Oblivious Keyword Search With Authorization and Verification for IoT Devices in Untrusted Cloud Environments

Abstract

With the rapid advancement of Internet of Things (IoT) technology, large volumes of data are exchanged among users via cloud servers. However, in an untrusted cloud server environment, the risk of data tampering is significant. For instance, a cloud server may fail to update its records promptly after receiving updated data from a data sender. Consequently, when the data receiver retrieves the relevant information, the cloud server may return outdated data, leading to security issues in data utilization. To address this problem, we propose a scheme that facilitates efficient verification in untrustworthy cloud environments. Our research approach is to utilize cryptographic accumulators within the oblivious searchable encryption model to achieve efficient verification. The data sender first uses a cryptographic accumulator to calculate the cumulative value of all messages to be uploaded, which are publicly accessible. In addition, the accumulator generates witness values for messages authorized to the data recipient. Before retrieving data, the data receiver can leverage the cryptographic accumulator to verify the timeliness of incoming messages, ensuring that the data is current and free from tampering. Furthermore, the data sender retains the flexibility to dynamically update the data stored in the cloud and efficiently refresh both the encrypted accumulator and its corresponding witness value. This article presents a rigorous security proof and a comparative experiment was carried out, supported by both analytical evaluations and experimental results, which collectively confirm the practical applicability of the proposed scheme in the context of the IoT.