Abstract This study introduces an innovative framework named scale for processing dynamic skyline queries securely in cloud environments. Unlike previous approaches that require complex operations on encrypted data, scale simplifies dynamic skyline domination to mere comparisons, significantly improving query efficiency. Through empirical evaluations over four datasets, we show that scale accelerates query processing nearly 1000-fold compared to existing state-of-the-art methods. Specifically, scale shows significant efficiency improvements by simplifying query interactions to a single round between the user and the cloud, which is validated through empirical studies on multiple datasets. Moreover, we introduce two distributed versions of scale , dist-scale-s and dist-scale-e , which further optimize performance by facilitating parallel processing. This adaptation showcases a substantial reduction in response times and computational overhead, underpinning the scalability and effectiveness of our framework in handling large-scale, secure cloud-based queries.

Dynamic symmetric searchable encryption (SSE) enables clients to perform searches and updates on an encrypted database outsourced to an untrusted server while preserving the privacy of data and queries. For restricting information leakage, it is very important to limit what the server can learn about the deleted data during searches after the deletion, i.e., to satisfy backward privacy. However, previous backward privacy definitions only considered the logical deletion of keywords in documents while ignoring security risks caused by the actual deletion of documents. Moreover, existing SSE schemes often depend on heavy cryptographic primitives for achieving high-level backward privacy, which greatly degrades the end-to-end performance. To this end, we define a new backward privacy notion named BP-DEL, which restricts the information leakage of the actual deletion. Moreover, we design a hybrid index structure that provides BP-DEL for SSE schemes such that they support deletions securely. Based on the hybrid index, we propose a BP-DEL construction named LUNA and design its protocols with a trusted execution environment (TEE) to maintain the index efficiently. Finally, we implement LUNA in the MySQL database by encapsulating it in UDFs. The experimental results show that LUNA has a performance much better than previous works satisfying BP-DEL.

Secure join schemes, an important class of queries over encrypted databases, have attracted increasing attention. While efficient querying is paramount, data owners also emphasize the significance of privacy preservation. The state-of-the-art JXT (Jutla and Patranabis ASIACRYPT 2022) enables efficient join queries over encrypted tables with a symmetric-key solution. However, we observe that JXT inadvertently leaks undesirable query results as the number of queries increases. In this paper, we propose a novel equi-join scheme, One-Time Join Cross-Tags (OTJXT), which can avoid additional result leakage in multiple queries and extend to equi-join as opposed to natural join in JXT. Specifically, we design a new data encoding method using nonlinear transformations that reveals only the union of results for each query without extra leakage observed in JXT. Moreover, OTJXT addresses the linear search complexity issue (Shafieinejad et al. ICDE 2022) while preventing multiple query leakage. Finally, we implement OTJXT and compare its performance with JXT and Shafieinejad et al.'s scheme on the TPC-H dataset. The results show that OTJXT outperforms in search and storage efficiency, achieving a$\mathbf {98.5\times }$(resp.,$\mathbf {10^{6}\times }$) speedup in search latency and reducing storage cost by 62.5% (resp., 78.5%), compared to JXT (resp., Shafieinejad et al.'s scheme). Using OTJXT, a TPC-H query on a 40 MB database only takes 21 ms.

The primitive of verifiable database (VDB) can enable a resource-limited client to securely outsource an encrypted database to an untrusted cloud server and the client could efficiently retrieve and update the data at will. Meanwhile, the client can undoubtedly detect any misbehavior by the server if the database has been tampered with. We argue that most of the existing VDB schemes can only support the updating operation of replacement, rather than other common updating operations such asinsertionanddeletion. Recently, the first publicly verifiable VDB schemes that supports all updating operations was proposed based on the idea of hierarchical vector commitment. However, one disadvantage of the proposed VDB scheme is that the computation and storage complexity increases linearly when the client continually inserts data records in the same index of the database. As a result, it remains an open problem how to construct an efficient (and publicly verifiable) VDB scheme that can support all updating operations regardless of the manner of insertion. In this paper, we first introduce a new primitive called committed invertible Bloom filter (CIBF) and utilize it to propose a new publicly verifiable VDB scheme that can support all kinds of updating operations. Additionally, the proposed construction is efficient regardless of the manner of updating operations and thus provides an affirmative answer to the above open problem.

The rich cloud services in the Internet of Things create certain needs for edge computing, in which devices should be able to handle storage tasks securely, reliably, and efficiently. When processing the storage requests from edge devices, each cloud server is supposed to eliminate duplicate copies of repeating data to reduce the amount of storage space and save on bandwidth. To protect data confidentiality while supporting deduplication, some convergent-encryption-based techniques have been proposed to encrypt the data before uploading. However, all these works cannot meet two requirements while preventing brute-force attacks: (i) power-constrained edge nodes should update encryption keys efficiently when an edge node is abandoned; and (ii) the access privacy of edge nodes should be guaranteed. In this article, we propose a novel encryption scheme for secure chunk-level deduplication. Based on this scheme, we present two constructions of the secure deduplication system that support an efficient key update protocol. The key update protocol does not involve any edge node in computational tasks, so that the deduplication system can adopt an active key update strategy. Moreover, one of our constructions, which is called advance construction, can provide access privacy assurances for edge nodes. The security analysis is given in terms of the proposed threat model. The experimental analysis demonstrates that the proposed deduplication system is practical.

Nowadays, machine learning is becoming a new paradigm for mining hidden knowledge in big data. The collection and manipulation of big data not only create considerable values, but also raise serious privacy concerns. To protect the huge amount of potentially sensitive data, a straightforward approach is to encrypt data with specialized cryptographic tools. However, it is challenging to utilize or operate on encrypted data, especially to perform machine learning algorithms. In this paper, we investigate the problem of training high quality word vectors over large-scale encrypted data (from distributed data owners) with the privacy-preserving collaborative neural network learning algorithms. We leverage and also design a suite of arithmetic primitives (e.g., multiplication, fixed-point representation, sigmoid function computation, etc.) on encrypted data, served as components of our construction. We theoretically analyze the security and efficiency of our proposed construction, and conduct extensive experiments on representative real-world datasets to verify its practicality and effectiveness.

With the growing popularity of cloud computing, more and more enterprises and individuals tend to store their sensitive data on the cloud in order to reduce the cost of data management. However, new security and privacy challenges arise when the data stored in the cloud due to the loss of data control by the data owner. This paper focuses on the techniques of verifiable data storage and secure data deduplication. We firstly summarize and classify the state-of-the-art research on cloud data storage mechanism. Then, we present some potential research directions for secure data outsourcing.