The widespread adoption of cloud storage has raised considerable data privacy concerns for outsourced databases. In recent years, Structured Encryption (STE) has emerged as a promising solution to build encrypted databases that efficiently handle queries while preserving privacy through underlying structures called Encrypted Multi-Maps (EMMs). However, current STE-based schemes primarily focus on static settings, and their direct extensions to dynamic settings introduce significant challenges in client storage overhead and update efficiency with join condition. In this paper, we present an efficient dynamic encrypted database scheme supporting large-scale data. To address the challenges in dynamic settings, we first propose a novel dynamic EMM design with constant client storage that utilizes a global counter to reduce client storage overhead. We then introduce an algorithm for dynamically handling join queries based on tags generated from values of the join attribute, significantly reducing update overhead. We implement our scheme and conduct comparative analyses with existing dynamic STE schemes. The experimental results demonstrate that our scheme offers significant advantages in terms of client storage overhead and update performance.

Searchable symmetric encryption (SSE) is a technique that enables secure outsourcing of data to an untrusted cloud server without sacrificing search functionality. Recently, multi-user SSE schemes for data sharing, which support access control from various users, have gained attention. However, the access control mechanisms in existing schemes are not adequate for realistic data-sharing scenarios as they do not consider time constraints or only partially address them, making these mechanisms unsuitable for SSE schemes. To address this issue, we first highlight the importance of time constraints in multi-user SSE and propose a completely time-constrained SSE scheme under a two-server model. By taking advantage of the Lagrange interpolation and pre-computation, our proposed scheme enables searching over time-related encrypted data with owner-enforced time constraints. Additionally, we employ the blinding technique with the assistance of a semi-honest time server to ensure the completeness of time constraints, which is not guaranteed in existing works. Based on the leakage function, we prove the security of our proposed scheme in the simulation-based security model. Furthermore, extensive experiments demonstrate the practicality of our scheme in supporting time-constrained functions.

Building encrypted databases has been a long-standing challenge in the field of database security. In recent years, Structured Encryption (STE) has emerged as a promising approach to constructing encrypted databases, striking a balance between security and efficiency. Although existing STE-based encrypted database systems achieve high efficiency in query processing, all these schemes struggle to support rich queries with minimal information leakage. In this paper, we present a new STE-based encrypted database system, named Filter-integrated Encrypted Database (FinEDB), which supports exact-match and range queries, conjunctive queries and join operations, while maintaining limited information leakage. We first design a novel secure inverted index to avoid storage overhead blow-up when extending to support rich query capabilities. Then, we integrate Binary Fuse filters into our proposed inverted index to enable efficient query processing. By leveraging the homomorphic property of Binary Fuse filters, our approach leaks less information than existing STE-based solutions. Besides, we provide rigorous proof for our proposed scheme under the simulation paradigm. To evaluate the performance, we implement the prototype of FinEDB and compare it with the baseline STE-based scheme. Experiment results demonstrate that FinEDB is practical and can support rich queries on real-world databases.

Searchable Symmetric Encryption (SSE) is a valuable cryptographic tool that allows a client to retrieve its outsourced data from an untrusted server via keyword search. Initially, SSE research primarily focused on the efficiency-security trade-off. However, in recent years, attention has shifted towards range queries instead of exact keyword searches, resulting in significant developments in the SSE field. Despite the advancements in SSE schemes supporting range queries, many are susceptible to leakage-abuse attacks due to volumetric profile leakage. Although several schemes exist to prevent volume leakage, these solutions prove inefficient when dealing with large-scale datasets. In this paper, we highlight the efficiency-security trade-off for range queries in SSE. Subsequently, we propose a volume-hiding range SSE scheme that ensures efficient operations on extensive datasets. Leveraging the order-weighted inverted index and bitmap structure, our scheme achieves high search efficiency while maintaining the confidentiality of the volumetric profile. To facilitate searching within large-scale datasets, we introduce a partitioning strategy that divides a broad range into disjoint partitions and stores the information in a local binary tree. Through an analysis of the leakage function, we demonstrate the security of our proposed scheme within the ideal/real model simulation paradigm. Our experimental results further validate the practicality of our scheme with real-life large-scale datasets.

Truth discovery is an effective tool to infer true information from multi-source data and has been widely applied in mobile crowdsensing systems. In some specific scenarios, the sensory data are collected in a streaming fashion with time-varying information, and the server should update the truth in time. Under such circumstances, local differential privacy-based mechanism can satisfy the requirement of real-time processing properly while keeping the privacy of sensory data. However, directly applying local differential privacy to handle streaming data will disclose the long-term potential privacy and decrease the accuracy. To address these problems, we propose an incentive-based privacy-preserving truth discovery framework over streaming data. Firstly, we adopt the sequential composition theorem of w-event privacy to protect workers' long-term privacy. Second, we design an incentive mechanism to improve the submitted data utility and thus avoid the decrease in accuracy. In this way, our scheme ensures that workers submit more accurate data while their global privacy is still guaranteed. Finally, we prove our scheme satisfies w-event (∊, δ) differential privacy and theoretically analyze the result utility. Extensive experiments also demonstrate the effectiveness of our incentive mechanism.

Through Searchable Symmetric Encryption (SSE), a user can make search over encrypted documents that are stored on an untrusted cloud server. Multi-client SSE schemes require that one client can search documents contributed by other clients and upload documents. Nevertheless, existing multi- client SSE schemes implement the fine-grained access control with high complexity. Although fine-grained access control adapts to complex scenarios, it is not necessary anytime and may cause heavy costs over computation in SSE schemes. Moreover, it is crucial to support documents updating and forward privacy. To combat that, we design a multi-client SSE scheme with efficient access control over dynamic encrypted documents. Specifically, we first modify Symmetric Hidden Vector Encryption (SHVE) and utilize Bloom filter to implement the access control, which reduces much of computation overhead. We then employ Oblivious Dynamic Cross-Tag (ODXT) protocol to preserve the forward privacy of our scheme. Finally, the corresponding security and experimental evaluation demonstrate both security and practicality of our scheme, respectively.

Truth discovery is an effective method to infer truthful information from a large amount of sensory data in mobile crowdsensing systems. Privacy-preserving truth discovery schemes require the cloud server not to access each worker's sensory data directly so that the privacy of sensory data can be preserved. In some specific applications such as sparse mobile crowdsensing, workers can only contribute sensory data on a small part of sensing tasks, implying that the information of which tasks are completed by a worker should also be preserved. However, existing privacy-preserving truth discovery schemes do not consider such sparse data scenarios in mobile crowdsensing systems. In this paper, we first identify the privacy issues in truth discovery when sensory data are sparse. To address these issues, we design a privacy-preserving truth discovery scheme by employing the additively homomorphic cryptosystem and additive secret sharing with two non-colluding servers. Through detailed analysis and extensive experiments, we demonstrate that our proposed scheme can satisfy strong privacy-preserving requirements with low computation and communication overhead.

With the proliferation of mobile and wearable devices, mobile crowdsensing (MCS) is becoming a new paradigm for data collection and analysis. To effectively identify truthful information from crowdsensed data without privacy leakage, privacy-preserving truth discovery (PPTD) has gained much attention recently. Existing works either didn't consider real-time applications over data streams or failed to achieve enough efficiency for a large group of workers. In this paper, we propose FPTD, a Fog-aided Privacy-preserving Truth Discovery framework which is secure and efficient in handling real-time applications with a large group of workers. To reduce overhead, we adopt cloud-fog computing architecture to divide the complete worker group into many smaller ones. Then we design a unique secure aggregation protocol SecAgg which can securely and efficiently aggregate inputs from workers in smaller groups. Finally, we give detailed construction of FPTD, an efficient truth discovery framework based on SecAgg for real-time applications. Through extensive experiments and security analysis, we demonstrate that both SecAgg and FPTD are secure and efficient.