Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Securing Organization's Data: A Role-Based Authorized Keyword Search Scheme with Efficient Decryption

Nazatul Haque Sultan, Maryline Laurent, Vijay Varadharajan

TL;DR

This work addresses secure keyword search over outsourced encrypted data in multi-organization cloud settings by integrating Role-Based Encryption (RBE) with RBAC policies. It introduces a nine-phase framework that enables only authorized users with appropriate roles to perform keyword search and decrypt data, while outsourcing costly cryptographic operations to the cloud and supporting conjunctive keywords and revocation. The scheme provides formal semantic security against chosen-plaintext and chosen-keyword attacks (IND-CPA and IND-CKA) via reductions to the Decisional Bilinear Diffie-Hellman assumption, and it demonstrates practical efficiency through a detailed performance analysis that accounts for data encryption, trapdoor generation, search, decryption, and revocation. This approach offers strong data confidentiality, keyword secrecy, forward/backward secrecy, replay protection, and scalable multi-organization data sharing, making it applicable to real-world enterprise environments with complex policy hierarchies.

Abstract

For better data availability and accessibility while ensuring data secrecy, organizations often tend to outsource their encrypted data to the cloud storage servers, thus bringing the challenge of keyword search over encrypted data. In this paper, we propose a novel authorized keyword search scheme using Role-Based Encryption (RBE) technique in a cloud environment. The contributions of this paper are multi-fold. First, it presents a keyword search scheme which enables only the authorized users, having proper assigned roles, to delegate keyword-based data search capabilities over encrypted data to the cloud providers without disclosing any sensitive information. Second, it supports a multi-organization cloud environment, where the users can be associated with more than one organization. Third, the proposed scheme provides efficient decryption, conjunctive keyword search and revocation mechanisms. Fourth, the proposed scheme outsources expensive cryptographic operations in decryption to the cloud in a secure manner. Fifth, we have provided a formal security analysis to prove that the proposed scheme is semantically secure against Chosen Plaintext and Chosen Keyword Attacks. Finally, our performance analysis shows that the proposed scheme is suitable for practical applications.

Securing Organization's Data: A Role-Based Authorized Keyword Search Scheme with Efficient Decryption

TL;DR

This work addresses secure keyword search over outsourced encrypted data in multi-organization cloud settings by integrating Role-Based Encryption (RBE) with RBAC policies. It introduces a nine-phase framework that enables only authorized users with appropriate roles to perform keyword search and decrypt data, while outsourcing costly cryptographic operations to the cloud and supporting conjunctive keywords and revocation. The scheme provides formal semantic security against chosen-plaintext and chosen-keyword attacks (IND-CPA and IND-CKA) via reductions to the Decisional Bilinear Diffie-Hellman assumption, and it demonstrates practical efficiency through a detailed performance analysis that accounts for data encryption, trapdoor generation, search, decryption, and revocation. This approach offers strong data confidentiality, keyword secrecy, forward/backward secrecy, replay protection, and scalable multi-organization data sharing, making it applicable to real-world enterprise environments with complex policy hierarchies.

Abstract

For better data availability and accessibility while ensuring data secrecy, organizations often tend to outsource their encrypted data to the cloud storage servers, thus bringing the challenge of keyword search over encrypted data. In this paper, we propose a novel authorized keyword search scheme using Role-Based Encryption (RBE) technique in a cloud environment. The contributions of this paper are multi-fold. First, it presents a keyword search scheme which enables only the authorized users, having proper assigned roles, to delegate keyword-based data search capabilities over encrypted data to the cloud providers without disclosing any sensitive information. Second, it supports a multi-organization cloud environment, where the users can be associated with more than one organization. Third, the proposed scheme provides efficient decryption, conjunctive keyword search and revocation mechanisms. Fourth, the proposed scheme outsources expensive cryptographic operations in decryption to the cloud in a secure manner. Fifth, we have provided a formal security analysis to prove that the proposed scheme is semantically secure against Chosen Plaintext and Chosen Keyword Attacks. Finally, our performance analysis shows that the proposed scheme is suitable for practical applications.

Paper Structure

This paper contains 54 sections, 2 theorems, 32 equations, 6 figures, 6 tables.

Table of Contents

  1. Introduction
  2. Related Works
  3. Keyword Search over Encrypted Data
  4. Cryptographic RBAC based Data Access Control
  5. Problem Statement
  6. System Model
  7. Threat Model
  8. Design and Security Goals
  9. Framework
  10. Security Model
  11. Semantic Security against Chosen Plaintext Attack
  12. Semantic Security against Chosen Keyword Attack
  13. Preliminaries
  14. Role Hierarchy notations
  15. Bilinear Pairing
  16. ...and 39 more sections

Key Result

Theorem 2

If a probabilistic-polynomial time (PPT) adversary $\mathcal{A}_1$ wins the CPA security game as defined in Section CPA with a non-negligible advantage $\epsilon$, then a PPT simulator $\mathcal{B}$ can be constructed to break the DBDH assumption with non-negligible advantage $\frac{\epsilon}{2}$.

Figures (6)

  • Figure 1: Proposed System Model
  • Figure 2: Sample Role Hierarchy (RH)
  • Figure 3: Sample Role Key Hierarchy (RKH)
  • Figure 4: Computation Time of Data Encryption and Trapdoor Generation Phases
  • Figure 5: Computation Time of Authentication and PartialDec Algorithms
  • ...and 1 more figures

Theorems & Definitions (7)

  • Definition 3.1
  • Definition 3.2
  • Remark 1
  • Theorem 2
  • proof
  • Theorem 3
  • proof