Bipartite graphs are instrumental for modeling interactions between heterogeneous entities. When outsourcing (α, β)-core community search to the cloud, preserving structural and query privacy is critical. Prior solutions, while aiming to protect privacy, often incur high communication overhead, rely on strong assumptions such as dual non-colluding servers, and may remain vulnerable to leakage of fine-grained access patterns or result sizes. We propose BiCore-Index PHE, an index-driven encrypted query framework under a practical proxy-cloud architecture. Our scheme stores two compact encrypted tables with precomputed thresholds and evaluates traversal in a branch-free manner using bitwise equality (BCDA), proxy-assisted oblivious comparisons (OGTC), and a ciphertext-level MUX controlled by encrypted type bits, thereby mitigating access-pattern leakage under the bounded-leakage model defined in our leakage function. On two real-world graphs, BiCore-Index PHE consistently outperforms a re-implemented state-of-the-art baseline: query time improves by about 10× and traversal iterations drop by over 90%. Communication is reduced by more than 96%. Index encryption remains <5s and token generation <6μs on the largest subsets, exhibiting near-linear scalability. We prove simulation-based security under the semi-honest, non-colluding proxy–cloud model, showing that each party’s view can be efficiently simulated from its specified leakage function, ensuring confidentiality of the graph, query parameters, and intermediate traversal states.

Private set intersection (PSI) is an important cryptographic primitive with many real-world applications. Delegating PSI computation to the cloud can effectively reduce management and computational costs of data owners, and therefore has received widespread attention from researchers. However, in the existing delegated PSI schemes, it is hard for the data owner to authorize only a part of its outsourced data, and for users to flexibly select a part of the outsourced encrypted data of the data owner for intersection computation. In this paper, we propose the multi-subset fine-grained authorization PSI (MA-PSI) over outsourced encrypted datasets. Specially, our protocol is designed for the multi-subset case where each subset is associated with one single tag for data classification. Through tag classification and encryption technology, the data owner can perform fine-grained authorization on its subsets. By querying tags, the user can flexibly select any subset of the data owner for intersection computation. The security definition of the MA-PSI protocol is given, and its security is proved in the semi-honest model. Experimental results show that our protocol is very efficient and the computational cost is linear with the size of the subset. Specifically, the intersection algorithm SetI in our MA-PSI is about 80× (the subset size is 215) - 2500× (the subset size is 210) faster than APSI (Wang et al., IEEE TIFS 2021).

With the prevalence of outsourced computation, such as Machine Learning as a Service, protecting the privacy of sensitive data throughout the whole computation is a critical yet challenging task. The problem becomes even more tricky when multiple sources of input and/or multiple recipients of output are involved, who would encrypt/decrypt data using different keys. Considering many computation tasks demand binary operands and operations but there are only outsourced computation constructions for arithmetic calculations [1], in this paper, the authors propose a privacy-preserving outsourced computation framework for Boolean circuits. The proposed framework can protect sensitive data throughout the whole computation, i.e., input, output and all the intermediate values, ensuring privacy for general outsourced tasks. Moreover, it compresses the ciphertext domain of [1] and attains secure protocols for four logic gates (AND, OR, NOT, and XOR) which are the basic operations in Boolean circuits. With the proposed framework as a building block, a novel Privacy-preserved (encrypted) Bloom Filter and a Multi-keyword Searchable Encryption scheme under the multi-user setting are presented. Security proof and experimental results show that the proposal is reliable and practical.

Message-Locked Encryption (MLE) is a useful tool to enable deduplication over encrypted data in cloud storage. It can significantly improve the cloud service quality by eliminating redundancy to save storage resources, and hence user cost, and also providing defense against different types of attacks, such as duplicate faking attack and brute-force attack. A typical MLE scheme only focuses on deduplication. On the other hand, supporting search operations on stored content is another essential requirement for cloud storage. In this article, we present a message-locked searchable encryption (MLSE) scheme in a dual-server setting, which achieves simultaneously the desirable features of supporting deduplication and enabling users to perform search operations over encrypted data. In addition, it supports both multi-keyword and negative keyword searches. We formulate the security notions of MLSE and prove our scheme satisfies all the security requirements. Moreover, we provide an interesting extension of our construction to support Proof of Storage (PoS). Compared with the existing solutions, MLSE achieves better functionalities and efficiency, and hence enables more versatile and efficient cloud storage service.

As cloud storage has been widely adopted in various applications, how to protect data privacy while allowing efficient data search and retrieval in a distributed environment remains a challenging research problem. Existing searchable encryption schemes are still inadequate on desired functionality and security/privacy perspectives. Specifically, supporting multi-keyword search under the multi-user setting, hiding search pattern and access pattern, and resisting keyword guessing attacks (KGA) are the most challenging tasks. In this article, we present a new searchable encryption scheme that addresses the above problems simultaneously, which makes it practical to be adopted in distributed systems. It not only enables multi-keyword search over encrypted data under a multi-writer/multi-reader setting but also guarantees the data and search pattern privacy. To prevent KGA, our scheme adopts a multi-server architecture, which accelerates search response, shares the workload, and lowers the key leakage risk by allowing only authorized servers to jointly test whether a search token matches a stored ciphertext. A novel subset decision mechanism is also designed as the core technique underlying our scheme and can be further used in applications other than keyword search. Finally, we prove the security and evaluate the computational and communication efficiency of our scheme to demonstrate its practicality.

In a cloud data storage system, symmetric key encryption is usually used to encrypt files due to its high efficiency. In order allow the untrusted/semi-trusted cloud storage server to perform searching over encrypted data while maintaining data confidentiality, searchable symmetric encryption (SSE) has been proposed. In a typical SSE scheme, a users stores encrypted files on a cloud storage server and later can retrieve the encrypted files containing specific keywords. The basic security requirement of SSE is that the cloud server learns no information about the files or the keywords during the searching process. Some SSE schemes also offer additional functionalities such as detecting cheating behavior of a malicious server (i.e., verifiability) and allowing update (e.g., modifying, deleting and adding) of documents on the server. However, the previous (verifiable) SSE schemes were designed for single users, which means the searching can only be done by the data owner, whereas in reality people often use cloud storage to share files with other users. In this paper we present a multi-user verifiable searchable symmetric encryption (MVSSE) scheme that achieves all the desirable features of a verifiable SSE and allows multiple users to perform searching. We then define an ideal functionality for MVSSE under the Universally Composable (UC-) security framework and prove that our ideal functionality implies the security requirements of a secure MVSSE, and our multi-user verifiable SSE scheme is UC-secure. We also implement our scheme to verify its high performance based on some real dataset.