An Efficient SCF‐PEKS Without Random Oracle Under Simple Assumption

Chinese Journal of ElectronicsVolume 30, Issue 1 p. 77-84 Original Research PaperFree Access An Efficient SCF-PEKS Without Random Oracle Under Simple Assumption Wang Guangbo, Corresponding Author Wang Guangbo 691759571@qq.com Beijing Science and Technology Information Research Center, Beijing, 100036 ChinaSearch for more papers by this authorLi Feng, Corresponding Author Li Feng lyx_wj@sina.com Beijing Science and Technology Information Research Center, Beijing, 100036 ChinaSearch for more papers by this authorFan Liwen, Fan Liwen Beijing Science and Technology Information Research Center, Beijing, 100036 ChinaSearch for more papers by this authorLiu Haicheng, Liu Haicheng Beijing Science and Technology Information Research Center, Beijing, 100036 ChinaSearch for more papers by this author Wang Guangbo, Corresponding Author Wang Guangbo 691759571@qq.com Beijing Science and Technology Information Research Center, Beijing, 100036 ChinaSearch for more papers by this authorLi Feng, Corresponding Author Li Feng lyx_wj@sina.com Beijing Science and Technology Information Research Center, Beijing, 100036 ChinaSearch for more papers by this authorFan Liwen, Fan Liwen Beijing Science and Technology Information Research Center, Beijing, 100036 ChinaSearch for more papers by this authorLiu Haicheng, Liu Haicheng Beijing Science and Technology Information Research Center, Beijing, 100036 ChinaSearch for more papers by this author First published: 01 January 2021 https://doi.org/10.1049/cje.2020.11.006Citations: 1AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinkedInRedditWechat Abstract The Public key encryption scheme with keyword search (PEKS), firstly put forward by Boneh et al., can achieve the keyword searching without revealing any information of the initial data. However, the original PEKS scheme was required to construct a secure channel, which was usually expensive. Aimed at resolving this problem, Baek et al. put forward an improved scheme, which tried to construct a Secure channel free PEKS (SCF-PEKS). Subsequently, several SCF-PEKS schemes were proposed, however most of them turned out only secure in the random oracle model, which possibly lead to the construction of insecure schemes. Therefore, Fang et al. put forward an enhanced SCF-PEKS construction, which was provably secure in the standard model, however this construction needed a strong and complicated assumption. Then Yang et al. put forward an SCF-PEKS construction under simple assumption, but their construction had a big reduction in efficiency. In this article, we propose an SCF-PEKS construction, which is provably secure under the same assumption as that of Yang et al.'s scheme, however, with better performance. Then we give its full security proof, along with the performance analysis. Finally, we improve the SCF-PEKS construction to resist Keyword guessing attack (KGA) and give its security demonstration. I. Introduction 1. Background The construction of Public key encryption scheme with keyword search (PEKS)[1], as a new cryptographic primitive proposed recently, can achieve keyword search without any information revealed of the original data. In the PEKS construction, there exists three entities called "server", "sender" and "receiver". Suppose the sender Alice wants to share with the receiver Bob a message M, then Alice first encrypts the message M with the use of a standard encryption E(·) and further attaches it multiple PEKS ciphertext, namely E(M, pkB)║ PEKS(w1,pkB)║ … ║ PEKS(wn, pkB) where pkB denotes Bob's public key and w1,…, wn denotes the corresponding keywords. Note that, this kind of ciphertext is stored in the server. When Bob wants to access the data, he must provide a trapdoor Tw, corresponding to the keyword w', to the server so that it can be used to find the message M with one of the keyword w ε {w1,…, wn} equaling to the keyword w of Bob's choice. Namely, provided PEKS(w', pkB) and Tww', the server will successfully test whether w = ww' or not. The application of PEKS is very extensive, in which the representative and interesting application is intelligent email routing as explained in Ref.[1]. PEKS provides a mechanism for the email server to extract encrypted emails containing some keyword by giving a trapdoor associated with this keyword. It guarantees that the email server and other entities except Bob fail to learn anything regarding the email. 2. Related works Waters et al. demonstrated an important contrete application of PEKS[2], namely allowing the untrusted logging server to keep encrypted audit log of data which is sensitive to privacy, so that it can only be searched by those authorized auditors. Next, Golle et al. proposed a PEKS scheme[3] that allowed to conduct conjunctive keyword inquiries for those encrypted data. Then, Boneh et al. extended a PEKS scheme[4] which can support range, subset, and conjunctive comparisons for the keywords. Moreover, two following articles[5, 6] conducted the research to combine public key data encryption with the PEKS. However, these schemes have a common shortcoming, namely they are required to construct a secure channel, which is usually costly, between the user and the server. Therefore, Baek et al. considered removing the secure channel as to propose a secure channel free public key encryption scheme(SCF-PEKS)[7]. In this scheme, only the designated server (the tester) chosen by the sender can conduct the test. In 2007, Gu et al. put forward another interesting PEKS construction[8] using pairings, and in this scheme, encryption process does not involve any pairing operation. Then they further discussed to remove the secure channel, and proposed an efficient SCF-PEKS construction. Next, Rhee et al. strengthened the security model[7] by Baek et al. in which the attacker has access to the correlation between a trapdoor and non-challenge ciphertext as well[9]. However, these constructions are only provably secure in the random oracle model. As we all know, random oracle model is an ideal hypothesis, which supposes that the attacker does not use the weakness of hash function to attack the constructed scheme. However, there is no such perfect hash function. Therefore, some schemes that are proved secure in the random oracle model are no longer secure after using some real hash functions as shown in Ref.[10]. Therefore, we should spare no efforts to construct a SCF-PEKS scheme provably secure in the standard model. Fang et al. in CANS 2009 put forward a SCF-PEKS construction[11] under the standard model based on Gentry's Identity based encryption (IBE)[12]. However, this SCF-PEKS scheme used a significantly complex assumption named the Decisional q-Augmented Bilinear Diffie-Hellman Exponent (q-ABDHE). Next, Yang et al. put forward a SCF-PEKS construction[13] based on a simple assumption called Decisional Bilinear Diffie-Hellman (DBDH). However, this SCF-PEKS construction had a big reduction in the efficiency which increased the system burden. This study provides an efficient SCF-PEKS construction by modifying the Water's IBE scheme[14], which is also proved secure under the simple DBDH assumption, however, with better performance. Next, we give the computational consistency validation, full security proof and performance discussion. Finally, we improve the SCF-PEKS construction to resist the Keyword guessing attack (KGA). II. Preliminaries This part firstly introduces asymmetric bilinear maps that will be used in our paper. Next, the complexity assumption will be demonstrated for which the security proof of our scheme is based on. Finally, we give the concrete definition of a SCF-PEKS scheme as well. 1. Asymmetric bilinear maps We briefly take a view to several facts related with asymmetric bilinear groups[15]. Let G be the group parameters generation algorithm which takes an security parameter 1λ as input to output the tuple in which p represents the big prime, and denote multiplicative groups with order p, g and > are the generators of and respectively. In addition, presents the bilinear map which satisfies that 1) Bilinear: for any and , we get . 2) Non-degenerate: there exists e(g, >) having order p in ,where and . 3) Computability: for any and , we can compute in a probabilistic polynomial time (PPT) algorithm. Note that, we can construct the asymmetric bilinear maps based on the curves introduced in Ref.[16], and if , then it becomes symmetric bilinear maps. 2. The DBDH assumption Let denote the group parameters generated by algorithm G. The DBDH assumption in groups and is that provided the input tuple to determine whether . An algorithm B possesses advantage ε to solve the DBDH problem in and if Note that, the probability in the above equation is determined by the parameters a, b, c, r chosen and the random bits used by If there exists no PPT algorithm to solve it in groups and with an advantage of at least ε, we can say the DBDH assumption holds. Definition 1 This study has (t, ε) - DBDH assumption holding in groups and if there exists no adversary possessing advantage at least ε to solve the DBDH problem in time t. III. Our Proposed Scheme This section describes the specific construction of our SCF-PEKS scheme. This construction draws lessons from Water's identity-based encryption in which identities are indicated by n-length bit strings and the ciphertext takes the form as: associated with identity w where are all public parameters and is the set of index i satisfying that . However, for another identity . However, for another identity and , so that the attacker can come to a decision whether the ciphertext is associated with keyword w' or not, namely the above scheme is not recipient anonymous. In reality, the number of all possible identities is 2n meaning that we can run at most 2n test attacks to reveal the identity associated with the ciphertext. Therefore, we modify Water's scheme to achieve recipient anonymity by making use of asymmetric bilinear map, and further construct a SCF-PEKS scheme using this anonymous IBE. 1. Our construction In our construction, n-length bit strings will be used to represent identities. However, we can also extend it to support bit strings of arbitrary length by using a hash functions, H : {0,1}* , 1}n, which is collision resistant. The detailed construction of our SCF-PEKS scheme is shown as follows: GlobalSetup(1λ) The globalsetup algorithm first performs G(1λ) to obtain , where and denote the cyclic groups with order p. Next, the algorithm will choose a one-way hash function denoted as . The keyword domain is set as . The keyword domain is set as Let and denote the generators . Finally, it outputs the global parameters ***GP as KeyGenServer(***GP) The server key generation algorithm takes ***GP as input. Then it chooses an exponent q ε randomly and further computes . Next, a random element is picked uniformly at random. Finally, the server's public and key are individually set as and . KeyGenReceiver(***GP) The receiver key generation algorithm takes ***GP as input. Then it chooses random parameters , and further computes , . Finally, the public key of receiver is set to be while the private key of receiver is set to be Trapdoor The trapdoor generation algorithm takes as input the global parameters ***GP, receiver's private key skR as well as the target keyword w which is denoted as an n bit strings. Let wi be the ith bit of w, then ***W ȅ {1,…,n} denotes the set of index i satisfying that , namely W is the set of all indices for which the bit strings of w are set to 1. Next, we choose an exponent randomly as to generate the trapdoor for keyword w: The SCF-PEKS algorithm takes as input the global parameters ***GP, server's public key pkS, receiver's public key pkR as well as the search keyword w' which is also denoted as an n bit strings. Let W' denote the set of index i satisfying that . Then it chooses random exponents . Finally, it computes the SCF-PEKS ciphertext as follows: Therefore, the SCF-PEKS ciphertext is set as . Test The test algorithm takes as input the global parameters ***GP, server's private key skS, trapdoor Tw and SCF-PEKS ciphertext Cw,. It first computes , then it checks if . Correctness This part will demonstrate the correctness of our SCF-PEKS scheme proposed above. Let the ciphertext be Correctness. This part will demonstrate the correctness of our SCF-PEKS scheme proposed above. Let the ciphertext be for the search keyword w' and trapdoor be for the target keyword w. Then we have 2. Computational consistency The computational consistency of the SCF-PEKS construction proposed above is demonstrated in this part as follows. Theorem 1 The SCF-PEKS construction proposed above has the property of computational consistency Proof Suppose (w,w') is the keywords pair returned by A in the computational consistency experiment. Before the proof, we assume that without loss of generality. Note that, we know from Ref.[14] that , we have with overwhelming probability. Let and . wins the computational consistency experiment when and . Since , so the probability of A winning the computational consistency experiment under condition is: 3. Security proof The detailed security proof of our SCF-PEKS construction proposed above without the random oracle is given in this part by using two games, namely Game 1 and Game 2, as follows: Theorem 2 Our SCF-PEKS construction proposed above is (t, q, ε) IND-SCF-CKA secure assuming that the DBDH problem is intractable where . Lemma 1 Our SCF-PEKS is (t, q, ε) IND-SCF-CKA secure in Game 1 assuming the DBDH problem is intractable. Proof Assuming that there is a (t, q, ε) adversary, A, who can successfully attack the SCF-PEKS scheme proposed above in Game 1, then a simulator, B, will be constructed to break that DBDH problem with the advantage at least . B first sets groups and of order p with e as the efficient bilinear map, then it chooses generators g, > of subgroups , respectively. Next, B will take the DBDH challenge as input to separate from the random element of . Setup Suppose that A makes q trapdoor queries, and let denote the group parameters will be used, then a one-way hash function is specified. Additionally, the keyword domain is set as . Therefore, it sets the global parameters . Note that, from the perspective of A, the global parameters haave the same distribution as that of real construction. Next, B sets an integer, , and picks an integer, k, randomly between 0 and n. Then it selects a value x' as well as an n-length vector, , where the elements x' and xi are all selected between 0 and m-1 randomly. Suppose thatX* denotes the pair (x', x). In addition, B picks a value y' as well as an n-length vector, , where the elements y' and yi are all selected in . Therefore, it sets the global parameters . Note that, from the perspective of , the global parameters haave the same distribution as that of real construction. Next, sets an integer, , and picks an integer, k, randomly between 0 and n. Then it selects a value x' as well as an n-length vector, , where the elements x' and are all selected between 0 and m-1 randomly. Suppose that X* denotes the pair . In addition, picks a value y' as well as an n-length vector, , where the elements y' and are all selected in randomly. Note that, all the values are private to B. Next, sets and . In addition, B chooses a exponent randomly and computes . Then selects a random element , and further sets and as the server's public and private key individually. Additionally, the receiver's public key is set as . Finally, sends to . Again, for a keyword let denote the set of index i satisfying . Next, three functions are defined: , and a binary function K(w) as follows: Query 1 The adversary, A, will make a number of trapdoor queries to the simulator B. Suppose A makes a query for the keyword w. If , then B will abort and choose its guess β' randomly for β. Otherwise, B chooses an exponent randomly, and then constructs the trapdoor, Tw, as follows: Let . Then we have Note that, the computation can only be performed on the condition that F(w) ̸= 0 mod p. For adding ease to perform the analysis, B will merely continue on the sufficient condition where K(w) ̸= 0. Note that K(w) ̸= 0 indicates mod p. Challenge Once A determine that Query 1 is over, it will output the keywords pair (w1, w2). Then B chooses a random and sets . Next, B selects randomly and further computes . Note that if , will abort the game and output its guess for β randomly, where is the set of index i with i with . Otherwise, we can know that , and return to A the ciphertext as follows: In order to validate the correctness of generated ciphertext, we assume B is given a DBDH tuple, namely . Then we can get Therefore, we can see that the above ciphertext is a correct random encryption on keyword w*. Finally, B sets the SCF-PEKS ciphertext as an d sends C* to A. Query 2 A proceeds to make trapdoor queries just like that in Query 1. Guess A outputs the guess β', if , then it will output 1 meaning ; otherwise, A will output 0 to demonstrate Z is a random element in . Note that, if two sets of q trapdoor queries are different, it may induce the B to abort the game with different probabilities. Therefore, B is yet unable to employ the guess output of the adversary A, because A's success probability is correlated with that of B 'aborting. The detailed probability and time complexity analysis are identical to Ref.[14]. Lemma 2 Our SCF-PEKS is (t, q, ε) IND-SCF-CKA secure in Game 2 assuming the DBDH problem is intractable. Proof Assuming that there is a (t, q, ε) -adversary A, who can successfully attack the SCF-PEKS construction proposed above in Game 2, then a simulator, B, will be constructed to break the DBDH problem with the advantage at least . B first sets groups and of order p with e as the efficient bilinear map, then it chooses generators g, > of subgroups respectively. Next, B will take a DBDH challenge as input, and have to separate from a random element in . Setup Suppose that A makes q trapdoor queries, and let be the group parameters will be used, then a one-way hash function is specified. Additionally, the keyword domain is set as . Finally, it sets the global parameters . Next, B sets , and further sets the public key of the server as . Then it chooses parameters randomly and computes . Therefore, the the receiver's public key is set as while its private key is set as Finally, B sends to A. Query 3 The adversary, A, will make a number of trapdoor queries to the simulator B. Suppose A makes a query for the keyword w, because B knows the private key skR, so B chooses an exponent randomly and further sets the trapdoor as: Challenge A outputs a keywords pair . Then B chooses a random and sets . Next, it sets and computes . Additionally, a random exponent is selected, and B computes Finally, the SCF-PEKS ciphertext is set as and sent to A. Query 4 A proceeds to make a number of trapdoor queries just like that in Query 3. Guess A outputs the guess β', if , then it will output 1 meaning ; Otherwise, it will output 0 demonstrates Z is a random element in GT. Probability analysis Assuming there is a (t, q, ε) -adversary, A, who can break our scheme in Game 2. Then the probability of simulator B succeeding in Game 2 will be provided as follows. If , we can get that A satisfies . Else if Z is a random element in , we have . In addition, from the abortion result discussed in Ref.[14], we have This completes our proof. IV. Analysis In this section, some comparisons are made in Table 1 between our proposed SCF-PEKS construction and several representative results in the conventional PEKS construction of Boneh et al.[1] the SCF-PEKS construction of Baek et al.[7], the SCF-PEKS construction without random oracle of Fang et al.[11] as well as the SCF-PEKS construction without random oracle under simple assumption of Yang et al.[13]. However, only in the random oracle model, Boneh et al.'s PEKS and Baek et al.'s SCF-PEKS constructions are provably secure. As we all know, efficient cryptographic schemes can be constructed without difficulty on the conditions that the random oracle is assumed. The most important is that random oracle may lead to insecure constructions. Therefore, our emphasis is mainly on the SCF-PEKS constructions put forward by Fang et al. and Yang et al., respectively, which are both provably secure in the standard model. 1. Tightness of the reduction In the Fang et al.'s reduction of security proof, there are the same success probability and time complexity for the simulator B and the adversary A, with the exception of additive factors which depends on q. Therefore, it is fair to arrival at a conclusion that there is a tight security reduction in Fang et al.'s SCF-PEKS construction. However, its security is based on decisional q-ABDHE assumption which is not necessarily better than the loose reduction from DBDH assumption as in our security proof. Firstly, decisional q-ABDHE appears as a stronger assumption compared with DBDH. Secondly, the meaning of "a tight reduction from decision q-ABDHE" remains not apparent in that the assumption is yet not fixed as q differs, it will get stronger with the number of queries increases. Additionally, the security proof in Yang et al's SCF-PEKS construction is not given, so we do not know its tightness of the reduction. 2. Performance This part estimates the efficiency of our proposed SCF-PEKS construction. We denote by TR and CT the size of trapdoor and PEKS ciphertext excluding the keyword. Besides, TG, PG and Test are the computational costs of generating trapdoor, PEKS ciphertext and constructing the test respectively. Let and be the bit-length of an element which belongs to and respectively. Additionally, let and denote k-times computational costs of multiexponent in and , individually, BM denotes that of one bilinear map computation. λ denotes the security parameter and p denotes the order of bilinear group. We can see from Table 1 that our SCF-PEKS has almost the same performance as that of Fang et al.'s scheme. However, as is pointed above, Fang et al.'s scheme is proved secure with q-ABDEH assumption while ours is proved secure with the simple DBDH assumption. Additionally, Yang et al. also provided a SCF-PEKS scheme based on the same DBDH assumption. However, his scheme had longer trapdoor and PEKS ciphertext, bigger computational costs of generating trapdoor, PEKS ciphertext and constructing the test, so it is not feasible in practical application. Table 1. Features and efficiency comparisons SCF Without RO Assumption CT TR TG PG Test Boneh[1] No No BDH BM Baek[7] Yes No BDH Fang[11] Yes Yes DBDH, q-ABDHE Yang[13] Yes Yes DBDH Ours Yes Yes DBDH V. SCF-PEKS Scheme Against the Keyword Guessing Attack In this part, we will improve our scheme to resist the Keyword guessing attack (KGA), which means an adversary, once obtains a trapdoor, can find some guess of keywords for this trapdoor and further verify the correctness of this guess successfully by some form of testing. Here, in our scheme we consider an attacker, A, who is neither the server nor the receiver, can implement the KGA as follows: ① A obtains a trapdoor as ② A chooses a candidate keyword w'. ③ Then A checks if , where Y, u' and ui are the receiver's public key. If the equation holds, then the guessed keyword w' is valid, otherwise go to ②. Note that, the equation will hold if , i.e. To solve the KGA problem, Fang et al.[17] improved the scheme[11] to resist KGA by using the hash function[14] and combining the private key of server and receiver. In this part, we also improve our proposed scheme to resist KGA. 1. Construction The main improvement is in the receiver key generation algorithm, which is performed to generate the public/private key of receiver as follows: KeyGenReceiver The receiver key generation algorithm chooses random parameters , and computes . So the receiver's public key is set as while its private key is set as Trapdoor( The trapdoor generation algorithm is defined almost the same as that in Section III.1, so the trapdoor is set as In addition, in the Test algorithm, we first compute , then continue to check if Correctness. This part will demonstrate the correctness of our SCF-PEKS scheme proposed above resisting the KGA as follows. Computational consistency The computational consistency is almost the same as that in Section III.2. Finally, we can get , Since r, t, q ̸= 0, so the probability of winningthe computational consistency experiment under condition w ̸= w' is: 2. Security proof The security proof against IND-SCF-CKA is almost the same as that in Section III.3. The detailed proof is omitted here. Next, we mainly demonstrate the security of our scheme against the KGA. Theorem 3 Our improved SCF-PEKS scheme proposed above is secure against outside keyword guessing attack. Proof Assume that there is an attacker, A, who obtains a trapdoor . Moreover, the public parameters , the server's public key pkS and the receiver's public key pkR are all available to A. To guess the keyword associated with the trapdoor, A firstly chooses a candidate keyword w' and then continues to perform the keyword guessing attacks to conform its guess as follows. In the above equation, although the parameters are available to A, however, the exponents r, x, d and di are kept private from A, namely the parameters gxd, gxdi or cannot be computed successfully. Therefore, A cannot attack our scheme successfully by performing the KGA. VI. Discussion As we can see, in the security proof of our scheme, the adversary cannot issue any test queries adaptively (adaptive security). To solve this problem, Fang et al. also constructed the scheme[17] to achieve adaptive SCF-PEKS by using a one-time signature scheme[18]. In addition, the paper Ref.[19] proposed a generic method to construct adaptive SCF-PEKS by applying anonymous IBE only. Note that our SCF-PEKS scheme is constructed based on an implicit anonymous IBE, so we can improve our SCF-PEKS scheme to achieve adaptive security based on this anonymous IBE using the generic method of Ref.[19]. However, it is required to construct an IND-stag-CCA-secure Tag-based encryption (TBE) scheme and a digital signature scheme by using this anonymous IBE first. Accordingly, the security relies on not only the security of anonymous IBE, but also that of the TBE and signature schemes. In addition, the computation cost using this generic construction is high. Therefore, we can excellently choose to apply the similar method of Ref.[17] on our scheme for achieving the adaptive security. VII. Conclusions and Future Work We provide in this paper a SCF-PEKS construction in the standard model based on simple DBDH assumption. The computational consistency and game-based security proof are given in detail. Additionally, we improve our scheme to achieve adaptive security and resist keyword guessing attack. However, we note that in the security proof, if there is an efficient approach to compute the abortion probability other than sampling, we can bring improvement to the time component of the reduction and simplify our analysis significantly. In addition, Zhang et al. proposed a SCF scheme[20] from the lattice assumption, which can resist quantum computer attacks. Therefore, we will conduct the research on this field in our future work. Biographies WANG Guangbo (corresponding author) received the Ph.D. degree in Zhengzhou Information Science and Technology Institute. He is now an information security engineer in Beijing Science and Technology Information Research Center. His research interests include information security and cryptography. (Email: 691759571@qq.com) LI Feng received the M.S. degree in Shandong University. He is now an information security senior engineer in Beijing Science and Technology Information Research Center. His research interests include information security and cryptography. (Email: lyx_wj@sina.com) References 1R. Tso, K. Huang, Y.C. Chen, et al., "Generic construction of dual-server public key encryption with keyword search on cloud computing", IEEE Access, DOI: 10.1109/ACCESS.2020.3017745, 2020. 2B.R. WATERS, D. BALFANZ, G. DURFEE, et al., "Building an encrypted and searchable audit log", Network and Distributed System Security Symposium, NDSS 2004, San Diego, California, USA. 3P. GOLLE, J. STADDON and B.R. WATERS, "Secure conjunctive keyword search over encrypted data", Lecture Notes in Computer Science, Vol. 3089, pp. 31– 45, 2004. 4B. DAN and B.R. WATERS, "Conjunctive, subset, and range queries on encrypted data", TCC′07: Proceedings of the 4th Conference on Theory of Cryptography. pp. 535– 554, 2007. 5T. FUHR and P. PAILLIER, "Decryptable searchable encryption, ProvSec 2007, Provable Security", Springer Berlin Heidelberg, pp. 228– 236, 2007. 6R. ZHANG and H. IMAI, "Generic combination of public key encryption with keyword search and public key encryption", Cryptology and Network Security CANS 2007, Springer, Berlin, Heidelberg, pp. 159– 174, 2007. 7J. BAEK, R. SAFAVINAINI and W. SUSILO, "Public key encryption with keyword search revisited", Lecture Notes in Computer Science, Vol. 5072, pp. 1249– 1259. 8C. GU, Y. ZHU and H. PAN, "Efficient public key encryption with keyword search schemes from pairings", Information Security and Cryptology Inscrypt 2007, Springer, Berlin, Heidelberg, pp. 372– 383, 2006. 9H.S. RHEE, J.H. PARK, W. SUSILO, et al., "Improved searchable public key encryption with designated tester", Proceedings of the 2009 ACM Symposium on Information, Computer and Communications Security, ASIACCS 2009, Sydney, Australia, pp. 376– 379, 2009. 10R. CANETTI, O. GOLDREICH and S. HALEVI, "The random oracle methodology, revisited", Journal of the ACM, Vol. 51, No.4, pp. 557– 594, 2004. 11L. FANG, W. SUSILO, C. GE, et al., "A secure channel free public key encryption with keyword search scheme without random oracle", International Conference on Cryptology & Network Security, Cans, Kanazawa, Japan, 2009. 12C. GENTRY, "Practical identity-based encryption without random oracles", Advances in Cryptology, EUROCRYPT 2006, 25th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Petersburg, Russia, pp. 445– 464, 2006. 13H.M. YANG, E.W. JIN, C.Z. LIU, et al., "A SCF-PEKS scheme without random oracle under simple assumption", 2011 International Conference on Instrumentation, Measurement, Computer, Communication and Control, Washington, USA, pp. 905– 908, 2011. 14B.R. WATERS, "Efficient identity-based encryption without random oracles", 24th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Aarhus, Denmark, pp. 114– 127, 2005. 15E. Ghadafi, "Further lower bounds for structure-preserving signatures in asymmetric bilinear groups", Progress in Cryptology-AFRICACRYPT 2019, LNCS, Vol. 11627, pp. 409– 428. 16P. S. L. M. BARRETO and M. NAEHRIG, Pairing-Friendly Elliptic Curves of Prime Order, Selected Areas in Cryptography, Springer, Berlin, Heidelberg, pp. 319– 331, 2005. 17L.M. FANG, W. SUSILO, C. GE, et al., "Public key encryption with keyword search secure against keyword guessing attacks without random oracle", Information Sciences An International Journal, Vol. 238, No.7, pp. 221– 241, 2013. 18F. Shahid, I. Ahmad, M. Imran, et al., "Novel one time Signatures (NOTS): A compact post-quantum digital signature scheme", IEEE Access, DOI:10.1109/ACCESS.2020.2966259, 2020. 19K. EMURA, A. MIYAJI, M.S. RAHMAN, et al., "Generic constructions of secure-channel free searchable encryption with adaptive security", Security & Communication Networks, Vol. 8, No.1, pp. 181– 189, 2015. 20XIAOJUN Z, CHUNXIANG X, RUN X, et al., "Designated cloud server public key encryption with keyword search from lattice in the standard model", Chinese Journal of Electronics, Vol. 27, No.2, pp. 304– 309, 2018. Citing Literature Volume30, Issue1Special Issue: DATA-DRIVEN INDUSTRIAL INTELLIGENCEJanuary 2021Pages 77-84 ReferencesRelatedInformation