Privacy-Preserving Key-Updatable Public Key Encryption with Keyword Search Supporting Ciphertext Sharing Function

Abstract

Public key encryption with keyword search (PEKS) allows a user to make search on ciphertexts without disclosing the information of encrypted messages and keywords. In practice, cryptographic operations often occur on insecure devices or mobile devices. But, these devices face the risk of being lost or stolen. Therefore, the secret keys stored on these devices are likely to be exposed. To handle the key exposure problem in PEKS, the notion of key-updatable PEKS (KU-PEKS) was proposed recently. In KU-PEKS, the users' keys can be updated as the system runs. Nevertheless, the existing KU-PEKS framework has some weaknesses. Firstly, it can't update the keyword ciphertexts on the storage server without leaking keyword information. Secondly, it needs to send the search tokens to the storage server by secure channels. Thirdly, it does not consider the search token security. In this work, a new PEKS framework named key-updatable and ciphertext-sharable PEKS (KU-CS-PEKS) is devised. This novel framework effectively overcomes the weaknesses in KU-PEKS and has the ciphertext sharing function which is not supported by KU-PEKS. The security notions for KU-CS-PEKS are formally defined and then a concrete KU-CS-PEKS scheme is proposed. The security proofs demonstrate that the KU-CS-PEKS scheme guarantees both the keyword ciphertext privacy and the search token privacy. The experimental results and comparisons bear out that the proposed scheme is practicable.

1. Introduction

In the wake of the rapid universal application of cloud storage, a growing number of enterprises and users are choosing to preserve the data in the cloud. The cloud provides users with more efficient and flexible data services while reducing the cost of data storage. Nevertheless, the cloud storage servers are untrusted for the data owners. Therefore, the data owners may choose to encrypt the data and upload the ciphertexts to the cloud storage server. But as a result, users face the question of how to retrieve the ciphertexts. The user can choose to download all ciphertexts to the local storage, and retrieve the data plaintexts after decryption. This method is obviously inefficient. It not only requires high communication and computation overhead, but also takes up a lot of local storage space. Another method is that the user sends the storage server the decryption key, then the storage server decrypts the ciphertexts and searches on the plaintexts, which obviously loses the meaning of encryption.

In order to handle the ciphertext retrieval issue, searchable encryption was proposed [1]. Searchable encryption allows users to retrieve the ciphertexts by keywords without revealing any information about the plaintexts. It can be implemented over symmetric encryption or public key encryption. In 2000, Song et al. [1] first brought a symmetric searchable encryption scheme. Subsequently, many improved symmetric searchable encryption schemes [2-6] were devised. Although these symmetric searchable encryption schemes have high execution efficiency, they encounter the difficulty in key distribution. The mechanism of public key encryption with keyword search (PEKS), invented by Boneh et al. [7], allows a ciphertext receiver to authorize a storage server to verify whether the ciphertexts sent to them contain specific keyword(s). In PEKS, a user sends the encrypted data to a storage server. If a recipient intends to get some data ciphertexts that involve a specific keyword w, it can produce a search token T_w of the keyword w by its own secret key. Then the recipient sends the storage server the search token T_w. Once receiving T_w, the storage server can use the search token to match the ciphertexts without decryption. In the end, the storage server sends the retrieved ciphertexts to the recipient. After the concept of PEKS was put forward, various PEKS schemes and variants have been proposed [8-19]. In PEKS, the search tokens need to be conveyed over secure channels to the storage server. If the search tokens are captured by the attacker, then the indistinguishability of the keyword ciphertexts will be broken. Nevertheless, it is costly to establish a secure channel, especially over an open network. In [20], Beak et al. introduced the framework of secure channel free PEKS (SCF-PEKS) which does not require transmitting the search tokens through secure channels. In SCF-PEKS, the user needs to use both the public keys of the recipient and the designated storage server to encrypt the keyword to create the keyword ciphertext. Thus, only the designated server can execute the search operation by its secret key. Due to the characteristic of no secure channel, several SCF-PEKS schemes have also been presented [21-26]. Apart from this, some works [27-33] introduced PEKS into other public key cryptosystems.

The security of a cryptosystem mainly depends on the confidentiality of secret keys. Once a secret key is leaked, the security of entire cryptosystem may not be guaranteed. However, cryptographic computations are often performed on some relatively insecure devices which cannot guarantee the secrecy of secret keys. Therefore, key disclosure seems to be inevitable. To overcome the key disclosure issue in PEKS setting, Anada et al. [34] put froward the concept of key-updatable PEKS (KU-PEKS). They also gave a generic KU-PEKS construction that combines a PEKS scheme with a public key encryption (PKE) scheme. In KU-PEKS, each user can update his/her public and secret keys as the system runs. Once re-keying occurs, the cloud server refreshes the ciphertexts stored on it by the decrypt-then-encrypt operations. Up to now, KU-PEKS is the only framework supporting the key update function in PEKS setting.

1.1 The Motivation and Contributions

Although KU-PEKS realizes the key update function in PEKS, it suffers from three security weaknesses.

1) KU-PEKS does not provide privacy-preserving ciphertext update function on the storage server. As we know, it is required that a keyword search encryption scheme should protect the keyword privacy. However, the KU-PEKS scheme proposed in [34] completely exposes the keyword information to the storage server when implementing ciphertext update. To update the ciphertexts, the storage server in KU-PEKS should first decrypt the old ciphertexts to get the encrypted keywords, and then re-encrypt the keywords using the new public key to produce the new keyword ciphertexts. Therefore, KU-PEKS fails in protecting the privacy of keywords.

2) KU-PEKS should transmit the search tokens secretly. In order to successfully retrieve the desired ciphertext, a user in KU-PEKS should send a search token to the storage server. However, the user should use a secure channel to transmit the search token. If not, the search token may be intercepted by an adversary and then is used to break the keyword ciphertext indistinguishability. Therefore, KU-PEKS is not suitable for the scenarios where establishing a secure channel is difficult or impossible.

3) KU-PEKS did not consider the search token indistinguishability. As Rhee et al. pointed out in [24], a PEKS scheme should meet the indistinguishability of keyword ciphertext/search token. If a PEKS scheme does not have the search token indistinguishability, it can’t endure the keyword guessing attack by the outside attacker (OUT-KGA). In [34], Anada et al. constructed the KU-PEKS scheme by integrating a PEKS scheme into a PKE scheme. Unfortunately, the vast majority of PEKS schemes were not proven to be search token indistinguishable. Therefore, the KU-PEKS scheme proposed in [34] is fragile to the OUT- KGA.

In this work, a privacy-preserving key-updatable public key searchable encryption scheme is devised. The presented scheme surmounts the weaknesses in the existing KU-PEKS framework and supports the ciphertext sharing function that is not considered in Anada et al.’s KU-PEKS scheme. Specifically, the contributions are as below:

1) A new PEKS framework called key-updatable and ciphertext-sharable PEKS (KU-CS- PEKS) is proposed. Compared with KU-PEKS, the proposed framework enjoys the following three merits. Firstly, KU-CS-PEKS provides privacy-preserving ciphertext update function on the storage server. To update the ciphertexts without decryption, proxy re-encryption [36–37] is incorporated into the framework. Since the storage server is absolutely ignorant of the keywords encrypted in the keyword ciphertexts during ciphertext updating, KU-CS-PEKS effectively protects the privacy of the keywords. Secondly, KU-CS-PEKS removes the requirement of secure channel in search token transmission. KU-CS-PEKS employs a designated storage server to perform the match-testing operation by its secret key. Since the outside attacker cannot run the testing operation, it cannot break the indistinguishability of keyword ciphertext even if it intercepts the corresponding search token. Therefore, a public channel can be used to transmit the search tokens. Thirdly, KU-CS-PEKS offers the ciphertext sharing function. In KU-PEKS, only the data owner can access the ciphertexts. However, in practice, the data owner often needs to share his/her ciphertexts to other users. In KU-CS- PEKS, by authorizing the storage server to act as a re-encryption proxy, the data owner can share his/her ciphertexts with others. In this way, the authorized users also can access and retrieve the re-encrypted ciphertexts on the storage server. After giving the framework of KU- CS-PEKS, the security model of KU-CS-PEKS is formalized, which captures both the indistinguishability of keyword ciphertext and search token.

2) A concrete KU-CS-PEKS scheme is developed. The security proofs show that: i) under the hardness assumption of the bilinear Diffie-Hellman inversion (BDHI) problem [38], it satisfies the original ciphertext indistinguishability and the re-encryption ciphertext indistinguishability; ii) under the hardness assumption of the hash Diffie-Hellman (HDH) problem [39], it satisfies the data owner’s search token indistinguishability and the authorized user’s search token indistinguishability. In addition, the KU-CS-PEKS scheme is compared with the existing KU-PEKS scheme to show its merits and applicability.

2. Preliminaries

In this section, some preliminaries that used in the paper are reviewed.

Assuming that G and G_T denote two multiplicative cyclic groups both with a prime order p, g denotes a random generator of G, and e: G × G → G_T is a bilinear map satisfying the following characteristics:

(1) Bilinearity: ∀m, n ∈ G and x, y ∈ Z^*_p , e(m^x, n^y) = e(m, n)^xy.

(2) Non-degeneracy: ∃m, n ∈ G, e(m, n) ≠ 1.

(3) Computability: ∀m, n ∈ G, e(m, n) can be calculated by an efficient algorithm.

Definition 1. The BDHI problem is: Inputting two elements (g, g^α), to calculate e(g, g)^1/α, where α ∈ Z_q.

Definition 2. The HDH problem is: Inputting four elements (g, g^α, g^β, H(g^γ)) ∈ G × G × G × {0, 1}^hlen and a hash function H: G → {0, 1}^hlen, to output “1” if αβ = γ or “0” otherwise, where α, β, γ ∈ Z_^*​​​​​​​_p and hlen ∈ Z⁺.

3. Framework and security model of KU-CS-PEKS

3.1 Framework definition

A KU-CS-PEKS scheme includes four entities: a global parameter generator (GPG), a designated storage server, a data owner and an authorized user. The GPG is responsible for producing the global parameters for the whole system. The data owner produces the keyword ciphertext as well as the data ciphertext, then transmits the keyword ciphertext and the data ciphertext to the designated storage server. The data owner also generates both the update key and the re-encryption key which are transmit to the designated storage server. When receiving an update key or a re-encryption key, the designated storage server can update or re-encrypt the ciphertexts. When the designated storage server gets a search token from the data owner or the authorized user, it seeks out and returns all matching data ciphertexts.

Definition 3. A KU-CS-PEKS scheme is specified by ten algorithms that are shown below:

(1) GlobalSetup(λ): Given as input a security parameter λ, the GPG executes the algorithm and outputs a set of global parameters gp.

(2) KeyGen_server(gp): Given gp, the designated storage server executes this algorithm to produce a pair of public/secret keys (PK_S, SK_S).

(3) KeyGen_user(gp): Given gp, the user (either a data owner or an authorized user) executes the algorithm to produce a pair of public/secret keys (PK_U, SK_U). In the following paper, the public/secret key pairs of a data owner in two different time periods i and j are denoted by (PK_{DO, i}, SK_{DO, i}) and (PK_{DO, j}, SK_{DO, j}) respectively, the public/secret key pair of an authorized user is (PK_AU, SK_AU) .

(4) KWCiphertextGen(gp, w, PK_S, PK_{DO, i}): Given gp, a keyword w, the designated storage server’s public key PK_S and the data owner’s public key PK_{DO, i}, the data owner executes this algorithm to produce a keyword ciphertext CT^W_{DO, i} which is valid only in the time period i.

(5) UpdateKeyGen(gp, SK_{DO, i}, SK_{DO, j}): Given gp, two secret keys SK_{DO, i} and SK_{DO, j} in two different time periods i and j, the data owner executes this algorithm to produce an update key uk_i→j. The update key uk_i→j is then sent to the designated storage server.

(6) CiphertextUpdate(gp, uki→j, CT^w _{DO, i} ): Given gp, an update key uk_i→j and a keyword ciphertext CT_{^W DO, i} in the time period i, the designated storage server executes this algorithm to produce an update ciphertext CT^W_{DO , j} for the time period j.

(7) ReKeyGen(gp, SK_{DO, j}, SK_AU): Given gp, the data owner’s secret key SK_{DO, j} and the authorized user’s secret key SK_AU, the data owner and the authorized user executes this algorithm to produce a re-encryption key rk_DO→AU in an interactive manner.

(8) CiphertextShare(gp, CT^W_{DO , j} , rk_DO→AU): Given gp, a keyword ciphertext CT^W_{DO , j} and a reencryption key rk_DO→AU, the designated storage server executes this algorithm to produce a shared keyword ciphertext CT^W_AU . Note that the keyword ciphertext CT^W_AU is encrypted under the authorized user’s public key PK_AU and the designated storage server’s public key PK_S.

(9) SearchTokenGen(gp, w′, PK_S, SK_U): Given gp, a keywordw′, the designated storage server’s public key PK_S and a secret key SK_U, the data owner or the authorized user executes the algorithm to produce a search token T _w′, where SK_U is either SK_DO,j or SK_AU.

(10) Test(gp, CT_w, T _w′, SK_S): Given gp, a keyword ciphertext CT_w, a search token T _w′and the designated storage server’s secret key SK_S, the designated storage server executes this algorithm to output 1 if CT_w matches T_w′ (i.e., w = w′ )or 0 else, where CT_w is either CT_w is either CT^W_{DO , j} or CT^W_AU .

If the following formulas are satisfied for any keyword w, then a KU-CS-PEKS scheme is correct.

(1) If gp ← GlobalSetup(λ), (PK_S, SK_S) ← KeyGen_server(gp), (PK_{DO, i}, SK_{DO, i}) ←KeyGen_user(gp), (PK_{DO, j}, SK_{DO, j}) ← KeyGen_user(gp), CT^W _{DO, i} ← KWCiphertextGen(gp, w, PK_S, PK_{DO, i}), uk_i→j ← UpdateKeyGen(gp, SK_{DO, i}, SK_{DO, j}), CT^W_DO,i ← CiphertextUpdate(gp, uk_i→j, CT^W_DO,i ),rk_DO→AU ← ReKeyGen(gp, SK_{DO, j}, SK_AU), CT^W_AU ← CiphertextShare(gp, CT^W_DO,i,rk_DO→AU), ← SearchTokenGen(gp, w, PK_S, SK_{DO, j}), then 1 ← Test(gp, CT^W_DO,i , T_w, SK_S);

(2) If gp ← GlobalSetup(λ), (PK_S, SK_S) ← KeyGen_server(gp), (PK_{DO, i}, SK_{DO, i}) ←KeyGen_user(gp), (PK_{DO, j}, SK_{DO, j}) ← KeyGen_user(gp), (PK_AU, SK_AU) ← KeyGen_user(gp),CT^W_DO,i ← KWCiphertextGen(gp, w, PK_S, PK_{DO, i}), uk_i→j ← UpdateKeyGen(gp, SK_{DO, i}, SK_{DO, j}), ← CT^W_DO,i ← CiphertextUpdate(gp, uk_i→j, CT^W_DO,i ), rk_DO→AU ← ReKeyGen(gp, SK_{DO, j}, SK_AU), CT^W_DO,i ← CiphertextShare(gp, CT^W_DO,i , rk_DO→AU), T_w ← SearchTokenGen(gp, w, PK_S, SK_AU), then 1 ←Test(gp, CT^W_AC , T_w, SK_S).

3.2 Security definitions

A KU-CS-PEKS scheme should meet the indistinguishability of keyword ciphertext/search token. To formalize the security definitions of KU-CS-PEKS, four adversarial games (Game 1 ~ Game 4) between an adversary A_i (i = 1, 2, 3, 4) and a challenger B are defined, where the adversary A_i is either a malicious designated storage server or an outsider attacker. Game 1 defines the original keyword ciphertext indistinguishability under the adaptively chosen keyword attack (OKC-IND-CKA). Game 2 defines the re-encryption keyword ciphertext indistinguishability under the adaptively chosen keyword attack (RKC-IND-CKA). Game 3 defines the data owner’s search token indistinguishability under the adaptively chosen keyword attack (DOST-IND-CKA). Game 4 defines the authorized user’s search token indistinguishability under the adaptively chosen keyword attack (AUST-IND-CKA).

Game 1 (OKC-IND-CKA): In this game, B plays with A₁ who models a designated storage server or an outsider attacker as below:

Setup: B generates gp and (PK_S, SK_S) by running GlobalSetup(λ) and KeyGen_server(gp). Then, B gives A₁ {gp, PK_S} if it is an outside attacker or {gp, PK_S, SK_S} if it is a designated storage server.

Phase 1: A₁ is capable of making six oracle queries adaptively.

- Uncorrupted key generation oracle O_pk: With the input of a time period index i by the adversary, the challenger runs KeyGen_user(gp) to produce a key pair (PK_{DO, i}, SK_{DO, i}) of the data owner and then gives PK_{DO, i} to A₁.

- Corrupted key generation oracle O_sk: With the input of a time period index j by the adversary, the challenger runs KeyGen_user(gp) to produce a key pair (PK_{DO, j}, SK_{DO, j}) of the data owner and then gives (PK_{DO, j}, SK_{DO, j}) to A₁. Here, it is restricted that A₁ is disallowed to submit a same time period index to both O_pk and O_sk.

- Update key generation oracle O_uk: With the input of two distinct time period indices (k, l) by the adversary, the challenger runs UpdateKeyGen(gp, SK_{DO, k}, SK_{DO, l}) to produce an update key uk_k→l and then returns it to A₁. As in [35], it is not allowed the update key queries to occur on a corrupted time period and an uncorrupted time period.

- Update ciphertext generation oracle O_uc: With the input of two distinct time period indices(k, l) and an keyword ciphertext CT^W_DO,k by the adversary where either both k and l are corrupted or both are uncorrupted, the challenger runs CiphertextUpdate(gp, uk_k→l, CT^W_DO,k ) to produce an update ciphertext CT^W_DO,l and then returns it to A₁.

- Search token generation oracle O_st: With the input of a time period index i and a keyword w by the adversary, the challenger runs SearchTokenGen(gp, w, PK_S, SK_{DO, i}) to produce a search token T_w and outputs to A₁.

- Test oracle O_te: With the input of ( CT^W_DO,l , T_W^' ) by the adversary, the challenger runs Test(gp, CT^W_DO,i , T_W^' , SK_S, ) and then returns the result to A₁. This oracle only allows the outside attacker to make queries.

Challenge: Once the Phase 1 is finished, A1 inputs two distinct keywords (w0, w1) where |w0| = | w1| and a time period index i* to B. The restrictions are (1) A1 has never submitted the query Osk(i*); (2) A1 has never submitted the queries Ost(i*, w0) and Ost(i*, w1) if it is the designated data storage server; (3) For any time period j, A1 has never submitted the queries Ouk(i*, j) and Ost(j, w0) or the queries Ouk(i*, j) and Ost(j, w1) if it is the designated data storage server. The challenger B randomly picks b ∈ {0, 1}, calculates the ciphertext CTWbDO,i* =KWCiphertextGen(gp, wb, PK , PKS) and sends it to A1.

Phase 2: A1 makes more oracle queries, but with the following constraints: (1) A1 is disallowed to ask Osk(i*); (2) A1 is disallowed to ask Ote( CTWbDO,i* , T1*) if it is the outside attacker, where T1*is the result of the query Ost(i*, w0) or Ost(i*, w1); (3) For any time period j, A1 is disallowed to ask Ote(Ouc(i*, j, CTWbDO,i* ),T2*)if it is the outside attacker, where T2* is the result of the query Ost(j, w0) or Ost(j, w1); (4) A1 is disallowed to ask Ost(i*, wb) if it is the designated data storage server; (5) For any time period j, A1 is disallowed to ask both Ouk(i*, j) and Ost(j, w0) or both Ouk(i*, j) and Ost(j, w1) if it is the designated data storage server; (6) For any time period j, A1 is disallowed to ask both Ouc(i*, j, CTWbDO,i* ) and Ost(j, w0) or both Ouc(i*, j, CTWbDO,i* )and Ost(j, w1) if A1 is the designated data storage server.

Guess: At last, A₁ outputs a guess b′and wins if b = b′ . Its advantage is defined as Adv_A1 ^{OKC − IND − CKA}( λ ) = |Pr[ b = b ′ ] − 1/2| .

Definition 4. For a KU-CS-PEKS scheme, if the advantage Adv_A1 ^{OKC − IND − CKA} of any polynomial time adversary A₁ is negligible, then the scheme is OKC-IND-CKA secure.

Game 2 (RKC-IND-CKA): In this game, B plays with A₂ who models a designated storage server or an outsider attacker as below:

Setup: B generates gp, (PK_S, SK_S) and (PK_{DO, i}, SK_{DO, i}) by running GlobalSetup(λ), KeyGen_server(gp) and KeyGen_user(gp) respectively. Then, B gives A₂ {gp, PK_S, PK_{DO, i}} if it is an outside attacker or {gp, PK_S, SK_S, PK_{DO, i}} if it is a designated storage server.

Phase 1: A₂ is capable of making six oracle queries adaptively.

- Uncorrupted key generation oracle O_pk: When A₂ queries this oracle, the challenger runs KeyGen_user(gp) to produce an authorized user’s public/secret key pair (PK_AU, SK_AU) and gives PK_AU to A₂.

- Corrupted key generation oracle O_sk: When A₂ queries this oracle, the challenger runs KeyGen_user(gp) to produce an authorized user’s public/secret key pair (PK_AU, SK_AU) and gives (PK_AU, SK_AU) to A₂.

- Re-encryption key generation oracle O_rk: With the input of (PK_{DO, i}, PK_AU) by the adversary, the challenger runs ReKeyGen(gp, SK_{DO, i}, SK_AU) to produce a re-encryption key rk_DO→AU and then returns it to A₂.

- Search token generation oracle O_st: With the input of (PK_AU, w) by the adversary, the challenger runs SearchTokenGen(gp, w, PK_S, SK_AU) to produce a search token T_w and then returns it to A₂.

-Test oracle O_te: With the input of ( CT^W_AU , T_w) by the adversary, the challenger runs Test(gp ,CT^W_AU , T_w, SK_S) and returns the result to A₂.

Challenge: Once the Phase1 is finished, A₂ inputs two distinct keywords (w₀, w₁) where |w0| = |w1| and a public key PK^*_AU . The restrictions are (1) PK^*_AU is from O_pk; (2) A2 has never submitted the queries O_st( PK^*_AU , w₀) and O_st( PK^*_AU , w₁). B randomly picks b ∈ {0, 1}, calculates the ciphertext C^* = KWCiphertextGen(gp, w_b, PK_S, PK^*_AU ) and sends it to A₂.

Phase 2: A₂ makes more oracle queries. The only restriction is that A₂ has never submitted the queries O_st( PK^*_AU , w₀) and O_st(PK^*_AU, w₁).

Guess: At last, A₂ outputs a guess b′and wins if b =b′. A₂’s advantage is defined to be Adv_A2 ^{RKC − IND − CKA} ( λ ) = |Pr[ b = b'] − 1/2| .

Definition 5. For a KU-CS-PEKS scheme, if the advantage Adv_A2 ^{RKC − IND − CKA} of any polynomial time adversary A₂ is negligible, then the scheme is RKC-IND-CKA secure.

Game 3 (DOST-IND-CKA): In this game, B plays with A₃ who models an outside attacker as below:

Setup: B generates gp and (PK_S, SK_S) by running GlobalSetup(λ) and KeyGen_server(gp) respectively. Then, B gives A₃{gp, PK_S}.

Phase 1: A₃ is capable of make queries to O_pk, O_sk, O_uk, O_uc, O_st and O_te adaptively. These queries are answered as in OKC-IND-CKA-Game.

Challenge: Once the Phase1 is finished, A3 inputs two distinct keywords (w0, w1) where |w0| = |w1| and a time period index i* to B. The restrictions are (1) A3 has never submitted the query Osk(i*); (2) For any time period j, A3 has never submitted the queries Ouk(j, i*); (3) For any time period j, A3 has never submitted the queries Ouc(j, i*, CTWbDO,j ) and Ouc(j, i*, CTW1DO,j ). B randomly selects b ∈ {0, 1}, calculates a search token Twb = SearchTokenGen(gp, wb, PKS, SKDO,i* ) and sends it to A3.

Phase 2: A3 makes more oracle queries, but with the constraints: (1) A3 is disallowed to ask Osk(i*); (2) For any time period j, A3 is disallowed to ask Ouk(j, i*); (3) For any time period j, A3 is disallowed to ask Ouc(j, i*, CTWbDO,j ) and Ouc(j, i*, CTW1DO,j ).

Guess: At last, A₃ outputs a guess b′and wins if b =b′. Its advantage is defined to be Adv _A3^{DOST − IND − CKA}( λ ) = |Pr[ b = b ] − 1/2| .

Definition 6. For a KU-CS-PEKS scheme, if the advantage Adv _A3^{DOST − IND − CKA} of any polynomial time adversary A₃ is negligible, then the scheme is DOST-IND-CKA secure.

Game 4 (AUST-IND-CKA): In this game, B plays with A₄ who models an outside attacker as below:

Setup: B generates gp, (PK_S, SK_S) and (PK_{DO, i}, SK_{DO, i}) by running GlobalSetup(λ) , KeyGen_server(gp) and KeyGen_user(gp) respectively. Then, B gives A₄ {gp, PK_S, PK_{DO, i}}.

Phase 1: A₄ is capable of make queries to O_pk, O_sk, O_rk, O_sc, O_st and O_te adaptively. These queries are answered as in RKC-IND-CKA-Game.

Challenge: Once the Phase1 is finished, A4 inputs two distinct keywords (w0, w1) where |w0| = |w1| and a public key PK*AU. The restrictions are that: (1) PK*AU is from Opk; (2) A4 has never submitted the queries Ork(PKDO, i, PK*AU ); (3) A4 has never submitted the queries Osc( CTW0 DO, i , rkDO→AU* ) and Osc( CTW1 DO, i , rkDO→AU* ). B randomly selects b ∈ {0, 1}, calculates a search token T wb = SearchTokenGen(gp, wb, PKS, SK*AU ) and sends it to A4.

Phase 2: A4 makes more oracle queries, but with the constraints: (1) A4 has never submitted the queries Ork(PKDO, i, PK*AU ); (2) A4 has never submitted the queries Osc( CTW0 DO, i , rkDO→AU* ) and Osc( CTW1 DO, i , rkDO→AU* ).

Guess: At last, A₄ outputs a guess b′and wins if b =b′ . Its advantage is defined as Adv_A4^{AUST − IND − CKA} ( λ ) = |Pr[ b = b ′ ] − 1/2| .

Definition 7. For a KU-CS-PEKS scheme, if the advantage Adv_A4^{AUST − IND − CKA} of any polynomial time adversary A₄ is negligible, then the scheme is AUST-IND-CKA secure.

4. The proposed KU-CS-PEKS scheme

4.1 Description of the proposed scheme

The proposed KU-CS-PEKS scheme is as below:

(1) GlobalSetup(λ): Inputting λ, the algorithm generates two cyclic groups (G, G_T) with order p and a bilinear pairing e: G × G → G_T. Additionally, it selects a generator g ∈ G and three cryptographic hash functions H: G →{0, 1}^hlen, H₁: {0, 1}^* → G and H₂: G_T → {0, 1}^hlen. Finally, it sets gp = {p, g, G, G_T, e, H, H₁, H₂}.

(2) KeyGen_server(gp): Inputting gp, this algorithm picks a ∈ Z^*_p at random, sets SK_S = a, and calculates PK_S = g^a . It then outputs (PK_S, SK_S).

(3) KeyGen_user(gp): Inputting gp, the algorithm picks x_U ∈ Z^* _p at random, sets SK_U = x_U and PK_U = g ^xU. It then outputs (PK_U, SK_U). In the following algorithms, the data owner’s key pairs in different time periods i and j are denoted by (PK_{DO, i}, SK_{DO, i}) and (PK_{DO, j}, SK_{DO, j}) respectively, and the authorized user’s key pair is denoted by (PK_AU, SK_AU).

(4) KWCiphertextGen(gp, w, PK_S, PK_{DO, i}): Inputting gp, w, PK_S and PK_{DO, i}, this algorithm randomly picks r ∈ Z^* _p , calculates A = PK^r_DO,i and B = H₂(t), where t = e(PK_S, H₁(w))^r. It then outputs CT^w _{DO, i} = (A, B).

(5) UpdateKeyGen(gp, SK_DO,i, SK_DO,j): Inputting gp, SK_DO,i and SK_DO,j, the data owner calculates a update key uk_i→j = SK_DO,j / SK_DO,i mod p.

(6) CiphertextUpdate(gp, uk_i→j, CT^W_DO,i ): Inputting gp, an update key uk_i→j and a keyword ciphertext CT^W_DO,i = (A, B) of the time period i. The algorithm calculates A′ = A ^uk_i→j = g^SK_DO,j·r= , PK^r_{DO, j} and creates a new keyword ciphertext w CTDO, j = ( A′ , B) for the time period j.

(7) ReKeyGen(gp, SK_{DO, j}, SK_AU): Inputting gp, SK_{DO, j} and SK_AU, this algorithm generates a re-encryption key rk_DO→AU = SK_AU / SK_{DO, j} mod p as below: The data owner picks n ∈ Z^*_p at random and sends (nSK_{DO, j} mod p) to the authorized user; The authorized user calculates and sends SK_AU / nSK_{DO, j} mod p to the data owner; Finally, the data owner uses can calculate rk_DO→AU = SK_AU / SK_{DO, j} mod p.

(8) CiphertextShare(gp, CT^W_DO,j , rk_DO→AU): Inputting gp, CT^W_DO,j and rk_DO→AU, the algorithm calculates A"= A^rk_DO→AU= g^SK_AU= PK^r_AUand creates a shared keyword ciphertext CT^W_AU = ( A", B) for the authorized user.

(9) SearchTokenGen(gp, w′ , PK_S, SK_U): Inputting gp, w′ , PK_S and SK_U, the algorithm picks r′∈ Z^* _p at random, calculates T₁ = g^r_′ and T₂ = H₁(w')^1/SK_U · H(PK^r'_s). It then outputs T_w' = (T₁, T₂)

(10) Test(gp, CT_w, T_w, SK_S): Inputting gp, CT_w, T_w'and SK_S = a,, this algorithm first computes τ= T / H( T₁^a ) and then tests if B= H₂(e(A, τ^a)). If yes, it returns 1, else, it returns 0.

Correctness: Assume the ciphertext of keyword w is CT_w = ( PK^r_U , H₂(e(g^a, H₁(w))^r)) and the search token associated to keyword w′is T _w' = ( g ^r', H ₁( w ′)^1/SK_U· H ( PK _s^{r ′})). If w = w′, then \(B=H_{2}\left(e\left(g^{a}, H_{1}(w)\right)^{r}\right)=H_{2}\left(e\left(g^{x^{\prime} r},\left(H_{1}\left(w^{\prime}\right)^{\frac{1}{x^{\prime}}}\right)^{a}\right)\right)=H_{2}\left(e\left(P K_{U}^{r},\left(T_{2} / H\left(T_{1}^{a}\right)\right)^{a}\right)\right)=H_{2}\left(e\left(A, \tau^{a}\right)\right)\)

Therefore, the KU-CS-PEKS scheme is correct.

4.2 Security proofs

Theorem 1. The KU-CS-PEKS scheme satisfies the OKC-IND-CKA security under the hardness assumption of the 1-BDHI problem in the random oracle model.

Proof: Presuming that an adversary A₁ can break the OKC-IND-CKA security of the KU- CS-PEKS scheme with an advantage ε. Then an algorithm B can be created to solve BDHI problem with advantage \(\varepsilon^{\prime}=\varepsilon / e q_{s t} q_{H_{2}}\), where and q_st respectively represent the largest number of A₁’s queries to the oracles O_H2and O_st, and e denotes the base of the natural logarithm. Given an instance {p, g, G, G_T, e, u₁ = g^y} of the 1-BDHI problem, B’s goal is to calculate e( g, g )^1/y ∈ G.

B plays with A₁ as below:

Setup: B picks a ∈Z^*_P at ransom, sets PK_S = g^a and SK_S = a. Then, B gives gp = {p, g, G, G_T, e, H, H₁, H₂} and PK_S to A₁ if it is an outside attacker or gp = {p, g, G, G_T, e, H, H₁, H₂} and (PK_S, SK_S) if it is a designated data storage server, where H, H₁ and H₂ are three random oracles.

Phase 1: A₁ is capable of make these queries:

- Random oracle O_H : B holds a list H-list that is made up of the tuples . When getting a query H(M) from A₁, B outputs N if is already in H-list. Otherwise, B randomly picks N ∈ {0, 1}^hlen and sets H(M) = N. Finally, B records a new tuple onto H-list and responds with N.

- Random oracle O_1H : B holds a list H₁-list that is made up of tuples . When getting a query H₁(w) from A₁, B outputs h if is already in the H₁-list. Else, B randomly picks cion ∈ {0, 1} such that Pr[cion = 0] =1 / (q_st + 1). Then, B randomly picks e ∈ Z^*_p and calculates h =g ^e∈ G if cion = 0 or h = ( u₁ )^e = g ^ye∈ G otherwise. Finally, B records a new tuple onto H₁-list and responds with H₁(w) = h.

- Random oracle O_2H : B holds a list H₂-list that is made up of the tuples . When getting a query H₂(t) from A₁, B outputs V if is already in H₂-list. Otherwise, B randomly selects V ∈ {0, 1}^hlen and sets H₂(t) = V. Finally, B records a new tuple onto H₂-list and returns V.

- Uncorrupted key generation oracle O_pk: B holds a list L_U that is made up of the tuples DO, _i, x_i>. When A₁ inputs a time period index i, B responds as below: B responds with PK_{DO, i}, if i is already in the L_U with a tuple DO, i, x_i>. Else, B randomly selects x_i ∈ and sets PK_{DO, i} = g ^xi. Then B records the tuple DO, x_i> onto L_U and returns PK_{DO, i}.

- Corrupted key generation oracle O_sk: B holds a list L_C that is made up of tuples DO, j, x_j>. When A₁ inputs a time period index j and j ≠ i, algorithm B responds as below: If j is already in the LC with a tuple DO, j, x_j> , then B answers with (PKDO,j, SKDO,j = xj).

Otherwise, B chooses xj ∈ Z^*_Pat random and sets PK_DO,j = g^x_j . Then B records the tuple DO, j, x_j>onto L_C and returns (PK_DO,j , SK_DO,j = x_j).

- Update ciphertext generation oracle O_uc: With the input of two distinct time period indices (k, l) and a keyword ciphertext CT^W_CO,k by the adversary, PK_DO,k and PK_DO,l l both appear on the L_U or L_C. B obtains the update key uk_k→l = x_l /x_k from O_uk and returns the update ciphertext CT^W_CO,l = (A, B) = ( PK^r_CO,l , H₂(e(PK_S, H₁(w))^r )).

- Search token generation oracle O_st: With the input of a time period index i and a keyword w by the adversary, algorithm B responds as follows:

B gets from O _H1 a tuple from O _H1 . If cion = 0, B ends the game.

Else, B selects r ′∈ Z^*_P ,y ′∈ Z^*_P at random, sets T₁ = g^r′and T₂ = (u₁^e)^1/y-y'·

valid search token for w. B responds A₁ with T_w = (T₁, T₂).

-Test oracle O_te: With the input of ( CT^W_CO,l , T_w′ ) by the adversary, the algorithm B outputs 1 if B = H₂(e(A,τ^a ) holds or 0 otherwise.

Challenge: Once the Phase1 is finish, A₁ inputs two distinct keywords (w₀, w₁) where |w₀| = |w₁| and a time period index i^* to B. B asks o_H1 obtain h_b ∈ G such that H₁(w_b) = h_b, where b ∈ {0, 1}. Let b, h_b, e_b, coin_b> be the response tuple.

If both coin₀ = 1 and coin₁ = 1 , B ends the game. Else, B randomly picks k′ ∈ Z _*p  and lets r = k ′/  a ⋅ /y∈ Z _^*p  , and calculates A^*  = PK^r_{DO, i*} =( g^y⋅y')^r = ( g^y⋅y' )^r'/a·y= g^y'·k'/a ; chooses Z ∈{0, 1}^hlen at random and sets B^* = Z. Finally, it transmits the challenge ciphertext C^* = (A^*, B^*) to A₁.

Phase 2: A₁ makes more oracle queries, but with the constraints as defined in Game 1.

Guess: At last, A₁ outputs its guess b ′. Clearly, A₁ may have issued a query H₂ ( e( PK^r_s , H₁ ( w_b ))) H₂ ( e( g^a , g^e_b )^k'/a·x ) . Therefore, it is possible that there exists one pair of the form ( e( ga , g^e_b·k'/x ) , H₂ e( PK^r_s , H₁ ( w_b )))) in H₂-list. B picks a tuple at random from H₂-list and outputs t^1/e_b·k' as its solution to the given 1-BDHI problem.

In order to analyze the advantage of B in solving the given 1-BDHI problem, three events are defined:

₁δ: B does not terminate for A₁’s search token query;

₂δ: B does not terminate during Challenge Phase;

δ₃: A₁ does not issue a query for either H₂ ( e( PK^r_s , H₁ ( w₀ ))) or H₂ ( e( PK^r_s , H₁ ( w₁ ))).

Clearly, Pr[ δ₁ ] = 1 − 1/( q_st + 1) , since A₁ makes at most q_st search token queries, the probability that B does not abort as result of all search token queries is at least (1 − 1/(q_st + 1)) ^{q st}≥1/ e.

In the challenge phase, Pr[ c_b = 0] = 1/( q_st + 1) where b ∈ {0, 1}. Therefore, Pr[ c₀ = c₁ = 1] = (1 − 1/( q_st + 1))² ≤ 1 − 1/ q_st . Thus, the probability of event δ₂ is at least 1/q _st.

Assuming that A₁ does not query either H₂ ( e( PK^r_s , H₁ ( w₀ ))) or H₂ ( e( PK^r_s , H₁ ( w₁ ))), then Pr[ b = b^' | ¬ δ₃ ] = 1/2 . According to the total probability formula:

Pr[ b = b^' ]= Pr[ b = b^'| δ₃ ]Pr[ δ₃ ]+ Pr[ b = b^' |¬ δ ]Pr[ ¬ δ₃ ]≤ Pr[ b = b^' |δ₃]Pr[ δ₃ ] + Pr[ ¬ δ₃ ] = 1/2+1/2Pr[ ¬ δ₃ ].

Therefore,ε ≤ | Pr[b = b^']- 1/2+1/2Pr[ ¬ δ₃ ]. Consequently, Pr[ ¬ δ₃]≥ 2ε

Since the probability that B chooses the right tuple from H₂-list is at least 1/q_H2 , B’s success probability is at least ε /(eq_stq_H2).

Theorem 2. The KU-CS-PEKS scheme satisfies the RKC-IND-CKA security under the hardness assumption of the 1-BDHI problem in the random oracle model.

Proof: Presuming that an adversary A₂ can break the OKC-IND-CKA security of the KU- CS-PEKS scheme with an advantage ε. Then an algorithm B can be created to solve 1- BDHI problem with advantage ε′= ε / eq_stq_H2 , where q_H2 and q_st respectively denote the largest number of A₂’s queries to the oracles O_H2 and O_st, and e is the base of the natural logarithm. Given an instance {p, g, G, G_T, e, u₁ = g^y} of the 1-BDHI problem, B’s goal is to calculate e( g, g )^1/y ∈ G.

B plays with A₂ as below:

Setup: B picks a ∈ Z^*_pat random, sets PK_S = g^a and SK_S = a. Then, B gives gp = {p, g, G, G_T, e, H, H₁, H₂} and PK_S to A₂ if it is an outside attacker or or gp = {p, g, G, G_T, e, H, H₁, H₂} and (PK_S, SK_S) if it is a designated data storage server, where H, H₁ and H₂ are three random oracles.

Phase 1: A₂ is capable of make these queries:

- Random oracle O_H : B holds a list H-list that is made up of the tuples . When getting a query H(M) from A₂, B outputs N if is already in H-list. Otherwise, B randomly picks N ∈ {0, 1}^hlen and sets H(M) = N. Finally, B records a new tuple onto H-list and responds with N.

- Random oracle O_1H : B holds a list H₁-list that is made up of tuples . When getting a query H₁(w) from A₂, B outputs h if is already in H₁-list. Else, B randomly picks cion ∈ {0, 1} such that Pr[cion = 0] =1 / (q_st + 1). Then, B randomly picks e and calculates h = g ^e∈ G if cion = 0 or h = ( u₁ )^e = g ^ye∈ G otherwise. Finally, B records a new tuple onto H₁-list and responds with H₁(w) = h.

- Random oracle O_2H : B holds a list H₂-list that is made up of the tuples . When getting a query H₂(t) from A₂, B outputs V if is already in H₂-list. Otherwise, B randomly selects V ∈ {0, 1}^hlen and sets H₂(t) = V. Finally, B records a new tuple onto H₂-list and returns V.

- Uncorrupted key generation oracle O_pk: B holds a list L_U that is made up of the tuples AU, x_AU>. When A₂ queries this oracle, B selects x_AU ∈ Z^*_pat random and sets PK_AU = g ^xAU.

B records the tuple AU, x_AU> onto L_U and returns PK_AU.

- Corrupted key generation oracle O_sk: B holds a list L_C that is made up of the tuples AU, x_AU>. When A₂ queries this oracle, B selects x_AU ∈ Z^*_p at random and sets PK_AU = g ^xAU. B records the tuple AU, x_AU> onto L_C and returns(PK_AU= g ^xAU, SK_AU = x_AU).

- Re-encryption key generation oracle O_rk: With the input of (PK_{DO, i}, PK_AU) by the adversary, B returns the re-encryption key rk_DO→AU = x_AU / x_i.

- Share ciphertext generation oracle O_sc: With the input of ( CT^W_DO,i , rk_DO→AU) by the adversary, B returns the share ciphertext CT^W_AU = (A, B) = ( PK^r_AU , H₂(e(PK_S, H₁(w))^r)).

- Search token generation oracle O_st: With the input of (w, PK_AU) by the adversary, B responds as below:

B gets from O_H1 a tuple from O_H1 . If cion = 0, B ends the game.

Else, h = (u₁)^e . B selects r′ ∈ Z^*_p , y′ ∈ Z^*_p at random, sets T₁ = g^r' and T₂ = (u₁)^1/y⋅y' · H(PK^r′_S) = g^e/y' ·H(g^a·r'). Because PK_U = (u₁)^y' = g^xi and H₁(w)^1/xi=(g^y·e)^1/y⋅y' = g^e/y', T_w = (T₁, T₂) is a valid search token for w. B responds A2 with T_w = (T₁, T₂).

-Test oracle O_te: With the input of (CT^W_CO,l ,T_w′ ) by the adversary, B outputs 1 if B = H₂(e(A, τ^a ) holds or 0 otherwise.

Challenge: Once the Phase1 is finished, A₂ inputs two distinct keywords (w₀, w₁) where |w₀| = |w₁| and a time period index i^* to B. B asks O_H1 to obtain h_b such that H₁(w_b) = h_b, where b ∈ {0, 1}. Let b, h_b, e_b, coin_b> be the response tuple. If both coin₀ = 1 and coin₁ = 1, B ends the game. Else, B randomly picks and lets r = a ⋅ , and calculates A^* = PK^r_CO,l* =(g^y⋅y')^r =(g^y⋅y')^k'/a·y=g^y'⋅k'/a ; chooses Z ∈{0, 1}^hlen at random and sets B^* = Z. Finally, it responds with the challenge ciphertext C^* = (A^*, B^*).

Phase 2: A₂ makes more oracle queries, but with the constraints as defined in Game 2.

Guess: At last, A₂ outputs a guess b′∈ {0, 1}. B randomly picks a tuple (t, V) from H₂-list and outputs t^1/eh·k' as its solution to the given 1-BDHI problem.

Similar to the proof of Theorem 1, it can be deduced that the lower bound on B’s advantage ε /( eq _td q _{H 2} ) .

Theorem 3. The KU-CS-PEKS scheme satisfies the DOST-IND-CKA security under the is

hardness assumption of the HDH problem in the random oracle model.

Proof: Presuming that an adversary A₃ breaks the DOST -IND-CKA security of the KU- CS-PEKS scheme with an advantage ε. Then an algorithm B can be created to solve the HDH problem with advantageε ′= ε . Given an instance {p, g, G, G_T, e, g^a, g^b, η, H} of the HDH problem, where H: G → {0, 1}^hlen is a hash function and η is either H(g^ab) or a random element of G. B’s goal is to decide whether η = H(g^ab).

B plays with A₃ as below:

Setup: B picks a, l ∈ Z^*_p at random, sets PK_S = g^al and SK_S = al. Then, B gives gp = {p, g,G, G_T, e, H, H₁, H₂} and PK_S to A₃, where H, H₁ and H₂ are three random oracles. Phase 1: A₃ is capable of make these queries:

- Random oracle O_H : B holds a list H-list that is made up of the tuples . When getting a query H(M) from A₄, B outputs N if is already in H-list. Otherwise, B randomly picks N ∈ {0, 1}^hlen and sets H(M) = N. Finally, B records a new tuple onto H-list and responds with N.

- Random oracle O_H1 : B holds a list H₁-list that is made up of tuples . When getting a query H₁(w) from A₄, B outputs h if is already in H₁-list. Otherwise, B randomly picks h ∈ G and sets H₁(w) = h. Finally, B records a new tuple onto H₁-list and returns h.

- Random oracle O_H2 : B holds a list H₂-list that is made up of the tuples . When getting a query H₂(t) from A₄, B outputs V if is already in H₂-list. Otherwise, B randomly selects V ∈ {0, 1}^hlen and sets H₂(t) = V. Finally, B records a new tuple onto H₂-list and returns V.

- Uncorrupted key generation oracle O_pk: B holds a list L_U that is made up of the tuples DO, _i, x_i>. When A₃ inputs a time period index i, B responds as below: B responds with PK_{DO, i}, if i is already in L_U with a tuple DO, i, x_i>. Else, B randomly selects x_i ∈ Z _pand sets PK_{DO, i} = g ^xi. Then B records the tuple DO, i, x_i> onto L_U and returns PK_{DO, i}.

- Corrupted key generation oracle O_sk: B holds a list L_U of tuples DO, j, x_j>. When A₃ inputs a time period index j and j ≠ i, B responds as below: If j is already in L_C with a tuple DO, _j, x_j>, then B answers with (PK_{DO, j} = g ^xj, SK_{DO, j} = x_j). Otherwise, B selects a random value x_j and sets PK_{DO, j} = g ^xj. Then B records the tuple DO, j, x_j> onto the L_C and returns (PK_{DO, j} = g ^xj, SK_{DO, j} = x_j).

- Update key generation oracle O_uk: With the input of two distinct time period indices (k, l) by the adversary, PK_{DO, k} and PK_{DO, l} both appear on the L_U or L_C. B responds A₃ with uk_k→l = x_l /x_k.

- Update ciphertext generation oracle O_uc: With the input of two distinct time period indices (k, l) and a keyword ciphertext CT by the adversary. PK_{DO, k} and PK_{DO, l} both appear on the L_U or L_C. B obtains the update key uk_k→l = x_l /x_k from O_uk and returns the update ciphertext CT = (A, B) = ( PK , H₂(e(PK_S, H₁(w))^r)).

- Search token generation oracle O_st: With the input of a time period index i and a keyword g ^{r′r ′}) _ix  1/  w by A₃, B picks r′∈ and T₂ = H w ′ )· H ( PK . B

* Z _p1( _S  at random and calculates T₁ = returns A₃ with T_w = (T₁, T₂).

Challenge: Once the Phase1 is finish, A₃ inputs two distinct keywords (w₀, w₁) where |w₀| * b/l = |w₁| and a time period index i^*. B picks a value c ∈ {0, 1} at random and sets = g and ₁T 1/ x  = H ) ⋅ η. Ifη=H(g^ab), then = g ^r*, * * * * w is a valid challenge token. If r^* = b / l, then T ₂₁( _c T _wcT ₁ i 1/ SK 1/ SK 1/ SK 1/ x

* * al ⋅ ( b/ l ) = H w ) w ﹒H(g^ab) = H ﹒H( g ) = w ) DO, i *, *DO, i *

⋅ η= T ₂₁( ₁( ₁( _c H ) w ) H ₁(DOiic c cH( PK ^{r ′}). Finally, it responds with the challenge token = ( ,* * *_S T _wcT ₁T ₂).

Phase 2: A₃ makes more oracle queries, but with the constraints as defined in Game 3.

Guess: At last, A₃ outputs a guess c′. If c = c′, B output 1, meaning that η= H(g^ab)or 0 otherwise.

The advantage of B in solving the given HDH problem is analyzed as below.

According to Game 3, whenη=H(g^ab), the view of the adversary A₃ in common with its guess c′satisfies |Pr[c = c′]- 1/2| = ε. On the other side, whenη′is uniform over G, its guess c ′ satisfies Pr[c = c′] = 1/2. Consequently, the advantage of B in solving the given HDH problem is |Pr[B(g, g^a, g^b, H(g^ab)) = 0] - Pr[B(g, g^a, g^b, η′)) = 0]| |1/2±ε -1/2| = ε.

Theorem 4. The KU-CS-PEKS scheme satisfies the AUST-IND-CKA security under the≧

hardness assumption of the HDH problem in the random oracle model.

Proof: Presuming that an adversary A₄ breaks the AUST -IND-CKA security of the KU- CS-PEKS scheme with an advantage ε. Then an algorithm B can be created to solve the HDH problem with advantageε ′= ε . Given an instance {p, g, G, G_T, e, g^a, g^b, η, H} of the HDH problem, where H: G → {0, 1}^hlen is a hash function and η is either H(g^ab) or a random element of G. B’s goal is to decide whether η = H(g^ab). B plays with A₄ as below:

Setup: B randomly picks a, l ∈ , sets PK_S = g^al and SK_S = al. Then, B gives gp = {p, g,*_pZG, G_T, e, H, H₁, H₂} and PK_S to A₄, where H, H₁ and H₂ are three random oracles. Phase 1: A₄ is capable of make these queries:

_HO : B holds a list H-list that is made up of the tuples . When - Random oracle

getting a query H(M) from A₄, B outputs N if is already in H-list. Otherwise, B randomly picks N ∈ {0, 1}^hlen and sets H(M) = N. Finally, B records a new tuple onto H-list and responds with N.

_1HO- Random oracle : B holds a list H₁-list that is made up of tuples . When getting a query H₁(w) from A₄, B outputs h if is already in H₁-list. Otherwise, B randomly picks h ∈ G and sets H₁(w) = h. Finally, B records a new tuple onto H₁-list and returns h.

_2HO- Random oracle : B holds a list H₂-list that is made up of the tuples . When getting a query H₂(t) from A₄, B outputs V if is already in H₂-list. Otherwise, B randomly selects V ∈ {0, 1}^hlen and sets H₂(t) = V. Finally, B records a new tuple onto H₂-list and returns V.

- Uncorrupted key generation oracle O_pk: B holds a list L_U that is made up of the tuples at random and sets PK_AU = g ^xAU.*AU, x_AU>. When A₄ queries this oracle, B selects x_AU ∈ _pZB records the tuple AU, x_AU> onto L_U and returns PK_AU.

- Corrupted key generation oracle O_sk: B holds a list L_C that is made up of the tuples AU, x_AU>. When A₂ queries this oracle, B selects x_AU ∈ at random and sets PK_AU = g ^xAU. B records*_pZthe tuple AU, x_AU> onto L_C and returns (PK_AU = g ^xAU, SK_AU = x_AU).

- Re-encryption key generation oracle O_rk: With the input of (PK_{DO, i}, PK_AU) by the

- Search token generation oracle O_st: With the input of a keyword w and a public key PK_AUg ^r′and T₂ = H · H ( PK ^{r ′})._AUx1/)′₁( _S by the adversary, B randomly chooses and calculates T₁ = w B responds A₄ with T_w = (T₁, T₂).

Challenge: Once the Phase1 is finish, A₄ inputs two distinct keywords (w₀, w₁) where |w₀|* * b/l *= |w₁ and a public key PK . B randomly picks c ∈ {0, 1} and sets = g and =_AU T ₁T ₂1/ xH w _c ) ⋅ η. Ifη=H(g^ab) then is a valid challenge token. If r^* = b / l, then = g ^r*, T ₂* * * *₁( T _wcT ₁AU1/ x* * ** 1/ SK 1/ al ⋅ ( b/ l ) 1/ SK= H w ⋅ η= H ﹒H(g^ab) = H w ﹒H( gSK) w ) ) ) = H w )₁( ₁( ₁( _{c 1}( _c AU AU AU AUc cH( PK ^{r ′}). Finally, it responds with the challenge token = ( ,* * *_S T ₁T ₂._cwT

Phase 2: A₄ issues more queries, but with the restrictions as defined in Game 4.

Guess: At last, A₄ outputs a guess c′∈ {0, 1}. If c = c′, B outputs 1, meaning thatη=

5. Performance Evaluation

We first compare the properties of the existing KU-PEKS framework [34] and the KU-CS- PEKS framework. The details are shown in Table 1. From the table, it is easy to see that the KU-CS-PEKS framework enjoys some good properties such as supporting privacy-preserving ciphertext update on the storage server and transmitting the search tokens without secure channel, while providing ciphertext sharing function.

Table 1. Properties of the KU-PEKS framework and the KU-CS-PEKS framework

Table 2. Computational efficiency of the compared schemes

Table 3. Communicational efficiency of the compared schemes

Table 4. Time cost of each basic operation and bit-length of an element/hash value

Table 2 and Table 3 respectively give the computational efficiency comparison and the communicational efficiency comparison of the KU-PEKS scheme [34] and the proposed KU- CS-PEKS scheme, where T_H, T_P, T_MP, T_E, T_ET, T_M and T_I are the running time of a cryptographic hash operation, a bilinear pairing operation, a map-to-point encoding operation, an exponent operation in G, an exponent operation in G_T, a modular multiplication operation in Z_p and a modular inverse operation in Z_p respectively, l and |G| respectively denote the bit-size of a hash value and the bit-size of an element in G.

To evaluate the computational efficiency, the schemes are tested by the PBC library [40]. The experiments are carried out on a laptop and Linux OS with an Intel Core i5-4210U CPU of 1.7GHz and 3.0GB RAM. The bilinear pairing is simulated by the Type-A pairing, which is defined on the curve y² = x³ + x over the finite field F_q for prime q≡3 mod 4. Besides, the hash functions are implemented by SHA-256. Table 4 gives the time cost of each basic operation and bit-length of a group element or a hash value.

The experimental results (see Fig. 1 ~ Fig. 4) show that the costs of the SearchTokenGen algorithm and the Test algorithm in the KU-CS-PEKS scheme are higher than that of the KU- PEKS scheme, but the costs of the KWCiphertextGen algorithm and the CiphertextUpdate algorithm are lower than that of the KU-PEKS scheme. Specifically, the time for encrypting a keyword in the KU-CS-PEKS scheme is about 6.113ms, while that in the KU-PEKS scheme is about 6.705ms. The time for updating a keyword ciphertext in the KU-CS-PEKS scheme is about 0.2ms, while that in the KU-PEKS scheme is about 6.907ms. The time for generating a search token in the KU-CS-PEKS scheme is about 4.905ms, while that in the KU-PEKS scheme is about 4.5ms. In addition, the time for matching a keyword ciphertext with a search token in the KU-CS-PEKS scheme is about 2.01ms, while that in KU-PEKS scheme is about 1.605ms.

Fig. 1. Time cost of keyword ciphertext generation algorithm

Fig. 2. Time cost of keyword ciphertext update algorithm

Fig. 3. Time cost of search token generation algorithm

Fig. 4. Time cost of test algorithm

Regarding the communication overhead (as illustrated in Fig. 5), the keyword ciphertext length in KU-CS-PEKS scheme is 768 bits, while the keyword ciphertext length in the KU- PEKS scheme is 1792 bits. Besides, the size of a search token in KU-CS-PEKS scheme is 1024 bits, while that in the KU-PEKS scheme is 512 bits. Compared with the KU-PEKS scheme, the KU-CS-PEKS scheme has shorter keyword ciphertext and longer search token.

Fig. 5. Bit-length of keyword ciphertext and search token

To remove secure channels and achieve search token indistinguishability, the KU-CS- PEKS scheme has to generate longer search tokens and consumes more time in search token generation and match testing. However, the additional costs are worthwhile, because the proposed scheme effectively fixes the inherent security weaknesses in the previous KU-PEKS scheme.

6. Conclusion

This paper presents a PEKS framework, named key-updatable and ciphertext-sharable PEKS (KU-CS-PEKS). After formally defining its security (including the keyword ciphertext indistinguishability and the search token indistinguishability), a concrete KU-CS-PEKS scheme that is proven secure in the random oracle model is given. The KU-CS-PEKS scheme realizes privacy-preserving ciphertext update on the storage server and ciphertext sharing functions, while removing the secure channel requirement. The experimental results and comparisons demonstrate that the KU-CS-PEKS scheme is feasible and applicable.