Query-Biased Preview over Outsourced and Encrypted Data

Abstract

For both convenience and security, more and more users encrypt their sensitive data before outsourcing it to a third party such as cloud storage service. However, searching for the desired documents becomes problematic since it is costly to download and decrypt each possibly needed document to check if it contains the desired content. An informative query-biased preview feature, as applied in modern search engine, could help the users to learn about the content without downloading the entire document. However, when the data are encrypted, securely extracting a keyword-in-context snippet from the data as a preview becomes a challenge. Based on private information retrieval protocol and the core concept of searchable encryption, we propose a single-server and two-round solution to securely obtain a query-biased snippet over the encrypted data from the server. We achieve this novel result by making a document (plaintext) previewable under any cryptosystem and constructing a secure index to support dynamic computation for a best matched snippet when queried by some keywords. For each document, the scheme has 𝑂(𝑑) storage complexity and 𝑂(log(𝑑/𝑠)+𝑠+𝑑/𝑠) communication complexity, where 𝑑 is the document size and 𝑠 is the snippet length.

1. Introduction

Cloud storage provides an elastic, highly available, easily accessible, and cheap data repository to users who do not want to maintain their own storage or just for convenience, and such a way of storing data becomes more and more popular. In many cases, especially when the users want to store their sensitive data such as business documents, it requires the security guarantees against the cloud provider since an internal staff may access to the data maliciously. Directly encrypting the sensitive documents using traditional encryption techniques such as AES is not an ideal solution since the user will lose the ability to effectively search for the desired documents.

One solution for effectively searching over encrypted data is searchable encryption technique. It enables a user to securely outsource his private documents to a third party while maintaining the ability to search the documents by keywords. The scenario is simple: the user submits some encrypted keywords to the server, and then the server performs the search and returns the encrypted documents which contain the queried keywords. However, current searchable encryption techniques either directly return the matched documents or return in the first round some limited information (guided mode) which is prestored in metadata, such as the name and a short static abstract for each matched document. The more documents stored, the more possible matched results will be, and finding the desired documents also becomes a problem. Moreover, the bandwidth cost must be taken into consideration such that returning a large amount of matched documents seemed to be impractical.

Another solution for effectively searching for the desired data is through content preview, which is the main topic of this paper. In modern search engine, if a user searches for a web page by keywords, the search engine will return the name, URI, and a small query-biased snippet for each matched page. The snippet explains why such page is matched. Then the user could make a final choice and selectively browse the needed pages without opening all matched links. The same way could be used for searching the desired encrypted documents since the scenario is the same. It could also be combined with searchable encryption to improve the user experience.

However, obtaining a query-biased snippet from an encrypted data is quite challenging. For a general search engine, in order to get a query-biased snippet from a plaintext, it must scan each matched document dynamically, extract the snippets where the keywords occur, then rank the results and finally return the top-ranking snippet. While data is encrypted, dynamic scanning becomes quite impossible. Precomputing a snippet file for preview is also impossible because there is no way to know in advance what the queried keywords are, and building all static (keyword, snippet) pairs for each document costs too much storage space even far more than the document itself. Thus, we consider dividing a document to many equal-size encrypted snippets and preconstruct an index to address each snippet. The index stores the information about the keyword frequency in each snippet, which enables the server to dynamically calculate the best snippet for the user when queried by multiple keywords.

There are two major security problems. First, the snippet is the part of a document; therefore the encryption scheme used may affect the snippet retrieval. We use a pad-and-divide scheme to preprocess the document to make it compatible with any cryptosystem such as DES and RSA. Second, the information in the index is private, and no partial information about the document should be leaked to the server. Therefore, we encrypt the index based on the core method of searchable encryption. Since each keyword maps an entry in the index, if queried by some keywords, directly returning the related score information without calculating leaks the information about the number of queried keywords (equals to the number of returned entries) to an eavesdropper, and it also costs multiple communication bandwidth as the number of requested keywords increases. A homomorphic encryption scheme could be adopted such that the server could directly operate over the encrypted data and produce a single result, while keeping the ciphertext still secure. However, homomorphic encryption scheme is often costly when dealing with a large amount of data. Observing that all the data are very small, we propose a novel lightweight substitution for homomorphic encryption to construct such secure index.

In this paper, our contributions are the following. (1) To the best of our knowledge, we formalize the problem of securely retrieving query-biased snippet over encrypted data for the first time. We generalize the notion of secure query-biased preview (SecQBP) and its security model. (2) We propose a lightweight solution to deal with matrix data with partial homomorphic property, named matrix additive coding (Matrix-AC), which could efficiently add two rows of small numbers while keeping the data still encrypted. (3) Based on Matrix-AC and private information retrieval protocol, we construct a secure additive ranking index (SecARI) that enables the server to efficiently compute the top-ranking snippet over encrypted data while no partial information about the document is leaked, and then we propose the complete construction to realize SecQBP and prove that it is secure under our security model. (4) We propose a high level solution to combine the preview scheme with searchable encryption technique, which greatly improves the user experience.

The rest of the paper is organized as follows. Section 2 presents the related work. Section 3 presents the notations and preliminaries. Section 4 presents our proposed additive coding scheme. In Section 5 we formally define the preview scheme and its security model and present the construction in detail. We present the application in searchable encryption and analyze the performance in Section 6. Section 7 concludes this paper.

2. Related Work

We categorize the related work into four topics, and each topic is summarized separately.

2.1. Query-Biased Snippet

Query-biased snippet refers to a piece of the content in a document that contains the queried keywords. Query-biased snippet generation schemes are widely used in modern search engine. It is also named dynamic summary or keyword-in-context (KWIC) snippet generation. The term was used firstly in [1]. The improvements were introduced in [2–6]. However, as far as we know, all query-biased schemes are focused on dynamically retrieving snippets from the plaintext. If the document is encrypted, dynamic scanning becomes impossible. Static preview refers to a snippet summarizing the content in advance, which is always the same regardless of the query. It is generally composed of either a subset of the content or metadata associated with the document. A lightweight static preview scheme over the encrypted data was introduced in [7]. For more details, please refer to [8] for a survey of the recent preview schemes.

2.2. Searchable Encryption

Our proposed scheme and security model are based on searchable encryption technique. The basic goal of searchable encryption is to enable a user to privately search over encrypted data by keywords. The first scheme was introduced in [9]. Later on, many index-based symmetric searchable encryption schemes were proposed. The first secure index was introduced in [10], and the security model of adaptive chosen keyword attack (IND-CKA) was also introduced. Reference [11] introduced two constructions to realize symmetric searchable encryption: the first is SSE-1 which is nonadaptive and the second is SSE-2 which is adaptive. A generalization for symmetric searchable encryption was introduced in [12]. Another type of searchable encryption schemes is public-key based. The first scheme was introduced in [13], the improved definition was introduced in [14], and the strongest security model was introduced in [15].

There are many functional extensions for the basic searchable encryption schemes. Reference [16] introduced a scheme supporting conjunctive keyword search. References [17–19] introduced ranked keyword search over encrypted data. References [20–22] introduced fuzzy keyword search over encrypted data. Similar to fuzzy keyword search but different, [23, 24] introduced similarity search over encrypted data.

2.3. Homomorphic Encryption

Our proposed additive coding method is based on the core concept of homomorphic encryption. The classical homomorphic encryption schemes are based on group operation such as the unpadded RSA in [25], the variant of ElGamal introduced in [26], Goldwasser and Micali’s bit homomorphic encryption scheme introduced in [27, 28], and Paillier’s encryption scheme introduced in [29]. Many improvements have been proposed based on these classical series of schemes. The referred schemes are public-key based, and few symmetric homomorphic schemes have been proposed. The series of symmetric homomorphic schemes which is based on one-time pad was introduced in [30]. Some ring-based homomorphic schemes have been proposed recently, which are also referred to as full homomorphic encryption, such as the one in [31] that is based on ideal lattices and the one in [32] that does not require ideal lattices.

2.4. Private Information Retrieval

We encapsulate a private information retrieval (PIR) protocol and extend the use of it in our scheme. PIR schemes allow a user to privately retrieve the 𝑖th bit of an 𝑛-bit database. The notion was fist introduced in [33] by Chor et al., and the notion of private block retrieval (PBR) was also introduced. Kushilevitz and Ostrovsky introduced a single-server and single-round computational PIR scheme in [34], which achieves communication complexity of 𝑂(√𝑛) for the basic scheme and could achieve 𝑂(𝑛^𝜖) with arbitrary small 𝜖 theoretically (2^{𝑂(log𝑛loglog𝑛)} is achieved assuming security parameter is polylogarithmic in 𝑛). In [35], Cashin et al. introduced a single-database PIR scheme with polylogarithmic communication complexity for the first time, about 𝑂(log⁸𝑛) as suggested. Gentry and Ramzan introduced a PBP scheme with 𝑂(𝑘+𝑑) communication cost in [36], where 𝑘≥log𝑛 is a security parameter that depends on 𝑛, which is nearly optimal.

3. Notations and Preliminaries

3.1. Basic Notations

We write 𝑥←_𝑈𝑋 to represent sampling element 𝑥 uniformly random from a set 𝑋 and write 𝑥←𝒜 to represent the output of an algorithm 𝒜. We write 𝑎‖𝑏 to refer to the concatenation of two strings 𝑎 and 𝑏. We write |𝐴| to represent its cardinality when 𝐴 is a set and write |𝑎| to represent its bit length if 𝑎 is a string. We write ⊕ to represent bitwise exclusive OR (XOR) and “≪𝑛” to represent bitwise shift left for 𝑛 bits. We write ⌈𝑥⌉ to represent the least integer less than or equal to 𝑥. We write 𝑠_𝑏 to represent a bit string that contains either 0 or 1 (e.g., 001101_𝑏). A function 𝜇(𝑘)∶ℕ→ℝ is negligible if for every positive polynomial 𝑝(⋅) there exists an inter 𝑁>0 such that for all 𝑘>𝑁, |𝜇(𝑘)|<1/𝑝(𝑘). We write poly(𝑘) and negl(𝑘) to denote polynomial and negligible functions in 𝑘, respectively.

We write Δ=(𝑤₁,…,𝑤_𝑛) to present a dictionary of 𝑛 words in lexicographic order. We assume that all words are of length polynomial in 𝑘. We write 𝑑 to refer to a document that contains poly(𝑘) words. We write 𝑑 to represent the identifier of 𝑑 that uniquely identifies the document, such as a memory location. We write 𝑠 to refer to a snippet (50 characters in general) extracted from the document and write 𝑠 to represent the identifier of 𝑠, such as the position in the document.

3.2. Cryptographic Primitives

A function 𝑓∶{0,1}^𝑘×{0,1}^𝑛→{0,1}^𝑚 is pseudorandom if it is computable in polynomial time in 𝑘 and for all polynomial size adversaries 𝒜, it cannot be distinguished from random functions. If 𝑓 is bijective then it is a pseudorandom permutation. We write the abbreviation PRF for pseudorandom functions and PRP for pseudorandom permutations.

Let ES represent an encryption scheme. Let ES.Gen(1^𝑘) represent the key generation algorithm (𝑘 is the secure parameter). Let ES.Enc_K(𝑑) represent the encryption algorithm that encrypts data 𝑑 using key 𝐾, and let ES.Dec_K(𝑐) represent the decryption algorithm that decrypts data 𝑐 to gain the plaintext 𝑑. In our scheme, a lot of data will be encrypted using the same key; therefore the encryption scheme must be at least CPA (chosen plaintext attack) and CCA (chosen ciphertext attack) secure. For example, ECB (electronic codebook) mode in DES or RSA without OAEP (optimal asymmetric encryption padding) should not be used.

3.3. Homomorphism

Let ℳ denote the set of the plaintexts, let 𝒞 denote the set of the ciphertexts, let ⊙ denote the operation between the plaintexts and ⊗ the operation between the ciphertexts, and let “←” denote “directly compute” without any intermediate decryption. An encryption scheme is said to be homomorphic if for any given encryption key 𝑘, the encryption function 𝐸 or the decryption function 𝐷 satisfies ∀𝑚₁,𝑚₂∈ℳ,𝐸𝑚₁⊙𝑚₂⟵𝐸𝑚₁⊗𝐸𝑚₂,∀𝑐₁,𝑐₂∈𝒞,𝐷𝑐₁⊗𝑐₂⟵𝐷𝑐₁⊙𝐷𝑐₂. (1)(2)

Sometimes, property (2) is also referred to as homomorphic decryption. If the operation is upon a group, we say it is a group homomorphism. If the operation is upon a ring, we say it is a ring homomorphism and is also referred to as full homomorphism. If the operator is addition, we say it is additively homomorphic, and if the operator is multiplication, we say it is multiplicatively homomorphic.

3.4. Private Block Retrieval Protocol

Let 𝐵=(𝐵₁,…,𝐵_𝑛) represent a database of 𝑛 blocks; all blocks have equal size 𝑑. The user wants to privately retrieve the 𝑖th block from the server; therefore he runs a private block retrieval protocol. At a high level, we define the single database and single round computational PBR as follows.

Definition 1 (computational PBR protocol). A computational PBR protocol scheme is a collection of four polynomial-time algorithms CPBR = (Setup, Query, Response, Decode) such that we have the following.  𝑃←Setup(𝐵) is a probabilistic algorithm that takes as input the database 𝐵 and outputs a parameter set 𝑃. It is run by the database owner, and 𝑃 is known to all users. 𝑡←Query(𝑖) is a probabilistic algorithm that takes as input a block index 𝑖 and outputs a token 𝑡. It is run by the user. 𝑡 is sent to the server. 𝑟←Response(𝑡) is a deterministic algorithm that takes as input the requested token 𝑡 and outputs a result 𝑟. It is run by the server. 𝑟 is sent to the user. 𝐵_𝑖←Decode(𝑟) is a deterministic algorithm that takes as input the response 𝑟 from the server and outputs the requested data block 𝐵_𝑖. It is run by the user.

In our preview scheme, we adopt the computational PBP scheme as a primitive introduced in [36]. In the setup algorithm, we set the database size as the maximal possible document size (e.g., 10 MB) and reuse prime number set and prime power set in all documents. The communication complexity is 𝑂(log|𝑑|+|𝑠|) where |𝑑| is the document length and |𝑠| is the snippet length.

4. Secure Additive Coding

Before introducing the preview scheme, we first introduce a novel coding method called matrix additive coding (Matrix-AC) that enables addition of two rows in a matrix in a homomorphic fashion, which is very fast and suitable for dealing with small numbers (the integer is coded to a specific bit string) and is especially useful for computing statistical table in encrypted form. Since all operated integers are correlative, it is not a homomorphic encryption scheme which could encrypt data independently.

Matrix-AC is used in the preview scheme to construct the secure additive ranking index (SecARI). Becouse a large number of small numbers will be calculated in the preview scheme, using homomorphic encryption schemes is costly. Therefore, we use Matrix-AC scheme as a substitution for homomorphic encryption scheme to achieve optimal performance.

We note that, for all the schemes (including the preview scheme in the next section), we only consider the confidentiality of the data. Mechanism about protecting data integrity is out of the scope of this paper.

4.1. Basic Idea

The basic idea of coding small integers 𝕊_𝑁=(0,1,2,…,𝑁) with homomorphic property is simple: we consider an integer vector 𝐦=(𝑚₁,…,𝑚_𝑛), where 𝑚_𝑖∈𝕊_𝑁 and ∑^𝑛_𝑖=1𝑚_𝑖≤𝑁. We define a “vernier” that has 𝑁 bits, and each integer 𝑚_𝑖 is mapped to such vernier for 𝑚_𝑖 bits in different position. A global cursor 𝑔 is autoincreased to process the mapping. To code a message, a random string as a one-time-pad key is used and XORed with the mapped data. The decoding is simple: just operate ⊕ with the key and count the number of bit-1 to make reverse mapping.

For example (as shown in Figure 1), consider a vernier that has 8 bits, and we map three integers (2,1,3) as a vector to three pairs (2,00000011_𝑏), (1,00000100_𝑏), and (3,00111000_𝑏). It is easy to see that the homomorphic property holds as 2+3=5, and 00000011_𝑏⊕00111000_𝑏=00111011_𝑏 which has exactly 5 bit-1. Thus, let the vector be (𝑚₁=2, 𝑚₂=1, 𝑚₃=3), and let the keys be (𝐾₁,𝐾₂,𝐾₃) that each key is a random string; then the ciphertext vector will be (𝑐₁=00000011_𝑏⊕𝐾₁, 𝑐₂=00000100_𝑏⊕𝐾₁, 𝑐₃=00111000_𝑏⊕𝐾₁). To perform addition for any two plaintexts 𝑚=𝑚₁+𝑚₂, the server could directly compute the corresponding ciphertexts 𝑐=𝑐₁⊕𝑐₂ and the decryption key becomes 𝐾=𝐾₁⊕𝐾₂. Using the new key, it is easy to decrypt the ciphertext and count the number of bit-1 to restore the result.

Figure 1 

Example of vernier mapping and the basic coding procedure.

The problem of the basic scheme is that the vernier may be used up. That is why we set the restriction that a vernier is just used in a single vector. Another drawback is that, as the max 𝑁 increases, the length of the vernier also increases in linear 𝑂(𝑁). Thus, the targeted data must be small enough to save storage space. A good application is not for dealing with few such integers but for computing a large number of small data in parallel.

4.2. Coding a Matrix

We extend the basic idea to code the data matrix. Let 𝐴_𝑚×𝑛 represent a matrix with 𝑚 rows and 𝑛 columns, let 𝑎_𝑖𝑗 represent the element in row 𝑖 and column 𝑗, and 𝑎_𝑖 represent the 𝑖th row. Matrix-AC scheme is described in Algorithm 1. Note that there are 𝑛 cursors that control the mapping for each column.

Input 𝑚 random strings 𝐊=(𝐾1,…,𝐾𝑚) of length 𝑛⋅𝑁 𝐂𝐨𝐝𝐞𝐊(𝑋𝑚×𝑛):  (1) check the validity of the input, continue if 𝑚𝑖𝑗∈𝕊𝑁 and for all 𝑗,   ∑𝑚𝑘=1𝑐𝑘𝑗≤𝑁, or output Ø otherwise  (2) initialize a ciphertext matrix 𝐶𝑚×𝑛=(𝑐𝑖𝑗), each element is set to 0   (𝑁 bits), and initialize 𝑛 cursors 𝑔1,…,𝑔𝑛 and set each 𝑔𝑗=1 (𝑁 bits)  (3) for  (𝑖=1;𝑖≤𝑚;𝑖++)  do  (4) for  𝑗=1;𝑗≤𝑛;𝑗++  do  (5)  for  𝑘=1;𝑘≤𝑥𝑖𝑗;𝑘++  do  (6)   𝑐𝑖𝑗←𝑐𝑖𝑗⊕𝑔𝑗  (7)   𝑔𝑗←𝑔𝑗<<1  (8)  end for  (9) end for  (10) encrypt the ith row as 𝑐𝑖←𝑐𝑖⊕𝐾𝑖  (11) end for  (12) output 𝐶𝑚×𝑛 Decode 𝐾𝑖𝑐𝑖:  (1) initialize a temporary data row 𝐭=𝑡1,…,𝑡𝑛 with each element   be 𝑁 bits, and set 𝐭=𝑐𝑖⊕𝐾𝑖  (2) for each 𝑡𝑗 in 𝐭, let the binary form of 𝑡𝑗 be 𝑏𝑁𝑏𝑁−1…𝑏1, then    𝑥𝑖𝑗=∑𝑁𝑘=1𝑏𝑘  (3) output 𝐱𝐢=(𝑥𝑖1,…,𝑥𝑖𝑛)

Algorithm 1 

Secure additive coding for matrix.

Let us check the homomorphism for decoding: let 𝐷 represent the decryption algorithm, for arbitrary two ciphertext rows 𝑐₁ and 𝑐₂, 𝐷(𝑐₁⊕𝑐₂)=𝐷(𝑐₁)+𝐷(𝑐₂), where the decryption key for 𝑐₁⊕𝑐₂ is 𝐾₁⊕𝐾₂.

There is a problem if the scheme is directly used in the application. In the real world, there is no way to directly represent, for example, data of 5 bits (there is an extended “bitset” class in C++, but it treats the bits as a set, and all operations are performed over set, and it is very slow). In computer, the data is represented by “byte” that a valid number is stored in such a byte. Thus, 5-bit data is stored in one byte (8 bits) as a “character,” 12-bit data is stored in two bytes (16 bits) as a “short integer,” and a 20-bit data is stored in four bytes (32 bits) as an “integer.” Thus, the XOR operation is performed over byte, and the data should be extended to such standard length. However, since all data in Matrix-AC are in fact a bit string, sometimes the data in the same row could be “chained” together. For example, suppose 𝑁=5 and there are 6 data in a row; the row could be chained to a 30-bit string and stored in a 32-bit integer. Another problem is that the “bit-counting” algorithm is realized indirectly by “mod 2” operation or setting 𝑁 masks to see if the masked bit is 1. Therefore, the performance would be improved if some dedicated hardware directly dealing with bits is used.

4.3. Proof of Security

Intuitively, the scheme is secure if any two matrices (the numbers of elements are the same) prepared by the adversary are indistinguishable, which also implies that any two elements from the same matrix are indistinguishable. We define the security of Matrix-AC as follows.

Lemma 2. If 𝐾₁,…,𝐾_𝑛 are random strings, then Matrix-AC is CPA secure.

Proof (sketch). We briefly prove the scheme since the mechanism is simple. We describe a PPT simulator 𝒮 for all PPT adversaries 𝒜. 𝒮 generates matrix 𝐗^∗_𝑚×𝑛 with 𝑚 random strings of length 𝑛⋅𝑁. For any row 𝑥_𝑖 in the original matrix 𝐗_𝑚×𝑛, no matter how it maps, the last computation is a string XORed with a one-time-pad random string 𝐾_𝑖; thus the result is indistinguishable from random. For any two rows 𝑥_𝑖 and 𝑥_𝑗 from the same matrix, each row is XORed with different random strings such that the results are indistinguishable from each other. For any two rows 𝑥_𝑖 and 𝑥^∗_𝑖 from two matrices, as discussed previously, 𝑥_𝑖 is indistinguishable from the random string 𝑥^∗_𝑖.

5. Secure Query Biased Preview Scheme

The preview scheme contains two steps: (1) storage at which the data owner prepares the previewable document and a searchable index; (2) retrieval at which the user privately retrieves the snippet from the server.

The basic idea of constructing a query-biased previewable document is as follows: divide the document into 𝑛 snippets with equal size, extract keywords from each piece to form a keyword set which records the snippet information as (keyword, frequency) pairs, and build an index to address the snippets according to the distinct keywords. The index 𝑅 is a 𝑚×𝑛 two-dimensional matrix of the form 𝑅(keyword, snippet index), and the value is the keyword frequency in the corresponding snippet. An example is shown in Table 1. The keyword is represented by 𝑤_𝑖, and the snippet index is represented by 𝑠_𝑖.

Table 1 

Example of a snippet index.

The main process of retrieving the best snippet by multi keywords follows the following steps. The user submits multikeywords to the server. The server retrieves the multirows in the index according to the submitted keywords and adds the rows together. The result is a single entry that contains the information about the best matched snippet. The user decrypts the entry, selects the snippet identifier (index number) with the highest score (for simplicity, the score equals the frequency), and privately retrieves the snippet from the server by running a PBR protocol. In order for the server to perform the “addition” operation over the encrypted data, a homomorphic encryption scheme could be used to encrypt the index. We adopt Matrix-AC as the encryption scheme instead of a standard homomorphic encryption scheme as discussed previously.

Now we begin to introduce the definition and the security model of the preview scheme. Note that we assume the server is honest but curious. Additional methods could be added to make those solutions robust against malicious attack; however, we restrict our discussion on honest-but-curious fashion. We also note that all documents are treated as text files the same way as search engine does. For example, if a document is a web page, the style tags will be pruned.

5.1. Scheme Definition

The secure-query biased preview (SecQBP) scheme contains two parties: a user 𝑈 and a remote server 𝑆. 𝑈 encrypts his private document 𝑑 to 𝐷, generates a secure additive ranking index (SecARI) 𝐻, and then outsources them to 𝑆. 𝑆 stores the document, performs the computation for the scores when queried by multiple keywords, and returns the result to 𝑈. 𝑈 then selects the best snippet indexed by 𝑖 and privately retrieves it from 𝑆.

Without loss of generality, we consider the construction for a single document. The scheme could be extended to a document collection with ease. Now we define the SecQBP scheme as follows.

Definition 3 (secure query-biased preview scheme). SecQBP scheme is a collection of six polynomial-time algorithms SecQBP = (Gen, Setup, Query, ComputeScore, DecScore, DecSnip) as follows.  𝐾←Gen(1^𝑘) is a probabilistic algorithm that takes as input a security parameter 𝑘 and outputs the secret key collection 𝐾. It is run by the user, and the keys are kept secret. (𝐷,𝐻)←Setup_K(𝑑) is a probabilistic algorithm that takes as input a document 𝑑 and outputs a encrypted document 𝐷 (using any cryptosystem) and an index 𝐻. It is run by the user, and 𝐷, 𝐻 are outsourced to the server. 𝑞←Query_K(𝐰) is a deterministic algorithm that takes as input the queried multiple keywords 𝐰=(𝑤₁,…,𝑤_𝑛) and outputs a secret query token 𝑞. It is run by the user, and 𝑞 is sent to the server. 𝑟←ComputeScore(𝑞,𝐻) is a deterministic algorithm that takes as input the secret query 𝑞 and the index 𝐻 and outputs the result 𝑟 that contains the final score information about each snippet. It is run by the server. 𝑖←DecScore_K(𝐰,𝑑,𝑟) is a deterministic algorithm that takes as input the queried keywords 𝐰, the document identifier 𝑑, and the query result 𝑟 and outputs the snippet index number 𝑖. It is run by the user. 𝑠_𝑖←DecSnip_K(𝐷_𝑖) is a deterministic algorithm that takes as input the ciphertext 𝐷_𝑖 and outputs the recovered plaintext snippet 𝑠_𝑖. It is run by the user. Note that, if the user retrieves the entire encrypted document, he could decrypt the document by decrypting each snippet.

5.2. Security Model

Informally speaking, SecQBP must guarantee that, first, given the encrypted document 𝑐 and the index 𝐻, the adversary cannot learn any partial information about the document; second, given a sequence of queries 𝑞=(𝑞₁,…,𝑞_𝑛), the adversary cannot learn any partial information about the queried keywords and the matched snippet (including the index number and the content). We now present the security definition for adaptive adversaries.

Definition 4 (semantic security against adaptive chosen keyword attack, CKA2-security). Let ∑ = (SecQBP algorithm + SecQBP protocol) be the preview scheme. Let 𝑘∈ℕ be the security parameter. one considers the following probabilistic experiments, where 𝒜 is an adversary and 𝒮 is a simulator.  Real_Σ,𝒜(𝑘): the challenger runs Gen(1^𝑘) to generate the key 𝐾. 𝒜 generates a document 𝑑 and receives (𝐷,𝐻)←Setup_K(𝑑) from the challenger. 𝒜 makes a polynomial number of adaptive queries 𝐰₁,…,𝐰_𝑛 (each set 𝐰_𝑖 contains multiple keywords in 𝑑), and for each queried keyword set 𝐰_𝑖, 𝒜 receives a query token 𝑞_𝑖←Query_K(𝐰_𝑖) from the challenger. Finally, 𝒜 returns a bit 𝑏 that is output by the experiment. Sim_Σ,𝒜,𝒮(𝑘): 𝒜 generates a document 𝑑. Given only the size |𝑑|, 𝒮 generates and sends (𝐷^∗,𝐻^∗) to 𝒜. 𝒜 makes a polynomial number of adaptive queries 𝐰₁,…,𝐰_𝑛 (each set 𝐰_𝑖 contains multiple keywords in 𝑑), and for each queried keyword set 𝐰_𝑖, 𝒜 receives a query token 𝑞^∗_𝑖 from 𝒮. Finally, 𝒜 returns a bit 𝑏 that is output by the experiment.
We say that SecQBP is semantic secure against adaptive chosen keyword attack if, for all PPT adversaries 𝒜, there exists a PPT simulator 𝒮 such that PrReal_∑,𝒜(𝑘)=1−PrSim_{∑,𝒜,𝒮}(𝑘)=1≤negl(𝑘), (3) where the probabilities are over the coins of Gen and Setup (related to the underlying cryptosystem).

Note that, with 𝑞_𝑖 or 𝑞^∗_𝑖, 𝒜 could run ComputeScore(𝑞,𝐻) to get the result 𝑟, and any internal state is also captured by 𝒜. 𝒜 could also send query according to the previous result.

5.3. Concrete Construction

Now we describe the concrete construction for SecQBP. We describe the constructions for some core components, and then represent the complete construction.

5.3.1. Encrypting a Document

We consider the problem of extracting keywords from a document. In general, a keyword is followed by a separator. Thus, in a general snippet of 50 characters, no more that 25 keywords are contained. Another problem is that not all words are keywords, and such words do not need indexing, for instance, the words “a,” “the,” and “and.” This kind of words can be found in most of the sentences such that it is useless as a key to index a file. They are called stop-word and firstly researched in [37]. The most classical stop word list used abroad is a list of 425 words suggested in [38].

There is a problem that the last word in a snippet may be cut off. In other words, the last word of a snippet may be not short enough to fit the space, and it cannot be split into two words because neither of them is a valid keyword. In a general search engine, such overflowed word is omitted. However, in the scenario of precomputing snippets, if the word is omitted, a keyword may be lost. It means that, when querying the omitted keyword, there will be no matched snippet returned, where actually there is a match for the document. Thus, we add the full word to both the keyword sets of the snippets which contain part of the keyword.

The basic idea for encrypting a document is dividing the document with equal size; therefore, a padding scheme is needed when the last piece of the document is not long enough. We modify the CBC plaintext padding scheme introduced in [39] to meet our goal. Let |𝑠| represent the length of the snippet; the snippet is treated as a sequence of bytes. If the last snippet is 𝑎 bytes, then pad the snippet with |𝑠|−𝑎 bytes with value |𝑠|−𝑎. After decryption, the padding will be deleted to recover the original plaintext. For instance, suppose |𝑠|=50; if the final snippet has 15 plaintext bytes, then pad the snippet as byte₁‖byte₂‖⋯‖byte₁₅‖35‖35‖⋯‖35, (4) where there are 35 bytes that have the number 35. If the snippet is divisible by |𝑠|, here is 50, then add a new snippet with all bytes being 50: 50‖50‖⋯‖50. (5)

Let 𝑑 represent a document, and 𝐷 is the encrypted form of 𝑑. We introduce the scheme for encrypting a document, shown in Algorithm 2. In the algorithm, “a valid keyword” means the token is not a separator, not a stop word, and not a random-looking string. A word dictionary could be used to check its validity.

Input: a document 𝑑, the encryption key 𝐾 Output: the encrypted document 𝐷=𝐷1,…,𝐷𝑛, a keyword-frequency set collection 𝑒=𝑒1,…,𝑒𝑛 Method:  (1) padding 𝑑 according to snippet length |𝑠| as discussed  (2) treat 𝑑 as 𝑛=|𝑑|/|𝑠| pieces 𝑠1,…,𝑠𝑛  (3) for  (𝑖=1;𝑖≤𝑛;𝑖++)  do  (4) create a keyword-frequency set 𝑒𝑖 for 𝑠𝑖  (5) scan 𝑠𝑖 for distinct valid keywords. For each keyword, count the    keyword frequency, and add the vector (keyword, frequency) to    𝑒𝑖 as set element  (6) encrypting the snippet as 𝐷𝑖←𝙴𝚂.𝙴𝚗𝚌𝐾𝑠𝑖  (7) end for

Algorithm 2 

Encrypting a document: 𝙴𝙳_𝐾(𝑑).

5.3.2. Constructing the Secure Index

The secure additive ranking index (SecARI) is the encryption form of the snippet index, as shown in Table 1 (PAD denotes the padding with a random string), and each row is an encrypted entry. For security reason, the number of entries of SecARI must be padded to a certain amount which is independent of the actual number of keywords in the content, or it will leak the information about the number of distinct keywords in the document (it equals the number of rows). An example of a SecARI is shown in Table 2. In the table, 𝜋 is a pseudorandom permutation which randomizes the order of the keywords, and the value 𝑐_𝑖𝑗 is the encrypted score.

Table 2 

Example of a SecARI.

Let us consider the secure amount of the entries. If the document 𝑑 is small, let a keyword occupy only one byte; then the maximum possible number of keywords is |𝑑|/2 (as discussed, a valid keyword is at least 2 bytes); thus, the number of entries must be set to |𝑑|/2 (the fractional part is ignored). If the document 𝑑 is large, the maximum possible number of keywords equals the total number of words in the dictionary. Reference [40] made a detailed word statistical analysis based on 450 million words on Corpus of Contemporary American English (1990–2012). The statistics show that the total words used are about 60000. We set the dictionary used as Δ and define the maximum keyword amount as |Δ|=60000. Thus, we define the number of entries as follows.

Definition 5 (number of entries). To guarantee security, the number of entries 𝑁_ent for a SecARI is 𝑁_ent=|𝑑|2,|𝑑|2<|Δ|,|Δ|,|𝑑|2≥|Δ|. (6)

SecARI is in fact a sparse look-up table, and we use indirect addressing method to manage it. Indirect addressing method is also called FKS dictionary introduced in [41], which is also adopted in symmetric searchable encryption scheme in [11]. It manages sparse table of the form (address, value). The address is a virtual address that could locate the value field. Given the address, the algorithm will return the associated value in constant look-up time and return ∅ otherwise.

In addition, we make use of a pseudorandom permutation 𝜋 to index an entry and a pseudorandom function to generate the one-time-pad keys for Matrix-AC: 𝜋∶{0,1}^𝑘×{0,1}^|𝑤|⟶{0,1}^|𝑤|,𝑓∶{0,1}^𝑘×{0,1}^{|𝑤|+|𝑑|}⟶{0,1}^𝑁⋅𝑛, (7) where |𝑤| is the keyword length and |𝑑| is the length of the document identifier. 𝑁 is the upper bound discussed in Matrix-AC and 𝑛 is the number of snippets that is calculated from the document size. The submitted keyword is encrypted by 𝜋 such that the server cannot figure out what the keyword the user queries.

Let 𝐻 be a {0,1}^|𝑤|×{0,1}^𝑁⋅𝑛×𝑁_ent data matrix managed by indirect addressing technique as discussed previously. Now we describe SecARI in Algorithm 3.

Input:  (1) 𝑑: the document identifier  (2) 𝑒=𝑒1,…,𝑒𝑛: the keyword-frequency set collection  (3) 𝐾=𝐾𝑚,𝐾𝑝: consists of the master key 𝐾𝑚 for row encryption     and the permutation key 𝐾𝑝 for 𝜋 Output: A secure additive ranking index 𝐻 Method:  (1) scan 𝑒, extract 𝑚 distinct keywords 𝑤1,…,𝑤𝑚  (2) create an 𝑚×𝑛 data matrix 𝑋=(𝑥𝑖𝑗), the value of each data 𝑥𝑖𝑗 is     the frequency of the keyword 𝑤𝑖 in the 𝑗th snippet  (3) for each row 𝑖, the encryption/decryption key is 𝑘𝑖←𝑓𝐾𝑚𝑤𝑖∣∣𝑑.     Thus the keys for all rows form a vector 𝐊𝑋=𝑘1,…,𝑘𝑚  (4) create an 𝑚×𝑛 matrix 𝐶, each cell 𝑐𝑖𝑗 has length 𝑁  (5) compute 𝐶←𝙲𝚘𝚍𝚎𝐊𝑋(𝑋) using Matrix-AC  (6) for all 𝑤𝑖, set 𝐻𝜋𝐾𝑝𝑤𝑖=𝑐𝑖 where 𝑐𝑖 is the 𝑖th row of the encrypted matrix 𝐶  (7) if 𝑚<𝑁ent, set remaining 𝑁ent−𝑚 entries of 𝐻 to random values

Algorithm 3 

Constructing SecARI: 𝙸𝚗𝚍𝚎𝚡_𝐾𝑑,𝑒.

5.3.3. The Complete Scheme

In order to hide the information about the number of queried keywords, a SecARI is not enough. When the user submits the queried multiple keywords, each query should be of the same length so that an eavesdropper cannot learn the information about the number of keywords in a query. Let the maximum number of keywords allowed in a single query be 𝑊_max; the remaining space must be padded. The user and the server should initiate a secure channel such as SSL to transport such message, or the padding may be discovered by an eavesdropper. Since the size of a keyword is small, the bandwidth waste of the padding is rather negligible.

We also determine the upper bound 𝑁 for Matrix-AC. As discussed, a general snippet contains at most 25 keywords; thus we set 𝑁=32 (stored as a standard integer).

Let 𝑓 be the pseudorandom function, and 𝜋 is the pseudorandom permutation as described previously. Now we describe the complete scheme in Algorithm 4, and describe the storage and retrieval protocol in Protocol 1. The retrieval protocol describes the retrieval of a query-biased snippet from document 𝑑 by submitting a multikeyword query 𝐰=(𝑤₁,…,𝑤_𝑛).

Storage:  (1) the user U runs 𝙶𝚎𝚗1𝑘 to generate the key 𝐾  (2) 𝑈 runs 𝚂𝚎𝚝𝚞𝚙𝐾(𝑑) to get the encrypted document 𝐷 and the index 𝐻,     and sends (𝐷,𝐻) to the server S Query:  (1) U runs 𝚀𝚞𝚎𝚛𝚢𝐾(𝐰) to get a token 𝑞 and sends it to S  (2) 𝑆 runs 𝙲𝚘𝚖𝚙𝚞𝚝𝚎𝚂𝚌𝚘𝚛𝚎𝑞,𝐻 to produce the score result 𝑟, and     sends it to U along with document identifier 𝑑  (3) 𝑈 runs 𝙳𝚎𝚌𝚂𝚌𝚘𝚛𝚎𝐾𝐰,𝑑,𝑟 to get the index number 𝑖 (best matched snippet)  (4) 𝑈 runs a CPBR protocol as discussed, generates a query token 𝑡    from 𝙲𝙿𝙱𝚁.𝚀𝚞𝚎𝚛𝚢(𝑖) and sends 𝑡 to S  (5) 𝑆 responses with 𝑜 from 𝙲𝙿𝙱𝚁.𝚁𝚎𝚜𝚙𝚘𝚗𝚜𝚎(𝑡)  (6) 𝑈 runs 𝙲𝙿𝙱𝚁.𝙳𝚎𝚌𝚘𝚍𝚎(𝑜) to get the encrypted snippet 𝐷𝑖  (7) 𝑈 runs 𝙳𝚎𝚌𝚂𝚗𝚒𝚙𝐾𝑑(𝐷𝑖) to get the plaintext 𝑠𝑖

Protocol 1 

SecQBP protocol.

𝙶𝚎𝚗1𝑘:  (1) sample index keys 𝐾𝑚,𝐾𝑝←𝑈{0,1}𝑘, generate document     encryption key 𝐾𝑑←𝙴𝚂.𝙶𝚎𝚗1𝑘  (2) output 𝐾=𝐾𝑚,𝐾𝑝,𝐾𝑑 𝚂𝚎𝚝𝚞𝚙𝐾(𝑑):  (1) invoke 𝙴𝙳𝐾𝑑(𝑑) to get 𝑒 and the encrypted document 𝐷  (2) invoke 𝙸𝚗𝚍𝚎𝚡(𝐾𝑚,𝐾𝑝)(𝑑,𝑒) to get the secure index 𝐻  (3) output 𝐷,𝐻 𝚀𝚞𝚎𝚛𝚢𝐾(𝐰):  (1) for each keyword 𝑤𝑖 in 𝐰=𝑤1,…,𝑤𝑛, compute 𝑡𝑖←𝜋𝐾𝑝𝑤𝑖  (2) put 𝑡1,…,𝑡𝑛 into query 𝑞 and pad it to length 𝑊max  (3) output the query 𝑞 𝙲𝚘𝚖𝚙𝚞𝚝𝚎𝚂𝚌𝚘𝚛𝚎𝑞,𝐻:  (1) let 𝑘 represent the snippet amount, unpack 𝑞 to get the queried     tokens 𝑡=𝑡1,…,𝑡𝑛, set a flag 𝐹=1  (2) select a subset of 𝑡∶𝑡′=𝑡′1,…,𝑡′𝑚 where 𝑡′𝑖 is in 𝐻. If no element     is in 𝐻, then set 𝐹=0  (3) create the result ℎ=𝐻𝑡′1⊕⋯⊕𝐻𝑡′𝑚 if 𝐹==1, or else randomly     select an index 𝑖 and set ℎ=𝐻[𝑖]  (4) put 𝑡′ into query 𝑞′ and pad it to length 𝑊max  (5) output 𝑟=ℎ,𝑞′,𝐹,𝑘 𝙳𝚎𝚌𝚂𝚌𝚘𝚛𝚎𝐾𝐰,𝑑,𝑟:  (1) unpack 𝑟=ℎ,𝑞′,𝐹,𝑘 and get 𝑡′=𝑡′1,…,𝑡′𝑚  (2)  if  the flag 𝐹==0   then  (3)  randomly select an index 𝑖∈[1,𝑘]  (4)  else  (5) according to 𝑡′, generate the decryption key 𝑘𝑗←𝑓𝐾𝑚(𝑤𝑗∣∣𝑑)       for each matched keyword 𝑤𝑗 in 𝐰  (6) compute the decryption key 𝑘𝑟=𝑘1⊕𝑘2⊕⋯⊕𝑘𝑚  (7) invoke 𝑎←𝙳𝚎𝚌𝚘𝚍𝚎𝑘𝑟(ℎ) using Matrix-AC  (8) choose a snippet number 𝑖 in 𝑎 with the highest score  (9) end if   (10) output the snippet index 𝑖   𝙳𝚎𝚌𝚂𝚗𝚒𝚙𝐾𝑑(𝐷𝑖): output the plaintext snippet 𝐷𝑖←𝙴𝚂.𝙳𝚎𝚌𝐾𝑑𝐷𝑖

Algorithm 4 

SecQBP algorithm.

Note that it is a scenario for a single document. The protocol also works for a document collection. Thus, the user could retrieve multiple snippets for multiple documents in the same round.

5.4. Proof of Security

The server stores the SecARI, performs homomorphic computation for a query, and returns to the user the score information as a single entry. We prove the security by introducing a theorem as follows.

Theorem 6. If 𝑓 is a pseudorandom function, if 𝜋 is a pseudorandom permutation, and if ES is CPA and CCA secure, then SecQBP is CKA2 secure.

Proof. We describe a polynomial-size simulator 𝒮, for all polynomial-size adversaries 𝒜, Real_∑,𝒜(𝑘) and Sim_{∑,𝒜,𝒮}(𝑘) are indistinguishable. Consider the simulator that given the size of the document |𝑑|, 𝒮 generates the data as follows. (1)(Simulating 𝐻^∗) 𝒮 computes 𝑚=𝑁_ent, 𝑛=⌈|𝑑|/|𝑠|⌉. For 1≤𝑖≤𝑚, 𝒮 generates a string 𝑎^∗_𝑖‖𝑐^∗_𝑖 such that each 𝑎^∗_𝑖 is a distinct string of length |𝑤| chosen uniformly at random, and each 𝑐^∗_𝑖 is a string of length 𝑁⋅𝑛 bits chosen uniformly at random. All strings form 𝐻^∗.(2)(Simulating 𝑞^∗_𝑖) 𝒮 prepares a query list 𝐿 that stores the query history. The value in 𝐿 is of the form (𝑤, 𝑎^∗). When queried by a keyword set 𝐰_𝑖, for each keyword 𝑤_𝑘 in 𝐰_𝑖, 𝒮 first scans 𝐿 to see if there is a match. If not, 𝒮 randomly chooses a distinct 𝑎^∗_𝑘 which is not in 𝐿 and stores the pair (𝑤_𝑘, 𝑎^∗_𝑘) into 𝐿. 𝒮 gets (𝑎^∗₁,…,𝑎^∗_|𝐰𝑖|) according to 𝐰_𝑖 and sets 𝑞^∗_𝑖=(𝑎^∗₁,…,𝑎^∗_|𝐰𝑖|).(3)(Simulating 𝐷^∗_𝑖) 𝒮 sets 𝐷^∗_𝑖 to a |𝐷_𝑖|-bit string chosen uniformly at random. Note that |𝐷_𝑖| is a global parameter known by the user and the server.
We claim that no polynomial-size distinguisher 𝒟 could distinguish the following pairs. (1)(𝐻 and 𝐻^∗) recall that 𝐻 consists of 𝑁_ent values. Each value consists of either a string of the form (𝜋_𝐾𝑝(𝑤_𝑖)‖𝑐_𝑖) or a random string. In any case, with all but negligible probability, the PRP key 𝐾_𝑝 is not included; therefore the pseudorandomness of 𝜋 guarantees that 𝜋_𝐾𝑝(𝑤_𝑖) is indistinguishable from random. The PRF key 𝐾_𝑚 is also not included; therefore the pseudorandomness of 𝑓 guarantees that the derived key 𝑘_𝑖 for each data row is indistinguishable from random, and then the underlying Matrix-AC is CPA-secure, which means that 𝑐_𝑖 is indistinguishable from random. 𝐻^∗ contains 𝑁_ent random values. Therefore, as discussed, 𝐻 and 𝐻^∗ are indistinguishable.(2)(𝑞_𝑖 and 𝑞^∗_𝑖) recall that 𝑞_𝑖 is the evaluation of the PRP 𝜋. In any case, with all but negligible probability, the PRP key 𝐾_𝑝 is not included; therefore the pseudorandomness of 𝜋 guarantees that all 𝜋_𝐾𝑝(𝑤_𝑖) in 𝑞_𝑖 are indistinguishable from random, and 𝑞^∗_𝑖 is a random string of the same length of 𝑞_𝑖.(3)(𝐷_𝑖 and 𝐷^∗_𝑖) recall that 𝐷_𝑖 is encrypted by a CPA and CCA secure encryption scheme. Since the encryption key 𝐾_𝑑 is not known by the adversary, the security of the encryption scheme guarantees that 𝐷_𝑖 and 𝐷^∗_𝑖 are indistinguishable.

6. Comparison, Application, and Performance Analysis

First, we compare the functionalities and performance of our work with previous works. Then, as a significant example, we discuss how to combine the preview scheme with symmetric searchable encryption to improve the user experience. We also discuss the performance of the preview scheme in the concrete application example.

6.1. Scheme Comparison

Let 𝑠 denote the snippet length and 𝑑 the document size; the comparisons of our work with other representative works are shown in Table 3.

Table 3 

Comparisons of preview schemes.

The query-biased preview mode is widely used in general search engine, as introduced in [5]. In the scheme, the search engine dynamically scans the document line by line to find the top-ranking snippet. Therefore, the computation complexity is 𝑂(𝑑). In [7], Mithal and Tayebi proposed a static preview scheme over encrypted data based on content mask technique. In the scheme, some segments of the plaintext are extracted in advance and are masked with noise in such a way that the so called “masked preview content” could be sent to the user as a preview when queried. The static scheme is fast and informative but does not explain why a document is matched by a query. Note that our scheme costs one extra round of communication since the score results have to be returned to the user in the first round.

6.2. Symmetric Searchable Encryption Extension

We review the generalized definition of symmetric searchable encryption (SSE) introduced in [12]. We assume that the searchable encryption scheme is in guided mode. In other words, the server will first return to the user the identifiers of the matched documents, and the user makes a final choice to select some document identifiers and sends them to the server to retrieve the selected ones.

Definition 7 (extended symmetric searchable encryption). In guided mode, a symmetric searchable encryption scheme is a collection of six polynomial-time algorithms SSE = (Gen, Enc, Token, Search, Retrieve, Dec) such that we have the following.  𝐾←Gen(1^𝑘) is a probabilistic algorithm that takes as input a security parameter 𝑘 and outputs a secret key 𝐾. It is run by the user, and the output key is kept secret by the user. (𝛾,𝐶)←Enc_𝐾(𝐷) is an algorithm that takes as input a secret key 𝐾 and a document collection 𝐷=(𝐷₁,…,𝐷_𝑛) and outputs a searchable structure 𝛾 and a sequence of encrypted documents 𝐶=(𝐶₁,…,𝐶_𝑛). It enables a user to query some keywords, and the server returns the matched documents. For instance, in an index-based searchable symmetric encryption scheme, 𝛾 is the secure index. It is run by the user, and (𝛾,𝐶) is sent to the storage server. 𝑡←Token_𝐾(𝐰) is a deterministic (possibly probabilistic) algorithm that takes as input a secret 𝐾 and a set of some keywords 𝐰=(𝑤₁,…,𝑤_𝑛) and outputs a search token 𝑡 (also named trapdoor or capacity). It is run by the user. 𝐼←Search(𝛾,𝑡) (guided mode) is a deterministic algorithm that takes as input the query token 𝑡 and the searchable structure 𝛾 and outputs the matched document identifiers 𝐼=(𝐼₁,…,𝐼_𝑚). It is run by the server, and the result 𝐼 is sent to the user. Note that, if not in guided mode, this algorithm returns the matched documents directly. It is run by the server. 𝐶^′←Retrieve(𝐶,𝐼^′) is a deterministic algorithm that takes as input the encrypted documents and the selected document identifiers 𝐼^′⊆𝐼 and outputs the selected documents corresponding to the identifiers. It is run by the server. 𝐷_𝑖←Dec_𝐾(𝐶_𝑖) is a deterministic algorithm that takes as input a secret key 𝐾 and the returned encrypted document 𝐶_𝑖 and outputs the recovered plaintext 𝐷_𝑖. It is run by the user.

The preview scheme is applied in SSE as follows. The user runs SSE.Gen, SecQBP.Gen, SSE.Enc, and SecQBP.Setup, respectively. The server stores the outsourced structure generated by SSE and the encrypted documents generated by SecQBP scheme. To search for some documents, the user runs SSE.Token and SecQBP.Query, respectively, and sends them to the server. The server produces the identifiers of the matched documents, runs SecQBP.ComputeScore for the corresponding documents one by one, and returns the document identifiers and the score results together. The user decodes the score, retrieves the preview snippets from the server, then makes the choice, and sends the selected document identifiers to the server to retrieve the interested documents.

6.3. Performance Analysis

We adopt SSE-2 introduced in [11] as an instance of a SSE scheme. Table 4 shows the time complexity and storage complexity for single SSE-2 scheme and SSE-2 plus SecQBP in detail.

Table 4 

Properties of SSE-2 + SecQBP.

Let 𝐶 represent the encrypted document collection, so the total size is |𝐶| bytes. Other than the returned encrypted documents, the extrastorage cost for SSE-2 is |𝐶|/8 bytes; thus the storage cost is 𝑂(𝑛). The extrastorage cost for SecQBP is 𝐻 for each document. By definition, the storage cost is 𝑂(𝑛). For SSE, the server searches the matched documents and decrypts the identifier list. For SecQBP, the server searches the indices for all matched documents, returns score results for all matched documents, and finally returns the snippets. They are both in time complexity of 𝑂(1). The number of rounds for SSE is two (guided mode). First, the server returns the identifiers of the matched documents and next returns the selected documents. SecQBP adds extra round for retrieving snippets from the snippet server. Moreover, for each matched document, the size of the messages for SEE is 𝑂(1). SecQBP is 𝑂(log(𝑑/𝑠)+𝑠+𝑑/𝑠), where 𝑑 is the document length, and 𝑠 is the snippet length, since the user will receive a score result of size 𝑑/𝑠 and a snippet of size 𝑠.

The detailed performance of SSE is analyzed in [42]; therefore we just analyze the performance of the SecQBP part. The content of a document 𝑑 is varied in the real world. By observation in [40], the number of keywords in a document increases along with the document size which satisfies log model, and the worst case satisfies linear model (each word in the document is keyword, such as a dictionary). However, the design for security in our scheme guarantees that the encrypted indices generated from any document are indistinguishable. Therefore, the computation for the server is independent from the models (i.e., the computations for all documents are the same). To simulate the reality, we design the data generator that simulates documents using log model.

In order to demonstrate the optimization for the server, we compare our suggested Matrix-AC scheme with the simplest and, as far as we know, the fastest symmetric homomorphic encryption scheme [30] denoted by SHE and a well-known homomorphic cryptosystem [29] denoted by Paillier cryptosystem. We consider that 100 users submit queries simultaneously. Each query contains 5 keywords, and the score computation is over 100 matched documents (SSE generates the identifiers of the matched documents). The size of each document increases from 50 KB to 1 MB (the sizes for all stored documents are the same), and the computation cost is described by millisecond.

The algorithms are coded in C++ programming language and the server is a Pentium Dual-Core E5300 PC with 2.6 GHz CPU. The result is shown in Figure 2. It demonstrates that:the following. (1) The scheme is secure. The figure shows a linear computation cost, which means the computation is independent of the document content. In other words, the server does not see any differences for all documents while performing the search. (2) In cloud environment, computation for 100 users simultaneously on a single server becomes a burden as the size of the document increases. In other words, the number of servers run as services is determined by the size of the stored documents and the accepted queries. (3) The performance is improved as we adopt Matrix-AC to substitute the homomorphic encryption schemes. From the data, Matrix-AC is about 30% faster than using SHE or Paillier cryptosystem. We assume that the user does not modify the document frequently, and the main operation is just searching for some documents. Therefore, the performance improvement is significant since it could save about 30% virtual machines in the cloud.

Figure 2 

Time cost for computing scores (single server, 100 users).

7. Conclusions

In this paper, we propose a generalized method of securely retrieving query-biased snippet over outsourced and encrypted data, which allows the users to take a sneak preview over their encrypted data. The preview scheme has strong security and privacy guarantees with relatively low overhead, and it greatly improves the user experience.

Acknowledgments

Part of this work is supported by the Fundamental Research Funds for New Century Excellent Talents in Chinese Universities (Grant no. NCET-10-0298) and Ministry of Science and Technology of Sichuan province (no. 2012HH0003).