DEIM Forum 2017 F7-5

Lightweight Efficient Multi-keyword Ranked Search over Encrypted Cloud Data
using Dual Word Embeddings
Ruihui Zhao†

Mizuho Iwaihara‡

Graduate School of Information, Production, and Systems, Waseda University
2-7 Hibikino, Wakamatu-ward, Kitakyushu-city, Fukuoka-ken, 808-0135 Japan
E-mail: †zachary@ruri.waseda.jp, ‡iwaihara@waseda.jp
Abstract Cloud computing is emerging as a revolutionary computing paradigm which provides a flexible and economic
strategy for data management and resource sharing. Security and privacy become major concerns in the cloud scenario, for which
Searchable Encryption (SE) technology is proposed to support efficient retrieval of encrypted data. However, the absence oflightweight ranked search is still a typical shortage in existing SE schemes. In this paper, we propose a Lightweight EfficientMulti-keyword Ranked Search over Encrypted Cloud Data using Dual Word Embeddings (LRSE) scheme that supports top-k
retrieval in the known background model. For the first time, we formulate the privacy issue and design goals for lightweightranked search in SE. We employ word embedding trained on the whole English Wikipedia using word2vec to replace the general
dictionary, afterwards we make use of Dual Embedding Space Model (DESM) to substitute traditional Vector Space Model(VSM), based on which we achieve the goal of lightweight ranked search with higher precision and solve the challenging
problems caused by updating the traditional dictionary in existing SE schemes. In LRSE, we employ an improved secure kNN
scheme to guarantee sufficient privacy protection. Our security analysis shows that LRSE satisfies our formulated privacy
requirements and extensive experiments performed on real-world datasets demonstrate that LRSE indeed accords with our
proposed design goals.
Keyword Searchable encryption, Lightweight, Dual Word Embeddings

1. Introduction

matching”, i.e., as many matches as possible, and ranking

Cloud computing is a revolutionary computing paradigm

matching documents by certain criteria, has been widely

which provides a flexible and economic strategy for data

used in the plaintext information retrieval (IR) field. In the

management and resource sharing [1], [3], thus is getting

field of document retrieval and natural language processing,more and more attention from both academic and industry

deep learning-based methods, such as word embedding [7],communities. However, security and privacy become major

are emerging as replacing traditional term vectors forconcerns in the cloud scenario when data owners outsource

measuring relatedness between terms. However, existing

their private data onto public cloud servers to be accessed

techniques in plaintext information retrieval and documentby the authenticated users. Usually, the cloud server isfiltering cannot be used in SE scenario directly. How to

considered as curious and untrusted entities [ 1], thus there

apply existing schemes in the plaintext field to encrypted

are risks of data exposure to a third party or even the cloud

cloud data search systems remains a challenging task.

service provider itself. Therefore, providing sufficient

To address the issue, searchable encryption (SE)security and privacy protections on sensitive data istechnology has been proposed in the literature in pursuit ofextremely important, especially for those applications

search over encrypted data. For schemes [ 1,6] that realize

dealing with health, financial and government data. To

flexible search, they only suppo rt Boolean keyword searc h

avoid information leakage, the sensitive data has to beor single keyword search and return inaccurate results thatencrypted before uploading onto the cloud servers, which

are often loosely related to the user ’s intent. In 2014, Caomakes it a big challenge to support efficient keyword-based

et al. [10] firstly proposed an effective mechanism called

queries and rank the matching results on the encrypted data.

MRSE to partially solve the multi-keyword ranked search

In the branch of plaintext information retrieval(IR) andproblem according to the number of matching keywords

document filtering, such as a common practice in web

between the query and documents, which established thesearch engines (e.g., Google search), da ta users may tend

foundation and basic framework of multi -keyword-ranked

to provide a set of keywords as the indicator of their searchsearch in the field of searchable encryption. As far as weinterest to retrieve the most relevant data. “Coordinate

know, most of latest schemes in SE follow this framework,such as [5, 11, 13]. As a consequence, they have the same

are determined by the dictionary, an update in thecongenital drawbacks. Here we conclude the congenital

dictionary will lead to a result that all generated

drawbacks of existing searchable encryption schemes as

index and trapdoor cannot be used and all previous

follows:
1)

work should be executed again.

Low precision. Most of latest existing SE schemes

example, if data user input “Java.” in the query, if

based on keyword match-based method, which isthe corresponding word in the dictionary is “java”,

functionally inferior in the view of current plaintext

there is no possibility to return relevant results due

information retrieval and machine learning. For

to the lack of “Java.” in the dictionary and keyword

example, MRSE simply counts the number ofmatch based method. Let alone some more advanced

matching keywords between query and documents

examples in existing plaintext information retrieva l,and does not take the access frequencies of thesuch as intelligent search using the semantic

keywords into account. Although following work

similarity, for example, “java” and “python”, orsuch as [5, 11, 13] emploies tf-idf weight to“iPhone” and “cellphone”. Because keyword match-

substitute occurrence bits in binary vectors, they arebased method cannot measure semantic similarities

still too primal and basic schemes, because tf-idf

in such cases.

is

quite

a

classic

techniqueininformation retrieval field. Besides, in MRSE_II, in

In conclusion, further researches are necessary toorder to guarantee security and avoid Scale Analysis

achieve lightweight efficient multi-keyword ranked search

Attack [10], the authors insert U dummy keywords

over encrypted cloud data with privacy preserved andin subindex I i ., which makes the final score deviate

higher precision. In this paper, we discuss a deep learning -from the real score. For example, we can set U =based approach which supports fuzzy search and intelligent

200, and the dimension of the keyword dictionary

search, and consider useful techniques for updating

becomes 4000. In the framework, they cannot

dictionaries, which is still a challenging problem.

resolvehigh

In this paper, we propose a Lightweight Efficient Multi-

precision and security, i.e., if they set the standard

difficulitiesinachieving

keyword Ranked Search over Encrypted Cloud Data using

deviation σ of the random variable ε larger, the final

Dual Word Embeddings (LRSE) scheme that supports top-

results are totally irrelevant to the query because ofk retrieval in the known background model. In summary,

the U inserted dummy keywords.

bothOr, if they set σ

lower, this framework cannot withstand the Scale

this paper makes the following contributions:1)

It firstly establishes a set of design goals andAnalysis Attack [10]. In conclusion, these two

privacyreasons cause the problem of low precision.

ranked search in a known background model . The

Dimension disaster. In MRSE [10], the system

improved kNN scheme guarantees high privacy

overhead during the whole process of index
construction, trapdoor generation, and executing
query,

ismostlydeterminedbyissuesforlightweightmulti -keyword

protection.
2)

matrixFor the first time, it introduces deep learning -based
method in SE framework. It combines word

multiplication, in another word, the large dimension

embeddingof the spare vector according to the dictionary inembedding space model (DESM), to achieve thethis framework causes dimension disaster. For

goal of lightweight efficient mult i-keyword ranked

example, in MRSE_II time cost of building index forsearch over encrypted cloud data, providing searcha data owner is almost 6,700s, when the number ofresults with higher precision and more consistent

documents in the dataset is 10,000 and thewith the query. Besides, it can also support fuzzy

dictionary has 4,000 keywords, which is too timeand intelligent search.

consuming. This problem leads to a result thatsearchable
3)

Lack of fuzzy search and intelligent search . For

which follow the classic MRSE scheme [10] areweighting2)

4)encryption

schemescannotbe3)

trainedusing

word2vec

and

dual

It lightenes the problems caused by dictionary
updates and reduces the system cost even when thepractically put into use in a real-world scenario.

vocabulary in our scheme has to be updated ,Problems caused by dictionary updates . Because all

through dimension reduction by utilizing word

the dimensions of secret key SK, index and trapdoor

embeddings.

4)

Thoroughanalysis

investigating

privacy

and

1)

The

cloud

server:

The

cloud

serverisanperformance evaluation is given, and experimentsintermediate entity hosting third -party data storage

on the real-world dataset further show the proposed

and retrieve services to authenticated data users.

scheme indeed introduces low overhead.

When received a trapdoor from the data user, thecloud server will locate the matching files by

The remainder of this paper is organized as follows: wescanning the indexes I, calculat e corresponding

discuss related work on existing searchable encryption andrelevance scores, and return the ranked top-k

document filtering based on deep learning in Section 2. In

results to the data user.

Section 3, we introduce the system model, security

2)

The data owner: The data owner encrypts arequirements, design goals, and preliminary on wordcollection of files using symmetric encryption

embeddings. Section 4 describes the LRSE framework andalgorithm and builds a searchable index I, then heproposed schemes, followed by Section 5, which focuses

outsources both the encrypted indexes I andon security analysis. Section 6 presents performanceencrypted files C onto the cloud server. After that,

evaluation and simulation results. At last we conclude thethe data owner sends the symmetric key and secret

paper in Section 7.

key SK to the data user.
3)

The data user: The data user generates a trapdoor
with SK and sends it to the cloud server. Afterward,

2. Related Workthe data user is returned the most relevant top -k

2.1 Existing Searchable Encryption

encrypted files and indexes, he decrypts and makes

Cao et al. [10] propose an effective mechanism which

use of them with the help of the symmetric key andcan partially solve the multi-keyword ranked querySK.

problem according to the number of matching keywords,
however, MRSE does not take the access frequencies of the
keywords into account. Yu et al. [ 5] propose a two-roundsearchable encryption that supports Top -k multi-keyword
retrieval, which can guarantee high security and practical
efficiency.

3.2 Security Requirements
The cloud server is considered as honest but curious, i.e.,
it is designed to execute the service algorithm faithfully,
however, it is also curious and eager to attain sensitive
information. We define the security requirements as

2.2 Document Filtering based on Deep Learning
Nalisnick et al. [9] propose a dual embedding space

follows:
1)

Data, index, and trapdoor privacy: Data privacy

model provides evidence that a document is about a querymeans that LRSE should prevent the cloud server from

term, complementing the traditional term frequency based

poking its nose into the outsourced data. Index privacy

approach. However, it is not directly applicable in themeans that the index should be constructed to prevent thecontext of encrypted cloud data retrieval.

cloud server from performing association attack i.e.,
deducing any association between keywords and en crypted

3. Problem Formulation

documents. Besides, trapdoor privacy means what the user

3.1 System Modelsubmits according to his interest is well protected by the

As illustrated in Fig. 1, our scheme involves threedifferent entities

complexity of trapdoor generating algorithm.
2)

Unlinkability of trapdoors: In LRSE, we define theunlinkability of trapdoors in a harsh model, Known
Background Model [10]. In this case, the cloudserver ismore powerfulan d possesses somestatistical information to carry out Scale Analysis
Attack [10]. We should assure that the cloud server
would not be able to identify the keywords in a queryeven if some background information had been
leaked.

Fig. 1: System Modelscheme, which mainly consists of the following four

3.3 Design Goals
In order to realize our LRSE scheme, the following
security

andperformance

guarantees

shouldbesimultaneously achieved:

phases: GenKey, BuildIndex, GenTrapdoor, and Query.

4.1 GenKey
The data owner randomly generates a (n+2)-dimension

Lightweight efficient multi-keyword ranked search: Itbinary vector as S and two (n+2)×(n+2) invertible matrices

can support efficient multi-keyword based query with low{M 1 , M 2 }, where n denotes the dimension of word

overheads and higher precision, guarantee the mostembeddings we obtained in Section 3.4. We extend therelevant files to appear in the top -k locations, and solve

dimension of vectors in our schemes to (n+2)-dimension in

the dimension disaster.

order to introduce random numbers in the final result s to

Privacy-preserving: To meet all of the harsh security
requirements specified in Section 3.2.

protect the search results. The secret key SK is in the formof a 3-tuple as {S, M 1 , M 2 }.

Solving the problem caused by dictionary update: As
specified in Section 1, traditional MRSE-based schemes
utilized a dictionary including 10,000 keywords, which is

4.2 BuildIndex
1)

The data owner utilizes the tf-idf statistical method

far from enough. Once the dictionary is updated, all

to extract keywords, usually top-10 keywords forgenerated index and trapdoor cannot be used and alleach document in our scheme. D i is the keyword set

previous work should be executed again. We should solveof i-th document. |𝐷𝑖| denotes the number ofthis problem.

keywords in the i-th document. d i j is the embedding

fuzzy and intelligent search in searchable encryption isvector for the j-th keyword of the i-th document. Let̅̅̅ denotes the centroid of all the normalized𝐷𝑖

necessary. It can realize various functions in SE as

document

Fuzzy and intelligent search supporting: Supporting

singleembedding for document D i. So we define vector ⃗⃗⃗𝐷𝑖

intelligent as today’s web search engines (e.g., Google

word

vectors

serving̅̅̅interest.

𝐷𝑖̇⃗⃗⃗𝐷𝑖 = ̅̅̅

(1)

‖𝐷ⅈ ‖

𝑤ℎ𝑒𝑟𝑒,

3.4 Preliminary on Word Embeddings1̅̅̅𝐷𝑖̇ = |𝐷ⅈ| ∑Word Embeddings [7] aim to representing words asvectors of more elementary components or features andwhich are the generic name of a set of NLP techniques . We
Word2vec helps represent each word w of the training set

corpus to act as the training set. The vocabulary size is(2)(n+1)-dimension and 1 in the (n+2)-th dimension.
⃗⃗⃗𝑖 is therefore extended to (𝐷⃗⃗⃗𝑖 , 𝜀ⅈ , 1).
𝐷

trained word embeddings using word2vec [7] in this paper.

In this paper, we chose the whole English Wikipediaⅆ𝑖𝑗ⅆ𝑖𝑗 ∈𝐷𝑖 ‖ⅆ𝑖𝑗 ‖Then we extend the dimension of ⃗⃗⃗𝐷𝑖 from n to n+2,
which means adding a random number 𝜀ⅈ in the

mapping words to low-dimensional vectors of real numbers ,capture the contexts in which w appears.

ausing the following equation:

search) and output the data files consistent with the user ’s

as a vector of features, where this vector is supposed toas2)Every plaintext subindex ⃗⃗⃗𝐷𝑖 is then spilt into a data⃗⃗⃗⃗⃗𝑖′ , ⃗⃗⃗⃗⃗⃗
vector pair donated as {𝐷𝐷𝑖′′ } using the splitting
process of the secure k-nearest neighbor (kNN)

about 200K (N = 212,6359). The training parameters ofword2vec are set as follows: continuous bag of words(CBOW) model instead of the skip-gram (word2vec options:cbow =1); the output vectors size is set to 100 (word2vec
options: size = 100); the number of negative samples is set
to 25 (word2vec options: negative = 25 ).

scheme [12] as follows: For m=1 to n+2, if 𝑆[𝑚] =1 , then ⃗⃗⃗⃗⃗𝐷𝑖̇′ [𝑚] and ⃗⃗⃗⃗⃗⃗
𝐷𝑖̇′′ [𝑚] are set to two random
numbers so that their sum is equal to ⃗⃗⃗𝐷𝑖 [𝑚]; else,⃗⃗⃗⃗⃗𝐷𝑖̇′ [𝑚] and ⃗⃗⃗⃗⃗⃗
𝐷𝑖̇′′ [𝑚] are set as the same as ⃗⃗⃗𝐷𝑖 [𝑚] .

4. The Design of LRSE
In this section, we first propose a basic idea for the
LRSE by elegantly combining word embedding and dual
embedding space model (DESM) with an improved kNN

Finally, the subindex 𝐼ⅈ = {𝑀1𝑇 ⃗⃗⃗⃗⃗
𝐷𝑖′ , 𝑀2𝑇 ⃗⃗⃗⃗⃗⃗
𝐷𝑖′′ } is built
for every encrypted document C i .

4.3 GenTrapdoor
The data user inputs a set of query keywords

1)

according to his interest. We define Q is the

In this section, we analyze the security properties

keyword set of query, thus |𝑄| is the number ofunder the schemes we introduced above. We will focus on

the keywords in the query. Vector 𝑞𝑘

three aspects: data privacy, index and trapdoor privacy,is theembedding vector for the k-th keyword of the⃗ is generated as follows:
query. Thus 𝑄⃗ = 1 ∑𝑄
|𝑄|

𝑞𝑘𝑞 ∈𝑄 ‖𝑞𝑘 ‖(3)𝑘⃗ is extended to (n+1)-dimension,
The vector 𝑄
where the (n+1)-dimension is set to 1, thenmultiplied by a random number 𝑟 ≠ 0, and finallyextended to a (n+2)-dimension vector where the last
⃗ isdimension is set to another random number t. 𝑄

2)

5. Security Analysis

and trapdoor unlinkability.

5.1 Data Privacy
Traditional symmetric key encryption technique s (e.g.,
AES [8]) could be properly utilized here to guarantee data
privacy and is not with the scope of this paper.

5.2 Index and Trapdoor Privacy
According to the secure kNN scheme [12], if the secretkey SK is kept confidential, the index privacy is well

⃗ , 𝑟, 𝑡). Here only the data user
therefore equal to (𝑟𝑄knows the exact values of r and t.
For m=1 to (n+2), if 𝑆[𝑚] = 0 , then ⃗⃗⃗⃗
𝑄 ′ [𝑚] andprotected by the computation complexity of deducing the⃗⃗⃗⃗⃗
𝑄 ′′ [𝑚] are set to two random numbers so that their⃗ [𝑚] ; else, ⃗⃗⃗⃗
sum is equal to 𝑄
𝑄 ′ [𝑚] and ⃗⃗⃗⃗⃗
𝑄 ′′ [𝑚] arealso adds to the complexity and nondeterminicity of the⃗ [𝑚] . Finally, the trapdoor T is
set the same as 𝑄
−1 ⃗⃗⃗⃗′
generated as {𝑀1 𝑄 , 𝑀2−1 ⃗⃗⃗⃗⃗
𝑄 ′′ } for the query.

meaning of every item in the index. In addition, theintroduction of random number 𝜀ⅈ in BuildIndex procedure
index generation. As a result, even the generated indexes
for the same search document F i by the same data ownerat different times are always irrelevant because of therandomness

4.4 Query

in

the

spilt

process

[12]

and

the

nondeterminicity of random number 𝜀ⅈ . Based on the same

For each document D i , with the trapdoor T, the cloudprinciple, the produced trapdoors will be irrelevant even toserver computes the similarity scores as shown in thethe same query at different times. Besides, the introduction

following equation, ranks all scores and returns the top -kof random numbers r and t also contributes to the trapdoor

ranked files and their corresponding index to the data user.

privacy.

Note here, we are not simply replacing the dictionary

5.3 Trapdoor Unlinkability

using word embedding. We also use dual embedding space

The trapdoor should be constructed to prevent the cloudmodel (DESM) model [9] to replace VSM model in MRSE-

server from deducing the relationships of any given

based schemes. Besides, vectors generated from word

trapdoors and the corresponding keywords, for example,

embeddings can not be used in the secure kNN framework

Scale Analysis Attack in a Known Background Model

directly, finally we modified the original scheme andintroduced in [10]. Basically, Scale Analysis Attack inachieve our goal of combining DESM model and the secure

MRSE schemes is based on sparse binary vector, whichkNN framewok using Equ.(1-3).

cannot be applied to our scheme because all the initial
vectors in our schemes are low-dimensional vectors of

𝐼ⅈ ⋅ 𝑇 = {𝑀1𝑇 ⃗⃗⃗⃗⃗
𝐷𝑖′ , 𝑀2𝑇 ⃗⃗⃗⃗⃗⃗
𝐷𝑖′′ } ∙{𝑀1−1 ⃗⃗⃗⃗
𝑄 ′ , 𝑀2−1 ⃗⃗⃗⃗⃗
𝑄 ′′ }= ⃗⃗⃗⃗⃗𝐷𝑖′ ∙ ⃗⃗⃗⃗
𝑄 ′ + ⃗⃗⃗⃗⃗⃗
𝐷𝑖′′ ∙ ⃗⃗⃗⃗⃗
𝑄 ′′
⃗
= ⃗⃗⃗
𝐷𝑖 ∙ 𝑄⃗ , 𝑟, 𝑡)⃗⃗⃗= (𝐷𝑖 , 𝜀ⅈ , 1) ∙ (𝑟𝑄

we can draw a conclusion that we achieve the same
security level of trapdoor unlinkability as MRSE_II
scheme [10] from the point of resisting Scale Analysis= r{DESM(D i ,Q) + 𝜀ⅈ } + t ,

(4)

where
DESM(D i ,Q) =real numbers generated from our word embeddings. Thus

Attack. Besides, Even under the extreme condition that the
cloud

̅̅̅
𝐷𝑖̇
1
𝑞𝑘
̅̅̅‖ ∙ |𝑄| ∑‖𝑞‖𝐷ⅈ𝑞 ∈𝑄 𝑘 ‖
𝑘

where

(5)

serveras many as

decrypts

thevector,(𝐶𝑁1 + 𝐶𝑁2 + 𝐶𝑁3 + ⋯ + 𝐶𝑁k ) /2

it

needs

computation of

Equ.3 in average to confirm the keywords concealed
behind the word embedding vector, where k ranges from 5

̅̅̅
𝐷𝑖̇ =

ⅆⅈ𝑗
1
∑
|𝐷𝑖|
‖ⅆⅈ𝑗 ‖ⅆ𝑖𝑗∈𝐷𝑖to 50, and N = 212,6359.
Note here, we also cannot protect Access Pattern [10],which is defined as the sequence of ranked search results.

for example, the dimension of vectors in LRSE andAlthough our proposed scheme are not designed to protect

MRSE are 100 and 10,000 respectively. The time

Access Pattern because of the efficiency consideration

cost of building the whole index is almost linear

just as most existing SE schemes (excluding costly PIR

with the size of dataset since the time cost oftechnique [4]), we still add the random number 𝜀ⅈ in thebuilding each subindex is fixed. As shown in Tab. I,

final result. The precision of our scheme is affected by thewe compare the storage overhead of subindex instandard deviation 𝜎 of the random number 𝜀ⅈ . From the

LRSE, MRSE_I, and MRSE_II within different sizes

consideration of precision, 𝜎 is expected be smaller toof dictionary. The size of subindex is absolutely

obtain high precion, for example, in an extreme case,linear with the size of dictionary.

𝜎 is set to 0, then all the final results are absolutely pure,and Access Pattern are totally without protection. Thus
the standard deviation 𝜎 can act as a flexible trade-off

2)

Generating Trapdoor: Time of generating eachparameter to adjust precision and security of Accesstrapdoor is determined by the complexity of thePattern.

splitting process and multiplications of a matrix andtwo spilt query vector, the time of generating a
trapdoor is greatly affected by the dimension of

6. Performance Evaluation

vectors. Thus the trapdoor generating time of LRSE
is much less than MRSE schemes due to the

6.1 Precisiondifference of their dimensions. The number of

As illustrated in [9], DESM model performs better than
traditional keyword match -based methods, for example,

keywords in the query has little influence upon the

BM25 [9]. Let alone MRSE_II scheme adds U dummy

result because the dimension of vector and matrices

keywords to the final results, for example, U = 200. We canis always fixed with the same word embeddings.

draw a conclusion that our precision is much larger thanWith respect to the size of the trapdoor, it occupies

MRSE-based schemes. We will further conduct experiments

the same space overhead as that of each subindex

on the famous Cranfield collection to verify our precisionlisted in Tab. I, which is only determined by thein the future.

dimension of the word embeddings.

Besides, As presented in Section 5.3: the precision canbe affected by the standard deviation σ of the random

3)

The

major

computation

tocomputing and ranking similarity scores for all

precision. If we do not attempt to protect Access Pattern atdocuments in the dataset and selecting top -k results

all, σ could be set as 0, and it will not affect the precision.

from all the scored documents. Thus the executing

6.2 Efficiency

query time of LRSE is much less than MRSE schemes

We conduct a thorough experiment on a real -world

due to the difference of their dimensions.

dataset: the NSF research award dataset and evaluate thewe set k to 50 in our experiment. We can learn that thequery time is linear with both the number of documents in

[10].
1)

Query:

execute a query in the cloud server consists ofvariable ε i . It is obvious that a smaller σ leads to better

performance of LRSE compared with the MRSE schemes

Executing

Building Index: The time cost of building the wholeindex is related to the number of documents and thecomputation complex of building each subindex. As
presented in Section 4.2, the major computation ofbuilding a subindex includes the splitting process
and two multiplications of an (n + 2) × (n + 2)
matrix and an (n + 2)-dimension vector. Given thethe dataset and the size of the dictionary. In addition, ourproposed scheme introduces nearly constant overhead asincreasing the number of query keywords for the same
reason as described in generating trapdoor. We will further
employ figures to illustrate our efficiency analysis in the
future.
TABLE I: Size of subindex/trapdoor

same size of dataset with 1000 documents, the index

Dim_MRSE

4000

construction time of LRSE is much less than MRSEMRSE_I(KB)

schemes due to the difference of their dimensions,

MRSE_II(KB)

6000

8000

10000

31.2656

46.8906

62.515678.1406

32.820348.445364.070379.6953

Dim_LRSE

50

100

200

300

LRSE(KB)

32.812548.4375

64.062579.6875[ 6 ] J. Li, Q. Wang, C. Wang, N. Cao, K. Ren, and W. Lou,

“Fuzzy keyword search over encrypted data in cloudcomputing,” in Proceedings of INFOCOM. IEEE,
2010, pp. 1–5.

7. Conclusion
In this paper, we propose a Lightweight Efficient Multi-[ 7 ] Mikolov, Tomas, et al. "Distributed representations

keyword Ranked Search over Encrypted Cloud Data using

of

words

and

phrases

and

their

Dual Word Embeddings (LRSE) scheme, which supports

compositionality." Advances in neural information

top-k retrieval in the known background model. We firstprocessing systems. 2013.

formulate stringent privacy requirements and design goals[ 8 ] N. Ferguson, R. Schroeppel, and D. Whiting, “Ain lightweight multi-keyword ranked search over encrypted

simple algebraic representation of rijndael, ” incloud data. For the first time, we introduce deep learning-

Selected Areas in Cryptography. Springer, 2001, pp.

based method in SE framework. We combine word

103–111.

embedding trained using word2vec and dual embedding
space model (DESM), which provides search results withhigher precision and more consistent with the query.
Besides, our scheme can also support fuzzy and intelligent
search. Security analysis shows that the proposed scheme
accords

with

ourformulated

privacyrequirements.

[ 9 ] Nalisnick, Eric, et al. "Improving document ranking

with dual word embeddings."Proceedings of the 25th
International Conference Companion on World Wide
Web. International World Wide Web Conferences
Steering Committee, 2016.

Extensive experiments demonstrate that the proposed[ 1 0 ] N. Cao, C. Wang, M. Li, K. Ren, and W. Lou,

scheme achieves the design goals. In the future, we will

“Privacy-preserving multikeyword ranked search

further complete our evaluation and function realization

over encrypted cloud data,” IEEE Transactions onpart and introduce personalized search into our scheme.

Parallel and Distributed Systems, vol. 25, no. 1, pp.
222–233, 2014.

References[ 1 1 ] Shen Z, Shu J, Xue W. Preferred keyword search over

[ 1 ] C. Wang, N. Cao, J. Li, K. Ren, and W. Lou, “Secure

encrypted data in cloud computing[C]// Ieee/acm,ranked keyword search over encrypted cloud data, ”

International Symposium on Quality of Service.

in the 30th International Conference on Distributed

ACM, 2013:1-6.

Computing Systems (ICDCS). IEEE, 2010, pp. 253–262.

[ 1 2 ] W. K. Wong, D. W.-l. Cheung, B. Kao, and N.

Mamoulis, “Secure knn computation on encrypted[ 2 ] H. Li, Y. Dai, L. Tian, and H. Yang, “Identity-based

databases,” in the 2009 ACM SIGMOD International

authentication for cloud computing, ” in Proceedings

Conference on Management of data . ACM, 2009, pp.

of Cloud computing. Springer, 2009, pp. 157–166.

139–152.

[ 3 ] H. Liang, L. X. Cai, D. Huang, X. Shen, and D. Peng,[ 1 3 ] Zhao R, Li H, Yang Y, et al. Privacy-preserving“An smdpbased service model for interdomain

personalized search over encrypted clouddata

resource allocation in mobile cloud networks ,” IEEE

supporting

Sixth

Transactions on Vehicular Technology , vol. 61, no. 5,

International

Conference

pp. 2222–2232, 2012.

Communications

and[ 4 ] Ishai

Y,Kushilevitz

E,

Ostrovsky

R,

et

al.

Cryptography from Anonymity.[J]. Foundations ofComputer Science Annual Symposium on, 2006,
2006:239-248.
[ 5 ] J. Yu, P. Lu, Y. Zhu, G. Xue, and M. Li, “Towards

secure multikeyword top-k retrieval over encrypted
cloud data,” IEEE Transactions on Dependable andSecure Computing, vol. 10, no. 4, pp. 239–250, 2013.

2014:1-6.

multi-keyword
Signalranking[C]//on

Wireless

Processing.

IEEE,