4 shos e resul of permuaon of columns Fgure 3 Paddng secure ndex for uple group = Fgure 4 Secure ndex afer permuaon Trapdoor Afer buldng e secure ndex I, e clen sde need o save e random-permuaon funcon hch s used o buld secure ndex, e mnmum and e maxmum elemen of Q W e query range, as npu, e generae a rapdoor, n e follong seps If s smaller or equal o e mnmum elemen of a mn Q equal o e maxmum elemen of Q and s more an or Q The column s e column a represens 500

5 e query-arbue value before dong permuaon operaon So Q mn If s smaller o e mnmum elemen of Q The 0 column s e column a represens e query-arbue value before dong permuaon operaon So 0 If s bgger o e maxmum elemen of Q Q The column s e column a represens e query-arbue value before dong permuaon operaon So Q We generae by e same ay of Afer generang e rapdoor, e send e rapdoor o cloud The cloud uses e rapdoor and secure ndex I o ge e expec resul n follong ay Tae a XOR operaon on e column and e columnths ll generae a b array leng n The value of b n s array s ndcaes a e uple sasfes e query range, We may fnd a e ro represen some uple n I may have e same ro number e correspondng euple n E The reason a e do no do permuaon operaon on e ro number o hde e real ro number n e orgnal able s a e suppose e query-arbue value randomly dsrbue, and s maes sense n much of praccal suaons Adversary can easly recognze a ordered arbue based on e fac e queres alays reurn connuous euples n e euples array, and us leas e order nformaon of R hch may lead o subsanal prvacy loss Hoever s s a rval problem hch could be solved easly by addng a permuaon operaon on ro number for ordered arbue To mae our basc consrucon concse e smply remove s sep B Our Scheme For Range Query On Encryped Daa Some noaons used are descrbed as follos: Le Q be e query-arbue of R We ll buld a n secure ndex I for o do range queres Le Q be e se of dsnc values appearng nq Le Q denoes e number of elemens n Q Le I be e secure ndex of our scheme hch s a Q 4 n bnary marx x y y column I, y x ro and y column Le r q denoe e value of uple I, denoes e b denoes e b array of r n arbueq Le SE be a symmerc encrypon scheme hch s pseudo-randomness agans chosen-planex aacs (PCPA-Secure Pseudo-random permuaon : 0, s, log 0 0, log s Geney 3 $ sample 0, SEGen reurn, I, E Encryp,R 3 : for le e n : SEEnc add e oe r 4 randomly sample v 0, 5 for j Q : 6 f r q Q j : 7 I, j v 8 else : 9 I, j v mod 0 I, 0 v denoe - I, Q v mod denoe paddng e ro of I so a enumber of v and 3 reurn v mod are bo equvalen oδq E,I, Trapdoor,α, : mn : 0 Q f Q 3else f max Q : 4 5 else : Q 6 mn 7f mn Q: 8 0 9else f max Q : Q 0 else : $ Q mn 3 reurn, 50

6 C Search I,, α β : B I, I, for n : 3 f B [ ] : 4 add e oc 5 reurn C r Decryp,e : r SEDec, e reurn r C Secury Analyss of our scheme Proof We provde a polynomal-sze smulaor S hose oupu Real Sm RQED, A RQED, A can no be dsngushed for all polynomal-sze adversary A, S gen-eraes oupu from a race of q-query hsory H as follos: Run Geney algorm o generae, Run Encryp algorm on R o generae I, Trapdoor,α,β q 3 Le 4 Se e o be a random bs srng leng q 5 Le e oupu V I, E, T e, e, e,,,,, I, n q q I rapdoor, searchng on expeced euple se V I, E, T e ll reurn e Assume s e oupu of Real RQED, A on hsory H We no clam a no polynomal-sze V and V dsngusher D can dsngush beeen ( E and E Recall a each e s SE cpherex e s a random bs srng same leng of e The PCPA-secury of SE ll guaranee a e and e are ndsngushable I Recall a e buldng process of I do ( I and no need any ey unless e random permuaon operaon uses a nely generaed ey o buld I So e pseudo-randomness of ll ensure I and I are ndsngushably 3 (T and T Bo T and T are generaed by dfferen eys, so e pseudo-randomness of ll ensure er ndsngushably The ndsngush beeen consrucon s non-adapve secure D Exenson of our scheme V and V ndcaes a our Dynamc add or delee operaon s a dffcul as for mos exsng schemes We fnd a our scheme can easly suppor add and delee operaon on euples slgh modfcaon We can spl e buldng process of e secure ndex I no buldng a sub secure ndex for each uple one by one Thus f e arbue space s pre-deermned en e add operaon for secure ndex I s e same as buldng a sub ndex for one uple hch ll no affec e srucure of I When ang e add operaon o E, only needs o add e correspondng euple a e al of E Whch s also e same e seup process of E The delee operaon can be mplemened by deleng e correspondng ro n I and correspondng euple n E The delee operaon may be a lle complcaed an e add operaon because e need o handle e blan ros afer ang e delee operaon Alough e clamed our secury model s very srong, no scheme proof secury can acheve s secury excep our s A rgorously analyss for s concluson s sll needed, hch s e furer research for us So far our scheme can only suppor one-dmenson arbue A rval ay o suppor mul-dmensons arbues s o expand e ndex sze The column number s no e dsnc values number n one arbue space, bu e number of dsnc value n e caresan produc of dfferen arbues spaces The cos of sorage may ncrease qucly e dmenson number As e can see, e column number of secure ndex s deermned by e arbue range hch means all possble value may appear n queres So f e arbue range s large maes e secure ndex large, oo Forunaely e use only one b for each value of arbue range n one ro Ths can reduce e oal sorage sharply There s a close ln beeen e sze of secure ndex and arbue ype To reduce e sorage e hope e arbue range s very dense An ypcal example of dense arbue range s e unque d of each uple hch s a seres of sequences number V PERFORMANCE ANALYSIS The performance analyss n our consrucon can be dvded no o pars, e cos on e euples array and e 50

7 cos on secure ndex Because e use some bloc cpher o encryp uples drecly, hch s a necessary cos for all e range queres schemes So e focus our performance analyss manly on e cos of secure ndex The performance bolenec of secure ndex n our scheme s e sorage cos n cloud The reason s a for each dsnc value n e query-arbue space e need o buld a bs-column n e secure ndex So e sze of e secure ndex s relevan ghly o e query-arbue value space Consder a able conssng of 04 uples a query-arbue named salary per ee hch ranges from 0$ o 0$ The sze of e secure ndex oupu by our consrucon s nearly bs a s 0M B The sze of e secure ndex ncreases lnearly e number of uples or e dsnc value number of query-range space The secure ndex of our consrucon can be arranged o a dsrbued envronmen o remedy e sorage cos We save a couple of columns nsead of e hole secure ndex n one machne When dong range queres, e only need o fnd e rgh machne conanng e columns a represen e query ranges The res operaons are e same as e orgnal scheme The compung cos manly consss of ree pars, a random permuaon on e clen sde, a XOR operaon of o b array leng n and a lnear search on a b array leng n on cloud The complexy of e search operaon s O(n Hoever, e ae s operaon on a b array The basc operaon no le a comparson beeen o large negers s only b operaon So e oal cos of compung ll ncrease sloly VI CONCLUSION In s paper, e proposed a scheme for range queres on encryped daa and e also proposed a non-adapve secury model based on e SSE [3] secury model for range queres on encryped daa, hch has a srong secury We mae secury analyss and prove a our scheme can acheve non-adapve secure for range queres on encryped daa Our scheme reduces e clen cos and mproves e secury ou effcency loss comparng o exsng schemes Wha s more slgh modfcaon our scheme can be appled o dynamc range queres on encryped daa and e secure ndex of our scheme s very suable o save on a dsrbued envronmen VII FUTURE WOR Inuvely our scheme acheve e sronges secury among presen schemes for range queres on encryped daa, bu a rgorous analyss s sll need o complee Revsng our scheme o suppor mul-range and dynamc add and delee euple are also meanngful ors And e ll ry o exend our scheme o apply o a mul-users crcumsances oo ACNOWLEDGMENT Ths or as suppored by Docoral Fund of Mnsry of Educaon of Chna (Gran No: REFERENCES [] B Hore, S Mehrora, and G Tsud A Prvacy-Preservng Index for Range Queres VLDB, 004 [] J L and E Omecns Effcency and secury rade-off n supporng range queres on encryped daabases In Proc DBSec, pages 69-83,005 [3] R Curmola, J Garay, S amara, and R Osrovsy Searchable symmerc encrypon: Improved defnons and effcen consrucons ACM Conference on Compuer and Communcaons Secury (CCS 06, 006 [4] B Hore, S Mehrora, M Canm, and M anarcoglu Secure muldmensonal range queres over ousourced daa The VLDB Journal,0 [5] D Boneh and B Waers, Conjuncve, subse, and range queres on encryped daa IACR Crypology eprn Archve, vol 006, p87,006 [6] E Shen, E Sh, and B Waers, Predcae prvacy n encrypon sysems In Theory of Crypography Conference (TCC 09, pp ,009 [7] E Sh, J Beencour, T Chan, D Song, and A Perrg Muldmensonal range query over encryped daa In IEEE Symposum on Secury and Prvacy, Washngon, DC, USA, 007 IEEE Compuer Socey [8] A Boldyreva, N Chenee, Y Lee, and A ONell, Order-preservng symmerc encrypon In EUROCRYPT, pp4-4, 009 [9] A Boldyreva, N Chenee, and A ONell, Order-preservng encrypon revsed: Improved secury analyss and alernave soluons In CRYPTO, 0, pp [0] H Lu, D Gu, C Jn,T Yn Reducng exra sorage n searchable symmerc encrypon scheme Cloud Compung Technology and Scence (CloudCom, 0 IEEE 4 Inernaonal Conference on IEEE, 0: 55-6 [] P Wang, R Chnya V Secure and Effcen Range Queres on Ousourced Daabases Usng Rp-rees Inernaonal Conference on Daa 503