$\mathsf {SENTRY}$: A Compliance-Check Service for Dynamic Searchable Encryption With Sanitized Authorization Query

Abstract

Searchable encryption enables privacy-preserving queries over data outsourced to cloud services. Classical symmetric schemes deliver efficient search but largely assume a single-client setting; multi-client variants permit delegation yet typically treat authorization as an owner-local decision, overlooking regulations enforced by higher-level authorities (e.g., sector-specific compliance). In practice, limited familiarity with regulatory detail or operational lapses can lead owners to delegate search permissions that violate authority regulations, rendering existing systems unsuited to regulated, multi-client cloud environments.

To address this gap, we propose two systems. First, we propose $\mathsf {SENTRY}$SENTRY, a multi-client dynamic searchable encryption framework with a built-in compliance-check service via sanitized authorization. Its core is a tag-based sanitization protocol: the authority encodes prohibited keywords as hidden tags, and the sanitizer uses these tags to remove non-compliant per-keyword search permissions before they reach readers, without learning the underlying keywords. As a result, readers receive only compliant search capabilities. We then propose $\mathcal {F}-\mathsf {SENTRY}$F-SENTRY, a forward-private variant of $\mathsf {SENTRY}$SENTRY for settings where regulations evolve over time. $\mathcal {F}-\mathsf {SENTRY}$F-SENTRY preserves the same sanitized-authorization mechanism and further adds forward privacy through a tailored constrained shiftable encryption, which binds search permissions and newly added encrypted updates to regulatory epochs. Consequently, permissions issued before a policy change cannot be used to retrieve data added afterward unless they are refreshed for the new epoch. We formalize the security of both $\mathsf {SENTRY}$SENTRY and $\mathcal {F}-\mathsf {SENTRY}$F-SENTRY and prove them secure under standard assumptions. Experiments under cloud-like workloads show that $\mathsf {SENTRY}$SENTRY achieves regulation-compliant authorization with modest overhead, while $\mathcal {F}-\mathsf {SENTRY}$F-SENTRY provides stronger protection under changing regulations at practical additional cost.