# A Secure Data Sharing Scheme with Designated Server

Authors: Binrui Zhu; Jiameng Sun; Jing Qin; Jixin Ma
Journal: Security and Communication Networks
 (2019)

---

## Abstract

The cloud-assisted Internet of Things (CIoT) is booming, which utilizes powerful data processing capabilities of the cloud platform to solve massive Internet of Things (IoT) data. However, the CIoT faces new security challenges, such as the confidentiality of the outsourced data. Data encryption is a fundamental technique that can guarantee the confidentiality of outsourced data, but it limits target encrypted data retrieval from cloud platform. Public key encryption with keyword search (PEKS) provides a promising solution to address this problem. In PEKS, a cloud server can be authorized to search the keyword in encrypted documents and retrieve associated encrypted documents for the receiver. However, most existing PEKS schemes merely focus on keyword search function while ignoring the associated documents encryption/decryption function. Thus, in practice, a PEKS scheme must cooperate with another separated public key encryption (PKE) scheme to fulfill a completely secure data sharing scheme. To address this problem, in this paper, we propose a secure data sharing scheme with designated server that combines PKE scheme with PEKS scheme, which provides both keyword search and documents encryption/decryption functions. Furthermore, only the designated server can search the keyword via encrypted documents for enhanced security in our work. Moreover, our scheme also satisfies the public verifiability of search results, which includes both keywords and documents ciphertexts’ correctness and integrity. As to the security, our scheme provides stronger indistinguishability security of document and keyword in the proposed security model.


---

## Body

## 1. Introduction

Cloud storage has been widely deployed in daily life. As a promising application, cloud-assisted Internet of Things (CIoT) have utilized cloud storage to store their data to reduce the burden of data processing, as shown in Figure1. In CIoT, users rely on the cloud platform to complete the data storage and data sharing. Generally, data is migrated from the user to a cloud server, in which the cloud server is widely recognized as an honest-but-curious party. However, the cloud storage is provided by a third party and the user’s data may have private information. Therefore, the user should encrypt the data prior to uploading it to cloud server for protecting data confidentiality. Unfortunately, this approach eliminates the data search service provided by modern search engines, which inevitably makes the effective data search function become a challenging research problem. A trivial solution is that we download the full encrypted data and then decrypt it to obtain the plaintext data. Of course, it needs to occupy a large amount of local storage space and communication consumption. Another trivial solution is that the user sends the private key to cloud server. The server decrypts the encrypted data in the cloud, searches for the user in plaintext, and retrieves the intended data. This solution solves the above problem, but it compromises data privacy, which violates the original intention of data encryption. Focusing on the aforementioned problem, searchable encryption was proposed. Searchable encryption enables a data receiver to authorize the cloud server to search in encrypted documents, where encrypted documents are not needed to be decrypted. Searchable encryption is mainly divided into two techniques, which are symmetric searchable encryption (SSE) and public key encryption with keyword search (PEKS). In SSE, a shared key is required to achieve data sharing function in the cloud platform. PEKS was proposed in 2004 by Boneh et al. [1], which can realize the keyword search function and eliminate complicated key management in cloud platform.Figure 1
Functions of a cloud-assisted IoT.The general PEKS system includes three participants, i.e., a data sender, a data receiver, and a cloud server. Data sender encrypts keywords index using receiver’s public key and uploads keyword ciphertexts to cloud server. The data receiver uses its private key to generate a keyword trapdoor and transmits trapdoor to cloud server. Cloud server uses the trapdoor to match the keyword ciphertext; if the keyword in the ciphertext and the keyword in the trapdoor are identical, its outputs are equal; otherwise, its outputs are not equal.However, PEKS mainly focuses on the keyword search process and omits the associated documents encryption/decryption process, which only explains using a standard encryption scheme to encrypt associated documents. However, in the actual applications, the documents encryption/decryption is indispensable, since the corresponding documents are what we really need. Therefore, it is essential and meaningful to combine the public key encryption (PKE) scheme with the PEKS scheme to form a completely secure data sharing scheme. For this reason, a completed scheme named integrated PKE and PEKS scheme is suggested, which combines PEKS with PKE to encrypt keywordw and its corresponding document message m together. The PEKS-PKE system includes three participants, i.e., a data sender, a data receiver, and a cloud server. Data sender encrypts message m using receiver’s public key pkr. It also encrypts keyword wi with receiver’s public key pkr and appends to the resulting message ciphertext and then uploads encrypted message and keywords Cm∥Cwi to cloud server. Receiver generates the trapdoor Tw with its private key skr and uploads Tw to cloud server. The cloud server matches the keyword trapdoor Tw with encrypted keywords Cwi, and if the same keyword is used, it outputs yes and returns Cm to receiver; else, it outputs no and returns ⊥. The data receiver uses its private key skr to decrypt the message ciphertext Cm.This integrated scheme PEKS-PKE can provide keywordw search function and message m encryption/decryption function. Most of PEKS schemes after Boneh’s scheme do not introduce how to achieve this completed scheme.When searching the keyword in the cloud, we generally assume that the cloud server is honest but curious, which means that it performs the search operation honestly; actually it is curious about the keyword content. However, in practical applications, the server may not always behave honestly. Generally, the cloud server is managed and operated by a business company. The company may delete encrypted data for their benefits for releasing storage space. In addition, the server may be broken into by malicious intruder Eve or it may unintentionally delete data. When performing a search operation, the server may return the part of the search results to deceive the receiver. Since the receiver does not know the content of the encrypted document, or even whether the encrypted document is associated with the keyword; this poses a threat to the receiver’s data correctness and integrity. In addition to, the receiver may declare that the cloud server has lost some data or returned incorrect search results and doubt about the behavior of cloud server even if the provider has performed all required operations honestly. This will cause disputes. Therefore, if there is an honest-but-curious third party who can verify the integrity and correctness of the search results in a public manner, we can entrust the cloud server honestly performs the keyword search operation and solves the dispute with receiver.Considering a specific scenario, Personal Health Record (PHR) is confidential documens to anyone except the patient and the chief physician. In order to protect patients’ privacy, patients need to encrypt the PHR data prior to uploading it to cloud server. We can use a PEKS scheme to solve keyword search problem in encrypted PHR. However, the above PEKS requires that the cloud server is totally trusted; that is, it honestly stores the encrypted documents, performs the search operation, and returns the encrypted PHR. We know that it is not practical to assume a cloud platform is honest for a hospital. Generally, the hospital will outsource the construction of the cloud platform to a professional company and the physical control of the encrypted PHR belongs to professional company. Therefore, the cloud platform may delete some encrypted PHR to release their storage space for their economic benefits. They may want to perform the dishonest search operation to deceive the chief physician and the patient. The chief physician does not know the correctness and integrity of the search results, and it is in charge of the diagnosis and treatment of patients. When the encrypted PHR search results are incomplete, the chief physician may make incorrect diagnostic results with serious consequences. Furthermore, once there is a medical negligence, the chief physician may unilaterally declare that the cloud server has lost some data or returned incorrect search results and deliberately pass the buck to the cloud service provider even if the provider has performed all required operations honestly. A straightforward solution is that the patient sends the PHR integrity evidence to the chief physician. The chief physician downloads the total encrypted data and then checks the integrity. This solution has two drawbacks. One drawback is that it breaks the asymmetry of PEKS, and on the other hand it is too expensive for the communication cost.From the above discussion, we can know that it is importance of combining PKE and PEKS with providing the public verifiability under the untrusted cloud platform. Maintaining the privacy and public verifiability of search results are exciting and unresolved research problems.Recently, Zhang et al. [2] proposed a public verifiable searchable encryption scheme. The scheme discussed the correctness of the returned keyword ciphertexts and lacked the integrity of both documents and keywords ciphertexts.In 2018, we proposed a PEKS with public verifiability scheme [3]. Our scheme achieves the correctness and integrity of keywords ciphertext. However, when the cloud server is not honest, we only discuss keywords ciphertext is incomplete, since the corresponding encrypted documents are what we really need. That is to say, when cloud server returns encrypted document, it also may return another uncorrelated encrypted document with a corrected keyword ciphertext. In this case, the cloud server can also pass the verification by sweeping attack. In addition, the taggen phase lacks an index label and it will reduce the efficiency of verification. Furthermore, the tag only includes the keyword and the corresponding document serial number, in which it may also let cloud server easily forge the tag. Therefore, in practical applications, the scheme is very fragile. Our previous scheme also only focuses on keyword search function, while ignoring the associated documents encryption/decryption function.In this paper, we propose a secure data sharing scheme with designated server that captures both functions of PKE and PEKS, which provides the functions both keyword search and documents encryption/decryption. Furthermore, only the designated server can search the keyword for enhanced security. Our scheme can also satisfy the public verifiability of search results, including ciphertexts both documents and keywords, which achieves the correctness and integrity. The scheme is great improvement comparing our previous work.


### 1.1. Our Contributions

Specifically, our contributions are as follows:(1) We introduce the definition of secure data sharing scheme with designated server, which satisfies the functions both of keyword search and documents encryption/decryption.(2) We propose a special secure data sharing scheme with designated server. Our scheme achieves security of the document indistinguishability against chosen ciphertext attack (IND-CCA), keyword indistinguishability against chosen keyword attack (IND-CKA), and trapdoor indistinguishability.(3) It achieves the public verifiability of search results, which includes both keywords and documents ciphertexts’ correctness and integrity.(4) Our scheme removes the secure channel between the data receiver and the cloud server, which only the designated server can perform matching operation.Technical route is as follows: we choose the Variable Hashed Elgamal scheme [4] as document encryption/decryption scheme and the PEKS with a designated tester (dPEKS) scheme as the searchable encryption scheme. These two schemes are basic components. Variable Elgamal scheme is an encryption scheme that provides document ciphertext indistinguishability security against chosen ciphertext attack (IND-CCA). The dPEKS scheme is an searchable encryption scheme that provides keyword ciphertext indistinguishability security against chosen keyword attack(IND-CKA). The trivial solution is to combine Variable Elgamal encryption with dPEKS, but there is a problem that the server is not fully trusted. The server may perform swapping keyword attacks. The swapping keyword attack is that the data receiver gets the document message it does not need. For example, when the receiver searches the document m1 corresponding to the keyword w1, the server sweeps the documents m2,m1 and returns the document m2 corresponding to the keyword w2. Therefore, the receiver can not get the document m1 that it really needs. To resist this attack, we need to bind the keyword ciphertext and document ciphertext so that the malicious server cannot perform the sweeping attacks. In addition to, we also need to consider the security of combined scheme.Since the widely used keyword space is limited, the outside adversary can guess a keyword and generate the keyword ciphertext; if the outside adversary can perform the matching operation, it can get the keyword in the trapdoor until guess the true keyword. We call this attack named offline keyword guessing attack (offline KGA). Therefore, to resist this offline KGA, we generate a key pair for the cloud server. Only the designated server can perform the keyword search operation to avoid outside adversary’s offline KGA. What we need to point out here is that the adversary may get the guessing keyword by comparing two bilinear pairs without generating keyword ciphertext. We also need the trapdoor satisfies trapdoor indistinguishability in proposed scheme to resist offline KGA.


### 1.2. Related Works

Song et al. [8] proposed the first symmetric searchable encryption (SSE) in 2000. Song’s scheme requires a word-by-word comparison to complete the keyword search operation. After Song’s work, many researchers propose SSE schemes [9–11].Boneh et al. [1] proposed the first PEKS scheme in 2004. Boneh et al.’s scheme realizes the data sharing and the keyword search functions. In 2005, Abdalla et al. explored the conversion relationship between identity based encryption (IBE) and PEKS [12]. It is shown that an anonymous IBE scheme could be transformed into a PEKS scheme and it proposed a temporary keyword search scheme. In 2008, Baek et al. [5] proposed the PEKS with a designated tester scheme that does not require a secure channel. In 2010, Rhee et al. [13] proposed a scheme that can resist outside attacker’s offline KGA in trapdoor indistinguishability security model. In 2013, Fang et al. [14] proposed a PEKS scheme in the standard model, which can resist outside attacker’s offline KGA. Later, many researchers studied the offline KGA and proposed many schemes [15–20].In 2014, Zheng et al. [21] proposed the first verifiable attribute-based encryption with keyword search scheme. This scheme flexibly uses bloom filters and signatures to achieve the verifiability. In Zheng et al. scheme, attribute ciphertext and trapdoor are proportional to the number of attributes. It also requires a secure channel and supports the receiver private verification. After this work, many researchers proposed attribute-based encryption with keyword search schemes [22, 23].In 2006, Baek et al. [24] proposed the first PEKS-PKE scheme. This scheme realizes the functions of document encryption/decryption and keyword search. Baek et al.’s scheme only discusses the security of document and does not involve the security of keyword, and it needs a secure channel. In 2009, Zhang et al. [7] proposed a PEKS-PKE scheme, which involves the security of keyword. It has two public and private key pairs and requires a secure channel. Chen et al. [6] proposed a PEKS-PKE scheme in 2016 and Chen et al.’s general construction leaks the keyword to the server. These three schemes do not discuss the security of trapdoor, and their schemes do not support the correctness and integrity verification of the search results, including the returned ciphertexts both documents and keywords.


### 1.3. Organization

The paper is organized as follows. Section1 is the introduction. The scheme definition and security models are described in Section 2. A secure data sharing scheme with designated server is proposed in Section 3. We analyze the security and efficiency of the proposed scheme in Section 3. The paper is concluded in Section 4.


## 1.1. Our Contributions

Specifically, our contributions are as follows:(1) We introduce the definition of secure data sharing scheme with designated server, which satisfies the functions both of keyword search and documents encryption/decryption.(2) We propose a special secure data sharing scheme with designated server. Our scheme achieves security of the document indistinguishability against chosen ciphertext attack (IND-CCA), keyword indistinguishability against chosen keyword attack (IND-CKA), and trapdoor indistinguishability.(3) It achieves the public verifiability of search results, which includes both keywords and documents ciphertexts’ correctness and integrity.(4) Our scheme removes the secure channel between the data receiver and the cloud server, which only the designated server can perform matching operation.Technical route is as follows: we choose the Variable Hashed Elgamal scheme [4] as document encryption/decryption scheme and the PEKS with a designated tester (dPEKS) scheme as the searchable encryption scheme. These two schemes are basic components. Variable Elgamal scheme is an encryption scheme that provides document ciphertext indistinguishability security against chosen ciphertext attack (IND-CCA). The dPEKS scheme is an searchable encryption scheme that provides keyword ciphertext indistinguishability security against chosen keyword attack(IND-CKA). The trivial solution is to combine Variable Elgamal encryption with dPEKS, but there is a problem that the server is not fully trusted. The server may perform swapping keyword attacks. The swapping keyword attack is that the data receiver gets the document message it does not need. For example, when the receiver searches the document m1 corresponding to the keyword w1, the server sweeps the documents m2,m1 and returns the document m2 corresponding to the keyword w2. Therefore, the receiver can not get the document m1 that it really needs. To resist this attack, we need to bind the keyword ciphertext and document ciphertext so that the malicious server cannot perform the sweeping attacks. In addition to, we also need to consider the security of combined scheme.Since the widely used keyword space is limited, the outside adversary can guess a keyword and generate the keyword ciphertext; if the outside adversary can perform the matching operation, it can get the keyword in the trapdoor until guess the true keyword. We call this attack named offline keyword guessing attack (offline KGA). Therefore, to resist this offline KGA, we generate a key pair for the cloud server. Only the designated server can perform the keyword search operation to avoid outside adversary’s offline KGA. What we need to point out here is that the adversary may get the guessing keyword by comparing two bilinear pairs without generating keyword ciphertext. We also need the trapdoor satisfies trapdoor indistinguishability in proposed scheme to resist offline KGA.


## 1.2. Related Works

Song et al. [8] proposed the first symmetric searchable encryption (SSE) in 2000. Song’s scheme requires a word-by-word comparison to complete the keyword search operation. After Song’s work, many researchers propose SSE schemes [9–11].Boneh et al. [1] proposed the first PEKS scheme in 2004. Boneh et al.’s scheme realizes the data sharing and the keyword search functions. In 2005, Abdalla et al. explored the conversion relationship between identity based encryption (IBE) and PEKS [12]. It is shown that an anonymous IBE scheme could be transformed into a PEKS scheme and it proposed a temporary keyword search scheme. In 2008, Baek et al. [5] proposed the PEKS with a designated tester scheme that does not require a secure channel. In 2010, Rhee et al. [13] proposed a scheme that can resist outside attacker’s offline KGA in trapdoor indistinguishability security model. In 2013, Fang et al. [14] proposed a PEKS scheme in the standard model, which can resist outside attacker’s offline KGA. Later, many researchers studied the offline KGA and proposed many schemes [15–20].In 2014, Zheng et al. [21] proposed the first verifiable attribute-based encryption with keyword search scheme. This scheme flexibly uses bloom filters and signatures to achieve the verifiability. In Zheng et al. scheme, attribute ciphertext and trapdoor are proportional to the number of attributes. It also requires a secure channel and supports the receiver private verification. After this work, many researchers proposed attribute-based encryption with keyword search schemes [22, 23].In 2006, Baek et al. [24] proposed the first PEKS-PKE scheme. This scheme realizes the functions of document encryption/decryption and keyword search. Baek et al.’s scheme only discusses the security of document and does not involve the security of keyword, and it needs a secure channel. In 2009, Zhang et al. [7] proposed a PEKS-PKE scheme, which involves the security of keyword. It has two public and private key pairs and requires a secure channel. Chen et al. [6] proposed a PEKS-PKE scheme in 2016 and Chen et al.’s general construction leaks the keyword to the server. These three schemes do not discuss the security of trapdoor, and their schemes do not support the correctness and integrity verification of the search results, including the returned ciphertexts both documents and keywords.


## 1.3. Organization

The paper is organized as follows. Section1 is the introduction. The scheme definition and security models are described in Section 2. A secure data sharing scheme with designated server is proposed in Section 3. We analyze the security and efficiency of the proposed scheme in Section 3. The paper is concluded in Section 4.


## 2. Scheme Definition and Security Models

### 2.1. System Model

The system model of secure data sharing scheme with designated server that supporting public verifiability is shown in Figure2: there are four participants in this model including a data sender, a receiver, cloud server, and the third party verifier.Figure 2
Secure data sharing scheme with designated server model.First of all, data sender encrypts the document messagem by using receiver’s public key pkr and encryption algorithm enc to form message ciphertext Cj, encrypts the corresponding keyword wi by using cloud server’s public key pks, receiver’s public key pkr, and encryption algorithm peks to form keyword ciphertext Cwi, then binds the Cj and Cwi to form ciphertext u, and uploads the ciphertext u to cloud server; data sender also uses the cloud server public key pks, the receiver public key pkr, the keyword wi, the keyword ciphertext Cwi, and corresponding message ciphertext Cj to generate the verification tag τ and sends the verification tag τ to third party verifier.Secondly, the receiver uses its secret keyskr and cloud server’s public key pks to generate keyword trapdoor Tw with the verification trapdoor VKw and transmits Tw to cloud server. And then, cloud server uses the trapdoor Tw and ciphertext u to compute the matching result. If the keyword in the ciphertext u and the keyword in the trapdoor Tw are equal, cloud server returns the ciphertext u to receiver. Next, to obtain the message m, the receiver decrypts the u by using its secret key skr.In final step, when there is a dispute between cloud server and receiver, the third party verifier uses the verification trapdoorVKw from receiver, the verification tag τ, and returns the verification result.


### 2.2. Scheme Definition

Definition 1.
More specifically, a secure data sharing scheme with designated server consists of the following algorithms:
(1)sp←SysGen1k: on input a security parameter 1k and output a system parameter sp.
(2)(pkr,skr)←KeyGenreceiversp: on input the system parameter sp and output a pair of public and secret key (pkr,skr) for the receiver.
(3)pks,sks←KeyGenserversp: on input the system parameter sp and output a pair of public and secret key (pks,sks) for the cloud server.
(4)u←Encsp,pks,pkr,w,m: on input the system parameter sp, the cloud server public key pks, the receiver public key pkr, the keyword w, the document message m and output a ciphertext u=(Cj,Cw,σ), which Cj=enc(sp,pkr,m) is message ciphertext, Cw=peks(sp,pks,pkr,w) is keyword ciphertext, σ is a binding tag.
(5)τwi←Tagsp,pks,pkr,wi,Cwi,Cj: on input the system parameter sp, the cloud server public key pks, the receiver public key pkr, the keyword wi, the keyword ciphertext Cwi and the message ciphertext Cj, which i is the serial number of the keyword and j is the message serial number corresponded the keyword wi, and output the verification tag τwi, releases τwi to the third party verifier.
(6)Tw,VKw←Trapdoorsp,pks,skr,w: on input the system parameter sp, the cloud server public key pks, the receiver secret key skr, the keyword w, and output the keyword search trapdoor Tw, the verification trapdoor VKw.
(7)uor⊥←Testsp,sks,Tw,u: on input the system parameter sp, the cloud server secret key sks, the keyword search trapdoor Tw, the ciphertext u, and output ciphertext u if the keyword in the u and the keyword in the Tw are equal; otherwise, output ⊥.
(8)mor⊥←Dec(sp,skr,u): on input the system parameter sp, the receiver secret key skr, the ciphertext u and output the message m or ⊥.
(9)1or0←Publicverify(sp,VKw,τ): when there is a dispute between cloud server and receiver, the third party verifier inputs the system parameter sp, the verification trapdoor VKw, the verification tag τ, output the verification result 1 if satisfies condition; and 0 otherwise.


### 2.3. Security Model

We define four security models, including the security models of IND-CKA, trapdoor indistinguishability (IND-Trapdoor), IND-CCA, and the public verifiability.We define the keyword ciphertext semantic security. Any adversary can not distinguish the challenge keyword ciphertext unless the trapdoor is available. Formally, we define security game IND-CKAi played between a challenger B and adversary Ai,i=1,2.In IND-CKA 1, the challengerB generates the receiver key pair (pkr,skr) and sends public key pkr to the cloud server adversary A1. The adversary A1 generates the cloud server key pair (pks,sks) and sends public key pks to the challenger. The adversary can access the trapdoor oracle O1(w) to get any keyword trapdoor wi and access the decryption oracle O2(u) on any ciphertexts u and then outputs two distinct challenge keywords and a message (w0,w1,m∗), in which wb≠wi,b∈{0,1}. The challenger generates challenge ciphertext ub of (wb,m∗) with a random bit b and sends it to A1. During the game, the adversary can adaptively continue the query to decryption oracle O2(u) and trapdoor oracle O1(w) unless the challenge keywords. Finally, the adversary A1 outputs a bit b′ as its guess.In IND-CKA 2, the game played between a challengerB and an outside adversary A2 is similar to IND-CKA 1. The details are in the following definition.Definition 2 ((IND-CKA) see Boxes1 and 2).
A secure data sharing scheme with designated server is IND-CKA secure if no probabilistic polynomial time (PPT) adversaryA1 can win game IND-CKA 1 and PPT adversary A2 can win game IND-CKA 2 with nonnegligible advantage, where B is the challenger, A1 is cloud server, and A2 is the outside adversary (including a receiver).
We defineAi advantage as(1)AdvAiIND-CKA=Prb=b′-12,i∈1,2.
Next, we define the keyword trapdoor semantic security. Any adversary can not distinguish the challenge trapdoor; that is to say, the challenge trapdoor does not reveal any information about the keyword. The IND-Trapdoor is similar to the IND-CKA 1. The adversary is given the challenge trapdoor instead of the challenge ciphertext. In IND-Trapdoor security model, the challengerB generates two key pairs (pks,sks),(pkr,skr) and sends public keys pks,pkr to the adversary A3. A3 can access the trapdoor oracle O1(w) to get any keyword trapdoor wi and outputs two distinct challenge keywords (w0,w1), in which wb≠wi,b∈{0,1}. The challenger generates challenge trapdoor Tb of wb with a random bit b and sends it to A3. During the game, the adversary A3 can adaptively continue to query trapdoor oracle O1(w) unless the challenge keywords. Finally, the adversary A3 outputs b′ as its guess.Box 1:Game IND-CKA 1 ExpA1CKA.
K s e t ← ϕ ( p k s , s k s , p k r , s k r ) ← K e y G e n ( s p ); ( w 0 , w 1 , m ∗ ) ← A 1 O 1,2 ( s p , ( p k s , s k s ) , p k r ); u b ← B ( m ∗ , w b , p k s , p k r , b ∈ { 0,1 } ); b ′ ← A 1 O 1,2 ( u b , g u e s s ); if{w0,w1}⋂‍Kset=ϕ, then return 1, if b′=b; else return 0. OracleO1(w): K s e t = K s e t ⋃ { w }, Tw←O(pks,skr,w); return{Tw} OracleO2(u): m ← O 2 ( s k r , u ); return{m}Box 2:Game IND-CKA 2 ExpA2CKA.
( p k s , s k s , p k r , s k r ) ← K e y G e n ( s p ); ( w 0 , w 1 , m ∗ ) ← A 2 O 2 ( s p , ( p k r , s k r ) , p k s ); u b ← B ( w b , m ∗ , p k s , p k r , b ∈ { 0,1 } ); b ′ ← A 2 ( u b , g u e s s ); then return 1, ifb′=b; else return 0. OracleO2(u): m ← O 2 ( s k r , u ); return{m}Definition 3 ((IND-Trapdoor); see Box3).
A secure data sharing scheme with designated server satisfies trapdoor indistinguishability if no PPT adversaryA3 can win the game IND-Trapdoor with nonnegligible advantage, where B is the challenger and A3 is an outside adversary.
We defineA3 advantage as(2)AdvA3IND-Trapdoor=Prb=b′-12.
After that, we define the document message ciphertext semantic security. Any adversary can not distinguish the challenge message ciphertext; even it can access the decryption oracleO2(u). Formally, we define security game IND-CCA.
The IND-CCA is similar to the IND-CKA 1. The difference is that the adversary outputs two distinct challenge message and a keyword(m0,m1,w∗). The challenger generates challenge ciphertext ub of (w∗,mb) with a random bit b∈{0,1} and sends it to A4. During the game, the adversary can adaptively continue the query to trapdoor oracle O1(w) and decryption oracle O2(u) unless the challenge ciphertext ub. We omit the details here.Box 3:Game IND-Trapdoor ExpA3.
K s e t ← ϕ ( p k s , s k s , p k r , s k r ) ← K e y G e n ( s p ); ( w 0 , w 1 ) ← A 3 O 1 ( s p , p k s , p k r ); T b ← B ( w b , p k s , s k r , b ∈ { 0,1 } ); b ′ ← A 3 O 1 ( T b , g u e s s ); if{w0,w1}⋂‍Kset=ϕ, then return 1, if b′=b; else return 0. OracleO1(w): K s e t = K s e t ⋃ ‍ { w }, Tw←O1(pks,skr,w); return{Tw}Definition 4 ((IND-CCA); see Box4).
A secure data sharing scheme with designated server is IND-CCA secure if no PPT adversaryA4 can win the game IND-CCA with nonnegligible advantage, where B is the challenger and A4 is an adversary (including the server).
We defineA4 advantage as(3)AdvA4IND-CCA=Prb=b′-12.
Finally, we define the public verifiability security. Any adversary can not forge a challenge response without the complete ciphertext.
In public verifiability security model, the challenger generates key pairs(pks,sks),(pkr,skr) and sends public keys pks,pkr and secret key sks to the adversary A5. The challenger B generates a query request chw and sends it to adversary. The adversary A5 forges challenge response R′ and sends it to challenger. Finally, the challenger outputs a bit b as its verification result.Box 4:Game IND-CCA ExpA4CCA.
( p k s , s k s , p k r , s k r ) ← K e y G e n ( s p ); ( m 0 , m 1 , w ∗ ) ← A 4 O 1,2 ( s p , ( p k s , s k s ) , p k r ); u b ← B ( w ∗ , m b , p k s , p k r , b ∈ { 0,1 } , w ∗ ≠ m 0 , w ∗ ≠ m 1 ); b ′ ← A 4 O 1,2 ( u b , g u e s s ); Then return 1, ifb′=b; else return 0. OracleO1(w): T w ← O ( p k s , s k r , w ); return{Tw} OracleO2(u): m ← O 2 ( s k r , u ); Ifu≠ub, return{m}, else return ⊥.Definition 5 (see Box5).
A secure data sharing scheme with designated server satisfies public verifiability security if no PPT adversaryA5 can win the game public verifiability (PV) with nonnegligible advantage, where B is the challenger and A5 is the cloud server.
We defineA5 advantage as(4)AdvA5PublicVerifiability=Prb=1.Box 5:Game PV ExpA5PV.
( p k s , s k s , p k r , s k r ) ← K e y G e n ( s p ); c h w ← B ( s p ); Forge challenge responseR′←A5(sp,chw,uw,pks,sks,pkr); b ∈ { 0,1 } ← B ( R ′ , τ , c h w ); If pass the verification process, then return1, else return0.


## 2.1. System Model

The system model of secure data sharing scheme with designated server that supporting public verifiability is shown in Figure2: there are four participants in this model including a data sender, a receiver, cloud server, and the third party verifier.Figure 2
Secure data sharing scheme with designated server model.First of all, data sender encrypts the document messagem by using receiver’s public key pkr and encryption algorithm enc to form message ciphertext Cj, encrypts the corresponding keyword wi by using cloud server’s public key pks, receiver’s public key pkr, and encryption algorithm peks to form keyword ciphertext Cwi, then binds the Cj and Cwi to form ciphertext u, and uploads the ciphertext u to cloud server; data sender also uses the cloud server public key pks, the receiver public key pkr, the keyword wi, the keyword ciphertext Cwi, and corresponding message ciphertext Cj to generate the verification tag τ and sends the verification tag τ to third party verifier.Secondly, the receiver uses its secret keyskr and cloud server’s public key pks to generate keyword trapdoor Tw with the verification trapdoor VKw and transmits Tw to cloud server. And then, cloud server uses the trapdoor Tw and ciphertext u to compute the matching result. If the keyword in the ciphertext u and the keyword in the trapdoor Tw are equal, cloud server returns the ciphertext u to receiver. Next, to obtain the message m, the receiver decrypts the u by using its secret key skr.In final step, when there is a dispute between cloud server and receiver, the third party verifier uses the verification trapdoorVKw from receiver, the verification tag τ, and returns the verification result.


## 2.2. Scheme Definition

Definition 1.
More specifically, a secure data sharing scheme with designated server consists of the following algorithms:
(1)sp←SysGen1k: on input a security parameter 1k and output a system parameter sp.
(2)(pkr,skr)←KeyGenreceiversp: on input the system parameter sp and output a pair of public and secret key (pkr,skr) for the receiver.
(3)pks,sks←KeyGenserversp: on input the system parameter sp and output a pair of public and secret key (pks,sks) for the cloud server.
(4)u←Encsp,pks,pkr,w,m: on input the system parameter sp, the cloud server public key pks, the receiver public key pkr, the keyword w, the document message m and output a ciphertext u=(Cj,Cw,σ), which Cj=enc(sp,pkr,m) is message ciphertext, Cw=peks(sp,pks,pkr,w) is keyword ciphertext, σ is a binding tag.
(5)τwi←Tagsp,pks,pkr,wi,Cwi,Cj: on input the system parameter sp, the cloud server public key pks, the receiver public key pkr, the keyword wi, the keyword ciphertext Cwi and the message ciphertext Cj, which i is the serial number of the keyword and j is the message serial number corresponded the keyword wi, and output the verification tag τwi, releases τwi to the third party verifier.
(6)Tw,VKw←Trapdoorsp,pks,skr,w: on input the system parameter sp, the cloud server public key pks, the receiver secret key skr, the keyword w, and output the keyword search trapdoor Tw, the verification trapdoor VKw.
(7)uor⊥←Testsp,sks,Tw,u: on input the system parameter sp, the cloud server secret key sks, the keyword search trapdoor Tw, the ciphertext u, and output ciphertext u if the keyword in the u and the keyword in the Tw are equal; otherwise, output ⊥.
(8)mor⊥←Dec(sp,skr,u): on input the system parameter sp, the receiver secret key skr, the ciphertext u and output the message m or ⊥.
(9)1or0←Publicverify(sp,VKw,τ): when there is a dispute between cloud server and receiver, the third party verifier inputs the system parameter sp, the verification trapdoor VKw, the verification tag τ, output the verification result 1 if satisfies condition; and 0 otherwise.


## 2.3. Security Model

We define four security models, including the security models of IND-CKA, trapdoor indistinguishability (IND-Trapdoor), IND-CCA, and the public verifiability.We define the keyword ciphertext semantic security. Any adversary can not distinguish the challenge keyword ciphertext unless the trapdoor is available. Formally, we define security game IND-CKAi played between a challenger B and adversary Ai,i=1,2.In IND-CKA 1, the challengerB generates the receiver key pair (pkr,skr) and sends public key pkr to the cloud server adversary A1. The adversary A1 generates the cloud server key pair (pks,sks) and sends public key pks to the challenger. The adversary can access the trapdoor oracle O1(w) to get any keyword trapdoor wi and access the decryption oracle O2(u) on any ciphertexts u and then outputs two distinct challenge keywords and a message (w0,w1,m∗), in which wb≠wi,b∈{0,1}. The challenger generates challenge ciphertext ub of (wb,m∗) with a random bit b and sends it to A1. During the game, the adversary can adaptively continue the query to decryption oracle O2(u) and trapdoor oracle O1(w) unless the challenge keywords. Finally, the adversary A1 outputs a bit b′ as its guess.In IND-CKA 2, the game played between a challengerB and an outside adversary A2 is similar to IND-CKA 1. The details are in the following definition.Definition 2 ((IND-CKA) see Boxes1 and 2).
A secure data sharing scheme with designated server is IND-CKA secure if no probabilistic polynomial time (PPT) adversaryA1 can win game IND-CKA 1 and PPT adversary A2 can win game IND-CKA 2 with nonnegligible advantage, where B is the challenger, A1 is cloud server, and A2 is the outside adversary (including a receiver).
We defineAi advantage as(1)AdvAiIND-CKA=Prb=b′-12,i∈1,2.
Next, we define the keyword trapdoor semantic security. Any adversary can not distinguish the challenge trapdoor; that is to say, the challenge trapdoor does not reveal any information about the keyword. The IND-Trapdoor is similar to the IND-CKA 1. The adversary is given the challenge trapdoor instead of the challenge ciphertext. In IND-Trapdoor security model, the challengerB generates two key pairs (pks,sks),(pkr,skr) and sends public keys pks,pkr to the adversary A3. A3 can access the trapdoor oracle O1(w) to get any keyword trapdoor wi and outputs two distinct challenge keywords (w0,w1), in which wb≠wi,b∈{0,1}. The challenger generates challenge trapdoor Tb of wb with a random bit b and sends it to A3. During the game, the adversary A3 can adaptively continue to query trapdoor oracle O1(w) unless the challenge keywords. Finally, the adversary A3 outputs b′ as its guess.Box 1:Game IND-CKA 1 ExpA1CKA.
K s e t ← ϕ ( p k s , s k s , p k r , s k r ) ← K e y G e n ( s p ); ( w 0 , w 1 , m ∗ ) ← A 1 O 1,2 ( s p , ( p k s , s k s ) , p k r ); u b ← B ( m ∗ , w b , p k s , p k r , b ∈ { 0,1 } ); b ′ ← A 1 O 1,2 ( u b , g u e s s ); if{w0,w1}⋂‍Kset=ϕ, then return 1, if b′=b; else return 0. OracleO1(w): K s e t = K s e t ⋃ { w }, Tw←O(pks,skr,w); return{Tw} OracleO2(u): m ← O 2 ( s k r , u ); return{m}Box 2:Game IND-CKA 2 ExpA2CKA.
( p k s , s k s , p k r , s k r ) ← K e y G e n ( s p ); ( w 0 , w 1 , m ∗ ) ← A 2 O 2 ( s p , ( p k r , s k r ) , p k s ); u b ← B ( w b , m ∗ , p k s , p k r , b ∈ { 0,1 } ); b ′ ← A 2 ( u b , g u e s s ); then return 1, ifb′=b; else return 0. OracleO2(u): m ← O 2 ( s k r , u ); return{m}Definition 3 ((IND-Trapdoor); see Box3).
A secure data sharing scheme with designated server satisfies trapdoor indistinguishability if no PPT adversaryA3 can win the game IND-Trapdoor with nonnegligible advantage, where B is the challenger and A3 is an outside adversary.
We defineA3 advantage as(2)AdvA3IND-Trapdoor=Prb=b′-12.
After that, we define the document message ciphertext semantic security. Any adversary can not distinguish the challenge message ciphertext; even it can access the decryption oracleO2(u). Formally, we define security game IND-CCA.
The IND-CCA is similar to the IND-CKA 1. The difference is that the adversary outputs two distinct challenge message and a keyword(m0,m1,w∗). The challenger generates challenge ciphertext ub of (w∗,mb) with a random bit b∈{0,1} and sends it to A4. During the game, the adversary can adaptively continue the query to trapdoor oracle O1(w) and decryption oracle O2(u) unless the challenge ciphertext ub. We omit the details here.Box 3:Game IND-Trapdoor ExpA3.
K s e t ← ϕ ( p k s , s k s , p k r , s k r ) ← K e y G e n ( s p ); ( w 0 , w 1 ) ← A 3 O 1 ( s p , p k s , p k r ); T b ← B ( w b , p k s , s k r , b ∈ { 0,1 } ); b ′ ← A 3 O 1 ( T b , g u e s s ); if{w0,w1}⋂‍Kset=ϕ, then return 1, if b′=b; else return 0. OracleO1(w): K s e t = K s e t ⋃ ‍ { w }, Tw←O1(pks,skr,w); return{Tw}Definition 4 ((IND-CCA); see Box4).
A secure data sharing scheme with designated server is IND-CCA secure if no PPT adversaryA4 can win the game IND-CCA with nonnegligible advantage, where B is the challenger and A4 is an adversary (including the server).
We defineA4 advantage as(3)AdvA4IND-CCA=Prb=b′-12.
Finally, we define the public verifiability security. Any adversary can not forge a challenge response without the complete ciphertext.
In public verifiability security model, the challenger generates key pairs(pks,sks),(pkr,skr) and sends public keys pks,pkr and secret key sks to the adversary A5. The challenger B generates a query request chw and sends it to adversary. The adversary A5 forges challenge response R′ and sends it to challenger. Finally, the challenger outputs a bit b as its verification result.Box 4:Game IND-CCA ExpA4CCA.
( p k s , s k s , p k r , s k r ) ← K e y G e n ( s p ); ( m 0 , m 1 , w ∗ ) ← A 4 O 1,2 ( s p , ( p k s , s k s ) , p k r ); u b ← B ( w ∗ , m b , p k s , p k r , b ∈ { 0,1 } , w ∗ ≠ m 0 , w ∗ ≠ m 1 ); b ′ ← A 4 O 1,2 ( u b , g u e s s ); Then return 1, ifb′=b; else return 0. OracleO1(w): T w ← O ( p k s , s k r , w ); return{Tw} OracleO2(u): m ← O 2 ( s k r , u ); Ifu≠ub, return{m}, else return ⊥.Definition 5 (see Box5).
A secure data sharing scheme with designated server satisfies public verifiability security if no PPT adversaryA5 can win the game public verifiability (PV) with nonnegligible advantage, where B is the challenger and A5 is the cloud server.
We defineA5 advantage as(4)AdvA5PublicVerifiability=Prb=1.Box 5:Game PV ExpA5PV.
( p k s , s k s , p k r , s k r ) ← K e y G e n ( s p ); c h w ← B ( s p ); Forge challenge responseR′←A5(sp,chw,uw,pks,sks,pkr); b ∈ { 0,1 } ← B ( R ′ , τ , c h w ); If pass the verification process, then return1, else return0.


## 3. A Secure Data Sharing Scheme with Designated Server

In this section, we propose an efficient construction of secure data sharing scheme with designated server.


### 3.1. Our Construction

Our secure data sharing scheme with designated server is described as follows:A symmetric bilinear pair isPG=(G1,GT,g,p,e), where G1, GT are cyclic multiplicative groups of prime order p and g is a generator of G1. Bilinear mapping e:G1×G1→GT satisfies the following properties: bilinearity: for any α,β∈Zp∗, e(gα,gβ)=e(g,g)αβ; computability: for any A,B∈G1, we can effectively calculate e(A,B); nondegeneracy: e(g,g) is a generator of GT.S y s G e n 1 k: this algorithm inputs a security parameter 1k and generates symmetric bilinear pair PG=(G1,GT,g,p,e), in which G1 and GT are two cyclic multiplicative groups of prime order p and g is generator of G1. H1:G1→{0,1}d,H2:{0,1}∗→G1,H3:{0,1}∗→{0,1}d,H4:{0,1}∗→{0,1}v,H5:{0,1}∗→Zp∗ are cryptography hash functions. f is a pseudo-random function, f:{0,1}k×{0,1}log2l→Zp∗. u,u~∈G1 are randomly chosen elements. d,v,l are bit length. The algorithm outputs the system parameter (5)sp=PG,H1,H2,H3,H4,H5,f,u,u~.KeyGenreceiver(sp): this algorithm inputs system parameter sp, chooses random number β∈Zp∗, and outputs a pair of public and secret key (pkr,skr) for the receiver: (6)pkr=pkr1,pkr2=gβ,u~β,skr=β.KeyGenserver(sp): this algorithm inputs system parameter sp, chooses random number α∈Zp∗, and outputs a pair of public and secret key (pks,sks) for the cloud server:(7)pks=pks1,pks2=gα,u1/α,sks=α.Enc(sp,pks,pkr,wi,mj): this algorithm inputs system parameter sp, the cloud server public key pks, the receiver public key pkr, the keyword wi, in which i=1,2,…,n are the serial number of the keyword, and the message mj∈{0,1}d, in which j=1,2,…,l are the message serial number corresponding to the keyword wi. It chooses random number r,r′∈Zp∗ and outputs the ciphertext: (8)uij=Cj,Cwi,σ, where message ciphertext is Cj=[Cj,1,Cj,2], (9)Cj,1=gr,k=pkr1r,Cj,2=H1k⊕mj; and keyword ciphertext is Cwi=[A,B](10)A=pkr1r′,B=H3eH2wi,pks1r′; and the binding tag is σ=H4(k,mj,Cj,Cwi).T a g ( s p , p k s , p k r , w i , C w i , C j ): this algorithm inputs system parameter sp, the cloud server public key pks, the receiver public key pkr, the keyword wi, the keyword ciphertext Cwi, and the message ciphertext Cj, in which i=1,2,…,n are the serial number of the keyword and j=1,2,…,l are the message serial number correspond the keyword wi. It outputs the verification tag τwi and releases it to the third party verifier. (11)τwi=τ1,τij=pks1H5wipkr1,gH5Cwi∥Cj.Trapdoor(sp,pks,skr,w): this algorithm inputs system parameter sp, the cloud server public key pks, the receiver secret key skr, and the keyword w and outputs the search trapdoor (12)Tw=T1,T2=gr1,H2w1/skr·pks1r1. We have the verification trapdoor VKw: (13)VKw=pks1H5wpkr1.Test(sp,sks,Tw,u): this algorithm inputs system parameter sp, the cloud server secret key sks, the trapdoor Tw, and the ciphertext u and outputs ciphertext u if (14)B=H3eA,T2T1skssks, and ⊥ otherwise.D e c ( s p , s k r , u ): this algorithm inputs system parameter sp, the receiver secret key skr, and the ciphertext u and outputs the message (15)m=Cj,2⊕H1Cj,1skr, if (16)σ=H4C1skr,m,Cj,Cwi and ⊥ otherwise.P u b l i c   v e r i f y ( s p , V K w , τ , u ): when there is a dispute between cloud server and receiver, this algorithm inputs system parameter sp, the verification trapdoor VKw, the verification tag τ, and the ciphertext u and outputs the verification result 1 if satisfying verification condition, and 0 otherwise. The verification process can be divided into three steps:(i)
Challengequery(sp): the third party verifier inputs the system parameter sp and chooses random number t∈[1,2k-1],s∈Zp∗. It keeps the s as a secret value and stores it. It outputs the challenge query chw and sends it to cloud server, (17)chw=<t,g2=gs>.(ii)
GenProof(chw,sp,u): the server inputs the returned ciphertext u, the system parameter sp, and the challenge query chw. It computes aj=ft(j) and outputs the challenge response (18)R=g2∑j∈1,…,lajH5Cw∥Cj.(iii)
Verify(sp,VKw,τw,R,s): the third party verifier inputs the system parameter sp, the verification trapdoor VKw, the verification tag τw, the challenge response R, and the secret value s. By the VKw and τw=[τ1,τij], if the VKw=τ1, it can get the τij and compute (19)aj=ftj,R′=∏j∈1,…,lτijajs.It outputs result 1, if R=R′ and 0 otherwise.


### 3.2. Proof of Construction

In the following theorems, we will prove that our scheme satisfies keyword ciphertext security and trapdoor indistinguishability security, document ciphertext security, and the public verifiability security in the proposed security model.We will prove that our scheme is based on 1-BDHI, BDH, DDH, and CDH hard problems.G1 and GT in the following problems are groups of prime order p from bilinear paring unless otherwise is specified.(1-BDHI)[25]. The 1-Bilinear Diffie-Hellman Inversion Problem: given the two tuples (g,ga), where g,ga∈G1, all polynomial time algorithms compute the value e(g,g)1/a∈GT is hard.(BDH)[25]. The Bilinear Diffie-Hellman Problem: given the four tuple (g,ga,gb,gc), where ga,gb,gc∈G1, all polynomial time algorithms compute the value e(g,g)abc∈GT is hard.Theorem 6.
Under 1-BDHI and BDH hard problems, the secure data sharing scheme with designated server satisfies the keyword ciphertext indistinguishability in random oracle model.Proof.
(1) Suppose there is a cloud server adversaryA1 that can break our scheme in the IND-CKA 1 security model with advantage ε. In order to solve the 1-BDHI hard problem, let us construct a simulator B with a problem instance (g,gx) over the cyclic group (G1,g,p). Our goal is to compute the value e(g,g)1/x.
The entire simulation process includes the following phases:
Setup. Let sp=(PG,H1,H2,H3,H4,H5,f,u,u~). The simulator B chooses random elements t,t′∈Zp∗ and sets the u=gt,u~=gt′. It randomly chooses a∈Zp∗, and it sets (20)pkr1=gxa,pkr2=u~xa=gt′xa,skr=xa, in which skr is unknown to simulator B. Simulator B sends the pkr=(pkr1,pkr2) to the adversary A1. A1 randomly chooses α∈Zp∗ and sets (21)pks1=gα,pks2=u1/α=gt/α,sks=α. Adversary A1 sends the pks=(pks1,pks2) to the simulator B.
Hash Query
H 1 -Query. The adversary A1 can query ki∈G1 to H1. If there exists a <ki,Xi> in H1 list, then the simulator B responds with H1(ki)=Xi; otherwise, the simulator B randomly chooses a value Xi, returns to the adversary A1, and adds the value <ki,Xi> to H1 list. The H1 list is initially empty.
H 2 -Query. The adversary A1 can query wi to H2. The simulator maintains a list of tuples <wi,vi,di,ei> and the H2 list is initially empty. If there exists a wi in H2 list, then the simulator B responds with H2(wi)=vi; otherwise, the simulator B generates a random coin di∈{0,1}, pr[di=0]=1/qT+1. It randomly chooses ei∈Zp∗, sets vi=gei if di=0, and sets vi=gxei if di=1 and adds the value <wi,vi,di,ei> to H2 list.
H 3 -Query. The adversary A1 can query ti to H3. If there exists a <ti,Vi> in H3 list, then the simulator B responds with H3(ti)=Vi; otherwise, the simulator B randomly chooses a value Vi, returns to the adversary A1, and adds the value <ti,Vi> to H3 list. The H3 list is initially empty.
H 4 -Query. The adversary A1 can query (ki,mi,Cj,Cwi) to H4. If there exists a ((ki,mi,Cj,Cwi),σi) in H4 list, then the simulator B responds with H4(ki,mi,Cj,Cwi)=σi; otherwise, the simulator B randomly chooses a value σi, returns to the adversary A1, and adds the value to H4 list. The H4 list is initially empty.
Decryption Query. The adversary A1 can query u to decryption oracle. uij=(Cj,Cwi,σ) is a decryption query. First, the simulator checks the H4 list, if a tuple <(ki,mi,Cj,Cwi),σi> exists, and satisfies e(g,ki)=e(Cj,1,pkr1); the simulator checks H1 list whether Cj,2=mi⊕H1(ki), if it satisfies the condition, and then returns mi or otherwise returns ⊥.
Trapdoor Query. The adversary A1 can query wi to trapdoor oracle. First the simulator checks the H2 list; if di=0, the simulation aborts. Otherwise, the simulator computes (22)Tw=T1,T2=gr′,gxei/axgαr′, in which r′ is randomly chosen from Zp∗. Therefore, the simulator completed the trapdoor query and the trapdoor is correct.
Challenge. The adversary A1 gives two challenge words w0, w1 and the message m∗ to the simulator B, wb≠wi,b∈{0,1}. The simulator returns a ciphertext uwb, in which b∈{0,1} is randomly chosen. First the simulator checks the H2 list; if both d0=1 and d1=1, the simulation aborts. Otherwise, the simulator selects the db=0, randomly chooses r∈Zp∗,h∈Zp∗,V∗∈{0,1}d, and computes the ciphertext uwb=(Cj,Cwb,σ) as(23)Cj=Cj,1,Cj,2,Cj,1=gr,k=pkr1r,Cj,2=H1k⊕m∗, and Cwb as(24)Cwb=A,B=gxah/xα=pks21/tha,V∗,σ=H4k,m∗,Cj,Cwb,r′=hxα, in which r′ is unknown for simulator B. The ciphertext uwb is a correct challenge ciphertext.
Trapdoor Query. The adversary A1 adaptively makes trapdoor query on wi,wi≠w0,w1. The simulator B computes the trapdoor as the above trapdoor query.
Decryption Query. The adversary A1 can query u to decryption oracle similar above decryption query.
Guess. The adversary A1 outputs bit b′ as its guess.
Through the above description, we have completed the simulation process of the scheme and the simulation is correct. Next we will discuss the indistinguishability of the simulation.
When the hash query is not a challenge hash querye(H2(wb),pks1)r′=e(geb,gα)h/xα, the response for the decryption query, trapdoor query, and challenge ciphertext are correct. All random numbers in simulation process are random and independent. Random numbers included (25)X1,X2,…,XqH1,v1,v2,…,vqH2V1,V2,…,VqH3,σ1,σ2,…,σqH4,a,α,t,t′,r,h. Therefore, the simulation of the scheme is indistinguishable.
When the hash query is not a challenge hash query, the challenge ciphertext is randomness. Therefore, the adversary wins the game with an advantage0.
As the assumption, frome(H2(wb),pks1)r′=e(gα,geb)h/xα, we can find the BDHI problem solution e(g,g)1/x and the finding probability Pc=1/qH3.
Next we will discuss the successful of the simulation; the simulator does not abort the simulation in trapdoor query and challenge phase. The probability analysis can be seen in the paper [1]. we omit here the probability Psuccessful=1/eqT. Therefore, the simulator solves the advantage of the 1-BDHI hard problem is (26)εR=εeqTqH3.
(2) Suppose there is an outside adversaryA2 (including the receiver) that can break our scheme in IND-CKA 2 security model with advantage ε. In order to solve the BDH hard problem, let us construct a simulator B with a problem instance (g,ga,gb,gc) over the cyclic group (G1,g,p). Our goal is to compute the value e(g,g)abc.
The entire simulation process includes the following phases.
Setup. Let sp=(PG,H1,H2,H3,H4,H5,f,u,u~). The simulator B randomly chooses t1, t2∈Zp∗ and sets the h1=ga,h2=gb,h3=gc,u=h1t1,u~=h3t2, and it randomly chooses t3∈Zp∗ and sets (27)pks1=gat3,pks2=u1/at3=gt1/t3,sks=at3, in which sks is unknown to the simulator B. The simulator B sends the pks=(pks1,pks2) to the adversary A2. The A2 randomly chooses β∈Zp∗ and generates (28)pkr1=gβ,pkr2=u~β,skr=β. The adversary A2 sends pkr=(pkr1,pkr2) to simulator B.
Hash Query
H 1 -Query. The adversary A2 can query ki∈G1 to H1. If there exists a <ki,Xi> in H1 list, the simulator B responds with H1(ki)=Xi. Otherwise, the simulator B randomly chooses a value Xi and returns to the adversary A2. It adds the value <ki,Xi> to H1 list. The H1 list is initially empty.
H 2 -Query. The adversary A2 can query wi to H2. The simulator maintains a list of tuples <wi,vi,ei> and the H2 list is initially empty. If there exists a wi in H2 list, the simulator B responds with H2(wi)=vi. Otherwise, the simulator B randomly chooses ei∈Zp∗, sets vi=gbei, and adds the value to H2 list.
H 3 -Query. The adversary A2 can query ti to H3. If there exists a ti in H3 list, the simulator B responds with H3(ti)=Vi. Otherwise, the simulator B randomly chooses a value Vi∈G1, returns to the adversary A2, and adds the value to H3 list. The H3 list is initially empty.
H 4 -query. The adversary A2 can query (ki,mi,Cj,Cwi) to H4. If there exists a ((ki,mi,Cj,Cwi),σi) in H4 list, the simulator B responds with H4(ki,mi,Cj,Cwi)=σi. Otherwise, the simulator B randomly chooses a value σi, and returns to the adversary A4 and adds the value to H4 list. The H4 list is initially empty.
Decryption Query. The adversary A2 can query u to decryption oracle. uij=(Cj,Cwi,σ) is a decryption query. First, the simulator needs check the H4 list, if a tuple <(ki,mi,Cj,Cwi),σi> exist and satisfie e(g,ki)=e(Cj,1,pkr1), the simulator checks H1 list and whether Cj,2=m⊕H1(ki); if it satisfies the condition, m returns; otherwise, ⊥ returns.
Challenge. The adversary A2 gives two challenge words w0, w1 and the message m∗ to the simulator B. The simulator randomly chooses r,t4∈Zp∗,V∗∈{0,1}d and returns a ciphertext uwb1, in which b1∈{0,1} is randomly chosen. The ciphertext uwb1=(Cj,Cwb1,σ) as(29)Cj=Cj,1,Cj,2,Cj,1=gr,k=pkr1r,C2=H1k⊕m∗, and Cwb1 as (30)Cwb1=A,B=pkr1r′=pkr2t4/t2,V∗,σ=H4k,m,Cj,Cwi,r′=ct4, in which r′ is unknown for simulator B. The ciphertext uwb1 is a correct challenge ciphertext.
Decryption Query. The adversary A2 can query u to decryption oracle similar above decryption query.
Guess. The adversary A2 outputs bit b1′ as its guess.
Through the above description, we have completed the simulation process of the scheme and the simulation is correct. Next we will discuss the indistinguishability of the simulation.
When the hash query is not a challenge hash querye(H2(wb1),pks1)r′=e(g,g)abct4t3eb1, the response for the decryption query and challenge ciphertext are correct. All random numbers in simulation process are random and independent. Random numbers includes (31)X1,X2,…,XqH1,v1,v2,…,vqH2V1,V2,…,VqH3,σ1,σ2,…,σqH4,a,b,c,r,t1,t2,t3,t4. Therefore, the simulation of the scheme is indistinguishable.
When the hash query is not a challenge hash querye(H2(wb1),pks1)r′=e(g,g)abct4t3eb1, the challenge ciphertext is randomness. Therefore, the adversary wins the game with an advantage 0.
As an assumption, from the challenge hash querye(H2(wb1),pks1)r′=e(g,g)abct4t3eb1, we can find the BDH problem solution e(g,g)abc and the probability Pc=1/qH3.
Next we will discuss the successful of the simulation; the simulator does not abort the simulation in challenge phase. Therefore, the simulator solves the advantage of the BDH hard problem is(32)εR=εqH3.
Therefore, Theorem6 has been proven.We will prove that our schemes are trapdoor indistinguishability following DDH hard problem in Theorem7.(DDH)[25]. The Diffie-Hellman Hard Problem: given the four tuple (g,ga,gb,gc), where ga,gb,gc∈G1, all polynomial time algorithms decide the value c=?ab is hard.Theorem 7.
Under DDH hard problem, the secure data sharing scheme with designated server satisfies the trapdoor indistinguishability in standard model, where the security reduction loss isL=1.Proof.
Suppose there is an outside adversaryA3 that can break our scheme in IND-Trapdoor security model with advantage ε. In order to solve the DDH hard problem, let us construct a simulator B with a problem instance (g,ga,gb,gc) over the cyclic group (G1,g,p). Our goal is to decide whether c=ab.
The entire simulation process includes the following phases:
Setup. Let sp=(PG,H1,H2,H3,H4,H5,f,u,u~). The simulator B randomly chooses t,t′,β∈Zp∗ and sets (33)u=gat,u~=gt′,pkr1=gβ,pkr2=u~β=gt′β,skr=β. The simulator B randomly chooses l∈Zp∗ and generates key pair (34)pks1=gal,pks2=gt/l,sks=al, in which sks is unknown to simulator B. The simulator B sends pks=(pks1,pks2) and pkr=(pkr1,pkr2) to adversary A3.
Trapdoor Query. The adversary A3 can query wi to trapdoor oracle. The simulator computes (35)Tw=T1,T2=gr′,H1wi1/βgalr′, in which r′ is randomly chosen from Zp∗. Therefore, the simulator completed the trapdoor query and the trapdoor is correct.
Challenge. The adversary A3 gives two challenge words w0, w1 to the simulator B, wb1≠wi. b1∈{0,1} is randomly chosen. The simulator returns a trapdoor (36)Twb1=T1,T2=gb/l,H2wb11/βgc, in which r′=b/l is unknown to simulator and gc is a component of the DDH challenge.
Whengc=gab,Twb1 is a valid challenge trapdoor for wb1.
Trapdoor Query. The adversary A3 adaptively makes trapdoor query on wi, wi≠w0,w1. The simulator B computes trapdoor as the above trapdoor query.
Guess. The adversary A3 outputs bit b1′ as its guess.
Through the above description, we have completed the simulation process of the scheme and the simulation is correct. Next we will discuss the indistinguishability of the simulation.
Whenc=ab, the response for trapdoor query and challenge trapdoor are correct. All random numbers in simulation process are random and independent. Random numbers included a,b,c,r′,b/l. So the simulation of the scheme is indistinguishable. The adversary wins the game with a probability of 1/2+ε as the breaking assumption.
Whenc≠ab, since the challenge trapdoor is randomness for the adversary A3, therefore, the adversary A3 wins the game with a maximum probability of 1/2.
Next we will discuss the successful of the simulation; the simulator does not abort the simulation in trapdoor query and challenge phase. Therefore, the probabilityPsuccessful=1.
Therefore, the simulator solves the advantage of the HDH hard problem as follows:(37)εR=12+ε-12=ε.We will prove that our scheme are IND-CCA secure following CDH hard problem in Theorem8.(CDH)[25]. The Computational Diffie-Hellman Problem: given the three tuple (g,ga,gb), g,ga,gb∈G1, where G1 is a general cyclic group of prime order p, all polynomial time algorithms compute the value gab∈G1 is hard.Theorem 8.
Under CDH hard problem, the secure data sharing scheme with designated server satisfies document ciphertext indistinguishability in random oracle model, where the security reduction loss isL=2vqH1/2v-qD.Proof.
Suppose there is an adversary (including a malicious server)A4 that can break our secure data sharing scheme with designated server in IND-CCA security model with advantage ε. In order to solve the CDH hard problem, let us construct a simulator B with a problem instance (g,ga,gb) over the cyclic group (G1,g,p), and our goal is to compute the value gab.
The entire simulation process includes the following phases.
Setup. Let sp=(PG,H1,H2,H3,H4,H5,f,u,u~). The simulator B randomly chooses t,t′∈Zp∗ and sets u=gt,u~=gt′, (38)pkr1=gb,pkr2=u~b=gt′b,skr=b, In which skr is unknown to simulator B. Simulator B sends the pkr=(pkr1,pkr2) to the adversary A4. A4 randomly chooses α∈Zp∗ and generates (39)pks1=gα,pks2=gt/α,sks=α, It sends pks=(pks1,pks2) to the simulator B.
Hash Query
H 1 -Query. The adversary A4 can query ki∈G1 to H1. If e(g,ki)=e(ga,gb), the simulator aborts the simulation. Otherwise, if there exists a <ki,Xi> in H1 list, the simulator B responds with H1(ki)=Xi; otherwise, it randomly chooses a value Xi, returns to the adversary A4, and adds the value to H1 list. The H1 list is initially empty.
H 2 -Query. The adversary A4 can query wi to H2. The simulator maintains a list of tuples <wi,vi,ei> and the H2 list is initially empty. If there exists a wi in H2 list, the simulator B responds with H2(wi)=vi. Otherwise, the simulator B randomly chooses ei∈Zp∗, sets vi=gbei, and adds the value to H2 list.
H 3 -Query. The adversary A4 can query ti to H3. If there exists a ti in H3 list, the simulator B responds with H3(ti)=Vi. Otherwise, the simulator B randomly chooses a value Vi∈G1, returns to the adversary A4, and adds the value to H3 list. The H3 list is initially empty.
H 4 -Query. The adversary A4 can query (ki,mi,Cj,Cwi) to H4. If e(g,ki)=e(ga,gb), the simulator aborts the simulation. Otherwise, if there exists a (ki,mi,Cj,Cwi) in H4 list, the simulator B responds with H4(ki,mi,Cj,Cwi)=σi. Otherwise, it randomly chooses a value σi, returns to the adversary A4, and adds the value to H4 list. The H4 list is initially empty.
Decryption Query. The adversary A4 can query u to decryption oracle. uij=(Cj,Cwi,σ) is a decryption query. First, the simulator needs to check the H4 list; if a tuple <(ki,mi,Cj,Cwi),σi> exists and satisfies e(g,k)=e(Cj,1,pkr1), the simulator checks the H1 list and whether Cj,2=mi⊕H1(ki); if it satisfies the condition, then mi returns; otherwise ⊥ returns.
Trapdoor Query. The adversary A4 can query wi to trapdoor oracle. The simulator sets (40)Twi=T1,T2=gri,gbei/bH6gαri=geiH6gαri.ri is randomly chosen from Zp∗. Therefore, the simulator completed the trapdoor query and the trapdoor is correct.
Challenge. The adversary A4 gives two challenge messages m0,m1 and keyword w∗ (w∗≠m0,m1) to the simulator B. The simulator B returns a ciphertext umb1, in which b1∈{0,1}, r′∈Zp∗ and Z∗∈{0,1}d are randomly chosen. The ciphertext umb1 is as follows:(41)Cj=Cj,1,Cj,2,Cj,1=ga,C2=Z∗,H1k∗=Z∗⊕mb1,Cw∗=A,B=gbr′,H3eH2w∗r′,pks1. The simulator randomly chooses σ∗∈{0,1}f, defines (42)σ∗=H4k∗,mb1,Cj,Cw∗, and adds the <(-,mb1,Cj,Cw∗),σ∗> (B does not know the value k∗) to H4 list.
Trapdoor Query. The adversary A4 adaptively makes trapdoor query on wi. The simulator B computes trapdoor as the above trapdoor query.
Decryption Query. The adversary A4 can query u≠umb1 to decryption oracle similar to the above decryption query.
Guess. The adversary A1 outputs bit b1′ as its guess.
Through the above description, we have completed the simulation process of the scheme and the simulation is correct. Next we will discuss the indistinguishability of the simulation.
When the hash query is not a challenge hash queryk=gab, the response for the decryption query, trapdoor query, and challenge ciphertext are correct. All random numbers in simulation process are random and independent. Random numbers include X1,X2,…,XqH1,v1,v2,…,vqH2,V1,V2,…,VqH3,σ1,σ2,…, σqH4,a,b,t,t′,ri,r′. So the simulation of the scheme is indistinguishable.
When the hash query is not a challenge hash queryk=gab, the challenge ciphertext is randomness. Therefore, the adversary wins the game with an advantage 0.
As an assumption, fromH1(k), we can find the correct challenge hash query k=gab, Pc=1/qH1.
Next we will discuss the successful of the simulation, the simulator dose not abort the simulation in trapdoor query and decryption query.
When the valueH4(k,m,Cj,Cw) has been correctly guessed without invoking H4, the query <(k,m,Cj,Cw),σ> to decryption oracle will be aborted. Therefore, the probability (43)Psuccessful=1-qD2v, and the qD is the number decryption oracle queries.
Therefore, the simulator solves the advantage of the CDH hard problem as follows:(44)εR=εqH11-qD2v=ε2vqH1/2v-qD.Theorem 9.
SinceH5 is a cryptography hash function, the secure data sharing scheme with designated server is public verifiability secure.Proof.
Suppose there is a malicious serverA5 that can break our secure data sharing scheme with designated server in public verifiability security model. Let us construct a simulator B which simulates the scheme. The adversary A5 can forge a response R for the search keyword w and satisfy the equation (sp,VKw,τw,R,s)=1. Since the formula R=R′ is established, the simulator can compute the equation (45)∑j∈1,…,lajH5Cw~∥Cj~=∏j∈1,…,lτijaj. Therefore, the adversary needs to compute the (46)H5Cw~∥Cj~=H5Cw∥Cj. Since H5 is a cryptography hash function, the probability that adversary outputs Cw~∥Cj~≠Cw∥Cj and makes the equation equal is negligible.About the verification tag security, we can also prove the tag security for third party verifier by the security reduction; we omit the details here.


### 3.3. Performance Analysis

We use Tables1 and 2 to show two comparisons between our secure data sharing scheme with designated server and previous schemes. In this section, the word abbreviation Trap Ind, Ciph Ind, Offline KGA, PVS, SKA, and keyword Ciph denote trapdoor indistinguishability, ciphertext indistinguishability, offline keyword guessing attacks, public verifiability security, swapping keyword attacks, and keyword ciphertext, respectively. We use e,E1,E2,h,PM to denote a pairing operation, an exponentiation operation in G1, an exponentiation operation in G2, a hash operation which map a string to an element of cyclic group, and a multiplication in G1, respectively. We ignore other hash operation and multiplication.Table 1
Computation cost comparison (ms).
BDOP [1]. BSW [5]. CZLZ [6]. Our. Keyword Ciph 2 E 1 + h + e = 6.686 E 1 + E 2 + h + 2 e = 6.218 2 E 1 + 4 E 2 + h + 4 e + P M = 9.069 E 1 + E 2 + h + e = 5.406 Trapdoor E 1 + h = 4.495 E 1 + h = 4.495 3 E 1 + 3 P M = 4.410 3 E 1 + h + P M = 7.014 Test e = 0.812 E 1 + e + P M = 2.282 5 E 1 + h + 4 e + 3 P M = 13.532 E 1 + E 2 + e = 2.290Table 2
Security comparison.
BDOP [1]. BSW [5]. CZLZ [6]. Our. Trap Ind NO NO NO YES Message Ciph Ind - YES YES YES Keyword Ciph Ind YES NO YES YES Off-line KGA NO NO NO YES SKA NO YES YES YES PVS NO NO NO YESTo evaluate the efficiency of our scheme, we implement these operations on a Core(TM) i7-6500U CPU of 2.50GHz 2.60GHz and 4GB RAM (3.89GB is available) running Ubantu 18.04. We use a Type-A pairing elliptic curve and implemented in the PBC library. For these four schemes, we test the running time of keyword ciphertext generation, trapdoor generation, and test algorithms, respectively.We first introduce some basic operation symbols. Every basic operation symbol denotes the running time of an operation in Table4.From Figures3 and 4 and Tables 1 and 4, we found that our scheme is efficient in terms of keyword ciphertext generation algorithm compared to BDOP [1], BSW [5], and CZLZ [6]. Since our scheme reduces some E1 modular exponentiation computations and e pairing computations, particularly, in CZLZ [6], the scheme requires the most computation cost due to 2E1 modular exponentiation computations, 4e pairing computations, and 1h hash computations per keyword ciphertext generation. In BDOP [1], the scheme requires the most computation cost due to 2E1 modular exponentiation computations, 1e pairing computations, and 1h hash computations per keyword ciphertext generation. In BSW [5], the scheme requires the most computation cost due to 1E1 modular exponentiation computations, 2e pairing computations, and 1h hash computations per keyword ciphertext generation. Our scheme requires the most computation cost due to 1E1 modular exponentiations computations, 1e pairing computations, and 1h hash computations per keyword ciphertext generation; therefore, our scheme is more efficient in terms of keyword ciphertext generation algorithm. As the number of keywords increases from 20 to 80 in Figure 4, we find that our scheme is also efficient.Figure 3
Computation cost of comparison.Figure 4
Computation cost of keyword ciphertext generation.From Figures3 and 5 and Tables 1 and 4, we found that our scheme is slightly higher than in terms of trapdoor generation algorithm. Since our scheme adds 2E1 modular exponentiation computations compared to BDOP [1] and BSW [5], however, it is worth noting that the trapdoor generation in our scheme is slightly higher than those of existing schemes. Since the BDOP [1], BSW [5], and CZLZ [6] suffer from trapdoor security attack, namely, offline KGA, we remove the secure channel between the cloud server and receiver for reducing the construction of secure channel costs. In addition, we can compress the trapdoor computation time from 7.014 ms to 2.876 ms. Since for the trapdoor Tw=[T1,T2]=[gr1,H2(w)1/skr·pks1r1], the H2(w)1/skr is the same value for the same keyword, therefore, we can reduce the E1+h computation time when using the same keyword.Figure 5
Computation cost of trapdoor generation.From Figures3 and 6 and Tables 1 and 4, we found that our scheme is efficient in terms of test algorithm compared to CZLZ [6], since our scheme reduces 3e pairing computations, 4E1 modular exponentiation computations, and 1h hash computations. However, our scheme is slightly higher than BDOP [1], since we add the 1E1+1E2 computation than BDOP [1]. But this is because we remove secure channel. In our scheme, only the designated server can search the keyword via encrypted documents and not need a secure channel between cloud server and receiver. The running test algorithm time of our scheme is almost the same as that of the BSW [5]. In addition, cloud computing has the advantages of unlimited capability in terms of both storage and computation. Therefore, it is acceptable to add a little time during the test phase for reducing the cost of establishing a secure channel.Figure 6
Computation cost of test algorithm.Furthermore, from Table2, we find that our scheme also offers stronger security than existing schemes, since our scheme satisfies the trapdoor indistinguishability security, ciphertext indistinguishability security, against offline keyword guessing attacks security, public verifiability security, against swapping keyword attacks security than other schemes. From Table 3, we find that our scheme also offers more functionality than existing schemes, since our scheme offers message and keyword encryption, message decryption, and search result’s public verifiability compared to other schemes.Table 3
Functionality comparison.
BDOP [1]. BSW [5]. ZH [7]. CZLZ [6]. Our. Message encryption NO NO YES YES YES Keyword encryption YES YES YES YES YES Message decryption NO NO YES YES YES PV NO NO NO NO YESTable 4
Running time of operations (ms).
e E 1 E 2 h P M 0.812 1.379 0.099 3.116 0.091


## 3.1. Our Construction

Our secure data sharing scheme with designated server is described as follows:A symmetric bilinear pair isPG=(G1,GT,g,p,e), where G1, GT are cyclic multiplicative groups of prime order p and g is a generator of G1. Bilinear mapping e:G1×G1→GT satisfies the following properties: bilinearity: for any α,β∈Zp∗, e(gα,gβ)=e(g,g)αβ; computability: for any A,B∈G1, we can effectively calculate e(A,B); nondegeneracy: e(g,g) is a generator of GT.S y s G e n 1 k: this algorithm inputs a security parameter 1k and generates symmetric bilinear pair PG=(G1,GT,g,p,e), in which G1 and GT are two cyclic multiplicative groups of prime order p and g is generator of G1. H1:G1→{0,1}d,H2:{0,1}∗→G1,H3:{0,1}∗→{0,1}d,H4:{0,1}∗→{0,1}v,H5:{0,1}∗→Zp∗ are cryptography hash functions. f is a pseudo-random function, f:{0,1}k×{0,1}log2l→Zp∗. u,u~∈G1 are randomly chosen elements. d,v,l are bit length. The algorithm outputs the system parameter (5)sp=PG,H1,H2,H3,H4,H5,f,u,u~.KeyGenreceiver(sp): this algorithm inputs system parameter sp, chooses random number β∈Zp∗, and outputs a pair of public and secret key (pkr,skr) for the receiver: (6)pkr=pkr1,pkr2=gβ,u~β,skr=β.KeyGenserver(sp): this algorithm inputs system parameter sp, chooses random number α∈Zp∗, and outputs a pair of public and secret key (pks,sks) for the cloud server:(7)pks=pks1,pks2=gα,u1/α,sks=α.Enc(sp,pks,pkr,wi,mj): this algorithm inputs system parameter sp, the cloud server public key pks, the receiver public key pkr, the keyword wi, in which i=1,2,…,n are the serial number of the keyword, and the message mj∈{0,1}d, in which j=1,2,…,l are the message serial number corresponding to the keyword wi. It chooses random number r,r′∈Zp∗ and outputs the ciphertext: (8)uij=Cj,Cwi,σ, where message ciphertext is Cj=[Cj,1,Cj,2], (9)Cj,1=gr,k=pkr1r,Cj,2=H1k⊕mj; and keyword ciphertext is Cwi=[A,B](10)A=pkr1r′,B=H3eH2wi,pks1r′; and the binding tag is σ=H4(k,mj,Cj,Cwi).T a g ( s p , p k s , p k r , w i , C w i , C j ): this algorithm inputs system parameter sp, the cloud server public key pks, the receiver public key pkr, the keyword wi, the keyword ciphertext Cwi, and the message ciphertext Cj, in which i=1,2,…,n are the serial number of the keyword and j=1,2,…,l are the message serial number correspond the keyword wi. It outputs the verification tag τwi and releases it to the third party verifier. (11)τwi=τ1,τij=pks1H5wipkr1,gH5Cwi∥Cj.Trapdoor(sp,pks,skr,w): this algorithm inputs system parameter sp, the cloud server public key pks, the receiver secret key skr, and the keyword w and outputs the search trapdoor (12)Tw=T1,T2=gr1,H2w1/skr·pks1r1. We have the verification trapdoor VKw: (13)VKw=pks1H5wpkr1.Test(sp,sks,Tw,u): this algorithm inputs system parameter sp, the cloud server secret key sks, the trapdoor Tw, and the ciphertext u and outputs ciphertext u if (14)B=H3eA,T2T1skssks, and ⊥ otherwise.D e c ( s p , s k r , u ): this algorithm inputs system parameter sp, the receiver secret key skr, and the ciphertext u and outputs the message (15)m=Cj,2⊕H1Cj,1skr, if (16)σ=H4C1skr,m,Cj,Cwi and ⊥ otherwise.P u b l i c   v e r i f y ( s p , V K w , τ , u ): when there is a dispute between cloud server and receiver, this algorithm inputs system parameter sp, the verification trapdoor VKw, the verification tag τ, and the ciphertext u and outputs the verification result 1 if satisfying verification condition, and 0 otherwise. The verification process can be divided into three steps:(i)
Challengequery(sp): the third party verifier inputs the system parameter sp and chooses random number t∈[1,2k-1],s∈Zp∗. It keeps the s as a secret value and stores it. It outputs the challenge query chw and sends it to cloud server, (17)chw=<t,g2=gs>.(ii)
GenProof(chw,sp,u): the server inputs the returned ciphertext u, the system parameter sp, and the challenge query chw. It computes aj=ft(j) and outputs the challenge response (18)R=g2∑j∈1,…,lajH5Cw∥Cj.(iii)
Verify(sp,VKw,τw,R,s): the third party verifier inputs the system parameter sp, the verification trapdoor VKw, the verification tag τw, the challenge response R, and the secret value s. By the VKw and τw=[τ1,τij], if the VKw=τ1, it can get the τij and compute (19)aj=ftj,R′=∏j∈1,…,lτijajs.It outputs result 1, if R=R′ and 0 otherwise.


## 3.2. Proof of Construction

In the following theorems, we will prove that our scheme satisfies keyword ciphertext security and trapdoor indistinguishability security, document ciphertext security, and the public verifiability security in the proposed security model.We will prove that our scheme is based on 1-BDHI, BDH, DDH, and CDH hard problems.G1 and GT in the following problems are groups of prime order p from bilinear paring unless otherwise is specified.(1-BDHI)[25]. The 1-Bilinear Diffie-Hellman Inversion Problem: given the two tuples (g,ga), where g,ga∈G1, all polynomial time algorithms compute the value e(g,g)1/a∈GT is hard.(BDH)[25]. The Bilinear Diffie-Hellman Problem: given the four tuple (g,ga,gb,gc), where ga,gb,gc∈G1, all polynomial time algorithms compute the value e(g,g)abc∈GT is hard.Theorem 6.
Under 1-BDHI and BDH hard problems, the secure data sharing scheme with designated server satisfies the keyword ciphertext indistinguishability in random oracle model.Proof.
(1) Suppose there is a cloud server adversaryA1 that can break our scheme in the IND-CKA 1 security model with advantage ε. In order to solve the 1-BDHI hard problem, let us construct a simulator B with a problem instance (g,gx) over the cyclic group (G1,g,p). Our goal is to compute the value e(g,g)1/x.
The entire simulation process includes the following phases:
Setup. Let sp=(PG,H1,H2,H3,H4,H5,f,u,u~). The simulator B chooses random elements t,t′∈Zp∗ and sets the u=gt,u~=gt′. It randomly chooses a∈Zp∗, and it sets (20)pkr1=gxa,pkr2=u~xa=gt′xa,skr=xa, in which skr is unknown to simulator B. Simulator B sends the pkr=(pkr1,pkr2) to the adversary A1. A1 randomly chooses α∈Zp∗ and sets (21)pks1=gα,pks2=u1/α=gt/α,sks=α. Adversary A1 sends the pks=(pks1,pks2) to the simulator B.
Hash Query
H 1 -Query. The adversary A1 can query ki∈G1 to H1. If there exists a <ki,Xi> in H1 list, then the simulator B responds with H1(ki)=Xi; otherwise, the simulator B randomly chooses a value Xi, returns to the adversary A1, and adds the value <ki,Xi> to H1 list. The H1 list is initially empty.
H 2 -Query. The adversary A1 can query wi to H2. The simulator maintains a list of tuples <wi,vi,di,ei> and the H2 list is initially empty. If there exists a wi in H2 list, then the simulator B responds with H2(wi)=vi; otherwise, the simulator B generates a random coin di∈{0,1}, pr[di=0]=1/qT+1. It randomly chooses ei∈Zp∗, sets vi=gei if di=0, and sets vi=gxei if di=1 and adds the value <wi,vi,di,ei> to H2 list.
H 3 -Query. The adversary A1 can query ti to H3. If there exists a <ti,Vi> in H3 list, then the simulator B responds with H3(ti)=Vi; otherwise, the simulator B randomly chooses a value Vi, returns to the adversary A1, and adds the value <ti,Vi> to H3 list. The H3 list is initially empty.
H 4 -Query. The adversary A1 can query (ki,mi,Cj,Cwi) to H4. If there exists a ((ki,mi,Cj,Cwi),σi) in H4 list, then the simulator B responds with H4(ki,mi,Cj,Cwi)=σi; otherwise, the simulator B randomly chooses a value σi, returns to the adversary A1, and adds the value to H4 list. The H4 list is initially empty.
Decryption Query. The adversary A1 can query u to decryption oracle. uij=(Cj,Cwi,σ) is a decryption query. First, the simulator checks the H4 list, if a tuple <(ki,mi,Cj,Cwi),σi> exists, and satisfies e(g,ki)=e(Cj,1,pkr1); the simulator checks H1 list whether Cj,2=mi⊕H1(ki), if it satisfies the condition, and then returns mi or otherwise returns ⊥.
Trapdoor Query. The adversary A1 can query wi to trapdoor oracle. First the simulator checks the H2 list; if di=0, the simulation aborts. Otherwise, the simulator computes (22)Tw=T1,T2=gr′,gxei/axgαr′, in which r′ is randomly chosen from Zp∗. Therefore, the simulator completed the trapdoor query and the trapdoor is correct.
Challenge. The adversary A1 gives two challenge words w0, w1 and the message m∗ to the simulator B, wb≠wi,b∈{0,1}. The simulator returns a ciphertext uwb, in which b∈{0,1} is randomly chosen. First the simulator checks the H2 list; if both d0=1 and d1=1, the simulation aborts. Otherwise, the simulator selects the db=0, randomly chooses r∈Zp∗,h∈Zp∗,V∗∈{0,1}d, and computes the ciphertext uwb=(Cj,Cwb,σ) as(23)Cj=Cj,1,Cj,2,Cj,1=gr,k=pkr1r,Cj,2=H1k⊕m∗, and Cwb as(24)Cwb=A,B=gxah/xα=pks21/tha,V∗,σ=H4k,m∗,Cj,Cwb,r′=hxα, in which r′ is unknown for simulator B. The ciphertext uwb is a correct challenge ciphertext.
Trapdoor Query. The adversary A1 adaptively makes trapdoor query on wi,wi≠w0,w1. The simulator B computes the trapdoor as the above trapdoor query.
Decryption Query. The adversary A1 can query u to decryption oracle similar above decryption query.
Guess. The adversary A1 outputs bit b′ as its guess.
Through the above description, we have completed the simulation process of the scheme and the simulation is correct. Next we will discuss the indistinguishability of the simulation.
When the hash query is not a challenge hash querye(H2(wb),pks1)r′=e(geb,gα)h/xα, the response for the decryption query, trapdoor query, and challenge ciphertext are correct. All random numbers in simulation process are random and independent. Random numbers included (25)X1,X2,…,XqH1,v1,v2,…,vqH2V1,V2,…,VqH3,σ1,σ2,…,σqH4,a,α,t,t′,r,h. Therefore, the simulation of the scheme is indistinguishable.
When the hash query is not a challenge hash query, the challenge ciphertext is randomness. Therefore, the adversary wins the game with an advantage0.
As the assumption, frome(H2(wb),pks1)r′=e(gα,geb)h/xα, we can find the BDHI problem solution e(g,g)1/x and the finding probability Pc=1/qH3.
Next we will discuss the successful of the simulation; the simulator does not abort the simulation in trapdoor query and challenge phase. The probability analysis can be seen in the paper [1]. we omit here the probability Psuccessful=1/eqT. Therefore, the simulator solves the advantage of the 1-BDHI hard problem is (26)εR=εeqTqH3.
(2) Suppose there is an outside adversaryA2 (including the receiver) that can break our scheme in IND-CKA 2 security model with advantage ε. In order to solve the BDH hard problem, let us construct a simulator B with a problem instance (g,ga,gb,gc) over the cyclic group (G1,g,p). Our goal is to compute the value e(g,g)abc.
The entire simulation process includes the following phases.
Setup. Let sp=(PG,H1,H2,H3,H4,H5,f,u,u~). The simulator B randomly chooses t1, t2∈Zp∗ and sets the h1=ga,h2=gb,h3=gc,u=h1t1,u~=h3t2, and it randomly chooses t3∈Zp∗ and sets (27)pks1=gat3,pks2=u1/at3=gt1/t3,sks=at3, in which sks is unknown to the simulator B. The simulator B sends the pks=(pks1,pks2) to the adversary A2. The A2 randomly chooses β∈Zp∗ and generates (28)pkr1=gβ,pkr2=u~β,skr=β. The adversary A2 sends pkr=(pkr1,pkr2) to simulator B.
Hash Query
H 1 -Query. The adversary A2 can query ki∈G1 to H1. If there exists a <ki,Xi> in H1 list, the simulator B responds with H1(ki)=Xi. Otherwise, the simulator B randomly chooses a value Xi and returns to the adversary A2. It adds the value <ki,Xi> to H1 list. The H1 list is initially empty.
H 2 -Query. The adversary A2 can query wi to H2. The simulator maintains a list of tuples <wi,vi,ei> and the H2 list is initially empty. If there exists a wi in H2 list, the simulator B responds with H2(wi)=vi. Otherwise, the simulator B randomly chooses ei∈Zp∗, sets vi=gbei, and adds the value to H2 list.
H 3 -Query. The adversary A2 can query ti to H3. If there exists a ti in H3 list, the simulator B responds with H3(ti)=Vi. Otherwise, the simulator B randomly chooses a value Vi∈G1, returns to the adversary A2, and adds the value to H3 list. The H3 list is initially empty.
H 4 -query. The adversary A2 can query (ki,mi,Cj,Cwi) to H4. If there exists a ((ki,mi,Cj,Cwi),σi) in H4 list, the simulator B responds with H4(ki,mi,Cj,Cwi)=σi. Otherwise, the simulator B randomly chooses a value σi, and returns to the adversary A4 and adds the value to H4 list. The H4 list is initially empty.
Decryption Query. The adversary A2 can query u to decryption oracle. uij=(Cj,Cwi,σ) is a decryption query. First, the simulator needs check the H4 list, if a tuple <(ki,mi,Cj,Cwi),σi> exist and satisfie e(g,ki)=e(Cj,1,pkr1), the simulator checks H1 list and whether Cj,2=m⊕H1(ki); if it satisfies the condition, m returns; otherwise, ⊥ returns.
Challenge. The adversary A2 gives two challenge words w0, w1 and the message m∗ to the simulator B. The simulator randomly chooses r,t4∈Zp∗,V∗∈{0,1}d and returns a ciphertext uwb1, in which b1∈{0,1} is randomly chosen. The ciphertext uwb1=(Cj,Cwb1,σ) as(29)Cj=Cj,1,Cj,2,Cj,1=gr,k=pkr1r,C2=H1k⊕m∗, and Cwb1 as (30)Cwb1=A,B=pkr1r′=pkr2t4/t2,V∗,σ=H4k,m,Cj,Cwi,r′=ct4, in which r′ is unknown for simulator B. The ciphertext uwb1 is a correct challenge ciphertext.
Decryption Query. The adversary A2 can query u to decryption oracle similar above decryption query.
Guess. The adversary A2 outputs bit b1′ as its guess.
Through the above description, we have completed the simulation process of the scheme and the simulation is correct. Next we will discuss the indistinguishability of the simulation.
When the hash query is not a challenge hash querye(H2(wb1),pks1)r′=e(g,g)abct4t3eb1, the response for the decryption query and challenge ciphertext are correct. All random numbers in simulation process are random and independent. Random numbers includes (31)X1,X2,…,XqH1,v1,v2,…,vqH2V1,V2,…,VqH3,σ1,σ2,…,σqH4,a,b,c,r,t1,t2,t3,t4. Therefore, the simulation of the scheme is indistinguishable.
When the hash query is not a challenge hash querye(H2(wb1),pks1)r′=e(g,g)abct4t3eb1, the challenge ciphertext is randomness. Therefore, the adversary wins the game with an advantage 0.
As an assumption, from the challenge hash querye(H2(wb1),pks1)r′=e(g,g)abct4t3eb1, we can find the BDH problem solution e(g,g)abc and the probability Pc=1/qH3.
Next we will discuss the successful of the simulation; the simulator does not abort the simulation in challenge phase. Therefore, the simulator solves the advantage of the BDH hard problem is(32)εR=εqH3.
Therefore, Theorem6 has been proven.We will prove that our schemes are trapdoor indistinguishability following DDH hard problem in Theorem7.(DDH)[25]. The Diffie-Hellman Hard Problem: given the four tuple (g,ga,gb,gc), where ga,gb,gc∈G1, all polynomial time algorithms decide the value c=?ab is hard.Theorem 7.
Under DDH hard problem, the secure data sharing scheme with designated server satisfies the trapdoor indistinguishability in standard model, where the security reduction loss isL=1.Proof.
Suppose there is an outside adversaryA3 that can break our scheme in IND-Trapdoor security model with advantage ε. In order to solve the DDH hard problem, let us construct a simulator B with a problem instance (g,ga,gb,gc) over the cyclic group (G1,g,p). Our goal is to decide whether c=ab.
The entire simulation process includes the following phases:
Setup. Let sp=(PG,H1,H2,H3,H4,H5,f,u,u~). The simulator B randomly chooses t,t′,β∈Zp∗ and sets (33)u=gat,u~=gt′,pkr1=gβ,pkr2=u~β=gt′β,skr=β. The simulator B randomly chooses l∈Zp∗ and generates key pair (34)pks1=gal,pks2=gt/l,sks=al, in which sks is unknown to simulator B. The simulator B sends pks=(pks1,pks2) and pkr=(pkr1,pkr2) to adversary A3.
Trapdoor Query. The adversary A3 can query wi to trapdoor oracle. The simulator computes (35)Tw=T1,T2=gr′,H1wi1/βgalr′, in which r′ is randomly chosen from Zp∗. Therefore, the simulator completed the trapdoor query and the trapdoor is correct.
Challenge. The adversary A3 gives two challenge words w0, w1 to the simulator B, wb1≠wi. b1∈{0,1} is randomly chosen. The simulator returns a trapdoor (36)Twb1=T1,T2=gb/l,H2wb11/βgc, in which r′=b/l is unknown to simulator and gc is a component of the DDH challenge.
Whengc=gab,Twb1 is a valid challenge trapdoor for wb1.
Trapdoor Query. The adversary A3 adaptively makes trapdoor query on wi, wi≠w0,w1. The simulator B computes trapdoor as the above trapdoor query.
Guess. The adversary A3 outputs bit b1′ as its guess.
Through the above description, we have completed the simulation process of the scheme and the simulation is correct. Next we will discuss the indistinguishability of the simulation.
Whenc=ab, the response for trapdoor query and challenge trapdoor are correct. All random numbers in simulation process are random and independent. Random numbers included a,b,c,r′,b/l. So the simulation of the scheme is indistinguishable. The adversary wins the game with a probability of 1/2+ε as the breaking assumption.
Whenc≠ab, since the challenge trapdoor is randomness for the adversary A3, therefore, the adversary A3 wins the game with a maximum probability of 1/2.
Next we will discuss the successful of the simulation; the simulator does not abort the simulation in trapdoor query and challenge phase. Therefore, the probabilityPsuccessful=1.
Therefore, the simulator solves the advantage of the HDH hard problem as follows:(37)εR=12+ε-12=ε.We will prove that our scheme are IND-CCA secure following CDH hard problem in Theorem8.(CDH)[25]. The Computational Diffie-Hellman Problem: given the three tuple (g,ga,gb), g,ga,gb∈G1, where G1 is a general cyclic group of prime order p, all polynomial time algorithms compute the value gab∈G1 is hard.Theorem 8.
Under CDH hard problem, the secure data sharing scheme with designated server satisfies document ciphertext indistinguishability in random oracle model, where the security reduction loss isL=2vqH1/2v-qD.Proof.
Suppose there is an adversary (including a malicious server)A4 that can break our secure data sharing scheme with designated server in IND-CCA security model with advantage ε. In order to solve the CDH hard problem, let us construct a simulator B with a problem instance (g,ga,gb) over the cyclic group (G1,g,p), and our goal is to compute the value gab.
The entire simulation process includes the following phases.
Setup. Let sp=(PG,H1,H2,H3,H4,H5,f,u,u~). The simulator B randomly chooses t,t′∈Zp∗ and sets u=gt,u~=gt′, (38)pkr1=gb,pkr2=u~b=gt′b,skr=b, In which skr is unknown to simulator B. Simulator B sends the pkr=(pkr1,pkr2) to the adversary A4. A4 randomly chooses α∈Zp∗ and generates (39)pks1=gα,pks2=gt/α,sks=α, It sends pks=(pks1,pks2) to the simulator B.
Hash Query
H 1 -Query. The adversary A4 can query ki∈G1 to H1. If e(g,ki)=e(ga,gb), the simulator aborts the simulation. Otherwise, if there exists a <ki,Xi> in H1 list, the simulator B responds with H1(ki)=Xi; otherwise, it randomly chooses a value Xi, returns to the adversary A4, and adds the value to H1 list. The H1 list is initially empty.
H 2 -Query. The adversary A4 can query wi to H2. The simulator maintains a list of tuples <wi,vi,ei> and the H2 list is initially empty. If there exists a wi in H2 list, the simulator B responds with H2(wi)=vi. Otherwise, the simulator B randomly chooses ei∈Zp∗, sets vi=gbei, and adds the value to H2 list.
H 3 -Query. The adversary A4 can query ti to H3. If there exists a ti in H3 list, the simulator B responds with H3(ti)=Vi. Otherwise, the simulator B randomly chooses a value Vi∈G1, returns to the adversary A4, and adds the value to H3 list. The H3 list is initially empty.
H 4 -Query. The adversary A4 can query (ki,mi,Cj,Cwi) to H4. If e(g,ki)=e(ga,gb), the simulator aborts the simulation. Otherwise, if there exists a (ki,mi,Cj,Cwi) in H4 list, the simulator B responds with H4(ki,mi,Cj,Cwi)=σi. Otherwise, it randomly chooses a value σi, returns to the adversary A4, and adds the value to H4 list. The H4 list is initially empty.
Decryption Query. The adversary A4 can query u to decryption oracle. uij=(Cj,Cwi,σ) is a decryption query. First, the simulator needs to check the H4 list; if a tuple <(ki,mi,Cj,Cwi),σi> exists and satisfies e(g,k)=e(Cj,1,pkr1), the simulator checks the H1 list and whether Cj,2=mi⊕H1(ki); if it satisfies the condition, then mi returns; otherwise ⊥ returns.
Trapdoor Query. The adversary A4 can query wi to trapdoor oracle. The simulator sets (40)Twi=T1,T2=gri,gbei/bH6gαri=geiH6gαri.ri is randomly chosen from Zp∗. Therefore, the simulator completed the trapdoor query and the trapdoor is correct.
Challenge. The adversary A4 gives two challenge messages m0,m1 and keyword w∗ (w∗≠m0,m1) to the simulator B. The simulator B returns a ciphertext umb1, in which b1∈{0,1}, r′∈Zp∗ and Z∗∈{0,1}d are randomly chosen. The ciphertext umb1 is as follows:(41)Cj=Cj,1,Cj,2,Cj,1=ga,C2=Z∗,H1k∗=Z∗⊕mb1,Cw∗=A,B=gbr′,H3eH2w∗r′,pks1. The simulator randomly chooses σ∗∈{0,1}f, defines (42)σ∗=H4k∗,mb1,Cj,Cw∗, and adds the <(-,mb1,Cj,Cw∗),σ∗> (B does not know the value k∗) to H4 list.
Trapdoor Query. The adversary A4 adaptively makes trapdoor query on wi. The simulator B computes trapdoor as the above trapdoor query.
Decryption Query. The adversary A4 can query u≠umb1 to decryption oracle similar to the above decryption query.
Guess. The adversary A1 outputs bit b1′ as its guess.
Through the above description, we have completed the simulation process of the scheme and the simulation is correct. Next we will discuss the indistinguishability of the simulation.
When the hash query is not a challenge hash queryk=gab, the response for the decryption query, trapdoor query, and challenge ciphertext are correct. All random numbers in simulation process are random and independent. Random numbers include X1,X2,…,XqH1,v1,v2,…,vqH2,V1,V2,…,VqH3,σ1,σ2,…, σqH4,a,b,t,t′,ri,r′. So the simulation of the scheme is indistinguishable.
When the hash query is not a challenge hash queryk=gab, the challenge ciphertext is randomness. Therefore, the adversary wins the game with an advantage 0.
As an assumption, fromH1(k), we can find the correct challenge hash query k=gab, Pc=1/qH1.
Next we will discuss the successful of the simulation, the simulator dose not abort the simulation in trapdoor query and decryption query.
When the valueH4(k,m,Cj,Cw) has been correctly guessed without invoking H4, the query <(k,m,Cj,Cw),σ> to decryption oracle will be aborted. Therefore, the probability (43)Psuccessful=1-qD2v, and the qD is the number decryption oracle queries.
Therefore, the simulator solves the advantage of the CDH hard problem as follows:(44)εR=εqH11-qD2v=ε2vqH1/2v-qD.Theorem 9.
SinceH5 is a cryptography hash function, the secure data sharing scheme with designated server is public verifiability secure.Proof.
Suppose there is a malicious serverA5 that can break our secure data sharing scheme with designated server in public verifiability security model. Let us construct a simulator B which simulates the scheme. The adversary A5 can forge a response R for the search keyword w and satisfy the equation (sp,VKw,τw,R,s)=1. Since the formula R=R′ is established, the simulator can compute the equation (45)∑j∈1,…,lajH5Cw~∥Cj~=∏j∈1,…,lτijaj. Therefore, the adversary needs to compute the (46)H5Cw~∥Cj~=H5Cw∥Cj. Since H5 is a cryptography hash function, the probability that adversary outputs Cw~∥Cj~≠Cw∥Cj and makes the equation equal is negligible.About the verification tag security, we can also prove the tag security for third party verifier by the security reduction; we omit the details here.


## 3.3. Performance Analysis

We use Tables1 and 2 to show two comparisons between our secure data sharing scheme with designated server and previous schemes. In this section, the word abbreviation Trap Ind, Ciph Ind, Offline KGA, PVS, SKA, and keyword Ciph denote trapdoor indistinguishability, ciphertext indistinguishability, offline keyword guessing attacks, public verifiability security, swapping keyword attacks, and keyword ciphertext, respectively. We use e,E1,E2,h,PM to denote a pairing operation, an exponentiation operation in G1, an exponentiation operation in G2, a hash operation which map a string to an element of cyclic group, and a multiplication in G1, respectively. We ignore other hash operation and multiplication.Table 1
Computation cost comparison (ms).
BDOP [1]. BSW [5]. CZLZ [6]. Our. Keyword Ciph 2 E 1 + h + e = 6.686 E 1 + E 2 + h + 2 e = 6.218 2 E 1 + 4 E 2 + h + 4 e + P M = 9.069 E 1 + E 2 + h + e = 5.406 Trapdoor E 1 + h = 4.495 E 1 + h = 4.495 3 E 1 + 3 P M = 4.410 3 E 1 + h + P M = 7.014 Test e = 0.812 E 1 + e + P M = 2.282 5 E 1 + h + 4 e + 3 P M = 13.532 E 1 + E 2 + e = 2.290Table 2
Security comparison.
BDOP [1]. BSW [5]. CZLZ [6]. Our. Trap Ind NO NO NO YES Message Ciph Ind - YES YES YES Keyword Ciph Ind YES NO YES YES Off-line KGA NO NO NO YES SKA NO YES YES YES PVS NO NO NO YESTo evaluate the efficiency of our scheme, we implement these operations on a Core(TM) i7-6500U CPU of 2.50GHz 2.60GHz and 4GB RAM (3.89GB is available) running Ubantu 18.04. We use a Type-A pairing elliptic curve and implemented in the PBC library. For these four schemes, we test the running time of keyword ciphertext generation, trapdoor generation, and test algorithms, respectively.We first introduce some basic operation symbols. Every basic operation symbol denotes the running time of an operation in Table4.From Figures3 and 4 and Tables 1 and 4, we found that our scheme is efficient in terms of keyword ciphertext generation algorithm compared to BDOP [1], BSW [5], and CZLZ [6]. Since our scheme reduces some E1 modular exponentiation computations and e pairing computations, particularly, in CZLZ [6], the scheme requires the most computation cost due to 2E1 modular exponentiation computations, 4e pairing computations, and 1h hash computations per keyword ciphertext generation. In BDOP [1], the scheme requires the most computation cost due to 2E1 modular exponentiation computations, 1e pairing computations, and 1h hash computations per keyword ciphertext generation. In BSW [5], the scheme requires the most computation cost due to 1E1 modular exponentiation computations, 2e pairing computations, and 1h hash computations per keyword ciphertext generation. Our scheme requires the most computation cost due to 1E1 modular exponentiations computations, 1e pairing computations, and 1h hash computations per keyword ciphertext generation; therefore, our scheme is more efficient in terms of keyword ciphertext generation algorithm. As the number of keywords increases from 20 to 80 in Figure 4, we find that our scheme is also efficient.Figure 3
Computation cost of comparison.Figure 4
Computation cost of keyword ciphertext generation.From Figures3 and 5 and Tables 1 and 4, we found that our scheme is slightly higher than in terms of trapdoor generation algorithm. Since our scheme adds 2E1 modular exponentiation computations compared to BDOP [1] and BSW [5], however, it is worth noting that the trapdoor generation in our scheme is slightly higher than those of existing schemes. Since the BDOP [1], BSW [5], and CZLZ [6] suffer from trapdoor security attack, namely, offline KGA, we remove the secure channel between the cloud server and receiver for reducing the construction of secure channel costs. In addition, we can compress the trapdoor computation time from 7.014 ms to 2.876 ms. Since for the trapdoor Tw=[T1,T2]=[gr1,H2(w)1/skr·pks1r1], the H2(w)1/skr is the same value for the same keyword, therefore, we can reduce the E1+h computation time when using the same keyword.Figure 5
Computation cost of trapdoor generation.From Figures3 and 6 and Tables 1 and 4, we found that our scheme is efficient in terms of test algorithm compared to CZLZ [6], since our scheme reduces 3e pairing computations, 4E1 modular exponentiation computations, and 1h hash computations. However, our scheme is slightly higher than BDOP [1], since we add the 1E1+1E2 computation than BDOP [1]. But this is because we remove secure channel. In our scheme, only the designated server can search the keyword via encrypted documents and not need a secure channel between cloud server and receiver. The running test algorithm time of our scheme is almost the same as that of the BSW [5]. In addition, cloud computing has the advantages of unlimited capability in terms of both storage and computation. Therefore, it is acceptable to add a little time during the test phase for reducing the cost of establishing a secure channel.Figure 6
Computation cost of test algorithm.Furthermore, from Table2, we find that our scheme also offers stronger security than existing schemes, since our scheme satisfies the trapdoor indistinguishability security, ciphertext indistinguishability security, against offline keyword guessing attacks security, public verifiability security, against swapping keyword attacks security than other schemes. From Table 3, we find that our scheme also offers more functionality than existing schemes, since our scheme offers message and keyword encryption, message decryption, and search result’s public verifiability compared to other schemes.Table 3
Functionality comparison.
BDOP [1]. BSW [5]. ZH [7]. CZLZ [6]. Our. Message encryption NO NO YES YES YES Keyword encryption YES YES YES YES YES Message decryption NO NO YES YES YES PV NO NO NO NO YESTable 4
Running time of operations (ms).
e E 1 E 2 h P M 0.812 1.379 0.099 3.116 0.091


## 4. Conclusion

We define a secure data sharing scheme with designated server and propose a specific construction. In our framework, the scheme not only realizes document encryption/decryption but also achieves the searchable encryption in the cloud environment. We also proved that our scheme has achieved the security of the document indistinguishability against chosen ciphertext attack, keyword indistinguishability against chosen keyword attack, trapdoor indistinguishability, and public verifiability under the proposed security models. The important property of the proposed scheme is that the search results can achieve public verifiability under dishonesty cloud server model, including ciphertexts both documents and keywords. Of course, this scheme can solve the practical scenario PHR problems in our introduction. Although we propose a DSS scheme with designated server that combines PKE scheme with PEKS scheme, we would consider as a major breakthrough to design a DSS scheme in the standard model and optimize the trapdoor size. In addition, as the increase in the number of receivers will degrade the efficiency of system in our scheme, we would consider constructing a DSS scheme in multireceivers scenario.



---

*Source: 4268731-2019-06-27.xml*