Multi-owner Secure Encrypted Search Using Searching Adversarial Networks

TL;DR

This paper introduces a novel multi-owner encrypted search method using searching adversarial networks, achieving high query precision, strong privacy, and efficient dynamic updates in cloud data environments.

Contribution

It proposes a secure, efficient multi-keyword ranked search scheme leveraging searching adversarial networks for optimal privacy and precision in multi-owner encrypted cloud data.

Findings

Query precision exceeds 95%

Computational complexity approaches O(log N)

Low overhead on computation, communication, and storage

Abstract

Searchable symmetric encryption (SSE) for multi-owner model draws much attention as it enables data users to perform searches over encrypted cloud data outsourced by data owners. However, implementing secure and precise query, efficient search and flexible dynamic system maintenance at the same time in SSE remains a challenge. To address this, this paper proposes secure and efficient multi-keyword ranked search over encrypted cloud data for multi-owner model based on searching adversarial networks. We exploit searching adversarial networks to achieve optimal pseudo-keyword padding, and obtain the optimal game equilibrium for query precision and privacy protection strength. Maximum likelihood search balanced tree is generated by probabilistic learning, which achieves efficient search and brings the computational complexity close to $\mathcal{O}(\log N)$. In addition, we enable flexible dynamic system maintenance with balanced index forest that makes full use of distributed computing. Compared with previous works, our solution maintains query precision above 95% while ensuring adequate privacy protection, and introduces low overhead on computation, communication and storage.

Equations

$$Score(\widetilde{u_{i,j}.v},T_i)=\{M_{i,1}^T{u}_{i,j}.v_1,M_{i,2}^T{u}_{i,j}.v_2\}\cdot \{M_{i,1}^{-1}{Q}_{i,1},M_{i,2}^{-1}{Q}_{i,2}\}=u_{i,j}^T.v\cdot Q_i$$

$$\underset{S}{\min }\underset{D}{\max }V(D,S)={\mathbb{E}}_{x\sim p_{data}(x)}[\log D(x)]+{\mathbb{E}}_{x\sim p_{\epsilon }(\epsilon )}[\log (1-D(S(\epsilon )))]$$

Full text

1 Introduction

Background and Motivation.

In cloud computing, searchable symmetric encryption (SSE) for multiple data owners model (multi-owner model, MOD) draws much attention as it enables multiple data users (clients) to perform searches over encrypted cloud data outsourced by multiple data owners (authorities). Unfortunately, none of the previously-known traditional SSE scheme for MOD achieve secure and precise query, efficient search and flexible dynamic system maintenance at the same time [9]. This severely limits the practical value of SSE and decreases its chance of deployment in real-world cloud storage systems.

Related Work and Challenge.

SSE has been continuously developed since it was proposed by Song et al. [12], and multi-keyword ranked search over encrypted cloud data scheme is recognized as outstanding [9]. Cao et al. [1] first proposed privacy-preserving multi-keyword ranked search scheme (MRSE), and established strict privacy requirements. They first employed asymmetric scalar-product preserving encryption (ASPE) approach [15] to obtain the similarity scores of the query vector and the index vector, so that the cloud server can return the top-k documents. However, they did not provide the optimal balance of query precision and privacy protection strength. For better query precision and query speed, Sun et al. [13] proposed MTS with the TF$\times$IDF keyword weight model, where the keyword weight depends on the frequency of the keyword in the document and the ratio of the documents containing this keyword to the total documents. This means that TF$\times$IDF cannot handle the differences between data from different owners in MOD, since each owner’s data is different and there is no uniform standard to measure keyword weights. Based on MRSE, Li et al. [8] proposed a better solution (MKQE), where a new index construction algorithm and trapdoor generation algorithm are designed to realize the dynamic expansion of the keyword dictionary and improve the system performance. However, their scheme only realized the linean search efficiency. Xia et al. [16] provided EDMRS to support flexible dynamic operation by using balanced index tree that builded following the bottom-up strategy and “greedy” method, and they used parallel computing to improve search efficiency. However, when migrating to MOD, ordinary balanced binary tree they employed is not optimistic [6]. It is frustrating that the above solutions only support SSE for single data owner model. Due to the diverse demand of the application scenario, such as emerging authorised searchable technology for multi-client (authority) encrypted medical databases that focuses on privacy protection [17, 18], research on SSE for MOD is increasingly active. Guo et al. [6] proposed MKRS_MO for MOD, they designed a heuristic weight generation algorithm based on the relationships among keywords, documents and owners (KDO). They considered the correlation among documents and the impact of documents’ quality on search results, so that the KDO is more suitable for MOD than the TF$\times$IDF. However, they ignored the secure search scheme in known background model [1](a threat model that measures the ability of “honest but curious” cloud server [14, 20] to evaluate private data and the risk of revealing private information in SSE system). Currently, SSE for MOD is still these challenges: (1) comprehensively optimizing query precision and privacy protection is difficult; (2) a large amount of different data from multiple data owners make the data features sparse, and the calculation of high-dimensional vectors can cause “curse of dimensionality”; (3) frequent updates of data challenge the scalability of dynamic system maintenance.

Our Contribution.

This paper proposes secure and efficient multi-keyword ranked search over encrypted cloud data for multi-owner model based on searching adversarial networks (MRSM_SAN). Specifically, including the following three techniques: (1) optimal pseudo-keyword padding based on searching adversarial networks (SAN): To improve the privacy protection strength of SSE is a top priority. Padding random noise into the data [1, 8, 19] is a current popular method designed to interfere with the analysis and evaluation from cloud server, which protects the document content and keyword information better. However, such an operation will reduce the query precision [1]. In response to this, we creatively use adversarial learning [4] to obtain the optimal probability distribution for controlling pseudo-keyword padding and the optimal game equilibrium for the query precision and the privacy protection strength. This makes query precision exceeds 95% while ensuring adequate privacy protection, which is better than traditional SSE [1, 6, 8, 13, 16]; (2) efficient search based on maximum likelihood search balanced tree (MLSB-Tree): The construction of the index tree is the biggest factor affecting the search efficiency. If the leaf nodes of the index tree are sorted by maximum probability (the ranking of the index vectors from high to low depends on the probability of being searched), the computational complexity will be close to $\mathcal{O}(\log N)$ [7]. Probabilistic learning is employed to obtain MLSB-Tree, which is ordered in a maximum probability. The experimental evaluation shows that MLSB-Tree-based search is faster and more stable compare with related works [6, 16]; (3) flexible dynamic system maintenance based on balanced index forest (BIF): Using unsupervised learning [3, 10] to design a fast index clustering algorithm to classify all indexes into multiple index partitions, and a corresponding balanced index tree is constructed for each index partition, thus all index trees form BIF. Owing to BIF is distributed, it only needs to maintain the corresponding index partition without touching all indexes in dynamic system maintenance, which improves the efficiency of index update operations and introduces low overhead on the computation, communication and storage. In summary, MRSM_SAN increases the possibility of deploying dynamic SSE in real-world cloud storage systems.

Organization and Version Notes.

Section 2 describes scheme. Section 3 conducts experimental evaluation. Section 4 discusses our solution. Compared with the preliminary version [2], this paper adds algorithms, enhances security analysis, and conducts more in-depth experimental analysis of the proposed scheme.

2 Secure and Efficient MRSM_SAN

2.1 System Model

The proposed system model consists of four parties, is depicted in Fig. 1. Data owners ($DO$) are responsible for constructing searchable index, encrypting data and sending them to cloud server or trusted proxy; Data users ($DU$) are consumers of cloud services. Based on attribute-based encryption [5], once $DO$ authorize $DU$ attributes related to the retrieved data, $DU$ can retrieve the corresponding data; Trusted proxy ($TP$) is responsible for index processing, query and trapdoor generation, user authority authentication; Cloud server ($CS$) provides cloud service, including running authorized access controls, performing searches over encrypted cloud data based on query requests, and returning top-k documents to $DU$. $CS$ is considered“honest but curious” [14, 20], so that it is necessary to provide a secure search scheme to protect privacy. Our goal is to protect index privacy, query privacy and keyword privacy in dynamic SSE.

2.2 MRSM_SAN Framework

Setup:

Based on index clustering results ($s$ index partitions) and privacy requirements in known background model [1], $TP$ determines the size $N_{i}$ of sub-dictionary $D_{i}$, the number $U_{i}$ of pseudo-keyword, sets the parameter $V_{i}=U_{i}+N_{i}$. Thus $V$ = {$V_{1}$,…,$V_{s}$}, $U$ = {$U_{1}$,…,$U_{s}$}, $N$ = {$N_{1}$,…,$N_{s}$}.

KeyGen($V$):

$TP$ generates key $SK$ = {$SK_{1}$,…,$SK_{s}$}, where $SK_{i}$ = {$S_{i}$, $M_{i,1}$, $M_{i,2}$}, $M_{i,1}$ and $M_{i,2}$ are two $V_{i}\times V_{i}$-dimensional invertible matrices, $S_{i}$ is a random $V_{i}$-dimensional vector. Symmetric key $\overline{SK}_{i}$ = {$S_{i}$, $M^{-1}_{i,1}$, $M^{-1}_{i,2}$}.

Extended-KeyGen($SK_{i},Z_{i}$):

For dynamic search [8, 16], if $Z_{i}$ new keywords are added into the $i$-th sub-dictionary, $TP$ generates a new key $SK_{i}^{\prime}$ = {$S_{i}^{\prime}$, $M_{i,1}^{\prime}$, $M_{i,2}^{\prime}$}, where $M^{\prime}_{i,1}$ and $M^{\prime}_{i,2}$ are two $(V_{i}+Z_{i})\times(V_{i}+Z_{i})$-dimensional invertible matrices, $S_{i}$ is a new random $(V_{i}+Z_{i})$-dimensional vector.

BuildIndex($F,SK$):

To realize secure search in known background model [1], $TP$ pads $U_{i}$ pseudo-keyword into weighted index $\overline{I}$ (associated with document $F$) to obtain secure index $\widetilde{I}$, and uses $\widetilde{I}$ and $SK$ to generate BIF $\mathcal{F}$ = {$\tau_{1}$,…,$\tau_{s}$} and encrypted BIF $\widetilde{\mathcal{F}}$ = {$\widetilde{\tau_{1}}$,…,$\widetilde{\tau_{s}}$}. Finally, $TP$ sends $\widetilde{\mathcal{F}}$ to $CS$.

Trapdoor($Q,SK$):

$DU$ send query requests (keywords and their weights) and attribute identification to $TP$. $TP$ generates query $Q$ = {$Q_{1}$,…,$Q_{s}$} and generates trapdoor $T$ = {$T_{1}$,…,$T_{s}$} using $SK$. Finally, $TP$ sends $T$ to $CS$.

Query$(T,\widetilde{\mathcal{F}},t,k)$:

$TP$ sends query information to $CS$ and specifies $t$ index partitions to be queried. $CS$ performs searches and retrieves top-k documents.

2.3 Algorithms for Scheme

Binary Index Generation: $DO_{i}$ uses algorithm 1 to generate the binary index (vector) $I_{i}$ for the document $F_{i}$, and sends $I_{i}$ to $TP$. 2. 2.

Fast Index Clustering & Keyword Dictionary Segmentation: We employ algorithm 2 to solve “curse of dimensionality” issue in computing. 3. 3.

Weighted Index Generation: $TP$ exploits the KDO weight model [6] to generate the weighted index, as shown in algorithm 3. 4. 4.

MLSB-Tree and BIF Generation: $TP$ uses algorithm 4 to generate MLSB-Tree $\tau_{1},\ldots,\tau_{s}$ and BIF $\mathcal{F}$ = $\{\tau_{1},\ldots,\tau_{s}\}$. 5. 5.

Encrypted MLSB-Tree and Encrypted BIF Generation. $TP$ encrypts $\mathcal{F}$ using algorithm 5 and sends encrypted $\widetilde{\mathcal{F}}$ to $CS$. $\tau_{i}$ and $\widetilde{\tau_{i}}$ are isomorphic (i.e.$\tau_{i}\cong\widetilde{\tau_{i}}$) [16]. Thus, the search capability of tree is still well maintained. 6. 6.

Trapdoor Generation. Based on query request from $DU$, $TP$ generates $Q$ = {$Q_{1}$,…,$Q_{s}$} and $T$ = {$T_{1}$,…,$T_{s}$} using algorithm 6, and sends $T$ to $CS$. 7. 7.

Search Process. (1) Query Preparation: $DU$ send query request and attribute identifications to $TP$. If validating queries are valid, $TP$ generates trapdoors and initiates search queries to $CS$. If access control passes, $CS$ performs searches and returns top-k documents to $DU$. Otherwise $CS$ refuses to query. (2) Calculate Matching Score for Query on MLBS-Tree $\tau_{i}$:

[TABLE]

(3) Search Algorithm for BIF: the greedy depth-first search (GDFS) algorithm for BIF as shown in algorithm 6.

2.4 Security Improvement and Analysis

Adversarial Learning.

Padding random noise into the data [1, 8, 19] is a popular method to improve security. However, pseudo-keyword padding that follows different probability distributions will reduce query precision to varying degrees [1, 8]. Therefore, it is necessary to optimize the probability distribution that controls pseudo-keyword padding. To address this, adversarial learning [4] for optimal pseudo-keyword padding is proposed. As shown in Fig. 2. Searcher Network S($\varepsilon$) : The search result (SR) is generated by taking the random noise $\varepsilon$ ($\varepsilon\sim p(\varepsilon)$, $p(\varepsilon)$ is the object probability distribution ) as an input and performing a search, and supplies SR to the discriminator network $D(x)$. Discriminator Network D($x$): The input has an accurate search result (ASR) or SR and attempts to predict whether the current input is an ASR or a SR. One of the inputs $x$ is obtained from the real search result set distribution $p_{data}(x)$, and then one or two are solved. Classify problems and generate scalars ranging from 0 to 1. Finally, in order to reach a balance point which is the best point of the minimax game, $S(\varepsilon)$ generates SR, and $D(x)$ (considered as adversary) considers the probability that $S(\varepsilon)$ produces ASR is $0.5$, i.e. it is difficult to distinguish between padding and without-padding, thus it can achieve effective security [19].

Similar to GAN [4], to learn the searcher’s distribution $p_{s}$ over data $x$, we define a prior on input noise variables $p_{\varepsilon}(\varepsilon)$, then represent a mapping to data space as $S(\varepsilon;\theta_{s})$, where $S$ is a differentiable function represented by a multi-layer perception with parameters $\theta_{g}$. We also define a second multi-layer perception $D(x;\theta_{d})$ that outputs a single scalar. $D(x)$ represents the probability that $x$ came from the data rather than $p_{s}$. We train $D$ to maximize the probability of assigning the correct label to both training examples and samples from $S$. We simultaneously train $S$ to minimize $\log(1-D(S(\varepsilon)))$: In other words, $D$ and $S$ play the following two-player minimax game with value function $V(S,D)$:

[TABLE]

Security Analysis.

Index confidentiality and query confidentiality: ASPE approach [15] is widely used to generate secure index/query in privacy-preserving keyword search schemes [1, 6, 8, 13, 16] and its security has been proven. Since the index/query vector is randomly generated and search queries return only the secure inner product [1] computation results (non-zero) of encrypted index and trapdoor, thus $CS$ is difficult to accurately evaluate the keywords including in the query and matching top-k documents. Moreover, confidentiality is further enhanced as the optimal pseudo-keyword padding is difficult to distinguish and the transformation matrices are harder to figure out [15].

Query unlinkability: By introducing the random value $\varepsilon$ (padding pseudo-keyword), the same search requests will generate different query vectors and receive different relevance score distributions [1, 16]. The optimal game equilibrium for precision and privacy is obtain by adversarial learning, which further improves query unlinkability. Meanwhile, SAN are designed to protect access pattern [19], which makes it difficult for $CS$ to judge whether the retrieved ranked search results come from the same request.

Keyword privacy: According to the security analysis in [16], for $i$-th index partition, aiming to maximize the randomness of the relevance score distribution, it is necessary to obtain as many different $\sum\varepsilon_{\nu_{i}}$ as possible (where $\nu_{i}\in\{j|Q_{i}[j+N_{i}]=\alpha_{i},j=1,\ldots,U_{i}\}$; in [16], $\alpha_{i}=1$). Assuming each index vector has at least $2^{\omega_{i}}$ different $\sum\varepsilon_{\nu_{i}}$ choices, the probability of two $\sum\varepsilon_{\nu_{i}}$ share the same value is less than $\frac{1}{2^{\omega_{i}}}$. If we set each $\varepsilon_{j}\sim U(\mu_{i}^{\prime}-\delta_{i},\mu_{i}^{\prime}+\delta_{i})$ (Uniform distribution), according to the central limit theorem, $\sum\varepsilon_{\nu_{i}}\sim N(\mu_{i},\sigma^{2}_{i})$ (Normal distribution), where $\mu_{i}=\omega_{i}\mu_{i}^{\prime}$, $\sigma^{2}=\frac{\omega_{i}\delta^{2}_{i}}{3}$. Therefore, it can set $\mu_{i}=0$ and balance precision and privacy by adjusting the variance $\sigma^{2}_{i}$ in real-world application. In fact, when $\alpha_{i}\in[0,1]$ (floating point number), SAN can achieve stronger privacy protection.

3 Experimental Evaluation

We implemented the proposed scheme using Python in Windows 10 operation system with Intel Core i5 Processor 2.40GHz and evaluated its performance on a real-world data set (academic conference publications provided by IEEE xplore https://ieeexplore.ieee.org/, including 20,000 papers and 80,000 different keywords, 400 academic conferences were randomly selected as data owners $DO$). All experimental results represent the average of 1000 trials.

Optimal Pseudo-keyword Padding.

The parameters controlling the probability distribution (using SAN to find or approximate) are adjusted to find the optimal game equilibrium for query precision $P_{k}$ (denoted as $x$) and rank privacy protection $P_{k}^{\prime}$ (denoted as $y$) (where $P_{k}=k^{\prime}/k$, $P_{k}^{\prime}=\sum|r_{i}-r_{i}^{\prime}|/k^{2}$, $k^{\prime}$ and $r_{i}$ are respectively the number of real top-k documents and the rank number of document in the retrieved $k$ documents, and $r_{i}^{\prime}$ is document’s real rank number in the whole ranked results [1]). We choose 95% query precision and 80% rank privacy protection as benchmarks to get the game equilibrium score calculation formula: $f(x,y)=\frac{1}{95}x^{2}+\frac{1}{80}y^{2}$ (objective function to be optimized). As shown in Fig. 3, we find the optimal game equilibrium ($\max f(x,y)=177.5$) at $\sigma_{1}=0.05$, $\sigma_{2}=0.08$, $\sigma_{3}=0.12$. The corresponding query precision are: 98%, 97%, 93%. The corresponding rank privacy protection are: 78%,79%,84%. Therefore, we can choose the best value of $\sigma$ to achieve optimal pseudo-keyword padding to satisfy query precision requirement and maximize rank privacy protection.

Search Efficiency of MLSB-Tree.

Search efficiency is mainly described by query speed, and our experimental objects are index trees that are structured with different strategy: EDMRS [16] (ordinary balanced binary tree), MKRS_MO [6] (grouped balanced binary tree), MRSM_SAN(globally grouped balanced binary tree) and MRSM_SAN_MLSB-Tree. We first randomly generate 1000 query vectors, then perform search on each index tree respectively, finally take the results of 20 repeated experiments for analysis. As shown in Fig. 4, the query speed and query stability based on MLSB-Tree are better than other index trees. Compared with EDMRS and MKRS_MO, query speed increased by 21.72% and 17.69%. In terms of stability, MLSB-Tree is better than other index trees. (variance of search time(s): 0.0515 [6], 0.0193 [16], 0.0061[MLSB-Tree])

Search Efficiency of BIF.

As shown in Fig. 4, query speed of MRSM_SAN (with MLSB-Tree and BIF) is significantly higher than MRSM_SAN (only with MLSB-Tree), and the search efficiency is improved by 5 times and the stability increase too. This is just the experimental result of 500 documents set with the 4000-dimensional keyword dictionary. After the index clustering operation, the keyword dictionary is divided into four sub-dictionaries with a dimension of approximately 1000. As the amount of data increases, the dimension of the keyword dictionary will become extremely large, and the advantages of BIF will become more apparent. In our analytical experiments, the theoretical efficiency ratio before and after segmentation is: $\eta=s\frac{\mathcal{O}(\log N)}{\mathcal{O}(\log N)-\mathcal{O}(\log s)}$,where $s$ denotes the number of index partitions after fast index clustering, and $N$ denotes the total number of documents. When the amount of data increases to 20,000, the total keyword dictionary dimension is as high as 80,000. If the keyword sub-dictionary dimension is 1000, the number of index partitions after fast index clustering is 80, the search efficiency will increase by more than 100 times ($\eta=143$). This will bring huge benefits to large information systems, and our solutions can exchange huge returns with minimal computing resources.

Comparison of Search Efficiency (Larger Data Set).

The efficiency of MRSM_SAN (without BIF) and related works [1, 6, 8, 16] are show as Fig. 5, and the efficiency of MRSM_SAN(without BIF) and MRSM_SAN(with BIF) are show as Fig. 5. It is more notable that the maintenance cost of scheme based on BIF is much lower than the cost of scheme only based on a balanced index tree. When adding a new document to $CS$, we need to insert a new index vector (the node of the tree) in the index tree accordingly. If it is only based on an index tree, search complexity (search the location where the new index is inserted into the index tree) and update complexity (update the parent node corresponding to the new index) are both at least $\mathcal{O}(\log N)$ [9], the total cost is $2\mathcal{O}(\log N)$ (where $N$ denotes the total number of documents). But BIF is very different, because we group all index vectors into $s$ different index partitions and reduce their dimension. We assume that the number of index vectors in each index partition is equal, thus we need to spend the same update operation for each partition, which makes the cost is only $\frac{2}{s}\mathcal{O}(\log\frac{N}{s})$ and enables flexible dynamic system maintenance. Moreover, the increase in efficiency is positively correlated with the increase in data volume and data sparsity. For communication, compared with traditional SSE schemes [6, 13, 16], when the old index tree in the cloud is overwritten by the new index tree uploaded by $DO$/$TP$, our scheme only needs to update the specified index tree instead of the entire index forest. For storage, tree-based overhead is $(2^{\log N}-\frac{1}{2})/(2^{\log\frac{N}{s}}-\frac{1}{2})\approx 2^{\log s}$ times forest-based.

4 Discussion

This paper proposes secure and efficient MRSM_SAN, and conducts in-depth security analysis and experimental evaluation. Creatively using adversarial learning to find optimal game equilibrium for query precision and privacy protection strength and combining traditional SSE with uncertain control theory, which opens a door for intelligent SSE. In addition, we propose MLSB-Tree, which generated by a sufficient amount of random searches and brings the computational complexity close to $\mathcal{O}(\log N)$. It means that using probabilistic learning to optimize the query result is effective in an uncertain system (owner’s data and user’s queries are uncertain). Last but not least, we implement flexible dynamic system maintenance with BIF, which not only reduces the overhead of dynamic maintenance and makes full use of distributed computing, but also improves the search efficiency and achieves fine-grained search. This is beneficial to improve the availability, flexibility and efficiency of dynamic SSE system.

Acknowledgment

This work was supported by “the Fundamental Research Funds for the Central Universities” (No. 30918012204) and “the National Undergraduate Training Program for Innovation and Entrepreneurship” (Item number: 201810288061). NJUST graduate Scientific Research Training of ‘Hundred, Thousand and Ten Thousand’ Project “Research on Intelligent Searchable Encryption Technology”.