KSF-OABE: Outsourced Attribute-Based Encryption with Keyword Search Function for Cloud Storage

TLDR

Cloud computing is increasingly used to outsource data, raising security and privacy concerns, and attribute‑based encryption offers fine‑grained access control, but its computation cost and ciphertext size grow with policy complexity, while outsourcing ABE reduces this cost, yet large volumes of encrypted files hinder efficient query processing. We introduce KSF‑OABE, a cryptographic primitive that supports keyword search over outsourced attribute‑based encrypted data. The scheme delegates partial decryption to the cloud service provider, which can perform encrypted keyword search using trapdoors without learning the plaintext or keywords. We prove that KSF‑OABE is secure against chosen‑plaintext attacks.

Abstract

Cloud computing becomes increasingly popular for data owners to outsource their data to public cloud servers while allowing intended data users to retrieve these data stored in cloud. This kind of computing model brings challenges to the security and privacy of data stored in cloud. Attribute-based encryption (ABE) technology has been used to design fine-grained access control system, which provides one good method to solve the security issues in cloud setting. However, the computation cost and ciphertext size in most ABE schemes grow with the complexity of the access policy. Outsourced ABE (OABE) with fine-grained access control system can largely reduce the computation cost for users who want to access encrypted data stored in cloud by outsourcing the heavy computation to cloud service provider (CSP). However, as the amount of encrypted files stored in cloud is becoming very huge, which will hinder efficient query processing. To deal with above problem, we present a new cryptographic primitive called attribute-based encryption scheme with outsourcing key-issuing and outsourcing decryption, which can implement keyword search function (KSF-OABE). The proposed KSF-OABE scheme is proved secure against chosen-plaintext attack (CPA). CSP performs partial decryption task delegated by data user without knowing anything about the plaintext. Moreover, the CSP can perform encrypted keyword search without knowing anything about the keywords embedded in trapdoor.