Privacy-Preserving Multi-Dimensional Range Search over ...

Privacy-Preserving Multi-Dimensional Range Search
over Encrypted Cloud Data within Sublinear Time
Boyang Wang †,†† , Yantian Hou † , Ming Li † , Haitao Wang † and Hui Li ††
† Department of Computer Science, Utah State University, Logan, UT, USA
†† State Key Laboratory of Integrated Service Networks, Xidian University, Xi’an, Shaanxi, China
Abstract—Cloud computing promises users massive scale outsourced
data storage services with much lower costs than traditional
methods. However, privacy concerns compel sensitive data
to be stored in the cloud under an encrypted form. This posts
a great challenge for effectively utilizing the outsourced data,
such as executing common SQL queries. A variety of searchable
encryption techniques have been proposed to solve this issue;
yet efficiency and scalability are still the two main obstacles
for their adoptions in real-world datasets, which are multidimensional
in general. In this paper, we propose the first sublinear
time and privacy-preserving searchable encryption scheme
for multi-dimensional range queries over encrypted databases.
By designing and leveraging two novel predicate encryption
primitives, our solution efficiently indexes and searches over the
encrypted database using multi-dimensional data structures (e.g.,
kd-trees), thus achieving sublinear time complexity. In addition,
our methodology is also general as different data structures
(e.g., range trees) can be exploited to yield different tradeoffs
among privacy, storage overhead and search time (as low as
polylogarithmic). Our scheme is provably secure, and through
extensive experimental evaluation on a large-scale real-world
dataset, we show the efficiency and scalability of our scheme.
I. INTRODUCTION
With the adoption of cloud computing, data owners can reap
huge economic benefits by outsourcing their data to the cloud
instead of storing their data locally. Due to the serious privacy
concerns in the cloud, sensitive data, such as financial or
medical records, should be encrypted before being outsourced
to the cloud server [1]. As a result, the cloud server or any
other unauthorized party is not allowed to reveal the content
of outsourced data unless it possesses proper decryption keys.
Unfortunately, the encryption on outsourced data inevitably
introduces new challenges to data utilization. Especially, how
to enable data users to effectively search over encrypted data as
they do in the plaintext domain, is one of the most significant
issues needed to be solved in the cloud.
To enable different search functions over encrypted data,
many searchable encryption (SE) schemes have been proposed
[2]–[7]. Besides protecting the data content as in traditional
encryption schemes, SE schemes should not only hide the
attributes (e.g. keywords) of encrypted data records, but also
protect the content of search queries. However, most of the existing
SE schemes are only able to handle very simple queries,
such as single keyword search [3] or single-dimensional
range queries [6], which are not able to well support multidimensional
range queries over encrypted data. Considering
real-world datasets are often multi-dimensional while common
SQL queries (such as equality and comparison) can all be
flexibly expressed as range queries [8], we believe designing
an efficient and privacy-preserving Multi-Dimensional Range
Search over Encrypted data (MDRSE) will be an important
step to make searchable encryption practical on large datasets
in a real-world cloud setting.
Shi et al. [8] first designed an SE scheme to handle multidimensional
range queries over encrypted data, which can
be used in many applications, such as network audit logs
and financial databases [8]. Unfortunately, the search time
of its straightforward application to large datasets is linearly
increasing with regard to the total number of data records.
Since the size of a real-world dataset is generally very large
(e.g. in the order of millions or larger), this scheme is clearly
not practical especially under the cloud setting.
More recently, Lu [9] designed a symmetric key based
single dimensional range search scheme (named LSED) on
encrypted data within logarithmic search time, and mentioned
a direct extension of it (denoted as LSED + ) into the multidimension
by achieving sublinear search time. However, this
direct extension, which decomposes multi-dimensional search
and decryption abilities (search tokens and decryption keys)
into the ones in each single dimension, will result in significant
privacy leaks [9].
Salary
2,000
1,000
G
20 30
Age
G The Granted Search and Decryption Ability
Privacy Leak on One Range Query
(a) Privacy leak on one query.
Salary
3,000
2,500
2,000
1,000
G
G
20 30 45 50
Age
G The Granted Search and Decryption Abilities
Privacy Leak Caused by Collusion
(b) Privacy leak caused by collusion.
Fig. 1. Examples of privacy leakage in LSED + [9].
Specifically, given the search and decryption ability of
a two-dimensional range query Q = (age ∈ [20,30]) ∧
(salary ∈ [1,000,2,000]) in LSED + , a data user is able to
not only search but also decrypt on a single dimensional range
query Qx = (age ∈ [20,30]) on X-dimension or Qy =
(salary ∈ [1,000,2,000]) on Y-dimension independently,
which clearly reveals more private information to this data user
than he is allowed to (as described in Fig. 1(a)). The leakage of
these privacy, referred to as single-dimensional query privacy
(search) and single-dimensional confidentiality (decryption)
respectively, will be dramatically aggravated when the number
of dimensions of a range query increases. Moreover, failing to
preserve query privacy or confidentiality in single dimension

TABLE I
COMPARISON AMONG DIFFERENT SOLUTIONS.
Solution Storage Cost Search Time Single-Dim. Confidentiality/Query Privacy Public Key Based
Straightforward [8] O(n·DlogT) O(n·DlogT) Yes / Yes Yes
LSED + [9] O(n·DlogT) O(n 1−1/D ·Dlog 2 T) No / No No
Ours (KD-Trees) O(n·DlogT) O(n 1−1/D ·DlogT) Yes / Yes Yes
Ours (Range Trees) O(nlog D−1 n·DlogT) O(log D−1 n·DlogT) Yes / No Yes
will inevitably introduce collusion among different queries [8].
As shown in Fig. 1(b), the data user is able to search and
decrypt the exact information on a multi-dimensional range
query Q ′ = (age ∈ [20,30]) ∧ (salary ∈ [2,500,3,000])
without the permission of the data owner.
On the other hand, due to the leak of single dimensional
query privacy in LSED + , the cloud server may easily deduce
the content of a multi-dimensional range query with some
advanced background information of outsourced data. For
instance, if the cloud server can decompose the search token of
multi-dimensional range query Q into each single dimension
while some single-dimensional statistics (e.g., the percentage
of people in their twenties within the whole population is
20% or people’s salary between [1,000,2,000] is 40%) are
available, then it is able to easily infer the content of this
range query in each single dimension respectively based on
the respective percentage of matched records in the database.
Therefore, how to design an efficient and privacy-preserving
MDRSE remains open.
In this paper, we endeavor to solve this problem by proposing
a privacy-preserving Multi-Dimensional Range Search
over Encrypted data (MDRSE) within sublinear time in the
cloud. Obviously, with multi-dimensional data structures, such
as kd-trees [10], we can easily achieve sublinear search time in
the plaintext domain with existing methods [11]. However, the
main challenge of utilizing these multi-dimensional data
structures in this paper is how to exactly follow the search
algorithm of a multi-dimensional data structure in the
plaintext domain while all the nodes (including all the data
records) in the structure and range queries are encrypted.
Meanwhile, we also need to preserve single dimensional
confidentiality and single dimensional query privacy. The
main contributions of our paper are:
(1) We first present two new predicate encryptions, named
hyper-rectangle intersection predicate encryption and hyperrectangle
contained predicate encryption respectively, by using
some existing cryptographic primitive [8] in a novel way.
With these predicate encryptions, we can verify the geometry
relationships of two hyper-rectangles, including whether two
hyper-rectangles intersect, and whether one hyper-rectangle is
fully contained in another one.
(2) With the properties of the two proposed predicate
encryptions, we can build a sublinear time MDRSE, which
can exactly follow the search algorithm of a kd-tree in the
plaintext domain while all the nodes in the kd-tree and range
queries are encrypted. Moreover, the security analyses show
that our scheme is selectively secure and privacy-preserving.
(3) With the similar design methodology, we can also
construct another MDRSE based on range trees [12] to achieve
a more efficient (polylogarithmic) search time over encrypted
data. As a necessary tradeoff, it requires much more storage
overhead than the one based on kd-trees. In addition, it
inevitably losses single dimensional query privacy, which is
caused by the structure of a range tree itself. However, single
dimensional confidentiality is still preserved.
(4) Using a large-scale real-world dataset, we evaluate
the performance of our schemes in experiments with up to
millions of data records. Compared to previous solutions, our
schemes show much higher scalability and efficiency over
large encrypted datasets.
The comparison among different solutions is presented in
Table I, where n denotes the number of data records in a
database, D is the number of dimensions and T is the size
of each dimension. Our schemes are within sublinear search
time with respect to n.
A. Framework for MDRSE
II. PROBLEM DEFINITION
In this paper, we focus on realizing sublinear time and
privacy-preserving Multi-Dimensional Range Search over Encrypted
Data (MDRSE). To achieve efficient (faster than linear)
search time, a multi-dimensional data structure Γ should
be used. Without loss of generality, we assume the entire range
of the i-th dimension is [1,Ti], where Ti is a power of 2. We
present the definition of MDRSE as below.
Definition 1: (MDRSE). An MDRSE scheme includes the
following six probabilistic polynomial time algorithms.
• Setup(λ, {T1,...,TD}): Given security parameter λ and
upper bound Ti in each dimension, output public key PK
and master key MK.
• Build({M1,...,Mn}, {A1,...,An}): Given all the data
records {M1,...,Mn} and their attributes {A1,...,An},
output data structure Γ.
• Encrypt(PK, Mi, Ai, Γ): Given public key PK, each
data record Mi, its attribute vector Ai = (ai,1,...,ai,D)
and data structure Γ, output an encrypted data record Ci,
and return outsourced data structure Γ ∗ based on all the
encrypted data record {C1,...,Cn}.
• Extract(MK, Q): Given master key MK and multidimensional
range search query Q, output search token
TKQ and decryption key SKQ.
• Search(TKQ, Ci, Γ ∗ ): Given search token TKQ, encrypted
data record Ci and outsourced data structure
Γ ∗ , where Ci ←Encrypt(PK, Mi, Ai, Γ), output 1 if
Ai ∈ Q; otherwise, output 0.
• Decrypt(DKQ, Ci): Given decryption key SKQ and
encrypted data record Ci, where Ci ←Encrypt(PK, Mi,
Ai, Γ), output data record Mi if Ai ∈ Q; otherwise, ⊥.
In the cloud scenario which we described in Fig. 2, there
are three entities, including one or multiple data owners, data

Data Owner
1. Request
2. Search Token & Decryption Key
Data User
Encrypted Data
3. Search Token
4. Matched Encrypted Data
Cloud Server
Fig. 2. The system model includes one or multiple data owners, data users,
and the cloud server.
users and the cloud server. Compared to the case of a single
data owner, an extra trusted party is needed to manage the
master key for the case of multiple owners. Setup is run by
the data owner (or a trusted party in the multi-owner case). The
data owner builds a multi-dimensional data structure Γ with
Build. Then, the owner encrypts every data record Mi based
on its attribute vector Ai = (ai,1,...,ai,n) (an attributeai,j can
be regraded as a value of a field/dimension in the database,
such as ”age=30” or ”salary=2,000”) with public key PK using
Encrypt, and outsources ciphertexts C = (C1,...,Cn) and
outsourced data structure Γ ∗ to the cloud. This outsourced data
structureΓ ∗ has the same structure asΓ, but all the nodes inΓ ∗
are encrypted. The data owner (or a trusted party in the multiowner
case) generates search token TKQ and decryption key
SKQ for a data user based on a multi-dimensional range search
query Q with Extract. In Search, a data user submits
search token TKQ as the encrypted version of search query Q
to the cloud server, and the cloud server follows outsourced
data structure Γ ∗ and returns encrypted data record Ci to
this data user, if 1 ←Search(TKQ, Ci, Γ ∗ ). After retrieving
all matched records from the cloud server, the data user can
decrypt each one using decryption key DKQ in Decrypt.
In practice, to improve the efficiency of encryption over
large-size data records (e.g., e-health records), we can use an
extra layer of symmetric key encryption to encrypt each data
record first, and encrypt each symmetric key with MDRSE.
B. Threat Model
In this paper, we assume the data owner herself is a secure
and trusted party. The cloud server is assumed as a semitrusted
party (a.k.a. honest-but-curious party [5], [13]), which
means the data owner believes the cloud server is able to
provide reliable data storage and search services (will return
the correct search results by following the protocols), but may
be curious about not only the content of data outsourced by
the owner but also the content of search queries submitted by
data users. We also assume that data users are curious — a
data user may try to search and decrypt more data than allowed
with his given capability, or even collude with the cloud server
to reveal more privacy information about the owner’s data.
C. Security Definition and Design Objectives
Similar to previous public-key based searchable encryption
schemes, our MDRSE should achieve selective security [14].
The security game between a challenger and an adversary with
selective security can be described as follows.
Definition 2: (MDRSE-selective security). An MDRSE
scheme is selectively secure if all polynomial time adversaries
have at most a negligible advantageǫin the following selective
security game.
• Setup: The challenger runs algorithmSetup(λ, {T1,...,
TD}) to generate public key PK and master key MK. It
keeps master key MK private and gives public key PK to
the adversary.
• Phase 1: The adversary adaptively issues p search token
and decryption key requests to the challenger for
multi-dimensional range queries Q1,...,Qp, and obtains
p search tokens and corresponding p decryption keys.
• Challenge: The adversary submits two equal length data
records M∗ 0 and M∗ 1 , and their corresponding attribute
vectors A∗ 0 and A∗ 1, where A∗ 0 /∈ Qi and A∗ 1 /∈ Qi,
∀i ∈ [1,p]. The challenger flips a coin, the random
result of the coin flipping is b ∈ {0,1}. Then, the
challenger encrypts data record M∗ b by running algorithm
Encrypt(PK, M∗ b , A∗ b , Γ), and returns encrypted data
record C∗ b to the adversary.
• Phase 2: The adversary continues to issue another q
search token and decryption key requests to the challenger
for multi-dimensional range queries Qp+1,...,Qp+q, and
obtains q search tokens and corresponding q decryption
keys, where A∗ 0 /∈ Qi and A∗ 1 /∈ Qi, ∀i ∈ [p+1,p+q].
• Guess: Eventually, the adversary outputs a guess b ′ of b.
An adversary A’s advantage in the above game is defines as
Adv MDRSE−SS
A (λ) = |Pr[b = b ′ ]− 1
| ≤ ǫ. (1)
2
In the above security game, an adversary is allowed to obtain
search tokenTKQ and decryption keySKQ for any search query
Q of his choice, however, it is not able to distinguish encrypted
data record C∗ 0 from encrypted data record C∗ 1 , where none of
search query chosen by this adversary contains attribute vector
A∗ 0 or A∗ 1.
Besides the above security requirement, the main design
objectives of our MDRSE focus on the following three aspects:
• Sublinear Search Time. The search with a multidimensional
range search query on the entire encrypted
cloud data should be finished within sublinear time with
respect to n, the total number of the data records.
• Single Dimensional Confidentiality. The decryption
ability of a data user on a multi-dimensional range query
should not render him the additional capability to decrypt
on each single dimension independently.
• Single Dimensional Query Privacy. The search ability
of a data user on a multi-dimensional range query should
not grant him the additional capability to search on each
single dimension independently.
Preserving single dimensional confidentiality will resist decryption
collusion among queries. Similarly, protecting single
query privacy is able to prevent search collusion among
queries. In this paper, we do not aim at providing the data
access pattern privacy, which is an orthogonal problem [15].

L2
L8
L5
P4 P9
P5
P1
P2
L4
P3
L1
P7
L9
L7
P10
L6
P6
P8
L3
P1
L8
P2
L1
L2 L3
L4 L5
L6 L7
P3 P4 P5
L9
P6 P7
P8 P9 P10
Nodes are not visited:
L5 L8 P1 P2 P4 P5
Nodes are visited:
L1 L2 L3 L4 L6 L7 P3 P8 P9 P10
Nodes are reported directly:
L9 P6 P7
Points are reported (points lie in the query):
P3 P6 P7
(a) Points {P1,...,P10} in two- (b) The kd-tree based on Points {P1,...,P10}, and the search on it based on a query rectangle R, where
dimension, and a query rectangle R point P3, P6, and P7 are reported
covers point P3, P6, and P7
III. PRELIMINARIES
In this section, we introduce some multi-dimensional data
structures and some definitions in the multi-dimensions.
A. Multi-Dimensional Data Structures
A kd-tree [10] is a type of multi-dimensional data structure,
which can be used in many applications, such as range
searches and nearest neighbor searches [11]. The basic idea
to build a kd-tree is to split a set of (1-dimensional) points
into two subsets of roughly equal size, one subset contains
the points smaller than or equal to the splitting value, the
other subset contains the points larger than the splitting value.
The splitting value is stored at the root, and the two subsets
are stored recursively in the two subtrees [11]. For the case
of two-dimensional points, the splitting is first performed on
X-dimension, next on Y-dimension, then on X-dimension, and
so on. Further details about how to construct a kd-tree can be
found in [11]. An example of a kd-tree in the two-dimension
is illustrated in Fig. 3. According to the construction, a kd-tree
for a set of n points use O(n) storage and can be constructed
in O(nlogn) time.
L2
L8
L5
P4 P9
P5
P1
P2
L4
P3
L1
P7
L9
L7
P10
L6
P6
P8
L3
Fig. 3. An example of on a kd-tree, and a search query on it.
L9
P6 P7
Fig. 4. Non-leaf node L3 represents two rectangles (the yellow rectangle
and the red rectangle).
As we can see from Fig. 4, a leaf node in a kd-tree
represents a point, and a non-leaf node (a splitting value)
represents two rectangles. Generally, a two-dimensional range
query on a kd-tree can also be described as a rectangle [11].
We observe that whether two rectangles intersect and
whether a rectangle is fully contained in another one are
two significant factors to make decisions at non-leaf nodes
during the search algorithm on a kd-tree. For the general
case in the multi-dimension, we use hyper-rectangles instead
of rectangles. A search example and details of the search
algorithm are presented in Fig. 3 and Algorithm 1. With
L1
L6
P8
L3
P9
L7
P10
kd-trees, a D-dimensional range query takes O(n 1−1/D +k)
(sublinear) time, where k is the number of reported points.
Algorithm 1: SearchKdTree(v,R)
Input: The root (or a node) v of a kd-tree, and a rectangle R.
Output: All points at leaves below v that lie in R.
1 if v is a leaf then
2 Report the point stored at v if it lies in R.
3 else if v is a non-leaf then
4 if LeftRectangle(v) is fully contained in R then
5 Report all the points in LeftRectangle(v);
6 else if LeftRectangle(v) intersects R then
7 SearchKdTree(LeftChild(v), R);
8 if RightRectangle(v) is fully contained in R then
9 Report all the points in RightRectangle(v);
10 else if RightRectangle(v) intersects R then
11 SearchKdTree(RightChild(v), R);
Compared to a kd-tree, a range tree [11] is able to achieve an
even faster search time with O(log D n + k). As a necessary
tradeoff, it requires O(nlog D−1 n) storage, which is much
more than the O(n) storage in a kd-tree. Details description
about range trees can be found in [11].
B. Definitions in the Multi-Dimension
Here we introduce some definitions, including lattices,
points and hyper-rectangles.
Definition 3: (Lattice). Let ∆ = (T1,...,TD), where Ti
is the upper bound in the i-th dimension and 1 ≤ i ≤ D.
A lattice L∆ is defined as L∆ = [T1] × ··· × [TD], where
[Ti] = {1,...,Ti}.
Definition 4: (Point). A point X in L∆ is defined as X =
(x1,...,xD), where xi ∈ [Ti], ∀i ∈ D.
Definition 5: (Hyper-Rectangle). A hyper-rectangle HR
in L∆ is defined as HR = (R1,...,RD), where Ri is a range
in the i-th dimension, Ri ∈ [1,Ti], ∀i ∈ D.
IV. MULTI-DIMENSIONAL RANGE SEARCH OVER
ENCRYPTED DATA (MDRSE)
In this section, we will first show how to design a straightforward
MDRSE with some existing cryptographic primitive
[8] but without the help of any data structure. Based on
the properties of the primitive, this straightforward solution

can protect both single dimensional confidentiality and query
privacy, but only with linear search time, which is not practical
for searching on large datasets in the cloud. Then, we will describe
how to build a sublinear time and privacy-preserving
MDRSE with kd-trees and the same cryptographic primitive
[8], which however, is leveraged in a novel way.
A. Straightforward Solution
By directly leveraging a recent primitive, named Multidimensional
Range Predicate Encryption (MRPE) [8], we can
first design a straightforward solution of MDRSE. Specifically,
the data owner can directly encrypt each data record using
MRPE without any data structure, and outsource all the
encrypted data records to the cloud server. Then, the cloud
server is able to preform search on all the encrypted records
one by one based on the search token submitted by a data user.
In fact, this is the final solution in [8]. Clearly, the search time
of this straightforward solution is linearly increasing with the
total number of encrypted data records in the cloud server.
Considering the number of data records stored in the cloud
server could be quite large, this straightforward solution is
not practical, especially in the cloud scenario.
The MRPE mentioned above is a special type of encryption
that, if a message is encrypted with a point X, then the
encrypted version of this message can be correctly decrypted
with a decryption key generated by a hyper-rectangle HR,
if X ∈ HR. Details of MRPE are presented in Fig. 5. In
the straightforward solution, each data record Mi can be seen
as a message, its attribute vector Ai = (a1,i,...,aD,i) can be
described as a point X, and a multi-dimensional range search
query Q can be represented as a hyper-rectangle HR.
This MRPE [8] is built on Anonymous Identity-Based
Encryption (AIBE) [16] and binding techniques, which are
able to prevent collusion attacks introduced by the use of
the combination of different secret keys [8]. The ability of
preventing collusion attacks with different secret keys enables
the straightforward solution to preserve single dimensional
confidentiality and query privacy. MRPE also has a predicateonly
version, denoted as MRPE O , where only the flag string
Flag is encrypted, and the final output of decryption is 1,
if X ∈ HR and 0 otherwise. MRPE is selectively secure
if all polynomial time adversaries have at most a negligible
advantage ǫ in the selective security game. The security
of MRPE is based on the Decision Bilinear Diffie-Hellman
Assumption and Decision Linear Assumption [8]. Details of
security analyses can be found in [8]. Actually, MRPE can be
seen as a type of Functional Encryption [17], which is believed
as a new vision for public key cryptography.
B. Our Solution: Challenges and Overview
In order to improve the search efficiency (faster than linear
search time), we would like to exploit a kd-tree to organize
all the data records and handle multi-dimensional range search
queries by following the search algorithm of a kd-tree. Obviously,
it is easy to implement with existing techniques if the
data records are in plaintext. However, it is a challenging task
to exactly follow the search algorithm of a kd-tree when all
the nodes in the kd-tree and range queries are encrypted. More
Definition 6: (MRPE). A Multi-Dimensional Range Predicate
Encryption (MRPE) scheme should consist of the following four
probabilistic polynomial time algorithms.
Setup (λ, L∆): Given security parameter λ and lattice L∆ =
[T1]×···×[TD], where [Ti] = {1,...,Ti}, output public key
PK and master key MK.
Encrypt (PK, X, M, Flag): Given public key PK, point X ∈
L∆, message M and flag string Flag ∈ {0,1} α , where Flag
is a constant string with α bits, output ciphertext C, where C
is the encryption of Flag||M, || denotes the concatenation of
the flag string and a message.
DeriveKey (MK, HR): Given master key MK and hyperrectangle
HR, where HR ∈ L∆, output secret key SKHR.
Decrypt (PK, SKHR, C): Given public key PK, secret key
SKHR and ciphertext C, output M if the first α bits of
the decryption of C is Flag (X ∈ HR), and ⊥ otherwise
(X /∈ HR). The above algorithms must satisfy the following
constraints:
Decrypt(PK,SKHR,C) =
Flag||M, if X ∈ HR
⊥, w.h.p., if X /∈ HR
where C =Encrypt(PK,X,M,Flag)
SKHR =DeriveKey(MK,HR)
If X /∈ HR, the probability that the decryption result shows ⊥
is 1−2 −α .
Fig. 5. Details of MRPE.
specifically, according to what we observed in Section III, we
need to find methods to decide whether two hyper-rectangles
intersect; and whether one hyper-rectangle is fully contained
in another one based only on encrypted data.
To the best of our knowledge, there is no Functional
Encryption (also denoted as Predicate Encryption) from the
current literature is able to be directly used to verify the
two geometry relationships of two hyper-rectangles that we
mentioned above while still preserving privacy in each single
dimension. Interestingly, by utilizing MRPE [8] in a novel
way, we can find solutions to decide these two geometry
relationships of two hyper-rectangles on encrypted data. More
importantly, we can also protect privacy and confidentiality in
each single dimension.
In fact, by doing so, we can actually build two new Predicate
Encryptions based on MRPE. The first one is hyper-rectangle
intersection predicate encryption, where if a message is
encrypted with a hyper-rectangle HR and it can only be
decrypted with a decryption key generated by another hyper-
rectangle HR ′ , if HR ∩ HR ′
= ∅. The second one is
hyper-rectangle contained predicate encryption, where if
a message is encrypted with a hyper-rectangle HR and it can
only be decrypted with a decryption key generated by another
hyper-rectangle HR ′ , if HR ⊆ HR ′ .
C. Hyper-Rectangle Intersection Predicate Encryption
We now explain how to build a hyper-rectangle intersection
predicate encryption based on MRPE. For the ease of
description, we start with two ranges in a single dimension.
Given two ranges R and R ′ in a single dimension, we treat
the first range R = [xl,xu] as a point in a two-dimension, and

transform the second range R ′ = [x ′ l ,x′ u] into a rectangle in a
two-dimension, and then decide whether the two-dimensional
point based on the first range lies in the two-dimensional
rectangle generated from the second range. If the point is
indeed in the rectangle, then the two ranges intersect with
each other. Otherwise, they do not intersect. Examples of range
intersection are described in Fig. 6. Based on this basic idea,
we have the following lemma
x1,l x1,u
1
x2,l x2,u x3,l x3,u
x ′ l
x ′ u
x4,l x4,u
Ranges intersect with R ′ = [x ′ l ,x′ u]
Ranges do not intersect with R ′ = [x ′ l ,x′ u]
Fig. 6. Examples of whether two ranges intersect.
Lemma 1: For two ranges R = [xl,xu] and R ′ = [x ′ l ,x′ u],
we have a point X = (x1,x2) = (xl,xu) based on range R
and a rectangle HR ′ = (R ′ 1,R ′ 2) based on range R ′ , where
R ′ 1 = [1,x ′ u] and R ′ 2 = [x ′ l ,T]. If X ∈ HR′ , then R∩R ′ =
∅; otherwise, X /∈ HR ′ , then R∩R ′ = ∅.
The correctness of this lemma can be explained as below
R∩R ′ = ∅ ⇔
xl ≤ x ′ u
xu ≥ x ′ l
⇔
xl ∈ [1,x ′ u]
xu ∈ [x ′ l ,T] ⇔ X ∈ HR′ .
By extending Lemma 1, we can decide whether the intersection
of two hyper-rectangles is null.
Lemma 2: For two hyper-rectangles HR = (R1,...,RD)
and HR ′ = (R ′ 1,...,R ′ D ), where Ri = [xi,l,xi,u] and R ′ i =
[x ′ i,l ,x′ i,u ], for i ∈ [D], we have a point X = (x1,...,x2D) =
(x1,l,x1,u,...,xD,l,xD,u) and a hyper-rectangle HR ′′ =
(R ′′
1,...,R ′′
2D ), where R′′ 2i−1 = [1,x′ i,u ] and R′′ 2i = [x′ i,l ,T],
for i ∈ [D]. If X ∈ HR ′′ , then HR∩HR ′ = ∅; otherwise,
X /∈ HR ′′ , then HR∩HR ′ = ∅.
Then, we can encrypt a message with this 2D-dimensional
point (transformed from HR) using MRPE, and this message
can only be decrypted with a decryption key generated by a
2D-dimensional hyper-rectangle (transformed from HR ′ ), if
HR ∩ HR ′ = ∅. Clearly, this hyper-rectangle intersection
predicate encryption is selectively secure if MRPE is selectively
secure.
D. Hyper-Rectangle Contained Predicate Encryption
Similar as the method in the last subsection, we can decide
whether a hyper-rectangle is fully contained in another one.
For the ease of understanding, we still start with two ranges
in the single dimension. Given two ranges R and R ′ , we
transform the first range as a two-dimensional point, and
transform the second one as a two-dimensional rectangle. If
the point is in the rectangle, then range R is fully contained
in range R ′ . Compared to the method of deciding whether
two ranges intersect, the second range R ′ in this method is
transformed in a different way, which is illustrated in the
following lemma and Fig. 7.
T
x1,l
x ′ l
x1,u
x2,lx2,u x3,lx3,u
1 T
x ′ u
x4,l x4,u
Ranges are fully contained in R ′ = [x ′ l ,x′ u]
Ranges are not fully contained in R ′ = [x ′ l ,x′ u]
Fig. 7. Examples of whether a range is fully contained in another one.
Lemma 3: For two ranges R = [xl,xu] and R ′ = [x ′ l ,x′ u],
we have a point X = (x1,x2) = (xl,xu) based on range R
and a rectangle HR ′ = (R ′ 1,R ′ 2) based on range R ′ , where
R ′ 1 = [x ′ l ,x′ u] and R ′ 2 = [x ′ l ,x′ u]. If X ∈ HR ′ , then R ⊆ R ′ ;
otherwise, X /∈ HR ′ , then R R ′ .
The correctness of this lemma can be proved as below
R ⊆ R ′ ⇔
xl ∈ [x ′ l ,x′ u]
xu ∈ [x ′ l ,x′ u] ⇔ X ∈ HR′ .
Similarly, we can also extend the above lemma into the multidimensional
version.
Lemma 4: For two hyper-rectangles HR = (R1,...,RD)
and HR ′ = (R ′ 1,...,R ′ D ), where Ri = [xi,l,xi,u] and R ′ i =
[x ′ i,l ,x′ i,u ], for i ∈ [D], we have a point X = (x1,...,x2D) =
(x1,l,x1,u,...,xD,l,xD,u) and a hyper-rectangle HR ′′ =
(R ′′
1,...,R ′′
2D ), where R′′ 2i−1 = [x′ i,l ,x′ i,u
] and R′′
2i =
[x ′ i,l ,x′ i,u ], for i ∈ [D]. If X ∈ HR′′ , then HR ⊆ HR ′ ;
otherwise, X /∈ HR ′′ , then HR HR ′ .
Then, we can encrypt a message with this 2D-dimensional
point (transformed from HR) using MRPE, and this message
can only be decrypted with a decryption key generated by
a 2D-dimensional hyper-rectangle (transformed from HR ′ ),
if HR ⊆ HR ′ . Similarly, this hyper-rectangle contained
predicate encryption is selectively secure as long as MRPE
is selectively secure.
E. Construction of Our Scheme
With the two novel predicate encryptions above, we can
build a sublinear time and privacy-preserving MDRSE by
following the framework in Section II. Details of our scheme
based on kd-trees are illustrated in Fig. 8.
Specifically, the data owner first generates the public key
and master key in Setup, and builds a kd-tree Γ based
all the data records and attribute vectors in Build. Then,
with Encrypt, the data owner encrypts every node in Γ,
and outputs outsourced kd-tree Γ ∗ , which has exactly the
same structure as Γ. A non-leaf node is encrypted with
the combination of hyper-rectangle contained predicate encryption
(e.g., {C3,L,C3,R}) and hyper-rectangle intersection
predicate encryption (e.g., {C4,L,C4,R}), and returned as
C = {C3,L,C3,R,C4,L,C4,R}. Note that only predicate-only
version of the two encryptions are required for a non-leaf node,
because a non-leaf node does not store any data records. A
leaf node is encrypted with the combination of symmetric key
encryption, MRPE and its predicate-only version, and returned
as Ci = {Ci,0,Ci,1,Ci,2}.

A data user is given the search token and decryption key
from the data owner based on the master key and search
query inExtract, and submits the search token to the cloud
server to operate Search. At a non-leaf node, if hL = 1
(the left hyper-rectangle is fully contained in the query hyperrectangle),
then the cloud server reports all the nodes in the left
subtree; else if gL = 1 (the two hyper-rectangle intersect), the
cloud server continues to search in the left subtree; otherwise,
the cloud server stops to search the left subtree; Meanwhile,
the cloud server also computes hR and gR, and make decisions
for the right subtree with the same rule as described in Fig. 8.
At a leaf node, if f = 1 (a point lies in the query hyperrectangle),
the cloud server returns the encrypted data record
on this leaf node to the data user.
Compared to the search algorithm (described in Section III)
of a kd-tree in the plaintext domain, our search algorithm over
encrypted data exactly follows the same search rules not only
at non-leaf nodes but also at leaf nodes, which enables our
scheme to achieve sublinear search time. Finally, the data user
is able to reveal a data record Mi with a two-layer decryption
if its attribute vector Ai ∈ Q in Decrypt. According to the
correctness of decryption, even a data user colludes with the
cloud server, and obtains more encrypted data records than he
is expected, he cannot reveal those data record, whose Ai /∈ Q.
F. Security and Privacy Analysis
We now analyze the security and privacy of our scheme.
Theorem 1: (Our Scheme-selective security). Our proposed
scheme is selectively secure, as long as MRPE is
selectively secure.
Proof: The security of our scheme includes two aspects:
the security on non-leaf nodes and security on leaf nodes.
In our scheme, each non-leaf node can be represented
as two hyper-rectangles, and the two hyperrectangle
are encrypted with MRPEO separately. Without
loss of generality, for two different encrypted values
C∗ 1 = {C∗ 1,3,L ,C∗ 1,3,R ,C∗ 1,4,L ,C∗ 1,4,R } and C∗ 2 =
{C∗ 2,3,L ,C∗ 2,3,R ,C∗ 2,4,L ,C∗ 2,4,R } on two different non-leaf
nodes returned from the selective security game defined in
Section II, if the advantage of an adversaryAon distinguishing
two different ciphertexts C∗ 1,3,L and C∗ 2,3,L (or C∗ 1,3,R and
C∗ 2,3,R ) in the MRPEO selectively secure game is ǫ, then
the advantage of this adversary A on distinguishing the two
different encrypted values C∗ 1 and C∗ 2 on two different nonleaf
nodes is4ǫ−6ǫ2 +4ǫ3−ǫ4 .The advantage of this adversary
A on non-leaf nodes in our scheme’s selective security game
is defined as
Adv OurScheme−SS
A−Non−Leaf (λ) = |Pr[b = b′ ]− 1
2 |
≤ 4ǫ−6ǫ 2 +4ǫ 3 −ǫ 4 .
which is negligible.
Each leaf node is encrypted with one round MRPE and
one round MRPE O . Without loss of generality, for two different
encrypted values C ∗ 1 = {C ∗ 1,0,C ∗ 1,1,,C ∗ 1,2} and C ∗ 2 =
{C ∗ 2,0,C ∗ 2,1,C ∗ 2,2} on two different leaf nodes (data records)
returned from the selective security game defined in Section
II, if the advantage of an adversary A on distinguishing
two different ciphertexts C ∗ 1,1 and C ∗ 2,1 in the MRPE selectively
secure game is ǫ, and the advantage on distinguishing
two different ciphertexts C ∗ 1,2 and C ∗ 2,2 in the corresponding
MRPE O selectively secure game is ǫ, then the advantage of
this adversary A on distinguishing two different encrypted
values C ∗ 1 and C ∗ 2 on two different leaf nodes (data records)
is 2ǫ−ǫ 2 .
The advantage of this adversary A on leaf nodes in our
scheme’s selective security game is defined as
Adv OurScheme−SS
A−Leaf (λ) = |Pr[b = b ′ ]− 1
2 | ≤ 2ǫ−ǫ2 . (2)
which is negligible.
Note that since the length of ciphertexts on a non-leaf
node and a leaf node are different, an adversary is able
to distinguish a non-leaf node from a leaf node based on
ciphertexts. However, distinguishing whether a node is a leaf
node or non-leaf node, the adversary will not gain more
more advantage in the selective security game. Therefore, our
proposed scheme is selectively secure, as long as MRPE is
selectively secure.
Theorem 2: (Single Dimensional Confidentiality). If our
scheme is selectively secure, then it preserves single dimensional
confidentiality.
Proof: We first assume an adversary is able to decrypt
data records on a single-dimensional range search query independently
based on a decryption key on a multi-dimensional
range search query, which means our scheme would fail to
achieve multi-dimensional confidentiality. Then we will show
that this assumption would conflict the fact that our scheme
is selectively secure.
More specifically, given a multi-dimensional range search
query Q = [x1,l,x1,u] ∧ [x2,l,x2,u] ∧ ···∧[xD,l,xD,u], the
data owner generates a decryption key SK SKQ on this query Q
for the adversary. This search query Q can be represented as a
hyper-rectangle HRQ = {R1,R2,...,RD}, Ri = [xi,l,xi,u],
for 1 ≤ i ≤ D.
We first assume the adversary is able to decrypt with SK SKQ
on a single-dimensional range search query Q ′ = [x1,l,x1,u],
which can be represented as HRQ ′ = {R1,R ′ 2,...,R ′ D },
R1 = [x1,l,x1,u] and R ′ i = [1,Ti], for 2 ≤ i ≤ D.
Then, for two ciphertexts C ∗ 1 and C ∗ 2 , where the two points
X ∗ 1,X ∗ 2 ∈ HRQ ′ but X∗ 1,X ∗ 2 /∈ HRQ, this adversary is
able to decrypt C ∗ 1 and C ∗ 2 , which means it can distinguish
the corresponding messages M ∗ 1 and M ∗ 2 . It also indicates
that, for the two points X ∗ 1,X ∗ 2 /∈ HRQ, this adversary is
able to distinguish M∗ 1 and M∗ 2 based on the decryption key
SK SKQ, which means MRPE is not selectively secure. Clearly, it
would conflict the fact that our scheme is selectively secure.
Therefore, as long as our scheme is selectively secure, then our
scheme is able to provide multi-dimensional confidentiality.
Theorem 3: (Single Dimensional Query Privacy). If all
the data records in our scheme are indexed with a kd-tree
and our scheme is selectively secure, then it achieves single
dimensional query privacy.

Setup(λ, {T1,...,TD}): Given security parameter λ and upper
bound Ti in each dimension, build a lattice L∆ = [T1]×···×[TD]
and a lattice L2∆ = [T1]×[T1]×···×[TD]×[TD]; compute
(PK1,MK1) ←MRPE.Setup(λ,L∆),
(PK2,MK2) ←MRPE O .Setup(λ,L∆),
(PK3,MK3) ←MRPE O .Setup(λ,L2∆),
(PK4,MK4) ←MRPE O .Setup(λ,L2∆);
and output public key PK = {PK1,PK2,PK3,PK4} and master key
MK = {MK1,MK2,MK3,MK4}.
Build({M1,...,Mn}, {A1,...,An}): Given all the data records
{M1,...,Mn} and their attributes {A1,...,An}, output kd-tree Γ.
Encrypt(PK PK PK, {M1,...,Mn}, Γ): Given public key PK =
{PK1,PK2,PK3,PK4}, all the data records {M1,...,Mn} and kdtree
Γ, encrypt each node in kd-tree Γ.
• If it is a non-leaf node, let HRL and HRR be the two hyperrectangles
of this node; transform HRL = (R1,..,RD),
where Ri = [xi,l,xi,u], into a point XL = (x1,...,x2D) =
(x1,l,x1,u,...,xD,l,xD,u), transform HRR into a point XR
in the same way; compute
C3,L ←MRPE O .Encrypt(PK3,XL,Flag),
C3,R ←MRPE O .Encrypt(PK3,XR,Flag),
C4,L ←MRPE O .Encrypt(PK4,XL,Flag),
C4,R ←MRPE O .Encrypt(PK4,XR,Flag),
and output C = {C3,L,C3,R,C4,L,C4,R}.
• If it is a leaf node, it is a data record Mi, i ∈ [1,n], and
its attribute vector is Ai = (ai,1,...,ai,D); set a point X
as X = (x1,...,xD) = (ai,1,...,ai,D), generate a random
symmetric key Ki, then encrypt as
Ci,0 ←Enc(Ki,Mi),
Ci,1 ←MRPE.Encrypt(PK1,X,Ki,Flag),
Ci,2 ←MRPE O .Encrypt(PK2,X,Flag),
and output Ci = {Ci,0,Ci,1,Ci,2}.
Output outsourced kd-tree Γ ∗ after encrypting all the nodes.
Extract(MK MK MK,Q): Given master key MK = {MK1,MK2,MK3,MK4}
and a multi-dimensional range search query Q = [x1,l,x1,u] ∧
Proof: Preserving single dimensional query privacy in
an MDRSE includes two aspects. First, the leveraged multidimensional
data structure itself will not reveal additional
query privacy in single-dimensions. Second, a data user (or
the cloud server) is not able to decompose the search token of
a multi-dimensional range query into the ones in each single
dimension.
For the first aspect, because all the data records in our
scheme are indexed based on the structure of a kd-tree, where
the search decision at each node depends on the ranges in all
the dimensions, therefore, an adversary is not able to reveal
single dimensional query privacy from the data structure of a
kd-tree.
Meanwhile, we can also prove that if an adversary is able
to decompose the search token of a multi-dimensional range
query into each single dimension, then it will conflict the fact
that our scheme is selectively secure.
More specifically, given a multi-dimensional range search
query Q = [x1,l,x1,u] ∧ [x2,l,x2,u] ∧ ···∧[xD,l,xD,u], the
Fig. 8. Details of our scheme based on kd-trees.
··· ∧ [xD,l,xD,u], transform Q into a hyper-rectangle HR =
(R1,...,RD), where Ri = [xi,l,xi,u] and 1 ≤ i ≤ D; generate
a hyper-rectangle HR ′ = (R ′ 1,...,R ′ 2D), where R ′ 2i−1 =
[xi,l,xi,u] and R ′ 2i = [xi,l,xi,u], for 1 ≤ i ≤ D, and a hyperrectangle
HR ′′ = (R ′′
1,...,R ′′
2D), where R ′′
2i−1 = [1,xi,u] and
R ′′
2i = [xi,l,Ti], for 1 ≤ i ≤ D; compute
SK1 ←MRPE.DeriveKey(MK1,HR),
TK2 ←MRPE O .DeriveKey(MK2,HR),
TK3 ←MRPE O .DeriveKey(MK3,HR ′ ),
TK4 ←MRPE O .DeriveKey(MK4,HR ′′ );
and return search token TK TKQ = {TK2,TK3,TK4} and decryption
key SK SKQ = SK1.
Search(TK TK TKQ, Γ ∗ ): Given search token TK TKQ = {TK2,TK3,TK4}
and outsourced kd-tree Γ ∗ , search from the root node of Γ ∗ and
perform as follows:
• If it is a non-leaf node C = {C3,L,C3,R,C4,L,C4,R}, compute
hL ← MRPE O .Decrypt(PK3,TK3,C3,L), if hL = 1,
report all the nodes in the left subtree; otherwise compute
gL ← MRPE O .Decrypt(PK4,TK4,C4,L), if gL = 1, continue
to search the left subtree; otherwise stop to search the
left subtree;
compute hR ←MRPE O .Decrypt(PK3,TK3,C3,R), if hR =
1, report all the nodes in the right subtree; otherwise compute
gR ← MRPE O .Decrypt(PK4,TK4,C4,R), if gR = 1,
continue to search the right subtree; otherwise stop to search
the right subtree;
• If it is a leaf node Ci = {Ci,0,Ci,1,Ci,2}, compute
f ← MRPE O .Decrypt(PK2,TK2,Ci,2), if f = 1, return
Ci; otherwise, do not return Ci.
Decrypt(SK SK SKQ,Ci): Given decryption keySK SK SKQ and encrypted data
record Ci = {Ci,0,Ci,1,Ci,2}, compute
Ki ←MRPE.Decrypt(PK1,SKHR,Ci,1),
Mi ← Dec(Ki,Ci,0) = Dec(Ki,Enc(Ki,Mi)),
and output data record Mi, if attribute set Ai ∈ Q; and ⊥
otherwise.
data owner generates a search token TK TKQ on this query Q for
the adversary. This search query Q can be represented as a
hyper-rectangle HRQ = {R1,R2,...,RD}, Ri = [xi,l,xi,u],
for 1 ≤ i ≤ D.
We first assume the adversary is able to search with TK TKQ
on a single-dimensional range search query Q ′ = [x1,l,x1,u],
which can be represented as HRQ ′ = {R1,R ′ 2,...,R ′ D },
R1 = [x1,l,x1,u] and R ′ i = [1,Ti], for 2 ≤ i ≤ D.
Then, for two ciphertexts C ∗ 1 and C ∗ 2 , where the two points
X ∗ 1,X ∗ 2 ∈ HRQ ′ but X∗ 1,X ∗ 2 /∈ HRQ, this adversary is
able to decrypt C ∗ 1 and C ∗ 2 , which means it can distinguish
the corresponding messages M ∗ 1 and M ∗ 2 . It also indicates
that, for the two points X ∗ 1,X ∗ 2 /∈ HRQ, this adversary is
able to distinguish M∗ 1 and M∗ 2 based on the search token
TK TKQ, which means MRPE is not selectively secure. Clearly, it
would conflict the fact that our scheme is selectively secure.
Therefore, as long as our scheme is selectively secure, an
adversary is not able to decompose the search token of a multidimensional
range query into each single dimension.

V. MULTI-DIMENSIONAL RANGE SEARCH OVER
ENCRYPTED DATA (MDRSE) ON RANGE TREES
A. Overview
Generally, different multi-dimensional data structures in the
plaintext domain can be used to achieve different tradeoffs
between search time and storage overhead. Ideally, we would
like to have the capability to make the same tradeoff over
encrypted data. In fact, we can also use the similar methodology
in the last section to design another MDRSE with an
even faster (polylogarithmic) search time based on range trees
[12]. According to the tradeoff, which we shown in Section
III, the scheme based on a range tree requires much more
storage overhead than the one based on a kd-tree.
Specifically, we can exactly follow the search algorithm of
a range tree in plaintext when all the nodes in a range tree are
encrypted with the utilization of hyper-rectangle intersection
predicate encryption and another novel predicate encryption,
named hyper-rectangle containing predicate encryption.
With the hyper-rectangle containing predicate encryption, if
a message is encrypted with a hyper-rectangle HR, then it
can be only decrypted with a decryption key generated by a
hyper-rectangle HR ′ , if HR ⊇ HR ′ . Note that this hyperrectangle
containing predicate encryption is different from the
hyper-rectangle contained predicate encryption designed in the
previous section.
However, because the search algorithm of a range tree
itself can be operated on each single dimension independently,
this scheme based on range trees is not able to achieve
single dimensional query privacy. For example, given a multidimensional
range query Q = [x1,x2] ∧ [y1,y2], the search
results of it after X-dimension is exactly the same as the search
result of the single dimensional range query Qx = [x1,x2], no
matter all the nodes in the range tree are encrypted or not. Note
that single dimensional confidentiality in the range tree-based
scheme is still preserved.
Actually, we also believe our design methodology can be
leveraged into other multi-dimensional data structures, such as
R-trees [18] and Quadtrees [19], whose search algorithm also
depends on the geometry relationships of hyper-rectangles.
B. Introduction to Range Trees
Before describing our MDRSE based on range trees, we first
briefly introduce how to search on a range tree. Without loss of
generality, we present the following examples and algorithms
with the two-dimension, which can be easily extended into the
multi-dimensional case. An example of a range tree is listed
in Fig. 9. In a 2-dimensional range tree, all the nodes are
first organized in x-dimension as a balanced binary tree. Then
for each non-leaf node, it also has a second level tree (still
a balanced binary tree), where the nodes under this non-leaf
node are organized based on y-dimension.
The essential idea to search on a range tree is to search
each single dimension one by one. Specifically, given range
query Q = [x1,x2]∧[y1,y2], we first concentrate on finding
the points whose x-dimension lies in [x1,x2], and then we
report those points whose y-dimension also lies in [y1,y2]. As
a result, for the search on each single dimension (x-dimension
or y-dimension), it is a 1-dimensional range query, which is
described as follows.
Given range query Qx = [x1,x2], we search with [x1,x2] in
the x-dimension until we get to a node vsplit where the search
paths split. From the left child of vsplit, we continue the search
with x1, and at every node v where the search path of x goes
left, we report all points in the right subtree of v. Similarly,
we continue the search with x2 at the right child of vsplit, and
at every node v where the search path of x ′ goes right, we
report all points in the left subtree of v. Finally, we check the
leaves µ and µ ′ where the two paths end to see if they contain
a point in the range. The search process is also illustrated in
Fig.9(c).
Based on the range search algorithm on 1-dimension, the
search algorithm of a 2-dimensional range tree is presented in
Algorithm 2. Further details about range trees can be found
in [11].
Algorithm 2: 2DRangeQuery(v, Q)
Input: A 2D range tree Γ and a query Q = [x1,x2]∧[y1,y2].
Output: All points in Γ that lie in Q.
1 vsplit ← FindSplitNode(Γ,[x1,x2]);
2 if vsplit is a leaf then
3 Report it if the point stored at vsplit lies in Q.
4 else
5 v ← LeftChild(vsplit);
6 while v is not a leaf do
7 if x1 ≤ xv then
8 1DRangeQuery(Γassoc(RightChild(v)),[y1,y2]);
9 v ← LeftChild(v);
10 else
11 v ← RightChild(v);
12 Report the leaf (where the path ends) if the point stored at
vsplit lies in Q;
13 Similarly, follow the path from RightChild(vsplit) to x2,
call 1DRangeQuery with the range [y1,y2] on the
associate structures of subtrees Γassoc(LeftChild(v)), which
is on the left of the path, and report a point at the leaf
(where the path ends) if it lies in Q.
C. Challenges
As we can see from Algorithm 2, by doing comparison (i.e.
if x1 ≤ xv) in 1-dimensional range query, it is more easier
and simpler to make decisions at nodes in a range tree than
verifying geometry relationships of two hyper-rectangles at
nodes in a kd-tree. However, during the design of an MDRSE
based on range trees, if we directly follow the one-by-one
search on each single dimension of a range tree in plaintext
domain, we have to decompose search tokens and decryption
tokens over encrypted data into each single dimension, which
will no doubt reveal more information to data users than
they are authorized.
In order to leverage the similar methodology in the last
section to solve the above problem, we first transform the
decision conditions at nodes in a range tree into geometry
relationships of two rectangles in the two-dimension (two

X-dimension
(first level tree)
Y-dimension
(second level tree)
(a) 2D range tree, where each non-leaf node in xdimension
has a second level tree on y-dimension.
X-dimension
(first level tree)
Two Rectangles
HRL = ([1,3],[1,Ty])
HRR = ([3,6],[1,Ty])
1
3
1,5 3,8 4,2
hyper-rectangles in the multi-dimension). This transformation
makes the decision conditions more complicated than the
original ones, but will offer us an opportunity to design an
MDRSE based on range trees.
Specifically, similar as a non-leaf node in a kd-tree, a nonleaf
node in a range tree can also be represented with two
rectangles on each level tree (shown in Fig. 9(b)) and the range
query can be always denoted as a rectangle HRQ. Then, we
can find a method to decide the split node in a range tree by
verifying whether a rectangle fully covers another one. Details
are illustrated in the following algorithm. To distinguish the
original one, we denote it as FindSplitNode ∗ . Note that the
input of the original one is the range treeΓand a range[x1,x2]
in a single dimension, while the input of ours is the range tree
Γ and the entire range query Q in the multi-dimension.
Algorithm 3: FindSplitNode ∗ (Γ, Q)
Input: A 2D range tree (or its subtree) Γ, and a query
Q = [x1,x2]∧[y1,y2], which can be transformed as a
rectangle HRQ = [Rx,Ry], where Rx = [x1,x2] and
Ry = [y1,y2];
Output: The split node vsplit in a single dimension.
1 v is the root (or a node) of Γ;
2 if v is a leaf then
3 v is the split node.
4 else if v is a non-leaf then
5 if LeftRectangle(v) fully covers HRQ then
6 FindSplitNode ∗ (LeftSubtree(v),Q);
7 else if RightRectangle(v) fully covers HRQ then
8 FindSplitNode ∗ (RightSubtree(v),Q);
9 else
10 v is the split node;
With Algorithm FindSplitNode ∗ , we then transform the
original search algorithm of a range tree by verifying geometry
relationships of two rectangles at nodes. Similar, to
distinguish the original one, we denote ours as 2DRange-
Query ∗ . The search rule of 1DRangeQuery ∗ is the same
as 2DRangeQuery ∗ , except when LeftRectangle(v) intersects
HRQ, 1DRangeQuery ∗ reports all the nodes on the right
subtree and continues to search on the left subtree. Clearly, we
can easily extend 2DRangeQuery ∗ into its the D-dimensional
version DDRangeQuery ∗ .
4
6,9
Y-dimension
(second level tree)
5
8
2
6,9
3,8
1,5
4,2
Two Rectangles
HRL = ([1,6],[2,5])
HRR = ([1,6],[5,9])
(b) A first level tree and its second level tree. Each
non-leaf node in x-dimension (or y-dimension) can be
represented as two rectangles.
Fig. 9. An example of a range tree.
3
10
23
19 30
37
49
70 89 93
3 10 19 23 30 37 59 62 70 80 93
49
59
62
Split Node
(c) Find split node in a single dimension with
query Q = [61,90].
Algorithm 4: 2DRangeQuery ∗ (v,Q)
Input: A 2D range tree Γ, and a query Q = [x1,x2]∧[y1,y2],
which can be transformed as a rectangle
HRQ = [Rx,Ry], where Rx = [x1,x2] and
Ry = [y1,y2];
Output: All points in Γ that lie in Q.
1 vsplit ← FindSplitNode ∗ (Γ,Q);
2 if vsplit is a leaf then
3 Report it if the point X stored at vsplit lies in HRQ.
4 else
5 v ← LeftChild(vsplit);
6 while v is not a leaf do
7 if LeftRectangle(v) intersects HRQ then
8 1DRangeQuery ∗ (Γassoc(RightChild(v)),Q);
9 v ← LeftChild(v);
10 else
11 v ← RightChild(v);
12 Report the leaf (where the path ends) if the point X stored
at vsplit lies in HRQ;
13 Similarly, follow the path from RightChild(vsplit) to some
leaf, call 1DRangeQuery ∗ with the query Q on the
associate structures of subtrees Γassoc(LeftChild(v)), which
is on the left of the path, and report a point at the leaf
(where the path ends) if it lies in HRQ.
D. Hyper-Rectangle Containing Predicate Encryption
As we argued at the beginning of this section, except hyperrectangle
intersection predicate encryption, which is able to
decide whether two rectangles intersect, we also need another
predicate encryption, named hyper-rectangle containing predicate
encryption, to decide whether a hyper-rectangle HR fully
contains another hyper-rectangle HR ′ based on encrypted
data.
Once again, for the ease of description, we start to explain
hyper-rectangle containing predicate encryption with two
ranges in a single dimension. Given two ranges R and R ′ in
a single dimension, we transform the first range R = [xl,xu]
into a point in a two-dimension, and convert the second range
R ′ = [x ′ l ,x′ u] into a rectangle in a two-dimension. Then,
we can decide whether range R fully covers range R ′ by
verifying whether this two dimensional point is in the twodimensional
rectangle. As shown in Fig. 10 and Lemma 5,
the transformation of range R into a point is the same as
hyper-rectangle intersection predication encryption and hyperrectangle
contained predicate encryption, but the transforma-
80
89
97

tion of range R ′ into the two-dimensional rectangle is neither
the same as the way in hyper-rectangle intersection predicate
encryption nor the approach in hyper-rectangle contained
predicate encryption.
x1,l
x2,l
x3,l
x ′ l
x1,u
x ′ u
x3,u
x2,u
1 T
Ranges fully cover R ′ = [x ′ l ,x′ u]
Ranges fully cover R ′ = [x ′ l ,x′ u]
x4,l x4,u
Fig. 10. Examples of whether one range fully covers another one.
Lemma 5: For two ranges R = [xl,xu] and R ′ = [x ′ l ,x′ u],
we have a point X = (x1,x2) = (xl,xu) based on range R
and a rectangle HR ′ = (R ′ 1,R ′ 2) based on range R ′ , where
R ′ 1 = [1,x ′ l ] and R′ 2 = [x ′ u,T]. If X ∈ HR ′ , then R ⊇ R ′ ;
otherwise, X /∈ HR ′ , then R R ′ .
The correctness of this lemma can be explained as below
R ⊇ R ′ ⇔
xl ∈ [1,x ′ l ]
xu ∈ [x ′ u,T] ⇔ X ∈ HR′ .
By extending Lemma 5, we can decide whether a hyperrectangle
fully covers another hyper-rectangle in the multidimension.
Lemma 6: For two hyper-rectangles HR = (R1,...,RD)
and HR ′ = (R ′ 1,...,R ′ D ), where Ri = [xi,l,xi,u] and R ′ i =
[x ′ i,l ,x′ i,u ], for i ∈ [D], we have a point X = (x1,...,x2D) =
(x1,l,x1,u,...,xD,l,xD,u) and a hyper-rectangle HR ′′ =
(R ′′
1,...,R ′′
2D ), where R′′ 2i−1 = [1,x′ i,l ] and R′′ 2i = [x′ i,u ,T],
for i ∈ [D]. If X ∈ HR ′′ , then HR ⊇ HR ′ ; otherwise,
X /∈ HR ′′ , then HR HR ′ .
Then, by transforming two D-dimensional hyper-rectangles
HR, HR ′ into a 2D-dimensional point and a 2D-dimensional
hyper-rectangle respectively based on the above lemma, we
can encrypt a message with this 2D-dimensional point (transformed
from HR) using MRPE, and this message can
only be decrypted with a decryption key generated by a
2D-dimensional hyper-rectangle (transformed from HR ′ ), if
HR ⊇ HR ′ . Clearly, this hyper-rectangle containing predicate
encryption is selectively secure if MRPE is selectively
secure.
E. Construction based on Range Trees
Using these two predicate encryptions together, we are able
to build an MDRSE within polylogarithmic search time based
on range trees over encrypted data. As we can see from the
following box, during the encryption, each non-leaf node is encrypted
with hyper-rectangle containing predicate encryption
and hyper-rectangle intersection predicate encryption together;
and each leaf node is still encrypted with the combination
of symmetric key encryption, MRPE and its predicate-only
version, which is the same as the case in kd-trees.
During the search, our scheme exactly follows
FindSplitNode ∗ and DDRangeQuery ∗ by computing hi,L,
hi,R, gi,L, gi,R, and f respectively when it is necessary. For
instance, when we need to decide whether LeftRectangle(v)
fully covers HRQ in FindSplitNode ∗ , we compute the
corresponding hi,L of this node v, if hi,L = 1 (indicates
LeftRectangle(v) fully covers HRQ), then we continue to
find split node in the left subtree. By doing these, we can
exactly follow the search algorithm of a range tree when all
the nodes are encrypted.
F. Security and Privacy Analysis
With the same approach in the previous section, we can
prove that our scheme (range-tree) is also selectively secure
and single dimensional confidentiality.
Theorem 4: (Our Scheme (range trees)-selective security.)
Our proposed scheme (range trees) is selectively secure
against polynomial-time adversaries, as long as MRPE is
selectively secure against polynomial-time adversaries.
Theorem 5: (Single Dimensional Confidentiality). If our
proposed scheme (range trees) is selectively secure, then it
preserves single dimensional confidentiality.
Although the search tokens are not able to be decomposed
into single dimensions in our scheme (range tree), however, it
is not able to achieve single dimensional query privacy. It is
because the data structure of a range tree itself will inevitably
reveal single dimensional query privacy. Now let us explain it
with the following example.
We first assume a data user obtains a search token TK TKQ
based on a two-dimensional range query Q = [x1,x2] ∧
[y1,y2]. Then this data user can submit his search tokenTK TK TKQ to
the cloud, and the cloud server will search on the outsourced
range tree Γ∗ with TK TKQ. If the cloud server colludes with
this data user, stops the search algorithm right after finishing
search on X-dimension, and directly returns the search results
on X-dimension to the data user, then these results are exactly
the same as the search results of a single dimensional range
query Qx = [x1,x2], which means the data user can search on
a range tree for an X-dimensional range query with a search
token of a multi-dimensional query. To search independently
on Y-dimension, the cloud server can directly jump to the
y-dimension tree (second level tree) without searching on Xdimension.
Then, by doing these, the search results after Ydimension
ofQis exactly the same asQy = [y1,y2], no matter
the nodes are encrypted or not.
Well, the good news is to compromise the single dimensional
query privacy, this data user needs to collaborate with
the cloud server. In addition, this data user is not able to
decrypt those results on single dimensions because single
dimensional confidentiality is still protected. The reason of this
privacy leak is caused by the fact that the search algorithm of
a range tree is operated on each single dimension one after
another. When performing search on x-dimension, the ranges
of other dimensions will not affect the search decisions at
nodes in x-dimension. Therefore, as long as two queries have
the same range on x-dimension, the search results after xdimension
(first level tree) is exactly the same, no matter

Setup(λ, {T1,...,TD}): Given security parameter λ and upper
bound Ti in each dimension, build a lattice L∆ = [T1]×···×[TD]
and a lattice L2∆ = [T1]×[T1]×···×[TD]×[TD]; compute
(PK1,MK1) ←MRPE.Setup(λ,L∆),
(PK2,MK2) ←MRPE O .Setup(λ,L∆),
(PK3,MK3) ←MRPE O .Setup(λ,L2∆),
(PK4,MK4) ←MRPE O .Setup(λ,L2∆);
and output public key PK = {PK1,PK2,PK3,PK4} and master key
MK = {MK1,MK2,MK3,MK4}.
Build({M1,...,Mn}, {A1,...,An}): Given all the data records
{M1,...,Mn} and their attributes {A1,...,An}, output range tree
Γ.
Encrypt(PK PK PK, {M1,...,Mn}, Γ): Given public key PK =
{PK1,PK2,PK3,PK4}, all the data records {M1,...,Mn} and kdtree
Γ, encrypt each node in range tree Γ.
• If it is a non-leaf node, let HRi,L and HRi,R be the two
hyper-rectangles represented on the i-level tree, where i ∈
[1,D]; transform HRi,L = (Ri,1,..,Ri,D), where Ri,j =
[xi,j,l,xi,j,u], into a point Xi,L = (xi,1,...,xi,2D) =
(xi,1,l,xi,1,u,...,xi,D,l,xi,D,u), transform HRi,R into a
point Xi,R in the same way; compute
Ci,3,L ←MRPE O .Encrypt(PK3,Xi,L,Flag),
Ci,3,R ←MRPE O .Encrypt(PK3,Xi,R,Flag),
Ci,4,L ←MRPE O .Encrypt(PK4,Xi,L,Flag),
Ci,4,R ←MRPE O .Encrypt(PK4,Xi,R,Flag),
and output C = {C1,...,CD}, where Ci =
{Ci,3,L,Ci,3,R,Ci,4,L,Ci,4,R} for the i-level tree of this
non-leaf node.
• If it is a leaf node, it is a data record Mi, i ∈ [1,n], and
its attribute vector is Ai = (ai,1,...,ai,D); set a point X
as X = (x1,...,xD) = (ai,1,...,ai,D), generate a random
symmetric key Ki, then encrypt as
Ci,0 ←Enc(Ki,Mi),
Ci,1 ←MRPE.Encrypt(PK1,X,Ki,Flag),
Ci,2 ←MRPE O .Encrypt(PK2,X,Flag),
whether the nodes in the tree are encrypted or not.
VI. PERFORMANCE
In this section, we analyze the performance of our scheme,
evaluate the performance in experiments based on a large-scale
real-world dataset.
A. Complexity Analysis
In our scheme, we utilize a kd-tree to achieve sublinear
search time over encrypted data. The search complexity of a
kd-tree is O(n 1−1/D ), where n is the number of data records
and D is the number of dimensions. We encrypt nodes in a
kd-tree with two novel predicate encryptions based on MRPE
[8], where the decryption cost at each node can be optimized
to O(DlogT). Therefore, the total search time of our scheme
is O(n 1−1/D · DlogT). According to the structure of a kdtree,
the storage cost of a kd-tree for a number of n records
is O(n). Considering the size of an encrypted value under
MRPE is O(DlogT) [8], the total storage cost of our scheme
is O(n·DlogT) as shown in Table I.
Fig. 11. Details of our scheme based on range trees.
and output Ci = {Ci,0,Ci,1,Ci,2}.
Output outsourced range tree Γ ∗ after encrypting all the nodes.
Extract(MK MK MK,Q): Given master key MK = {MK1,MK2,MK3,MK4}
and a multi-dimensional range search query Q = [x1,l,x1,u] ∧
··· ∧ [xD,l,xD,u], transform Q into a hyper-rectangle HR =
(R1,...,RD), where Ri = [xi,l,xi,u] and 1 ≤ i ≤ D; generate a
hyper-rectangle HR ′ = (R ′ 1,...,R ′ 2D), where R ′ 2i−1 = [1,xi,l]
and R ′ 2i = [xi,u,Ti], for 1 ≤ i ≤ D, and another hyperrectangle
HR ′′ = (R ′′
1,...,R ′′
2D), where R ′′
2i−1 = [xi,l,xi,u] and
R ′′
2i = [xi,l,xi,u], for 1 ≤ i ≤ D, then compute
SK1 ←MRPE.DeriveKey(MK1,HR),
TK2 ←MRPE O .DeriveKey(MK2,HR),
TK3 ←MRPE O .DeriveKey(MK3,HR ′ ),
TK4 ←MRPE O .DeriveKey(MK4,HR ′′ );
and return search token TK TKQ = {TK2,TK3,TK4} and decryption
key SK SKQ = SK1.
Search(TK TK TKQ, Γ ∗ ): Given search token TK TKQ = {TK2,TK3,TK4}
and outsourced range tree Γ ∗ , search from the root node
of Γ ∗ by exactly following FindSplitNode ∗ (Γ ∗ ,TK TK TKQ) and
DDRangeQuery ∗ (Γ ∗ ,TK TK TKQ), and compute hi,L,hi,R,gi,L,
gi,R,f when it is necessary, where
hi,L ←MRPE O .Decrypt(PK3,TK3,Ci,3,L),
hi,R ←MRPE O .Decrypt(PK3,TK3,Ci,3,R),
gi,L ←MRPE O .Decrypt(PK4,TK4,Ci,4,L),
gi,R ←MRPE O .Decrypt(PK4,TK4,Ci,3,R),
f ←MRPE O .Decrypt(PK2,TK2,Ci,2);
and report points that lies in Q.
Decrypt(SK SK SKQ,Ci): Given decryption keySK SK SKQ and encrypted data
record Ci = {Ci,0,Ci,1,Ci,2}, compute
Ki ←MRPE.Decrypt(PK1,SKHR,Ci,1),
Mi ← Dec(Ki,Ci,0) = Dec(Ki,Enc(Ki,Mi)),
and output data record Mi, if attribute set Ai ∈ Q; and ⊥
otherwise.
B. Experimental Results
Now we evaluate the performance of our proposed scheme,
and compare it with the straightforward solution in experiments.
All the experiments are tested under Ubuntu with
Intel Core i5 3.30 GHz Processor and 4 GB Memory. We
leverage Pairing-Based Library (PBC) 1 to simulate the cost of
cryptographic operations. We use a large-scale real world data
set with millions of records (U.S. census 1990 2 ) to evaluate the
search performance of our scheme and the straightforward solution
[8]. In the experiments, we test the search performance
over 200 times with the input of random multi-dimensional
range search queries.
As we can see from Fig. 12(a) and 12(b), the average
search time in the straightforward solution increases linearly
with the number of records when the number of dimensions
is fixed. While the average search time of our scheme also
increases with the number of records, however, it increases
1 crypto.stanford.edu/pbc/
2 http://archive.ics.uci.edu/ml/datasets.html

Ave. Search Time (s)
9000
8000
7000
6000
5000
4000
3000
2000
1000
Our Scheme
Straightforward
0
10 20 30 40 50
n: the number of records (thousand)
(a) Average search time (second)
when D = 4.
Ave. Search Time (s)
3000
2500
2000
1500
1000
500
0
2 3 4 5
D: the number of dimensions
Ave. Search Time (s)
1600
1400
1200
1000
800
600
400
200
0
Our Scheme
Straightforward
10 20 30 40 50
n: the number of records (thousand)
(b) Average search time (second)
when D = 2.
Fig. 12. Impact of n on average search time.
20
Our Scheme
Straightforward
15
Our Scheme
Straightforward
(a) Average search time (second)
when n = 10,000.
Ave. Search Time (ks)
10
5
0
2 3 4 5
D: the number of dimensions
(b) Average search time (kilosecond)
when n = 100,000.
Fig. 13. Impact of D on average search time.
much slower than the straightforward solution. Therefore, our
scheme can finish search much faster than the straightforward
solution under the same parameters. For instance, when D = 4
and n = 50,000, the straightforward solution requires 7,377
seconds in average to finish each multi-dimensional range
search query; with our solution, the same search query can
be done within 1,537 seconds in average. We can also find in
Fig. 13(a) and 13(b) that our scheme has a better performance
than the straightforward solution.
In Table II, we compare the performance of our scheme
and the straightforward solution under different scales of data
records. Compared to the straightforward solution, our scheme
is able to save a huge of time on multi-dimensional range
search queries. Especially, when the total of the data records
is one million and the number of dimensions is D = 4, our
scheme is able to finish search within 5.33×10 3 seconds in
average while the average search time of the straightforward
solution is 152.03×10 3 seconds.
TABLE II
AVERAGE SEARCH TIME (KILOSECOND) WHEN D = 4.
n Our Scheme Straightforward
10,000 0.47 1.59
100,000 3.25 15.44
1,000,000 5.33 152.03
As we mentioned in the previous section, we can improve
search efficiency by leveraging range trees. For instance, with
a number of 4,096 records, the search time over encrypted
data with range trees is only around 10.96 seconds while the
one with kd-trees is about 161.03 seconds.
TABLE III
AVERAGE SEARCH TIME (SECOND) WHEN D = 4.
n With kd-trees With range-trees
1,024 82.10 8.89
2,048 142.33 9.46
4,096 161.03 10.96
Note that since the main cryptographic operation during
the decryption of MRPE is the pairing operation, we can use
some optimized method [20] on the computation of pairing
to improve the current search performance. More specifically,
by using an efficient method [20] for computing pairing
operations, we can reduce the time of computing pairing from
6.33 ms to 1.69 ms, which can significantly improve the
current search performance of our scheme. For instance, with
the optimization on the computation of pairing operations,
when the number of data records is one million and the
number of dimension of search queries is D = 4, then the
average search time over encrypted data can be reduced to
1,423 seconds. In addition, we can also leverage some special
hardware, such as the Elliptic Semiconductor CLP-17 [21],
to further reduce the search time on multi-dimensional range
search over encrypted cloud data.
VII. RELATED WORK
Searchable Encryption. Searchable Encryption schemes can
be divided into two categories, symmetric key based and
public key based. The first practical symmetric key based
keyword search solution for encrypted text documents was
proposed by Song et al. [2], which has linear complexity with
regard to the document length. Since then, the quest for higher
efficiency and better functionality has never stopped. Various
schemes has improved the efficiency of keyword search by
creating an encrypted searchable index such like an inverted
index [4], [5], [7], [22], [23]. However, the above works can
only support single keyword search functionalities. Recently
Cao et al. [24] proposed a multi-keyword ranked search
scheme over encrypted cloud data. Kamara et al. focused on
enabling privacy-preserving dynamic updates for SSE [13].
However, the search complexity is still linear with the number
of documents. Moreover, the above works mostly focus on
document search and does not apply to searches on databases
(may contain numerical values) considered in this paper.
On the other hand, the first public key based keyword
searchable encryption scheme was proposed by Boneh et al.
[3]. To support more complex queries, conjunctive keyword
search solutions over encrypted data have been proposed [25],
[26]. They are based on bilinear pairings, while the search
needs to touch every data record. Bellare et al. [27] proposed
an efficient deterministic searchable public key encryption
scheme. Logarithmic search complexity can be achieved;
however, it only allows equality test. In addition, due to its
deterministic property, plaintext frequency will be exposed due
to duplicate attributes.
Predicate Encryption. Predicate Encryption is a promising
approach to achieve more flexible search functionalities [28],
[29]. In general, given a ciphertext encrypting under an
attribute vector A, a predicate function f(), the encryption
enables a user who holds the corresponding token to f() to
test whether f(A) = 1 without decrypting the data.
Boneh et al. proposed a public key based hidden vector
encryption scheme [6], which supports conjunctive subset,
equality and range queries. However, the complexity of range
search per data record is O(TD) (linear with the range size
T ), which is far from efficient when the range is large. Later
Katz et al. [30] proposed another public key based predicate
encryption scheme that supports inner products. Theoretically,

equality, subset, conjunctive, disjunctive predicates can all be
expressed in the form of inner-products. However, it incurs an
exponential blowup for handling arbitrary boolean expressions
(containing both CNF/DNF [29]).
Shi et al. [8] proposed an MRPE by exploiting an efficient
tree-based range representation, the per data record search
complexity is reduced to O(DlogT). Later, Shen et al. [31]
found the predicate encryption in [8] may inherently reveal
the query predicate within a token, and proposed a symmetrickey
inner product encryption scheme to solve it. However, it
does not support efficient multi-dimensional range search and
the symmetric-key based approach is not suitable for multiowner
settings. To enable multi-dimensional range query with
predicate privacy, Li et al. [32] proposed a public key based
encrypted search scheme, by introducing an additional trusted
proxy that keeps a secret proxy key. However, it lacks support
for efficient arbitrary range queries. Finally, none of the above
schemes achieve sublinear time search complexity with regard
to the dataset size.
VIII. CONCLUSION
In this paper, we address the problem of efficient and
privacy-preserving search over encrypted databases outsourced
to the cloud. We propose a suite of MDRSE for handling multidimensional
range queries over encrypted data within sublinear
search time. Through a novel combination of predicate encryption
primitives with efficient multi-dimensional data structures
(such as kd-trees and range trees), efficient MDRSE can be
realized. Our approach is general, in that it can be easily
integrated with different multi-dimensional data structures to
achieve different tradeoffs. We carry out extensive experiments
on a large-scale real-world dataset and show the scalability and
efficiency of our schemes.
REFERENCES
[1] M. Armbrust, A. Fox, R. Griffith, A. D.Joseph, R. H.Katz, A. Konwinski,
G. Lee, D. A. Patterson, A. Rabkin, I. Stoica, and M. Zaharia, “A View
of Cloud Computing,” Communications of the ACM, vol. 53, no. 4, pp.
50–58, Apirl 2010.
[2] D. Song, D. Wagner, and A. Perrig, “Practical Techniques for Searches
on Encrypted Data,” in Proc. of IEEE S&P’00, 2000.
[3] D. Boneh, G. D. Crescenzo, R. Ostrovsky, and G. Persiano, “Public Key
Encryption with Keyword Search,” in Proc. of EUROCRYP’04, 2004,
pp. 506–522.
[4] E.-J. Goh, “Secure Indexes,” Cryptology ePrint Archive, Report
2003/216, 2003, http://eprint.iacr.org/.
[5] R. Curtmola, J. A. Garay, S. Kamara, and R. Ostrovsky, “Searchable
Symmetric Encryption: Improved Definitions and Efficient Constructions,”
in Proc. of ACM CCS’06, 2006.
[6] D. Boneh and B. Waters, “Conjunctive, Subset, and Range Queries on
Encrypted Data,” in Proc. of TCC’07, 2007, pp. 535–554.
[7] C. Wang, N. Cao, J. Li, K. Ren, and W. Lou, “Secure Ranked Keyword
Search over Encrypted Cloud Data,” in Proc. of ICDCS’10, 2010.
[8] E. Shi, J. Bethencourt, T.-H. H. Chan, D. Song, and A. Perrig, “Multi-
Dimensional Range Query over Encrypted Data,” in Proc. of IEEE
S&P’07, 2007, pp. 350–364.
[9] Y. Lu, “Privacy-Preserving Logarithmic-time Search on Encrypted Data
in Cloud,” in Proc. of NDSS’12, Feb. 2012.
[10] J. L. Bentley, “Multidimensional Binary Search Trees Used for Associative
Searching,” Communications of the ACM, vol. 18, no. 9, pp.
509–517, 1975.
[11] Mark de Berg and Otfried Cheong and Marc van Kreveld and Mark
Overmars, Computational Geometry: Algorithms and Applications.
Springer-Verlag, 2008.
[12] J. L. Bentley, “Decomposable Searching Problems,” Information Processing
Letters, vol. 8, no. 5, pp. 201–244, 1979.
[13] S. Kamara, C. Papamanthou, and T. Roeder, “Dynamic Searchable
Symmetric Encryption,” in Proc. of ACM CCS’12, 2012, pp. 965–976.
[14] D. Boneh, G. D. Crescenzo, R. Ostrovsky, and G. Persiano, “Public
Key Encryption with Keyword Search,” in Proc. of EUROCRYPT’04.
Springer-Verlag, 2004, pp. 506–522.
[15] M. Islam, M. Kuzu, and M. Kantarcioglu, “Access Pattern Disclosure on
Searchable Encryption: Ramification, Attack and Mitigation,” in Proc.
of NDSS’12, 2012.
[16] X. Boyen and B. Waters, “Anonymous Hierarchical Identity-Based
Encryption (Without Random Oracles),” in Proc. of CRYPTO’06.
Springer-Verlag, 2006, pp. 290–307.
[17] Dan Boneh and Amit Sahai and Brent Waters, “Functional Encryption:
A New Vision for Public Key Cryptography,” Communications of the
ACM, vol. 55, no. 11, pp. 56–64, 2012.
[18] A. Guttman, “R-Trees A Dynamic Index Structure for Spatial Searching,”
in Proc. of ACM SIGMOD’84, 1984.
[19] R. Finkel and J. L. Bentley, “Quad Trees: A Data Structure for Retrieval
on Composite Keys,” ACTA Informatica, vol. 4, no. 1, pp. 1–9, 1974.
[20] D. F. Aranha, K. Karabina, P. Longa, C. H. Gebotys, and J. Lopez,
“Faster Explicit Formulas for Computing Pairings over Ordinary
Curves,” in Proc. of EUROCRYPT’11, 2011, pp. 48–68.
[21] “The Elliptic Semiconductor (CLP-17): high performance
elliptic curve cryptography point multiplier core,”
http://www.ellipticsemi.com/pdf/CLP-17 90401.pdf.
[22] Y.-C. Chang and M. Mitzenmacher, “Privacy Preserving Keyword
Searches on Remote Encrypted Data,” in Proc. of ACNS’05, 2005, pp.
442–455.
[23] Z. Yang, S. Zhong, and R. N. Wright, “Privacy-Preserving Queries on
Encrypted Data,” in Proc. of ESORICS’06, 2006, pp. 479–495.
[24] N. Cao, C. Wang, M. Li, K. Ren, and W. Lou, “Privacy-Preserving
Multi-keyword Ranked Search over Encrypted Cloud Data,” in Proc. of
IEEE INFOCOM’11, 2011.
[25] P. Golle, J. Staddon, and B. Waters, “Secure Conjunctive Keyword
Search over Encrypted Data,” in Proc. of ACNS’04. Springer-Verlag,
2004, pp. 31–45.
[26] L. Ballard, S. Kamara, and F. Monrose, “Achieving Efficient Conjunctive
Keyword Searches over Encrypted Data,” Information and Communications
Security, pp. 414–426, 2005.
[27] M. Bellare, A. Boldyreva, and A. O’Neill, “Deterministic and Efficiently
Searchable Encryption,” in Proc. of CRYPTO’07, 2007, pp. 535–552.
[28] T. Okamoto and K. Takashima, “Hierarchical Predicate Encryption for
Inner-Products,” in Proc. of ASIACRYPT’09, 2009, pp. 214–231.
[29] A. Lewko, T. Okamoto, A. Sahai, K. Takashima, and B. Waters,
“Fully Secure Functional Encryption: Attribute-Based Encryption and
(Hierarchical) Inner Product Encryption,” in Proc. of EUROCRYPT’10,
2010, pp. 62–91.
[30] J. Katz, A. Sahai, and B. Waters, “Predicate Encryption Supporting
Disjunctions, Polynomial Equations, and Inner Products,” in Proc. of
EUROCRYPT’08, 2008, pp. 146–162.
[31] E. Shen, E. Shi, and B. Waters, “Predicate Privacy in Encryption
Systems,” in Proc. of TCC’09, 2009, pp. 457–473.
[32] M. Li, S. Yu, N. Cao, and W. Lou, “Authorized Private Keyword Search
over Encrypted Data in Cloud Computing,” in Proc. of IEEE ICDCS’11,
2011, pp. 383–392.