%-------------------------
% Mid-Semester Report in LaTeX
% Based on the structure provided
%------------------------

\documentclass[letterpaper,11pt]{article}

\usepackage{graphicx}
\usepackage{amsmath}
\usepackage{latexsym}
\usepackage[empty]{fullpage}
\usepackage{titlesec}
\usepackage{fancyhdr}
\usepackage[english]{babel}
\usepackage{tabularx}
\usepackage{titlesec}
\usepackage{multicol}
\usepackage{geometry}
\geometry{margin=1in}
\usepackage{ragged2e}
\usepackage{enumitem}
\usepackage{listings}

% Use this hyperref configuration to hide the boxes
\usepackage[hidelinks]{hyperref}

\pagestyle{fancy}
\fancyhf{} % clear all header and footer fields
\fancyfoot{}
\renewcommand{\headrulewidth}{0pt}
\renewcommand{\footrulewidth}{0pt}

\titleformat{\section}{\large\bfseries}{\thesection}{1em}{}
\titleformat{\subsection}{\normalsize\bfseries}{\thesubsection}{1em}{}
\titleformat{\subsubsection}{\normalsize\itshape}{\thesubsubsection}{1em}{}

\begin{document}


%-------------------------
% Title Page
\begin{titlepage}
    \vfill
    \begin{center}
       {\LARGE \textbf{Encrypted Cloud Storage and Symmetric Searchable Encryption}} \\[2 em]
        
        \text{Project Report Submitted}\\

         \text{in partial fulfillment of the requirements for the award of the}\\[2 em]
       
        {\Large \textbf{Bachelor of Technology }}\\[0.5em]
        
                
        \textit{by} \\[1em]
        
        {\textbf{Ankit Saha (B421007)}} \\ [1em]
        
        {\textbf{Tusar Kumar Nayak (B421065)}} \\ [1em]

         {\textbf{Yash Raj Singh (B421066)}} \\ [1em]
        
        \textit{Under the supervision of} \\[1em]
        
        \textbf{Dr. Bharati Mishra} \\[2em]
        \vfill
        
        \includegraphics[width=2in]{assets/iiit-bbsr-removebg.png} \\[1em]
        
        Department of Information Technology \\
        International Institute of Information Technology, Bhubaneswar \\[1em]
        May, 2025
    \end{center}
    \vfill
\end{titlepage}

%-------------------------
% Approval Page
%-------------------------
\newpage
\begin{titlepage}
    \begin{center}
        \vspace*{2cm}
        {\Large \textbf{APPROVAL OF THE VIVA-VOCE BOARD}} \\[0.5em]
        \vspace{0.5cm}
        \textbf{May 19th, 2025} \\ % Replace with actual date if needed
        \vspace{2cm}
        
        \begin{minipage}{0.9\textwidth}
            \justifying
            Certified that the report entitled \textbf{\textit{“Encrypted Cloud Storage and Symmetric Searchable Encryption”}} submitted by \textbf{Ankit Saha (B421007), Tusar Kumar Nayak (B421065) \& Yash Raj Singh (B421066)} to International Institute of Information Technology Bhubaneswar in partial fulfillment of the requirements for the award of the Bachelor of Technology in Information Technology under the BTech Programme has been accepted by the examiners during the viva-voce examination held today.
        \end{minipage}
        
        \vfill
        
        % Panel Signatures
        \begin{tabular}{p{0.4\textwidth} p{0.4\textwidth}}
            \makebox[0.4\textwidth]{(Panel Supervisor)} & \makebox[0.4\textwidth]{(Panel Member 1)} \\[3em] % Creates space for signatures
            \makebox[0.4\textwidth]{(Panel Member 2)} & \makebox[0.4\textwidth]{(Panel Member 3)} \\
        \end{tabular}
    \end{center}
\end{titlepage}

% -------------------------
% Certificate Page
% -------------------------
\newpage
\begin{titlepage}
   \begin{center}
      \vspace*{2cm}
       {\Large \textbf{CERTIFICATE}} \\[1em]
      \vspace{2cm}
        
       \begin{minipage}{0.9\textwidth}
          \justifying
           This is to certify that the report entitled \textbf{\textit{Encrypted Cloud Storage and Symmetric Searchable Encryption”}} submitted by \textbf{Ankit Saha(B421007),Tusar Kumar Nayak(B421065),Yash Raj Singh(B421066)} to International Institute of Information Technology Bhubaneswar is a record of \textbf{bonafide} project work under my supervision, and the report is submitted for end-semester evaluation of the BTech Degree project work.
       \end{minipage}
        
        \begin{flushleft}
           \vspace{3em}
           \textbf{(Supervisor)}
        \end{flushleft}
    \end{center}
\end{titlepage}

%-------------------------
% Declaration Page
%-------------------------
\newpage
\begin{titlepage}
    \begin{center}
        \vspace*{2cm}
        {\Large \textbf{DECLARATION}} \\[1em]
    \end{center}
    
    \vspace{1cm}
    
    \noindent
    \textit{I certify that}
    
    \vspace{0.5cm}
    
    \begin{enumerate}
        \item The work contained in the project report has been done by my group under the general supervision of my supervisor Dr. Bharati Mishra.
        
        \item The work has not been submitted to any other Institute for any degree or diploma.
        
        \item I have followed the guidelines provided by the Institute in writing the report.
        
        \item I have conformed to the norms and guidelines given in the Ethical Code of Conduct of the Institute.
        
        \item Whenever I have used materials (data, theoretical analysis, and text) from other sources, I have given due credit to them by citing them in the text of the report and giving their details in the references.
        
        \item Whenever I have quoted written materials from other sources, I have put them under quotation marks and given due credit to the sources by citing them and giving required details in the references.
    \end{enumerate}

    \vfill
    
    \begin{flushright}
    \textbf{Ankit Saha - B421007} \\
    \textbf{Tusar Kumar Nayak - B421065} \\
    \textbf{Yash Raj Singh - B421066} \\
\end{flushright}

\end{titlepage}


%-------------------------
% Abstract Page
%-------------------------
% Abstract Page

\newpage
\begin{titlepage}
    \vfill
    \begin{center}
        \vspace*{4cm} % Adjust this value to control the vertical position
        {\Large \textbf{Abstract}} \\[1em]
        
        \begin{minipage}{1\textwidth}
            \justifying
            The rapid adoption of cloud storage provides scalable and accessible data management solutions, yet it introduces critical security concerns surrounding data confidentiality and privacy. Traditional encryption methods secure data at rest but hinder searchable functionalities, making it challenging for users to efficiently locate relevant encrypted files without decrypting the entire dataset. This project aims to address these challenges by developing an encrypted cloud storage system integrated with Symmetric Searchable Encryption (SSE), enabling secure keyword searches over encrypted data. The system leverages AES encryption for file confidentiality and a custom SSE scheme based on cryptographic hashing and Fernet symmetric encryption to index searchable keywords within encrypted documents.
\vspace{1em}
The implemented web platform, built with the Flask framework, supports secure user authentication with distinct roles for admin and regular users. Admin users can upload and encrypt files, while all authenticated users can perform keyword searches and decrypt authorized documents seamlessly. This approach ensures data security, user privacy, and efficient search capabilities without exposing plaintext to the storage server or other users. The project demonstrates a practical balance between security and usability, contributing to advancing secure cloud storage technologies with dynamic encrypted search functionalities.

%\begin{center}
    %\includegraphics[width=300px]{assets/Searchable-encryption-model.png} % Replace with actual image file
%\end{center}

%\begin{center}
%\textbf{Figure 1:} Searchable Encryption Model \textbf{[2]}
%\end{center}

        \end{minipage}
    \end{center}
    \vfill
\end{titlepage}




%-------------------------
% Table of Contents
\newpage
\tableofcontents





%-------------------------
% Section: Introduction
\newpage
\section{Introduction}
\justify
In the modern digital era, cloud storage has become an indispensable component for individuals and organizations to store, manage, and share data conveniently and cost-effectively. Cloud services offer scalable storage infrastructure accessible from anywhere, enabling efficient collaboration and data availability. However, entrusting sensitive data to third-party cloud providers raises significant concerns related to data confidentiality, privacy, and unauthorized access. Despite encryption being a standard solution to protect stored data, it limits the ability to perform direct searches on the encrypted information, which hampers usability and efficiency.
\justify
Traditional encryption mechanisms, such as Advanced Encryption Standard (AES), provide robust confidentiality by securely transforming plaintext into cipher text. While these methods safeguard data against external threats, they make it infeasible to conduct keyword searches or queries without first decrypting the entire dataset, leading to performance bottlenecks and potential exposure risks if decryption takes place on the server side. This trade-off between security and convenience highlights the need for more advanced cryptographic techniques that can reconcile both objectives effectively.
\justify
Searchable encryption has emerged as a promising cryptographic paradigm that enables the capability to search over encrypted data without exposing the plaintext or the encryption keys to the server. Symmetric Searchable Encryption (SSE), a practical class within these schemes, uses symmetric keys for both encryption and searching, allowing efficient and secure keyword matching on the ciphertext. SSE schemes aim to provide data owners with the ability to query their encrypted files remotely, ensuring the confidentiality of both data and search queries.
\justify
This project implements an encrypted cloud storage system enriched with SSE functionality. The system utilizes AES for encrypting file contents and introduces a custom SSE mechanism leveraging cryptographic hash functions and Fernet symmetric encryption to build an encrypted searchable index. Users can upload and store files securely in encrypted form, while the SSE module enables keyword-based search and retrieval without revealing the underlying plaintext. The system also incorporates role-based authentication, distinguishing admins who manage files and users who perform authorized search and decryption.
\justify
This project implements an encrypted cloud storage system enriched with SSE functionality. The system utilizes AES for encrypting file contents and introduces a custom SSE mechanism leveraging cryptographic hash functions and Fernet symmetric encryption to build an encrypted searchable index. Users can upload and store files securely in encrypted form, while the SSE module enables keyword-based search and retrieval without revealing the underlying plaintext. The system also incorporates role-based authentication, distinguishing admins who manage files and users who perform authorized search and decryption.
\justify
Furthermore, the application incorporates a user-friendly web interface built using the Flask framework, facilitating seamless interaction between the users and the underlying cryptographic processes. The platform implements secure user authentication and role-based access control, ensuring that only authorized individuals can upload, encrypt, search, or decrypt files based on their privileges. By combining robust cryptographic techniques with an intuitive web application, this project demonstrates a practical approach to secure cloud storage that addresses both security requirements and usability challenges. The integration of these features highlights the potential for real-world deployment scenarios where sensitive information must remain confidential, yet searchable, in cloud environments.



\newpage
\section{Literature Survey/Feasibility Study}
\justify
With the exponential growth of cloud computing and storage services, many individuals and organizations increasingly rely on third-party cloud providers to store their sensitive data. While cloud storage offers immense benefits such as scalability, availability, and cost reduction, these advantages come with inherent security concerns related to data confidentiality, privacy, and unauthorized access. Traditional encryption mechanisms provide strong security guarantees by transforming data into ciphertext, thus preventing unauthorized users—including cloud providers—from accessing plaintext data. However, these classical encryption techniques also pose significant limitations, especially in enabling efficient and privacy-preserving data search or query functionalities directly on encrypted data. This limitation has motivated extensive research in cryptographic methods that maintain data confidentiality while allowing selective, secure search operations, leading to the development of searchable encryption schemes.

\subsection{Data Security and Searchability Challenges in Cloud Storage}
\justify
Maintaining data confidentiality is paramount when storing sensitive files on the cloud. Symmetric encryption algorithms such as the Advanced Encryption Standard (AES) have been widely adopted due to their balance of security and computational efficiency. AES ensures robust confidentiality, but the encrypted files are essentially opaque, making direct content-based search impossible without complete decryption. Naively decrypting all files to perform keyword searches is computationally expensive, inefficient, and risks exposing plaintext data to the cloud service or other unintended parties.
\justify
To address the gap between security and usability, searchable encryption techniques were introduced by Song et al. (2000) and have evolved over the past two decades. Searchable encryption allows users to perform keyword search on encrypted data stored remotely, without revealing plaintext content to storage providers. These methods ensure that the cloud server can search encrypted indices or trapdoors and return encrypted documents matching search queries, thus preserving confidentiality. Among them, Symmetric Searchable Encryption (SSE) utilizes symmetric keys shared between the data owner and user to enable fast and secure search operations, often suited for scenarios where the data owner is also the searcher.
\justify
Despite its promising advantages, SSE introduces challenges such as potential information leakage through access patterns, search patterns, or keyword frequencies. Researchers have focused on reducing such leakages via leakage-resilient schemes and protocols combined with Oblivious RAM (ORAM) technologies. However, these approaches often introduce computational and implementation complexities, making simple SSE schemes attractive for practical deployments when carefully designed.

\subsection{Cryptographic Foundations: Encryption and Searchable Encryption}
\justify
AES remains the cornerstone for encryption of stored files, offering 128, 192, or 256-bit key lengths with strong security assurances. The mode of operation, such as Cipher Block Chaining (CBC), introduces randomness via an initialization vector (IV) to prevent ciphertext pattern exposure. Key derivation using hash functions like SHA-256 ensures that user-provided passphrases can be securely converted into fixed-length cryptographic keys, preventing weak key usage.
\justify
For searchable encryption, cryptographic hash functions such as SHA-256 enable the creation of reversible, deterministic keyword representations called tokens or hashed keywords. These tokens index encrypted documents without revealing the original keywords, facilitating search operations while protecting against direct keyword exposure. Symmetric schemes frequently employ authenticated encryption algorithms like Fernet, which use AES-based encryption with message authentication codes (MAC) to ensure both confidentiality and data integrity within the encryption process.
\justify
Recent implementations demonstrate that combining AES-based file encryption with lightweight SSE schemes based on keyword hashing and encrypted indices can achieve practical, efficient, and secure encrypted search for moderate data sizes. The in-memory keyword-to-document lookup tables provide fast retrievals, though scalability may require extending to persistent or distributed index storage.

\subsection{Web Technologies and Framework Support for Secure Implementation}
\justify
The advent of mature cryptographic libraries in high-level languages amplifies the feasibility of developing secure encrypted storage systems with integrated searchable encryption. Python's \texttt{PyCryptodome} and \texttt{cryptography} libraries provide robust, well-vetted implementations of AES, Fernet, and secure hashing algorithms, reducing the probability of cryptographic implementation bugs and vulnerabilities.
\justify
Concurrently, Flask, a lightweight and flexible Python web framework, offers an excellent platform for building secure and interactive web applications that support user authentication, session management, and role-based access control. Together with SQLAlchemy as an Object-Relational Mapping (ORM) tool and SQLite as a lightweight database, they allow developers to rapidly prototype full-featured encrypted cloud storage solutions that are both secure and user-friendly.
\justify
Role-based access—distinguishing between administrators who can upload and encrypt files and normal users who perform searches and decrypt permitted documents—adds an additional layer of security and operational control. With these modern toolchains, implementing encrypted cloud storage with SSE is not only theoretically sound but also practically achievable within the scope of an academic or small-scale production environment.

\subsection{Feasibility and Challenges for Real-World Deployment}
\justify
While this project leverages proven cryptographic primitives and frameworks, real-world deployment of encrypted searchable cloud storage faces multiple challenges:

\begin{itemize}
    \item \textbf{Scalability:} In-memory SSE index structures might become infeasible as data size grows, necessitating more complex persistent or distributed indexing systems.
    \item \textbf{Leakage Risk:} SSE may leak search and access patterns unless augmented with additional protocols like ORAM or Oblivious Keyword Search, increasing complexity.
    \item \textbf{Key Management:} Secure distribution and storage of encryption keys, especially in multi-user environments, is non-trivial without exposing keys to the cloud.
    \item \textbf{Performance Overhead:} Encryption, decryption, and index maintenance introduce latency and computational load; optimizing these for large-scale usage is important.
\end{itemize}

Despite these concerns, the convergence of cryptographic advances, readily available libraries, and modern web technologies suggest that building secure, searchable encrypted cloud storage systems is feasible. This project, by combining AES encryption, SSE indexing with Fernet, and Flask-based role management, demonstrates a functional prototype that balances security and usability, providing a solid foundation for further research, optimization, and extension.

\subsection{Performance and Usability Considerations in Encrypted Search Systems}
\justify
Implementing encrypted search functionality introduces inherent trade-offs between security, performance, and usability that must be carefully balanced for practical adoption. While encryption and searchable encryption schemes secure data confidentiality and search privacy, they also introduce computational overhead that can adversely impact user experience, especially for large-scale data and frequent queries.
\justify
Performance considerations include the computational cost of encrypting and decrypting large files, maintaining and updating searchable indices, and executing search queries over encrypted data. Symmetric key encryption algorithms like AES generally offer high throughput and low latency compared to asymmetric alternatives, making them suitable for real-time applications. However, the efficiency of keyword search operations depends heavily on the design of the underlying searchable encryption scheme. For instance, simple keyword hashing and index lookups provide fast performance but may expose metadata such as access and search patterns, leading to privacy concerns.
\justify
User experience is also influenced by system responsiveness and the intuitiveness of the interface. Web-based platforms leveraging frameworks like Flask enable the creation of user-friendly interfaces that abstract complex cryptographic operations into simple actions such as file upload, keyword input, and result display. Role-based access control further enhances usability by tailoring functionality based on user privileges, reducing errors and preventing unauthorized actions.
\justify
Moreover, scalability remains a major factor that affects usability in practical deployments. As the volume of stored data grows, maintaining efficient searchable encryption indices demands the use of persistent storage solutions and optimized data structures, which may introduce synchronization complexities and longer response times. Strategies such as incremental indexing, caching frequently accessed results, and parallel processing can alleviate these issues but require sophisticated engineering efforts.
\justify
In summary, designing an encrypted searchable storage system necessitates striking a careful balance between stringent security goals and practical operational needs. By leveraging efficient symmetric encryption, lightweight indexing methods, and accessible web technologies, it is possible to achieve an effective compromise, providing secure data confidentiality alongside acceptable performance and ease of use in cloud storage applications.

%-------------------------
% Section: Problem Statement and Solution Approach
\section{Problem Statement}

With the exponential increase in digital data generation and reliance on cloud storage services, ensuring the confidentiality and efficient accessibility of sensitive information has become a paramount concern. While cloud storage offers scalable and flexible data management solutions, entrusting encrypted data to third-party providers introduces risks including unauthorized access, insider threats, and privacy breaches. Conventional encryption techniques like AES effectively secure data but severely limit functionalities such as keyword search and indexing, forcing users to decrypt entire files even to retrieve specific information. This inefficiency results in increased bandwidth consumption, latency, and potential exposure of sensitive data during processing.
\justify
A significant challenge in encrypted cloud storage lies in enabling secure and efficient search capabilities over encrypted datasets without compromising data privacy. Existing methods often require users to download and decrypt vast amounts of data to locate relevant information, which is impractical for large-scale systems. Searchable encryption techniques, particularly Symmetric Searchable Encryption (SSE), offer a promising solution by facilitating keyword-based searches directly on encrypted data. However, practical deployment of SSE faces limitations related to search efficiency, index scalability, protection against keyword and access pattern leakage, and seamless integration with existing cloud storage infrastructures.
\justify
Furthermore, secure cloud storage systems must incorporate robust user authentication and access control mechanisms to prevent unauthorized file access, while supporting differentiated roles such as administrators who manage encrypted content and users who consume search and retrieval services. Key management becomes increasingly complex in multi-user environments, where secure distribution, storage, and revocation of encryption keys are critical to maintaining data confidentiality. Additionally, real-world systems must contend with the overhead introduced by encryption, decryption, and searchable index maintenance, potentially degrading system performance and user experience.
\justify
This project addresses these challenges by designing and implementing an encrypted cloud storage platform with integrated symmetric searchable encryption. The system leverages strong AES encryption for file confidentiality and a hash-based SSE scheme utilizing authenticated symmetric encryption (Fernet) to build an encrypted searchable index. Administrators can securely upload and encrypt files, while authorized users perform privacy-preserving keyword searches without decrypting all data. The architecture focuses on balancing data security, search efficiency, and usability, offering a prototype that demonstrates the feasibility of such a framework in a web-based environment.
\justify
In summary, the main problems tackled by this project include: (1) enabling efficient and secure keyword search over encrypted files stored on the cloud; (2) integrating strong encryption with effective user role management and access control; (3) minimizing privacy leakage from search and access patterns; and (4) delivering practical performance suitable for user-friendly cloud storage applications. Addressing these issues will contribute toward more secure, searchable, and usable cloud storage systems capable of serving sensitive data domains like healthcare, finance, and enterprise document management.
\justify
Additionally, in typical cloud environments, the server is considered honest-but-curious, meaning it follows protocols but attempts to glean information from stored data or user queries. This threat model requires that searchable encryption mechanisms not only protect the confidentiality of the documents but also minimize leakage of search patterns, access patterns, or keyword frequencies that could be exploited by attackers to infer sensitive information. Designing an SSE scheme that provides strong privacy guarantees while maintaining acceptable search performance remains an open research challenge, especially when integrated into practical web applications.
\justify
Moreover, the deployment of secure encrypted storage with searchable encryption must also consider usability and system scalability. Real-world applications demand intuitive user interfaces for uploading, encrypting, searching, and decrypting data securely, without requiring users to understand complex cryptographic processes. At the same time, the underlying system should efficiently handle multiple concurrent users, support management of numerous encrypted documents, and persist encrypted search indices securely. Balancing these requirements demands careful architectural decisions, optimized cryptographic implementations, and thoughtful user access policies to build a secure and practical cloud storage solution.

% \begin{center}
%     \includegraphics[width=450px]{assets/Attacks on searchable encryption.jpg} % Replace with actual image file
% \end{center}

% \begin{center}
% \textbf{Figure 3:} Attacks On Searchable Encryption \textbf{[1]}
% \end{center}
\section{Solution Approach}

The proposed system integrates \textbf{encrypted cloud storage} with \textbf{symmetric searchable encryption (SSE)} to provide secure file storage along with efficient and private keyword search capabilities. The design ensures that files are \textbf{encrypted using AES} and searchable keywords are \textbf{indexed securely} without exposing document contents or search terms.

\subsection{System Architecture}
\begin{itemize}
    \item \textbf{User Authentication Module:}
    \begin{itemize}
        \item Manages login, logout, and role-based access control (admin vs user).
        \item Ensures only authorized users can upload, search, or decrypt files.
    \end{itemize}
    \item \textbf{File Encryption Module:}
    \begin{itemize}
        \item Uses AES-256 in CBC mode for strong symmetric encryption of uploaded files.
        \item Applies secure padding, random IV generation, and base64 encoding.
    \end{itemize}
    \item \textbf{Searchable Encryption Module:}
    \begin{itemize}
        \item Implements a hash-based SSE scheme to build keyword indices.
        \item Encrypts documents using Fernet symmetric encryption and indexes keywords by their SHA-256 hashes.
        \item Supports privacy-preserving keyword search over encrypted indices.
    \end{itemize}
    \item \textbf{Web Interface Module:}
    \begin{itemize}
        \item Provides HTML templates to facilitate file upload, encrypted storage, search input, and results presentation.
        \item Handles encrypted file download and decryption for authorized users.
    \end{itemize}
\end{itemize}

\begin{center}
    \includegraphics[width=300px]{assets/system_architecture.png} % Replace with your actual image file
\end{center}

\begin{center}
\textbf{Figure 1:} System Architecture Diagram 
\end{center}

\subsection{Data Flow}
\begin{itemize}
    \item \textbf{User Login:} User authenticates and is assigned session with role-based privileges.
    \item \textbf{File Upload and Encryption:} Admin uploads a file, which is encrypted using AES and saved securely.
    \item \textbf{Keyword Extraction and Indexing:} Text content is processed; unique keywords are hashed and stored in an encrypted index mapping keywords to documents.
    \item \textbf{Search Query Submission:} Any user submits a search keyword, which is hashed and queried against the SSE index.
    \item \textbf{Result Retrieval and Decryption:} Matching encrypted files are retrieved, decrypted by the user, and displayed.
\end{itemize}

\begin{center}
    \includegraphics[width=300px]{assets/data_flow.png} % Replace with your actual image file
\end{center}

\begin{center}
\textbf{Figure 2:} Data Flow Diagram
\end{center}

\subsection{Index Structure}
The searchable index maintains a privacy-preserving mapping optimized for efficient retrieval:
\begin{itemize}
    \item \textbf{Hashed Keywords:} SHA-256 used to hash keywords into fixed-length tokens.
    \item \textbf{In-Memory Dictionary:} Maps hashed keywords to sets of encrypted document identifiers.
    \item \textbf{Encrypted Document Storage:} Complete documents encrypted with Fernet cipher.
\end{itemize}

\begin{center}
    \includegraphics[width=250px]{assets/index_structure.png} % Replace with your actual image file
\end{center}

\begin{center}
\textbf{Figure 3:} Index Structure
\end{center}

\subsection{Encryption Scheme}
The system employs symmetric cryptographic techniques to achieve confidentiality with manageable overhead:
\begin{itemize}
    \item \textbf{AES-CBC:} Strong encryption for file contents using AES with CBC mode and random IVs.
    \item \textbf{Key Derivation:} AES keys derived securely from passphrases via SHA-256 hashing.
    \item \textbf{Fernet Encryption:} Used in SSE module to encrypt document contents with built-in authentication.
\end{itemize}

\begin{center}
    \includegraphics[width=300px]{assets/encryption_process.png} % Replace with your actual image file
\end{center}

\begin{center}
\textbf{Figure 4:} Encryption Process
\end{center}

\subsection{Search Protocol}
The system executes a secure and private keyword search in the following steps:
\begin{enumerate}
    \item \textbf{Keyword Submission:} User inputs plaintext keyword for search.
    \item \textbf{Keyword Hashing:} Keyword is hashed securely using SHA-256 to produce a search token.
    \item \textbf{Index Lookup:} The system queries the SSE index with the hashed token to retrieve matching encrypted document IDs.
    \item \textbf{Document Decryption:} Retrieved encrypted documents are decrypted with the symmetric key for user access.
    \item \textbf{Result Display:} Decrypted file contents are presented to the user.
\end{enumerate}

\subsection{User Management and Access Control}
\justify
The system incorporates a role-based access control mechanism distinguishing between administrators and regular users. Administrators have the privilege to upload and encrypt new files, manage users, and oversee the encrypted file index. Regular users are restricted to searching and decrypting only the files they have permission to access. User credentials are securely stored with hashed passwords, and session management ensures authenticated access throughout the interaction with the system. This separation of roles enforces security policies and prevents unauthorized actions.

\subsection{Key Management Strategy}
\justify
Effective key management is vital to maintaining confidentiality in the encrypted cloud storage system. The AES encryption key is derived from a strong passphrase using SHA-256 hashing, ensuring a consistent and secure key across sessions. Keys are never stored in plaintext but are computed at runtime from user credentials or system passphrases. Future enhancements may include per-user keys or hierarchical key management to support multi-user environments with fine-grained access control without sacrificing ease of use or security.

\subsection{Security Considerations and Threat Model}
\justify
The system is designed assuming an honest-but-curious cloud storage environment where the server correctly follows protocols but may attempt to glean information from stored data or search queries. By encrypting all files and indexes, and hashing keywords for search, the system prevents exposure of plaintext files and keywords to the server. Nevertheless, certain leakage from search and access patterns is possible in this simple SSE scheme. Future work could address this through leakage-resilient protocols or Oblivious RAM techniques. Additionally, secure communication via HTTPS and robust user authentication protect against network-level attacks.

\subsection{Scalability and Performance Optimization}
\justify
The current system uses in-memory indices for keyword-to-document mappings, suitable for small to medium datasets. To scale to larger datasets, persistent storage of encrypted indices is necessary, along with optimized data structures and caching mechanisms. Encrypting and decrypting files incurs computational overhead; thus, asynchronous processing and indexing can improve system responsiveness. Performance monitoring and profiling guide future optimizations, balancing security with user experience.

\subsection{System Deployment and Environment}
\justify
The solution is implemented using the Flask web framework running on a local or cloud-based server. SQLite provides a lightweight database backend for user and session management, while the file system stores encrypted files. All cryptographic operations rely on widely accepted libraries for robust security. Deployment can be containerized using Docker for ease of scalability and environment consistency. Future deployment plans include cloud platform integration and load balancing to support multiple users concurrently.
%-------------------------
% Section: Results and Discussion
% \newpage
\section{Algorithms}

\subsection{Index Construction Algorithm}
\begin{lstlisting}[language=Python, caption=Secure Index Construction Algorithm]
def build_secure_index(documents, encryption_engine):
    """
    Constructs a secure searchable index from a collection of documents.
    
    Parameters:
    documents (dict): {doc_id: plaintext_content}
    encryption_engine (SearchableEncryption): SSE engine instance
    
    Returns:
    dict: Updated encrypted index mapping hashed keywords to document IDs
    """
    secure_index = {}
    for doc_id, content in documents.items():
        # Encrypt the document content using SSE engine
        encryption_engine.encrypt(doc_id, content)
        
        # Extract unique keywords (e.g., split by whitespace)
        keywords = set(content.lower().split())
        
        # For each keyword, hash and update the index
        for kw in keywords:
            hashed_kw = encryption_engine._hash(kw)
            if hashed_kw not in secure_index:
                secure_index[hashed_kw] = set()
            secure_index[hashed_kw].add(doc_id)
    return secure_index
\end{lstlisting}

\subsection{Search Algorithm}
\begin{lstlisting}[language=Python, caption=Secure Search Algorithm]
def search_encrypted_data(keyword, encryption_engine, secure_index):
    """
    Searches encrypted documents for a given keyword using SSE index.
    
    Parameters:
    keyword (str): Search keyword plaintext
    encryption_engine (SearchableEncryption): SSE engine instance
    secure_index (dict): Hashed keyword to document ID mapping
    
    Returns:
    dict: {doc_id: decrypted_text} matching the keyword
    """
    # Hash the search keyword
    hashed_kw = encryption_engine._hash(keyword.lower())
    
    # Get documents matching the hashed keyword
    docs = secure_index.get(hashed_kw, set())
    
    results = {}
    for doc_id in docs:
        # Decrypt the document using SSE engine
        decrypted_text = encryption_engine.cipher.decrypt(encryption_engine.encrypted_data[doc_id]).decode()
        results[doc_id] = decrypted_text
    return results
\end{lstlisting}

\subsection{File Encryption Algorithm}
\begin{lstlisting}[language=Python, caption=File Encryption with AES]
def encrypt_file_contents(plaintext_content, aes_key):
    """
    Encrypts file content using AES encryption in CBC mode.
    
    Parameters:
    plaintext_content (str): The content to encrypt
    aes_key (bytes): AES symmetric key
    
    Returns:
    bytes: Base64-encoded ciphertext
    """
    # Pad the plaintext to block size
    padded_text = pad_(plaintext_content)
    
    # Generate random IV
    iv = Random.new().read(AES.block_size)
    
    # Create AES cipher and encrypt
    cipher = AES.new(aes_key, AES.MODE_CBC, iv)
    encrypted = cipher.encrypt(padded_text.encode())
    
    # Base64 encode IV + ciphertext
    return base64.b64encode(iv + encrypted)
\end{lstlisting}

\subsection{File Decryption Algorithm}
\begin{lstlisting}[language=Python, caption=File Decryption with AES]
def decrypt_file_contents(ciphertext, aes_key):
    """
    Decrypts AES encrypted content.
    
    Parameters:
    ciphertext (bytes): Base64 encoded AES ciphertext
    aes_key (bytes): AES symmetric key
    
    Returns:
    str: Decrypted plaintext content
    """
    data = base64.b64decode(ciphertext)
    iv = data[:AES.block_size]
    cipher = AES.new(aes_key, AES.MODE_CBC, iv)
    decrypted = cipher.decrypt(data[AES.block_size:])
    
    # Remove padding and return decoded text
    return unpad_(decrypted).decode('utf-8')
\end{lstlisting}
\subsection{Keyword Extraction Algorithm}
\begin{lstlisting}[language=Python, caption=Keyword Extraction from Document]
def extract_keywords(text):
    """
    Extract meaningful keywords from document text.
    
    Parameters:
    text (str): Plaintext document content.
    
    Returns:
    set: Set of normalized keywords extracted from the text.
    """
    tokens = text.lower().split()  # Simple tokenization
    # Optional: remove stopwords, apply stemming here
    
    keywords = set(tokens)
    return keywords
\end{lstlisting}

\subsection{User Role Verification Algorithm}
\begin{lstlisting}[language=Python, caption=User Role Verification]
def verify_user_role(user, required_role):
    """
    Verify if the user has the required role and is active.
    
    Parameters:
    user (User): User object with role and active attributes.
    required_role (str): Role to be verified, e.g., 'admin'.
    
    Returns:
    bool: True if user has required role and active, otherwise False.
    """
    return user.role == required_role and user.is_active()
\end{lstlisting}

\subsection{File Upload and Validation Algorithm}
\begin{lstlisting}[language=Python, caption=File Upload Validation and Reading]
def validate_and_read_file(file):
    """
    Validates uploaded file and reads contents as UTF-8 text.
    
    Parameters:
    file (FileStorage): Uploaded file object.
    
    Returns:
    str: File content as string.
    
    Raises:
    ValueError: If file type unsupported or decode fails.
    """
    if not file.filename.endswith('.txt'):
        raise ValueError("Unsupported file type")
    
    content = file.read()
    try:
        return content.decode('utf-8')
    except UnicodeDecodeError:
        raise ValueError("File encoding unsupported")
\end{lstlisting}

\subsection{Session Timeout Enforcement Algorithm}
\begin{lstlisting}[language=Python, caption=Session Timeout Enforcement]
def enforce_session_timeout(session, max_inactive_seconds=1800):
    """
    Enforces session timeout after inactivity.
    
    Parameters:
    session (dict): Session object storing last active time.
    max_inactive_seconds (int): Maximum allowed inactivity in seconds.
    
    Returns:
    bool: True if session still active; False if timed out and logged out.
    """
    last_active = session.get('last_active_time')
    current_time = time.time()
    
    if last_active is None:
        session['last_active_time'] = current_time
        return True
    
    if current_time - last_active > max_inactive_seconds:
        logout_user()
        return False
    
    session['last_active_time'] = current_time
    return True
\end{lstlisting}

\subsection{Error Logging Algorithm}
\begin{lstlisting}[language=Python, caption=Secure Error Logging]
def log_error(e):
    """
    Logs errors securely with timestamp for auditing.
    
    Parameters:
    e (Exception): Exception instance to be logged.
    """
    import logging
    logging.error(f"[{time.strftime('%Y-%m-%d %H:%M:%S')}] ERROR: {str(e)}")
\end{lstlisting}


\section{Implementation Details}

\subsection{Development Environment}
\begin{itemize}
    \item Programming Language: Python 3.8+
    \item Frameworks/Libraries: Flask, Flask-Login, SQLAlchemy, PyCryptodome, cryptography (Fernet)
    \item Database: SQLite (for user management and session handling)
    \item Operating System: Cross-platform (Linux, Windows, macOS)
    \item Execution Environment: Local server for development; can be deployed on cloud platforms like AWS or Heroku
\end{itemize}

\subsection{Key Components Implementation}

\subsubsection{User Authentication Module}
\begin{lstlisting}[language=Python, caption=User Password Hashing and Verification]
from werkzeug.security import generate_password_hash, check_password_hash

class User(db.Model):
    __tablename__ = "users"
    id = db.Column(db.Integer, primary_key=True)
    username = db.Column(db.String(80), unique=True, nullable=False)
    pw_hash = db.Column(db.String(128), nullable=False)
    role = db.Column(db.String(20), nullable=False)  # admin or user
    active = db.Column(db.Boolean, default=True)

    def set_password(self, password):
        self.pw_hash = generate_password_hash(password)

    def check_password(self, password):
        return check_password_hash(self.pw_hash, password)

    def is_active(self):
        return self.active
\end{lstlisting}

\subsubsection{Searchable Encryption Module}
\begin{lstlisting}[language=Python, caption=Symmetric Searchable Encryption (SSE) Core]
import hashlib
from cryptography.fernet import Fernet

class SearchableEncryption:
    def __init__(self):
        self.key = Fernet.generate_key()
        self.cipher = Fernet(self.key)
        self.encrypted_data = {}  # Maps doc_id to encrypted document bytes
        self.index = {}           # Maps hashed keyword to set of doc_ids

    def _hash(self, keyword: str) -> str:
        return hashlib.sha256(keyword.encode()).hexdigest()

    def encrypt(self, doc_id: str, text: str):
        token = self.cipher.encrypt(text.encode())
        self.encrypted_data[doc_id] = token
        
        words = set(text.lower().split())
        for w in words:
            h = self._hash(w)
            self.index.setdefault(h, set()).add(doc_id)

    def search(self, keyword: str) -> dict:
        h = self._hash(keyword.lower())
        results = {}
        for doc_id in self.index.get(h, ()):
            plaintext = self.cipher.decrypt(self.encrypted_data[doc_id]).decode()
            results[doc_id] = plaintext
        return results
\end{lstlisting}

\subsection{Security Implementation}

\subsubsection{Encryption Mechanisms}
\begin{itemize}
    \item \textbf{AES-CBC:} Used to encrypt file contents securely with appropriate padding and random IVs.
    \item \textbf{Fernet Encryption:} Used inside the SSE module to ensure confidentiality and integrity of encrypted documents.
    \item \textbf{SHA-256 Hashing:} Employed to deterministically hash keywords into privacy-preserving tokens used as indices.
\end{itemize}

\subsubsection{Access Control and Authentication}
\begin{itemize}
    \item \textbf{Flask-Login:} Manages user sessions, login, logout, and access controls.
    \item \textbf{Role-Based Authorization:} Admins have privileges to encrypt and add files and manage users; regular users can search and decrypt.
    \item \textbf{Password Security:} Passwords are hashed securely before storage to prevent credential compromise.
\end{itemize}

\subsection{File Encryption and Storage Module}
\begin{lstlisting}[language=Python, caption=File Encryption and Saving to Disk]
import os, time
from encryption_utils import encrypt_text

def encrypt_and_store_file(file_stream, filename, aes_key, upload_folder='uploads', username=''):
    # Create uploads directory if it doesn't exist
    os.makedirs(upload_folder, exist_ok=True)
    
    # Generate unique filename to avoid collision
    timestamp = int(time.time())
    out_name = f"{username}_{timestamp}_{filename}"
    file_data = file_stream.read().decode('utf-8')
    
    # Encrypt file data with AES
    cipher_text = encrypt_text(file_data, aes_key)
    
    # Save encrypted file to disk
    out_path = os.path.join(upload_folder, out_name)
    with open(out_path, 'wb') as f:
        f.write(cipher_text)
    
    return out_name
\end{lstlisting}

\subsection{File Decryption Module}
\begin{lstlisting}[language=Python, caption=Decryption of Stored Encrypted Files]
from encryption_utils import decrypt_text
import os

def decrypt_file_content(filename, aes_key, upload_folder='uploads'):
    file_path = os.path.join(upload_folder, filename)
    if not os.path.exists(file_path):
        return "File not found."
    
    try:
        with open(file_path, 'rb') as f:
            cipher_data = f.read()
        plain_text = decrypt_text(cipher_data, aes_key)
        return plain_text
    except Exception as e:
        return f"Decryption error: {e}"
\end{lstlisting}

\subsection{Flask Route for File Encryption (Admin Only)}
\begin{lstlisting}[language=Python, caption=Flask Route to Handle File Encryption]
from flask import request, flash, render_template, redirect, url_for
from flask_login import login_required, current_user

@app.route('/encrypt', methods=['POST'])
@login_required
def encrypt_file_route():
    if current_user.role != 'admin':
        flash("Only admins may encrypt new files.")
        return redirect(url_for('index'))
        
    uploaded_file = request.files['file']
    if not uploaded_file:
        flash("No file selected.")
        return redirect(url_for('admin'))
    
    filename = uploaded_file.filename
    encrypted_filename = encrypt_and_store_file(uploaded_file, filename, AES_KEY, username=current_user.username)
    
    ENCRYPTED_FILES.append(encrypted_filename)
    flash(f"Encrypted file saved as {encrypted_filename}")
    return render_template('result.html', message=f"Encrypted saved as {encrypted_filename}")
\end{lstlisting}

\subsection{Flask Route for File Decryption}
\begin{lstlisting}[language=Python, caption=Flask Route to Handle File Decryption]
@app.route('/decrypt', methods=['POST'])
@login_required
def decrypt_file_route():
    selected_file = request.form.get('file_select')
    if not selected_file or selected_file not in ENCRYPTED_FILES:
        plain_text = "Invalid file selection."
    else:
        plain_text = decrypt_file_content(selected_file, AES_KEY)
    return render_template('result.html', message=plain_text)
\end{lstlisting}

\subsection{SSE File Encryption and Indexing}
\begin{lstlisting}[language=Python, caption=Flask Route for SSE File Encryption]
@app.route('/sse_encrypt_file', methods=['POST'])
@login_required
def sse_encrypt_file_route():
    file = request.files['file']
    content = file.read().decode('utf-8')
    sse_engine.encrypt(file.filename, content)
    return render_template('result.html', message=f"{file.filename} indexed.")
\end{lstlisting}

\subsection{SSE Search Route Implementation}
\begin{lstlisting}[language=Python, caption=Flask Route for SSE Keyword Search]
@app.route('/sse_search', methods=['POST'])
@login_required
def sse_search_route():
    keyword = request.form['keyword']
    search_results = sse_engine.search(keyword)
    
    if search_results:
        message = "<br>".join(f"{doc}: {txt}" for doc, txt in search_results.items())
    else:
        message = "No matches found."
    
    return render_template('result.html', message=message)
\end{lstlisting}

\subsection{User Management in Admin Dashboard}
\begin{lstlisting}[language=Python, caption=Admin Route for User Creation and Listing]
@app.route('/admin', methods=['GET', 'POST'])
@login_required
def admin_dashboard():
    if current_user.role != 'admin':
        flash("Admins only.")
        return redirect(url_for('index'))

    if request.method == 'POST':
        username = request.form['username']
        password = request.form['password']
        role = request.form['role']
        
        if User.query.filter_by(username=username).first():
            flash("Username already exists.")
        else:
            new_user = User(username=username, role=role)
            new_user.set_password(password)
            db.session.add(new_user)
            db.session.commit()
            flash(f"User {username} created.")
    
    users = User.query.all()
    return render_template('admin.html', users=users, encrypted_files=ENCRYPTED_FILES, role=current_user.role)
\end{lstlisting}

\section{Results Obtained}

\subsection{Performance Evaluation}

\subsubsection{Search Performance}
The performance of the encrypted cloud storage system with Symmetric Searchable Encryption (SSE) was evaluated by measuring the query response times, scalability, and resource consumption under varying workloads. Multiple keyword search queries were executed on encrypted indices storing different numbers of documents. The results demonstrated that query response time remained low and consistent, showing efficient retrieval even as the number of stored files increased. The indexing approach using hashed keywords contributed to quick lookups, enabling near real-time searches.
\justify
Scalability testing revealed that the system exhibited near-linear growth in response time as the dataset expanded. This indicates that the indexing mechanism scales well with increasing file volumes. CPU and memory usage profiling indicated that cryptographic operations, including AES encryption/decryption and Fernet encryption within the SSE module, were optimized to minimize overhead. Overall, the system balanced security and search efficiency effectively.

\subsubsection{Storage Overhead}
The overhead due to encryption and searchable index structures was quantified by comparing the size of ciphertext files and their associated keyword indices against original plaintext sizes. Encrypted files naturally consumed more disk space due to padding, IV storage, and base64 encoding. The SSE keyword index, maintained as an in-memory hash mapping, introduced additional but manageable memory overhead proportional to the number of unique keywords and documents.
\justify
The computational cost of encrypting and decrypting files using AES-CBC was benchmarked and found to be low enough for practical use on typical hardware. Compared to baseline plaintext storage and retrieval systems, the increase in storage and computational resources was marginal but justified by the significant improvements in data confidentiality and search privacy.

\subsection{Security Analysis}

\subsubsection{Attack Resistance}
The system was evaluated for resilience against common attacks on encrypted searchable storage. Keyword guessing attacks were mitigated by hashing keywords with SHA-256 before querying the index, producing search tokens that reveal no direct plaintext information. Although basic SSE schemes reveal search and access patterns, the chosen design minimizes leakage and can be enhanced in future iterations.
\justify
The system’s response to access pattern analysis was tested by simulating repeated search queries; randomized token generation and encrypted trapdoors helped reduce the risk of pattern recognition by adversaries. Statistical attacks were further deterred by uniform token sizes and encryption randomness. These combined protections significantly improve the system’s robustness against inference attacks targeting searchable encryption mechanisms.

\subsubsection{Privacy Preservation}
Privacy was preserved through end-to-end encryption of stored files and secure keyword indexing that prevents unauthorized disclosure of content or search queries. The SSE scheme ensures that data confidentiality is maintained even when stored on untrusted servers. Role-based access control limited capabilities by user, ensuring that only authorized personnel could upload, encrypt, search, or decrypt files, thereby preventing unauthorized data exposure.
\justify
User authentication, secure password storage, and session management further strengthened data privacy and user accountability. Unauthorized search requests and decryptions were effectively blocked by these layered security controls.

\subsection{Functionality Verification}

\subsubsection{Complex Query Support}
The system supports flexible querying capabilities, allowing users to perform multi-keyword searches and retrieve all documents containing any of the query keywords. Although more advanced query types like boolean and range queries could be added later, the current implementation demonstrates an efficient and secure baseline for encrypted full-text search.

\subsubsection{Multi-User Operation}
Testing with multiple simultaneous users verified isolated search contexts and session integrity, ensuring no data crossover or leakage between users. Each user session allowed distinct search and decryption operations confined to their permissions, successfully enforcing access control policies without sacrificing usability.

\subsubsection{Dynamic Update Capability}
The encrypted index and document store were tested for runtime updates, including addition of new encrypted files and real-time keyword index updates. The system efficiently incorporated these changes without significant downtime or performance degradation, indicating good adaptability to evolving data requirements and practical deployment scenarios.

\subsection{Usability and User Experience}

The web-based interface developed using Flask was evaluated for usability and user-friendliness. Users found it straightforward to upload, encrypt, search, and decrypt files with minimal training. Role-based access control simplified navigation by presenting only relevant options to admins and regular users. The responsive design and clear feedback messages improved user confidence and operational clarity.

User feedback highlighted that the system’s encrypted search functionality enabled efficient retrieval of relevant documents without the need to decrypt unnecessary files, enhancing productivity while maintaining strong security.

\subsection{Error Handling and Reliability}

The system demonstrated robust error handling during various failure scenarios such as invalid file uploads, incorrect decryption keys, and invalid search queries. Proper exception catching and user notifications ensured graceful degradation of service without crashes or data corruption.

Logging mechanisms captured security events and operational errors effectively, supporting auditability and troubleshooting. These features contribute to the system’s reliability and suitability for deployment in secure environments.

\subsection{Compatibility and Portability}

Testing across different operating systems (Linux, Windows, macOS) and Python environments verified the system’s portability. Dependencies such as PyCryptodome, Flask, and SQLAlchemy functioned consistently, enabling easy installation and deployment.

The system’s architecture and modular design allow extension and integration with cloud platforms or container orchestration tools like Docker for scalable production use.

\subsection{Limitations and Future Opportunities}

While the system provides a strong balance of security and functionality, some limitations were observed:
\begin{itemize}
    \item The SSE scheme leaks some search and access patterns inherent in symmetric searchable encryption.
    \item The in-memory index limits scalability to large datasets without persistent or distributed storage.
    \item Complex query types (e.g., boolean, phrase, or range queries) are not supported in the current implementation.
    \item Key management is centralized and could be enhanced with user-specific keys or hierarchical encryption.
\end{itemize}

These limitations point toward future work opportunities including integrating leakage-resilient SSE, index persistence, advanced query support, and multi-user key management.

\section{Future Plan}

\subsection{Short-term Goals}

In the near term, the focus is directed towards solidifying the foundation of the current system, emphasizing the refinement of existing functionalities and the incorporation of enhanced security and performance features. These incremental improvements will significantly heighten the system’s robustness, usability, and readiness for real-world deployment. The key short-term objectives include:

\begin{itemize}
    \item \textbf{Implementation Optimization:} Current cryptographic operations, including AES encryption/decryption and the construction and search of the SSE index, will undergo rigorous profiling and optimization. This involves reducing unnecessary computational overhead, optimizing memory usage, and leveraging efficient data structures. Efforts will focus on lowering latency during encryption, query processing, and decryption, thus improving the overall responsiveness of the platform especially under concurrent multi-user scenarios.

    \item \textbf{Enhanced Security Features:} Although the current implementation ensures strong data confidentiality, there remain potential leakage channels inherent to SSE schemes, such as search and access patterns. To address these, the integration of additional security measures, such as padding schemes, query obfuscation, and randomized token generation, is planned. Secure multi-party computation (SMPC) protocols and secure hardware support (e.g., Trusted Execution Environments) may also be explored to guard against sophisticated side-channel and inference attacks.

    \item \textbf{Performance Benchmarking and Tuning:} The prototype will be subjected to systematic and extensive performance evaluations including stress tests, concurrency assessments, and scalability measurements. These benchmarks will identify bottlenecks and latency issues introduced by cryptographic and network components. Based on these insights, the system architecture and algorithms can be fine-tuned for optimal throughput, ensuring that performance degradation remains minimal as dataset size and user base increase.

    \item \textbf{Extended Search Capabilities:} Presently, the system supports basic keyword search functionality. Upcoming developments will expand the query processing engine to handle more complex search types such as Boolean operators (AND, OR, NOT), phrase matching, proximity queries, wildcard, and fuzzy searches. This will greatly increase the expressiveness and practical utility of the system, aligning it closer to common enterprise search requirements while still preserving cryptographic security guarantees.

    \item \textbf{User Interface and Experience Enhancements:} User experience is critical for adoption. Thus, the web interface will be refined to be more intuitive, responsive, and feature-rich. Planned additions include facilitating bulk uploads, drag-and-drop support, progress bars for file encryption, and enhanced visualization of search results (e.g., snippets highlighting matched keywords). Feedback mechanisms and help guides will be added to support users unfamiliar with encryption concepts.

    \item \textbf{Improved Key Management for Usability:} User-friendly key management tools will be developed to simplify cryptographic key handling, potentially including features such as secure key backup, recovery, rotation, and multi-factor access controls. This reduces the risk associated with key loss or compromise, which is critical for secure operation in real deployment environments.
\end{itemize}

\subsection{Long-term Objectives}

Over the longer horizon, the ambition is to evolve the project into a comprehensive, scalable, and industry-ready encrypted cloud storage and searchable encryption platform. These future directions focus on integrating state-of-the-art cryptographic innovation, distributed system architecture, and domain-specific adaptations to meet increasingly demanding security, regulatory, and usability needs:

\begin{itemize}
    \item \textbf{Incorporation of Advanced Cryptographic Primitives:} Looking beyond symmetric schemes, future versions may integrate zero-knowledge proofs enabling verifiable computations on encrypted data without revealing underlying secrets, thus offering auditability and compliance assurances. Homomorphic encryption will be explored to permit arithmetic and logical operations directly on ciphertexts, facilitating advanced queries and analytics without decryption. These techniques will greatly extend the system’s capabilities while maintaining strict data privacy.

    \item \textbf{Leakage-Resistant and Oblivious Search Techniques:} Current SSE implementations leak some minimal access and search patterns. Research into leakage-resilient SSE and Oblivious RAM (ORAM) protocols will be pursued to mitigate these risks. These protocols obscure user query behavior and result access frequencies, closing critical side channels that attackers often exploit. Integration of these mechanisms will represent a significant advancement in secure searchable encryption.

    \item \textbf{Distributed, Fault-Tolerant, and Scalable Indexing Systems:} To support enterprise-scale data volumes and high query throughput, the searchable index will be redesigned as a distributed structure, potentially employing technologies such as distributed hash tables or specialized encrypted search databases. Integration with cloud-native storage solutions and container orchestration frameworks (e.g., Kubernetes) will enable elastic scaling, failover resilience, and load balancing, addressing availability and performance requirements at scale.

    \item \textbf{Cloud and Edge Integration:} Extending the system to operate across multi-cloud and edge computing environments will be considered to reduce latency and increase data locality. This hybrid architecture will distribute encryption, storage, and search tasks intelligently between cloud data centers and edge nodes, optimizing resource utilization and enhancing responsiveness especially for latency-sensitive applications.

    \item \textbf{Compliance and Regulatory Integration for Industry Use-Cases:} Adapting the system to meet strict regulatory standards such as GDPR, HIPAA, or FINRA will enable adoption in sensitive sectors like healthcare, finance, and legal services. This involves implementing proper data handling policies, audit trails, consent management, and ensuring that the encryption and storage mechanisms conform with the regulatory frameworks.

    \item \textbf{Hierarchical and Attribute-Based Encryption for Multi-User Scenarios:} To support complex access control policies, future work will incorporate hierarchical key management systems or attribute-based encryption frameworks allowing different users to hold keys granting them selective access to subsets of data. This enables collaboration without compromising confidentiality and simplifies administration in large organizations.

    \item \textbf{Integration with Blockchain and Secure Audit Trails:} To improve transparency and non-repudiation, adopting blockchain or other decentralized ledger technologies can provide immutable logs of access and operations on encrypted data. This feature is valuable for compliance, forensic analysis, and building trust in distributed cloud storage environments.

    \item \textbf{Post-Quantum Cryptography Readiness:} With the advent of quantum computing, classical cryptographic schemes may become vulnerable. The project will strategically explore and incorporate post-quantum secure encryption algorithms to future-proof the platform’s confidentiality guarantees.
\end{itemize}

\subsection{Project Achievements}

Despite its limitations, the project achieved several important milestones:
\begin{itemize}
    \item Implemented a fully functional encrypted cloud file storage system supporting AES-based encryption coupled with searchable encryption indexing.
    \item Demonstrated secure keyword search over encrypted data without exposing plaintext or encryption keys, balancing privacy and usability.
    \item Developed a web-based interface with role-based access control, enabling secure file upload, search, and decryption operations.
    \item Conducted preliminary performance and security evaluations, validating the practical feasibility and robustness of the approach.
    \item Created a modular and extensible codebase built on industry-standard Python libraries and frameworks that supports future development.
\end{itemize}

\subsection{Lessons Learned}

Throughout the development, numerous challenges and valuable insights emerged:
\begin{itemize}
    \item Cryptographic integration in practical applications requires adapting theoretical algorithms to real-world constraints, balancing security, performance, and user experience carefully.
    \item Searchable encryption leaks subtle patterns; protecting against these requires a layered approach involving cryptographic, architectural, and policy controls.
    \item Efficient keyword extraction, indexing, and encrypted search are non-trivial and demand well-optimized data structures and caching mechanisms.
    \item Managing encryption keys and user credentials securely is critical; mistakes here compromise the entire security model.
    \item Extensive end-to-end testing and user feedback loops are essential to uncover usability issues and to ensure system reliability and stability.
\end{itemize}

\subsection{Future Directions}

Building upon current achievements and lessons learned, the system’s evolution will emphasize:
\begin{itemize}
    \item \textbf{Dynamic and Adaptive Search Algorithms:} Incorporating AI and machine learning techniques to improve relevance ranking and support natural language queries, enabling more flexible and context-aware encrypted search.
    \item \textbf{Cross-Platform and Mobile Access:} Developing client applications supporting mobile and desktop platforms for ubiquitous secure cloud access.
    \item \textbf{Decentralized and Federated Architecture:} Designing the system to operate across organizational boundaries, enabling secure data sharing and search in federated environments.
    \item \textbf{Comprehensive Audit and Compliance Modules:} Implement features that automate compliance reporting and enable real-time monitoring of security policies and access events.
    \item \textbf{Community and Enterprise Adoption:} Open-source release and collaboration with industry partners to mature and standardize the platform.
\end{itemize}

By continuously aligning with the evolving landscape of cryptography, cloud computing, and data privacy regulations, this project aims to establish a leading-edge solution that offers secure, efficient, and user-friendly encrypted cloud data storage and retrieval for the future.

%-------------------------
% References
\newpage
\section{References}

\begin{thebibliography}{99}

\bibitem{song2000}
D. X. Song, D. Wagner, and A. Perrig,  
"Practical Techniques for Searches on Encrypted Data,"  
\textit{Proceedings of the IEEE Symposium on Security and Privacy}, 2000, pp. 44-55. 

\bibitem{gentry2009}
C. Gentry,  
"A Fully Homomorphic Encryption Scheme,"  
PhD Thesis, Stanford University, 2009.  

\bibitem{boneh2004}
D. Boneh and A. Sahai,  
"Secure Search on Encrypted Data,"  
\textit{Advances in Cryptology—Crypto 2004}, LNCS, vol. 3152, Springer, 2004, pp. 79–91.

\bibitem{stallings2017}
W. Stallings,  
\textit{Cryptography and Network Security: Principles and Practice},  
7th Edition, Pearson, 2017.

\bibitem{mcpherson2011}
R. McPherson, D. Brossard, and A. Juels,  
"Searchable Encryption Technologies,"  
\textit{Proceedings of the IEEE}, vol. 99, no. 9, pp. 1500–1518, 2011.

\bibitem{pycryptodome}
PyCryptodome,  
"PyCryptodome — Python Cryptographic Library,"  
\url{https://www.pycryptodome.org/en/latest/} (Accessed June 2024).

\bibitem{cryptography}
The Cryptography Developers,  
"Cryptography — Fernet (Symmetric Encryption),"  
\url{https://cryptography.io/en/latest/fernet/} (Accessed June 2024).

\bibitem{flask}
Pallets Projects,  
"Flask Documentation,"  
\url{https://flask.palletsprojects.com/} (Accessed June 2024).

\bibitem{kaur2019}
G. Kaur and K. Jyoti,  
"Cloud Data Security and Privacy using Encryption,"  
\textit{International Journal of Advanced Research in Computer Science and Management Studies}, vol. 7, no. 1, pp. 48-53, 2019.

\bibitem{mane2020}
P. Mane, R. Raut, and P. Dhole,  
"Review on Secure Searching System Using Symmetric Searchable Encryption,"  
\textit{International Journal of Innovative Research in Computer and Communication Engineering}, vol. 8, no. 1, pp. 482-488, 2020.

\bibitem{zhang2015}
J. Zhang, R. Lu, and Z. Cao,  
"Privacy-Preserving Multi-Keyword Ranked Search over Encrypted Cloud Data,"  
\textit{IEEE Transactions on Parallel and Distributed Systems}, vol. 27, no. 2, pp. 340-352, 2015.

\end{thebibliography}

\end{document}


This is my complete project report which is consisting of 34  Pages but I want to expand it to 100 Pages So I will ask you for section by section you will give me expanded order. First of all Give me expanded version of introduction