# Privacy-Aware Cloud Architecture for Collaborative Use of Patients' Health Information
## 3 Proposed Architecture
### Architecture Fundamental Aspects
#### 3.1.2 Searchable Symmetric Encryption (SSE)  
Searchable symmetric encryption is a cornerstone of the proposed system architecture. The main objective of the proposed system architecture is to store patients' information on the cloud without allowing the cloud provider to read it. Achieving this is considered easy but not practical without a mechanism that enables searching through encrypted information without decrypting it. The proposed system employs a searchable symmetric encryption (SSE) approach. The SSE approach enables outsourcing data storage while preserving the ability to selectively search over it. There are three models for searching on encrypted data identified in the literature: searching on public-key encrypted data [60], single-database private information retrieval (PIR) [61], and finally searching on private-key encrypted data [59] which is the approach employed in the proposed cloud architecture. For consistency purposes, the private key is denoted by secret key (Sk) throughout the paper. In the secret-key-encrypted data model, the data are encrypted by the user and are organized in an arbitrary way prior to encrypting it. The data are stored on a server in encrypted form, and decrypting it can only happen with the \(\text{S}_{k}\). In this model, the initial work for the user is large when the data are large, while subsequent work, such as accessing the data are small. The user's work is large because data pre-processing requires performing a number of processes to facilitate searchability while it is encrypted. Structuring data as part of the pre-processing allows for efficient access to relevant data. In this proposed system, information is partitioned into portions denoted by documents, as explained earlier. For every patient, there is a root secret key (\(\text{S}_{\text{LR}}\)) that is used to encrypt three secret keys (\(\text{S}_{\text{R}}\)). Secret keys are used to encrypt patients' documents (doc-1, doc-2, and doc-3). Each document is encrypted with its corresponding \(\text{S}_{k}\). Indexes and trapdoors--explained further in this section--are generated to identify and decrypt documents, respectively. An important property of the secret-key-encryption approach is that anyone who can decrypt information for a document can also decrypt any file in that document. This means anyone who has access to a document can have access to all files within that document. The main goal of employing the SSE approach is to store patients' health information on the cloud in a searchable manner so that only authorized parties can access it. Moreover, the cloud provider can never learn anything about the information stored; it receives encrypted information to store and releases it without decrypting it. The decryption of each document under the secret root key requires the secret key for it, which is released upon authenticated and authorized user requests. The cloud provider is not informed about the content of any document; therefore, the challenge remains in identifying encrypted document(s) without decrypting them. The searching capability of the SSE approach is achieved using a secure index mechanism [62]. The secure index is a structure of data that stores document collections while supporting efficient keyword search. For example, given a keyword (w), the index returns a pointer to the documents that contain it. The secure index works by searching for an exact string match in encrypted documents. Every document contains a collection of encrypted strings, and a string is chosen to be the searching keyword for the document that contains it. The selected keyword is computed using the secret key with which the entire document is encrypted. The resulting ciphertext is then used to search for an exact match in documents. For example, a keyword in a document is \"Basic-Information\". This keyword is computed using the secret key of