Blockchain-based searchable encryption with efficient result verification and fair payment

Abstract

Data outsourcing has become a popular application. Searchable encryption (SE) can provide data retrievability as well as keep data privacy. In the threat model of SE schemes, the cloud server is usually assumed to be Honest-But-Curious, but this may not be true in reality. The blockchain-based SE makes malicious cloud servers dare not to deviate from the protocol, and search results are validated by miners. However, rational miners would skip the validation step and accept the block directly to save computational resources. This situation is called the Verifier’s Dilemma which will make the blockchain-based SE scheme not real verifiable. Therefore, this paper proposes a verifiable blockchain-based public-key encryption scheme that outsources the verification to the TrueBit network. This design makes our scheme achieves effective verifiability which will minimize the computational cost of miners. Furthermore, our scheme also establishes a fair payment protocol between the multiple data owners and data users. Also, the data owner can revoke the permission of the document he/she shared before. We also present security proofs and analysis of the proposed scheme. Performance evaluation presents the overheads of performing search operations on the cloud server and conducting transactions on smart contracts in Ethereum. The experiment results demonstrate the practicability of our proposed scheme.

Introduction

With the growth of data storage demands, personal users and institutional users would outsource their data to cloud service providers (CSP). For data privacy concerns, data outsourced to the cloud is typically encrypted. However, a regular encryption scheme makes the encrypted data unsearchable, which hinders the application of cloud storage service industry. Searchable encryption (SE) is a promising technique allowing users to retrieve ciphertext data [1], [2]. SE tradeoffs data privacy and data availability, but there are still many problems that need to be resolved. For example, there are potential risks if the data owner trusts the CSP completely. For financial benefit, the CSP has the incentive not to follow the protocol truthfully. So in this setting, the retrieving results returned by the CSP need to be verified to make sure he/she did what he/she claimed to do. And the realization of fair payments between users and CSP in insecure public communication networks [3] should also be considered.

Song et al. [4] first proposed a symmetric searchable encryption (SSE) scheme. After that, a large number of researches have been carried out, including the multi-keyword symmetric searchable encryption schemes [5], [6], [7] and the schemes that support dynamic updates [8], [9]. As those works are all based on symmetric cryptography primitives, Boneh [10] first formalized the notion of public-key encryption with keyword search (PEKS), and defined the security of this system. In 2007, Boneh and Waters [11] proposed a scheme that supports conjunctive and range queries based on their previous work. Rhee et al. [12] also proposed a public-key searchable encryption scheme that introduces the concept of “trapdoor indistinguishability”, which is against keyword-guessing attacks. Public-key encryption with keyword search scheme avoids the key distribution problem in symmetric searchable encryption, but it also brings difficulties such as key leakage [13] and low efficiency.

In many previous searchable encryption schemes, the remote server is modeled as an Honest-But-Curious entity that always performs search queries correctly for users, which is hardly true in reality. In fact, a malicious server may return searching results that do not match the search query to the user. To verify searching results, some works have focused on the verifiable searchable encryption schemes [14], [15], [16]. Zheng et al. [15] proposed a verifiable attribute-based searchable encryption scheme that can verify if the cloud server has performed the correct search operation. Sun et al. [16] proposed a verifiable conjunctive keyword search scheme and its tree index structure greatly improves efficiency. However, the malicious behaviors on cloud servers can only be detected without penalty in most schemes. Thus, a verifiable searchable encryption scheme that can constrain the behavior of all parties is needed in practice.

Recently, the research of combining searchable encryption with blockchain technology has realized the punishment to the malicious server. Hu et al. [17] proposed a blockchain-based symmetric searchable encryption scheme, which realized the fairness of data sharing system. On this basis, Chen et al. [18] proposed a blockchain-based search scheme for electronic health records in which the index is constructed by complex logical expressions. Yang et al. [19] constructed a fair searchable encryption scheme in the single-owner setting that the correctness of search results is verified in the blockchain.

Blockchain can solve the trust problem of data sharing system with the cloud involved. In our proposed scheme, all parties will be treated fairly and incentivized to do the right computations. We also adopt the key-aggregate method in [20], which makes it easy for the data owner to share search and verification permissions on document sets selectively. Different from [20], we explore the potential of blockchain technology in public-key encryption with keyword search scheme via smart contract. The contributions of this paper are summarized as follows:

• A blockchain-based public-key encryption with keyword search scheme is proposed, which can achieve decentralized and fair searchable encryption. We have improved Liu’s scheme [20] to realize publicly verifiable and adopted the key-aggregate method to reduce the cost of holding keys. Furthermore, our proposed scheme solves the Verifier’s Dilemma by introducing the TrueBit protocol [21] then enables secure outsourced verification and minimizes execution cost.

• In our proposed scheme, the data owner can update the private key and revoke the permission of the document shared before. Key update property and data revocability have not been realized in [20]. We believe this merit makes our scheme achieve Forward Secrecy which means data users whose document access permission was revoked cannot retrieve the revoked document by submitting an old token to search.

• Our proposed scheme achieves fair finance and access control between the data user and data owners through smart contract. As long as the data owner grants access to the data user and the cloud server provides the searching results honestly, they will be paid by the data user automatically.

• In the multi-owner setting, our proposed scheme implements fine-grained payments with smart contract. Especially, the data user pays the actual search fee based on the percentage of results returned by the cloud server that pass the verification, with the rest refunded to his/her account. Also, data owners are paid fairly for the number of documents they share.

The remainder of this paper is organized as follows. Our Motivation is expounded in Section 2. Preliminaries are described in Section 3. The system model and design goals are presented in Section 4. We present the concrete construction of our proposed scheme in Section 5, and its security proof is presented in Section 6. The performance evaluation is presented in Section 7 and the conclusion is drawn in Section 8.