Designated-Ciphertext Searchable Encryption - Insider Keyword Guessing Attack Prevention - Generic DCSE Scheme and Lattice-Based Construction

Sep 4, 2026

Upload by Angel

Designated-ciphertext searchable encryption (DCSE) addresses insider keyword guessing attacks in public-key encryption with keyword search (PEKS). After a malicious insider receives a trapdoor, it can encrypt candidate keywords with the user’s public key and test correspondence, revealing sensitive information. DCSE assigns each trapdoor to a specific ciphertext, blocking IKGA. The work proposes a generic DCSE using identity-based encryption and key encapsulation, proves its security, and provides a lattice-based instantiation resistant to quantum attacks based on NTRU and ring-learning with errors.

LanguageEnglish

CategoryTechnology

FormatPDF

Pages18

Reading Time45 min

AccessFree to download

Abstract

Introduction

Public-key Encryption with Keyword Search

Motivation

Designated-ciphertext Searchable Encryption Zi-Yuan Liu 1 , Yi-Fan Tseng 1 ? , Raylin Tso 1 , and Masahiro Mambo2 1 Department of Computer Science, National Chengchi University, Taipei 11605, Taiwan fzyliu, yftseng, [raylin](rayling@cs.nccu.edu.tw)[g](rayling@cs.nccu.edu.tw)[@cs.nccu.edu.tw](rayling@cs.nccu.edu.tw) 2 Institute of Science and Engineering, Kanazawa University, Kakuma-machi, Kanazawa 920-1192, Japan [mambo@ec.t.kanazawa-u.ac.jp](mambo@ec.t.kanazawa-u.ac.jp) Abstract. Public-key encryption with keyword search (PEKS), proposed by Boneh et al. , allows users to search encrypted keywords without losing data privacy. Although extensive studies have been conducted on this topic, only a few have focused on insider keyword guessing attacks (IKGA) that can reveal a user's sensitive information. In particular, after receiving a trapdoor used to search ciphertext from a user, a malicious insider (e.g., a server) can randomly encrypt possible keywords using a user's public key, and then test whether the trapdoor corresponds to the selected keyword. This paper introduces a new concept called designatedciphertext searchable encryption (DCSE), which provides the same desired functionality as a PEKS scheme and prevents IKGA. Each trapdoor in DCSE is designated to a speci􀀌c ciphertext, and thus malicious insiders cannot perform IKGA. We further propose a generic DCSE scheme that employs identity-based encryption and a key encapsulation mechanism. We provide formal proofs to demonstrate that the generic construction satis􀀌es the security requirements. Moreover, we provide a lattice-based instantiation whose security is based on NTRU and ring-learning with errors assumptions; the proposed scheme is thus considered to be resistant to the quantum-computing attacks. Keywords: Quantum-resistant 􀀁 Searchable Encryption 􀀁 Insider Keyword Guessing Attack 􀀁 Designatedciphertext 􀀁 Lattices 1 Introduction With the development of the 5G and Internet of Things (IoT), the importance of cloud storage is increasing. However, because the cloud providers cannot be easily trusted, to avoid data leakage or abuse, data owners need to ensure the privacy of sensitive data. A straightforward method is data encryption before upload to cloud servers. However, encrypted data loses its processing 􀀍exibility and cannot be used for useful operations, such as sorting or searching. Speci􀀌cally, search functionality is important for cloud storage. If a data owner wants to search for some speci􀀌c 􀀌les among large encrypted data sets, it becomes necessary to download and decrypt all the data to search, which is impractical and resource-consuming. To resolve this issue, Song et al. [45] proposed the 􀀌rst searchable encryption (SE) that allows the ciphertext to be searched using the corresponding trapdoor. However, because their construction is based on a symmetric key primitive, only the owner of a particular secret key can generate any corresponding ciphertext and trapdoor. Hence, as with a symmetric cryptosystem, their work faces the key distribution problem when it is deployed in public cloud environments. 1.1 Public-key Encryption with Keyword Search To circumvent the issue of the symmetric searchable encryption and allow multiple data owners to easily generate di􀀋erent ciphertexts for a single data receiver, Boneh et al. [10] proposed the 􀀌rst public-key encryption with keyword search (PEKS) . The scheme, unlike Song et al.'s work [45], is built on a public-key cryptosystem. The PEKS scheme has three entities: data owner (Alice), data receiver (Bob), and cloud server. Consider the following scenario: Alice wants to store 􀀌les that can be accessed and searched by Bob without any leakage of information to the cloud server. Therefore, in addition to encrypting 􀀌les using Bob's public key pk, she also encrypts the related keywords of the 􀀌les using a PEKS algorithm that allows ciphertexts to be searched, e.g. , Enc (pk; 􀀌le)kPEKS(pk; \pkc")k 􀀁

FAQs

What problem does PEKS face in cloud and IoT settings?

PEKS enables searchable encryption for encrypted data, but many schemes assume insiders are trustworthy and do not defend against attacks where insiders guess keywords from trapdoors.

How does an insider keyword guessing attack (IKGA) work?

After receiving a trapdoor, a malicious insider encrypts candidate keywords using the authorized receiver’s public key and tests whether the trapdoor matches the selected keyword.

What does DCSE change to prevent IKGA?

DCSE designates each trapdoor for a specific ciphertext, so malicious insiders cannot use the same trapdoor to test arbitrary guessed keywords.

Sep 4, 2026

Upload by Angel