# Searchable Data Vault: Encrypted Queries in Secure Distributed Cloud Storage
## 2 Related Work
### Security Model  
An SSE scheme aims to protect confidentiality of documents being stored in the storage servers, including the keywords of the documents. Consequently, the entries of the index and search token must be protected so that no information about the stored documents is revealed. Nevertheless some information leak is inevitable for Search to be efficient. This characteristic of the scheme is called the leakage profile as was first formalized in [19]. The leakage profile normally consists of the following three functions.  
\(\mathcal{L}^{setup}\) is information the server obtained by looking at the encrypted objects and index, such as the block size.  
\(\mathcal{L}^{query}\) is the information gathered by the server in observing messages in the Search protocol, such as the number of blocks associated to the input search token.  
\(\mathcal{L}^{update}\) is the information disclosed to server by the changes to index and set of encrypted objects on the server, including number of keywords of each added or removed object.  
**Definition 1**.: _A multi-server SSE scheme with leakage profile \(\mathcal{L}=(\mathcal{L}^{setup},\mathcal{L}^{query},\mathcal{L}^{update})\) is said to be \(\mathcal{L}\)-secure against non-adaptive attack by colluding servers, if for any adversary \(\mathcal{A}\) there exists a simulator \(\mathcal{S}\) such that:_  
\[|Pr[\mathbf{Ideal}_{SSE,\mathcal{A},\mathcal{S}}(\lambda)=1]-Pr[\mathbf{ Real}_{SSE,\mathcal{A}}(\lambda)=1]|\leq\mathtt{negl}(\lambda) \tag{1}\]  
_where the \(\mathbf{Real}\) and \(\mathbf{Ideal}\) games are defined as follows:_  
\(\mathbf{Real}\) _The adversary \(\mathcal{A}\) chooses a set of documents \(D\), a keyword index table, a set of servers \(S\) and a sequence of search and update queries, and submits them to the challenger. The challenger then runs_ Setup _with the given input documents and keyword index table. Then the challenger runs_ Search _on the sequence of search and update queries. All the responses are returned to \(\mathcal{A}\). Finally, \(\mathcal{A}\) outputs a bit._  
\(\mathbf{Ideal}\) _The adversary \(\mathcal{A}\) chooses a set of documents \(D\), a keyword index table, a set of servers \(S\) and a sequence of search and update queries, and submits them to the challenger. The challenger gives the simulator\(\mathcal{S}\) the leakage \(\mathcal{L}^{setup}\),\(\mathcal{L}^{query}\),\(\mathcal{L}^{update}\) resulting from the given input. The result of the setup, search and update simulation is returned to \(\mathcal{A}\). Finally, \(\mathcal{A}\) outputs a bit._  
For Definition 1, colluding servers means that storage servers share their leakage profile and other information gathered from the execution of the system among themselves. We further remark that for our proposed scheme in the following section (a simplified version compared to the proposal in [3]), the only keyword for each document is its filename and thus there is no keyword index table required, as in the above definition. This provides flexibility to include desired search functionalities (e.g., Boolean, conjunctive) on top of the filename search in our proposed scheme.