SSE: A Secure Searchable Encryption Scheme for Urban Sensing and Querying

Abstract

With the distributed sensors that are deployed to monitor the urban environment in smart cities, the sensed data are overwhelming and beyond the scope of the wireless sensor networks (WSNs) capability. Due to the communication range limits of the sensors, most of these data will be outsourced and stored on some untrusted servers. Thus, how to maintain the data confidentiality and integrity, as well as source authentication and data query privacy of the outsourced data, is a challenging problem. In this paper, we propose a secure searchable encryption scheme, named SSE, for urban sensing and querying to address the problem. Specifically, our SSE constructs a secure hidden vector encryption-(HVE-) based rang query predicate. The sensed data can be stored on an untrusted server in encrypted form. A requester can obtain the correct ciphertexts when his authorized range query matches the HVE-based encryption predicate. With the help of the base station, the ciphertexts can be decrypted and data integrity can be verified; then, the requester can obtain the correct original data. Security analysis demonstrates that; in the SSE, only the authorized requesters can obtain the query results, while the data confidentiality and integrity and source authentication are also preserved.

1. Introduction

Nowadays, with the continuous expansion of urban populations, there are increasing needs in many aspects related to urban living, such as environment monitoring, and public safety supervision [1]. Especially, a city can be defined as “smart” when modern information and communication infrastructures (ICI) communication can automatically control the urban living in a secure means. Wireless sensor networks (WSNs) increasingly become viable solutions to urban sensing and querying for smart cities. Widely distributed sensors monitor the urban environment in real time and collect data for intelligent decision making by multi-hop wireless transmission, as shown in Figure 1, which can facilitate various services and improve the quality of urban living [2]. However, deploying sensors without security in mind has often proved to be dangerous in hostile environments [3]. Especially, when there is terrorism, the detection of suspicious activities should be reported to the proper authorities in a secure approach.

Figure 1

The conceptional model of wireless sensor network.

In the worst case scenario, a single corrupted message can lead to the ICI systems in a total tizzy. For example, if a fake traffic accident information is broadcasted in rush hours, the ICI systems maybe make some misleading decisions to the drivers; thus, traffic jams will be caused in that city. This kind of fake data injection attacks not only prevent the authorities from collecting correct messages but also exhaust the energy of the forwarders [4]. Consequently, it is essential to prevent the malicious node from impersonating good nodes for spreading misleading information intentionally. Hence, sensitive monitoring data should be transmitted in encrypted form to achieve data confidentiality, integrity, and authentication between communicating parties. Furthermore, with the distributed sensors, the data collections are going to be several millions a day. In order to save energy and relieve the burden of data storage and maintenance [5], data outsourcing is the best way to let sensors store their sensed data on some untrusted servers (cloud or third party provided servers) in encrypted form and execute computation and queries using server's computational capabilities. In addition, universal data access with independent geographical locations, avoidance of capital expenditure on hardware, software, and personnel maintenances will make the smart city's ICI system more reliable and efficient.

Naturally, storing data in encrypted form on untrusted server can maintain data confidentiality for the stored data, as long as a secret key corresponding to a certain encryption is not given out to untrusted servers [6]. However, if these data are needed later for matters such as: calculation, analysis, or for intelligent decision-making, searchers (e.g., decision maker) are endowed with the task of querying these data, which can help them to gain organization-wide situational awareness. In this case, querying encrypted data is a major logistic problem. The server is anticipated to be able to evaluate various query predicates against the data without having to decrypt it [7]. Especially, when the query conditions are composed of many conjunctive range requirements (e.g., date ranges and geographic regions, etc.), rang query over encrypted data is much more difficult.

In this paper, we propose a secure searchable encryption scheme (SSE) for urban sensing and querying. The SSE addresses the data confidentiality, integrity, and source authentication by using a secure hidden vector encryption-(HVE-) based range query predicate. The main contributions of this paper are twofold.

• (i)

Firstly, we propose a secure HVE-base range query predicate. Specifically, a sensor node encrypts its data by using the shared key with the $\text{BS}$ . Then, it hides the searchable attributes and the ciphertext into the HVE-base range query predicate. Only when the two vectors associated with the encryption attributes and range query are component-wise equal, the ciphertext can be recovered.

(ii)

Secondly, we analyze the security strengths of the SSE. The analysis results demonstrate that, compared with existing schemes, the SSE is the only one which can achieve data confidentiality and integrity, as well as source authentication and data query privacy.

The remainder of this paper is organized as follows. In Section 2, we discuss the related works. In Section 3, we introduce our system model and security requirements. Then, in Section 4, we review some preliminaries. In Section 5, we construct a secure HVE-based range query predicate. In Section 6, we present our SSE scheme, followed by its security analysis in Section 7. Finally, we conclude this paper in Section 8.

2. Related Works

2.1. Security in Sensor Network

Security in sensor network has been widely studied. Many security proposals for WSNs have focused on efficient key management in WSNs. Some are based on the symmetric cryptosystems. For instance, Perrig et al. [8] propose SPINS, a suite of efficient symmetric key-based security building blocks. Eschenauer and Gligor [9] look at random key predistribution schemes, which open the way to a large number of follow-up works [10]. Zhu et al. [11] proposed LEAP, a rather efficient scheme based on local distribution of secret keys among neighboring nodes. These strategies, however, do not provide perfect resilience, as after a certain percentage of nodes have been compromised, the whole network can be compromised as well. Others have employed public key cryptography (PKC) to adjust conventional algorithms (e.g., RSA [12]) to sensor nodes or to employ more efficient techniques (e.g., NTRU [3], ECC [13]) in this resource constrained environment. However, they all use interactive protocols and therefore nodes are required to exchange messages to agree on keys. Moreover, they are not suitable for data outsourcing and data query. He and Li schedule the sequence of query processing to achieve the optimized overall energy efficiency by fully utilizing the implications among sensor networks [14]. It also cannot be applied to query over encrypted data.

2.2. Range Query over Encrypted Data

The problem of range query over encrypted data is a hot issue in both cryptography and database communities [6, 15–17]. There are essentially four categories of solutions that have been developed for range queries. One general approach is to ensure that order amongst plaintext data is preserved in the ciphertext domain by using order-preserving encryption-based (OPE) techniques [15]. This allows direct translation of range predicates from the original domain to the domain of the ciphertext. As discussed in [18], the coupling distribution of plaintext and ciphertext domains might be exploited by attackers to guess the scope of the corresponding plaintext for a ciphertext. Another bucketization-based (Buck) technique [6] is to use distributional properties of the dataset to partition and index them for efficient querying while trying to keep the information disclosure to a minimum. Queries are evaluated in an approximate manner where the returned set of records may contain some false positives. These records will expose unrelated data's confidentiality and increase the computational and communication overhead of the system.

Thirdly, those that use some specialized data structure for range query evaluation while trying to preserve notions of semantic security of the encrypted data [17], such as B+tree [19]. In order to hide the access patterns, they run fake queries. In addition, they buffer the first few levels of the tree on the client side. Finally, they shuffle from time to time. The last approach is using a specialized type of predicate encryption, the HVE-based approach [20], where two vectors over attributes are associated with a ciphertext and a token, respectively. Under predicate translator, the ciphertext matches the token if and only if the two vectors are component-wise equal. Although most of the existing range query approaches can maintain part of the data confidentiality, all of them are not secure enough to keep the untrusted server from peering the original data when the requester's query is successful. Therefore, the goal of this paper is to propose a secure range query predicate to support data confidentiality and integrity, as well as source authentication and data query privacy.

3. System Model and Security Requirements

In this section, we formalize the system model and identify the security requirements and our design goals.

3.1. System Model

In this paper, we consider a large-scale WSNs consisting of a database server (DB), a base station ( $\text{BS}$ ), some cluster heads (CHs), and numerous sensor nodes (SNs) which are grouped into clusters. The clusters can be formed based on various criteria such as capabilities, location, and communication range [21]. Each CH controls a cluster and is responsible for assigning public group information and distributing some command to its cluster members. Each CH is assumed to be reachable to all sensors in its cluster, either directly or by multihop. We also assume that each node is innocent before deployment and cannot be compromised during the first several minutes after deployment since compromising a node takes some time. The system model is depicted in Figure 2. We require that the sensed data from each SN can be stored in a DB by its corresponding CH. Due to the large distances between cluster and the DB, communication from SN to DB can only be performed via CH. This assumption is generally true, since the communication range of each SN is limited. The DB can be cloud servers or other local third party servers; they are honest but curious; sometimes it is untrusted.

Figure 2

System model of SSE.

All the SNs encrypt their data by using the shared keys with the $\text{BS}$ and hide their searchable attributes by using the HVE-based encryption predicate. When a requester S got an authorized query tokens from the $\text{BS}$ , he can get the corresponding corrected querying results from DB. Next, with the help of the $\text{BS}$ , S can decrypt and authenticate the original data. Thus, the $\text{BS}$ is trustable.

3.2. Security Requirements

We identify the security requirements for our SSE. In our security model, the $\text{BS}$ operates as a trusted authority (TA). The sensors $\mathbb{N}=\{N_{\mathrm{1}},N_{\mathrm{2}},\dots ,N_v\}$ are honest as well. However, there exists an adversary 𝒜 in the system to eavesdrop and invade the database on DB to steal the individual SN's reports. In addition, 𝒜 can also launch some active attacks to threaten the data confidentiality and integrity. Therefore, in order to prevent 𝒜 from learning the SNs' data and to detect 𝒜's malicious actions, the following security requirements should be satisfied in range query applications for smart cities.

• (i)

Data Confidentiality. Sensed data should not be disclosed by unauthorized parties and it is the most important issue in mission critical applications. Moreover, in many applications, SNs transmit highly sensitive data, for example, terrorism supervision data, and therefore it is extremely important to build secure channels between SNs and the authorities. The standard approach for keeping sensitive data secret is to encrypt the data with a secret key that only intended authorized receivers possess, hence achieving confidentiality.

(ii)

Data Integrity. A malicious node may just corrupt messages to prevent network from functioning properly. Thus, sensitive data needs to be protected from being altered. Message authentication code (MAC) is a widely used approach to guarantee that the message being transferred is never corrupted. Therefore, data integrity can be achieved.

(iii)

Source Authentication. Since wireless sensor networks use a shared wireless medium, without source authentication, an adversary could masquerade a node, thus gaining unauthorized access to resource and sensitive information and interfering with the operation of other nodes. Moreover, a compromised node may send data to its CH under several fake identities so that the decision-making is misled.

(iv)

Data Query Privacy. Since SN's sensed data are stored on the untrusted DB in an encrypted form, generally, the server cannot know the original data. In this case, when a requester's query vectors in the query tokens match the encryption vectors, the original data can be exposed to the DB. This is also the security vulnerability of the data privacy. Therefore, double encryption is needed to ensure data privacy when range query succeeds.

4. Preliminaries

In this section, we will briefly describe the basic definition and properties of bilinear pairings, polynomial-based key predistribution, and HVE-based comparison query predicate.

4.1. Bilinear Pairing

Bilinear pairing is an important cryptographic primitive [22]. Let ${𝔾}_{\mathrm{1}}$ and ${𝔾}_{\mathrm{2}}$ be two cyclic multiplication groups of prime order q. Let a and b be elements of $Z_q^{*}$ . We assume that the discrete logarithm problem (DLP) in both ${𝔾}_{\mathrm{1}}$ and ${𝔾}_{\mathrm{2}}$ is hard. g is a generator of ${𝔾}_{\mathrm{1}}$ . A bilinear pairing is a map $e:{𝔾}_{\mathrm{1}}\times {𝔾}_{\mathrm{1}}\to {𝔾}_{\mathrm{2}}$ with the following properties:

• (1)

bilinear: $e(g^a,h^b)=e(g,h{)}^{ab}$ for any $(g,h)\in {𝔾}_{\mathrm{1}}^{\mathrm{2}}$ ;

(2)

nondegenerate: $e(g,h)\ne {\mathrm{1}}_{{𝔾}_{\mathrm{2}}}$ whenever $g,h\ne {\mathrm{1}}_{{𝔾}_{\mathrm{1}}}$ ;

(3)

computable: there is an efficient algorithm to compute $e(g,h)\in {𝔾}_{\mathrm{2}}$ for all $(g,h)\in {𝔾}_{\mathrm{1}}^{\mathrm{2}}$ .

Definition 1.

A bilinear parameter generator $𝒢en$ is a probabilistic algorithm that takes a security parameter κ as input and outputs a 5-tuple $(q,g,{𝔾}_{\mathrm{1}},{𝔾}_{\mathrm{2}},e)$ .

4.2. Polynomial-Based Key Predistribution

In this section, we briefly review the polynomial-based key predistribution approach [23]. To predistribute shared keys, the TA randomly generates a bivariate t-degree polynomial $h(x,y)={\sum }_{i,j=\mathrm{0}}^t‍a_{ij}{x}_i{y}_j$ over a finite field $F_q$ , where q is a large prime number. The polynomial has the property of $h(x,y)=h(y,x)$ . For example, if two sensor nodes i and j need to establish a shared symmetric key, the KDC computes a polynomial share of $h(x,y)$ , that is, $h(i,y)$ to the node i. Then, node i can compute the common key $h(i,j)$ by evaluating $h(i,y)$ at point j, and node j can compute the shared symmetric key $h(j,i)=h(i,j)$ by evaluating $h(j,y)$ at point i.

4.3. HVE-Based Comparison Query Predicate

HVE [16] is a type of predicate encryption where two vectors over attributes are associated with a ciphertext and a token, respectively. The ciphertext matches the token if and only if the two vectors are component-wise equal. There are two character sets $\sum ‍$ and ${\sum }_{*}‍=\sum ‍\cup \{*\}$ in the setting of HVE. Here, $\sum ‍$ is an arbitrary set of attributes. We assume $\sum ‍={\mathbb{Z}}_q$ ; * is a special symbol denoting a wildcard component, which means that the component related to * is not involved with any attribute. HVE mainly consists of four phases: key generation, data encryption, token generation, and data query.

In key generation phase, a TA distributes the public/private key pair $(\text{PK},\hspace{0.17em}\text{SK})$ to a receiver.

Then, in the data encryption phase, a SN chooses a vector $\mathbf{x}=(x_{\mathrm{1}},\dots ,x_l)\mathrm{\hspace{0.17em}\hspace{0.17em}}\in {\sum ‍}^l$ to characterize its data. If we map the ith component $x_i\in \mathbf{x}$ to a number of its domain $j\in \{\mathrm{1},\dots ,n\}$ as in [20], the value of $x_i$ is one of the number in set $\{\mathrm{1},\dots ,n\}$ . The SN builds an encryption vector $\sigma (\mathbf{x})=({\sigma }_{i,j})\in \{\mathrm{0,1}{\}}^{nl}$ for $\mathbf{x}=(x_{\mathrm{1}},\dots ,x_l)\in \{\mathrm{1},\dots ,n{\}}^l$ , as follows:

$$\begin{array}{cc}& {\sigma }_{i,j}=\{\begin{array}{cc}1,\hfill & \text{if}\hspace{0.17em}\hspace{0.17em}{x}_i\ge j,\hfill \\ 0,\hfill & \text{otherwise},\hfill \end{array}\end{array}$$

(1)

where $i\in \{\mathrm{1},\dots ,l\}$ and $j\in \{\mathrm{1},\dots ,n\}$ . For example, $l=\mathrm{3}$ , $n=\mathrm{5}$ and let $\mathbf{x}=(\mathrm{1,3},\mathrm{2})$ . Thus, $\mathbf{x}=(x_{\mathrm{1}},\dots ,x_l)\in \{\mathrm{1},\dots ,n{\}}^l=\{\mathrm{1,2},\mathrm{3,4},\mathrm{5}{\}}^{\mathrm{3}}$ and the corresponding encryption vector $\sigma (\mathbf{x})=(\mathrm{10000},\mathrm{11100,11000})$ . Then, SN's data m should be encrypted into a ciphertext $CT$ under the encryption vector $\sigma (\mathbf{x})$ and the receiver's public key.

Next, in the token generation phase, the requester chooses a vector $\mathbf{w}=(w_{\mathrm{1}},\dots ,w_l)\mathrm{\hspace{0.17em}\hspace{0.17em}}\in ({\sum }_{*}‍{)}^l$ to represent his query bound and builds a query vector ${\sigma }^{*}(\mathbf{w})=({\sigma }_{i,j}^{*})\in \{\mathrm{0,1},*{\}}^{nl}$ for $\mathbf{w}=(w_{\mathrm{1}},\dots ,w_l)\in \{\mathrm{1},\dots ,n{\}}^l$ as follows:

$$\begin{array}{cc}& {\sigma }_{i,j}^{*}=\{\begin{array}{cc}1,\hfill & \text{if}\hspace{0.17em}\hspace{0.17em}{w}_i=j,\hfill \\ *,\hfill & \text{otherwise}.\hfill \end{array}\end{array}$$

(2)

Similarly, we assume that $l=\mathrm{3}$ , $n=\mathrm{5}$ , and $\mathbf{w}=(w_{\mathrm{1}},\dots ,w_l)\in \{\mathrm{1},\dots ,n{\}}^l=\{\mathrm{1,2},\mathrm{3,4},\mathrm{5}{\}}^{\mathrm{3}}$ . For example, if the receiver's query condition is $P=(x_1\ge 1)\wedge (x_2\ge 3)\wedge (x_3\ge \mathrm{1})$ ; that is, $\mathbf{w}=(\mathrm{1,3},\mathrm{1})$ . Thus, the query vector ${\sigma }^{*}(\mathbf{w})=(\mathrm{1}****,**\mathrm{1}**,\mathrm{1}****)$ . Note that, the number of the elements in ${\sigma }^{*}(\mathbf{w})$ is $nl$ . Based on the query vector ${\sigma }^{*}(\mathbf{w})$ , a query token $T_P$ is generated. The receiver sends $T_P$ to the server.

In the data query phase, let $s({\sigma }^{*}(w))$ denote the set of all indexes k which satisfies ${\sigma }_k^{*}\ne *$ , where $k\in \{\mathrm{1},\dots ,nl\}$ . Let $P_{{\sigma }^{*}(\mathbf{w})}(\sigma (\mathbf{x}))$ be the following comparison predicate:

$$\begin{array}{cc}& P_{{\sigma }^{*}\left(\mathbf{w}\right)}\left(\sigma \left(\mathbf{x}\right)\right)=\{\begin{array}{cc}1,\hfill & \text{if}\hspace{0.17em}\hspace{0.17em}\forall i\in s\left({\sigma }^{*}\left(w\right)\right),\hspace{0.17em}{\sigma }^{*}\left(w_i\right)=\sigma \left(x_i\right),\hfill \\ 0,\hfill & \text{otherwise}.\hfill \end{array}\end{array}$$

(3)

Finally, the server can disclose the data m if the comparison predicate $P_{{\sigma }^{*}(\mathbf{w})}(\sigma (\mathbf{x}))=\mathrm{1}$ .

5. Construction of Secure HVE-Based Range Query Encryption Predicate

In this section, we modified the HVE scheme in [7] to support data query privacy. To protect the original data from exposing to the untrusted server even when the range query succeeds, double encryption is needed. Firstly, sensed data m can be encrypted into a ciphertext C by using its shared secret key with the $\text{BS}$ . Then, to enable range query on the untrusted DB, the ciphertext C can be encrypted into a searchable cipher $CT$ by using the HVE-based range query encryption predicate. Consequently, the DB can only get the ciphertext C when the requester's query tokes match the encryption vectors. Finally, the requester can get the original data with the help of the $\text{BS}$ .

Three entities: sender, server, and requester are involved in this section. It mainly consists of the following five phases: key generation phase, data encryption phase, token generation phase, data query phase, and data decryption phase.

• (1)

In key generation phase, a TA also distributes the public/private key pair $(\text{PK},\text{SK})$ to a receiver. We extend the comparison predicate to support range query predicate. Specifically, we can achieve the opposite semantics of the above comparison query in (1), that is, $x_i\le j$ , by constituting the vectors $\sigma (\mathbf{x})$ in a reverse manner as follows:

$$\begin{array}{cc}& {\sigma }_{i,j}=\{\begin{array}{cc}1,\hfill & \text{if}\hspace{0.17em}\hspace{0.17em}{x}_i\le j,\hfill \\ 0,\hfill & \text{otherwise}.\hfill \end{array}\end{array}$$

(4)

Thus, the encryption predicate can support range queries, such as $a\le x_i\le b$ .

(2)

In the data encryption phase, the SN should define two encryption vectors: ${\sigma }_g(\mathbf{x})$ and ${\sigma }_s(\mathbf{x})$ according to (1) and (4) when $x_i\ge j$ and $x_i\le j$ , respectively. The receiver can get the correct data if and only if both conditions $x_i\ge a$ and $x_i\le b$ hold. Suppose that, if the encrypted data in HVE is M, the SN $N_i\in \mathbb{N}$ should encrypt M into a ciphertext C. Then, $N_i$ split C into different parts by using secret sharing: randomly chooses a polynomial $f(x)={\alpha }_{\mathrm{0}}+{\alpha }_{\mathrm{1}}x+\cdots +{\alpha }_t{x}^{t-\mathrm{1}}$ , where ${\alpha }_{\mathrm{0}}=C$ and ${\alpha }_i$ are randomly coefficients. In our scheme, C only needs to be divided into two directions of the range query; thus, $t=\mathrm{2}$ . Then, $N_i$ chooses two random integers $\xi ,\hspace{0.17em}\pi$ and computes two data shares $f(\xi )$ and $f(\pi )$ ; that is, C is divided into two parts: $f_{\mathrm{0}}=f(\xi )$ and $f_{\mathrm{1}}=f(\pi )$ . $N_i$ encrypts $f_{\mathrm{0}}$ and $f_{\mathrm{1}}$ under vectors ${\sigma }_g(\mathbf{x})$ and ${\sigma }_s(\mathbf{x})$ , respectively. For example, if we assume $l=\mathrm{3}$ , $n=\mathrm{5}$ , and $\mathbf{x}=(\mathrm{2,3},\mathrm{4})$ , $f_{\mathrm{0}}$ is encrypted under the vector ${\sigma }_g(\mathbf{x})=(\mathrm{11000,11100,11110})$ , as shown in Table 1. $N_i$ outputs $C{T}_{\mathrm{0}}$ . Also, $f_{\mathrm{1}}$ is encrypted under the vector ${\sigma }_s(\mathbf{x})=(\mathrm{01111,00111,00011})$ , as shown in Table 2. Similarly, $N_i$ outputs $C{T}_{\mathrm{1}}$ . Thus, ciphertext C is encrypted into ciphertexts $C{T}_{\mathrm{0}}$ and $C{T}_{\mathrm{1}}$ .

(3)

In the token generation phase, the requester's range query is defined with two vectors: ${\sigma }_g^{*}(\mathbf{w})$ and ${\sigma }_s^{*}(\mathbf{w})$ when $x_i=a$ and $x_i=b$ , respectively. Let $s({\sigma }_g^{*}(w))$ be the set of all indexes k which satisfies ${\sigma }_g^{*}(w_k)\ne *$ , and let $s({\sigma }_s^{*}(w))$ be the sets of all indexes $k^{\prime }$ which satisfies ${\sigma }_s^{*}(w_{k^{\prime }})\ne *$ . Here, $k,k^{\prime }\in (\mathrm{1},\dots ,nl)$ . Finally, in the data query phase, the server checks two comparison predicates $P_{{\sigma }_g^{*}(\mathbf{w})}({\sigma }_g(\mathbf{x}))$ and $P_{{\sigma }_s^{*}(\mathbf{w})}({\sigma }_s(\mathbf{x}))$ , which are generated according to (4). The server can obtain $f_{\mathrm{0}}$ if ${\sigma }_g(x_k)$ and ${\sigma }_g^{*}(w_k)$ are equal for all $k\in s({\sigma }^{*}(w_g))$ ; that is, $P_{{\sigma }_g^{*}(\mathbf{w})}({\sigma }_g(\mathbf{x}))=\mathrm{1}$ . Similarly, the server can obtain $f_{\mathrm{1}}$ if ${\sigma }_s(x_{k^{\prime }})$ and ${\sigma }_s^{*}(w_{k^{\prime }})$ are equal for all $k^{\prime }\in s({\sigma }_s^{*}(w))$ ; that is, $P_{{\sigma }_s^{*}(\mathbf{w})}({\sigma }_s(\mathbf{x}))=\mathrm{1}$ . The range query predicate can be denoted as follows:

$$\begin{array}{l}{P}_{\left({\sigma }_g^{*}\left(\mathbf{w}\right),{\sigma }_s^{*}\left(\mathbf{w}\right)\right)}\left({\sigma }_g\left(\mathbf{x}\right),{\sigma }_s\left(\mathbf{x}\right)\right)\\ \hspace{1em}=\{\begin{array}{ll}1,\hfill & \text{if}\hspace{0.17em}\hspace{0.17em}{P}_{{\sigma }_g^{*}\left(\mathbf{w}\right)}\left({\sigma }_g\left(\mathbf{x}\right)\right)=\mathrm{1},\hspace{0.17em}\hspace{0.17em}{P}_{{\sigma }_s^{*}\left(\mathbf{w}\right)}\left({\sigma }_s\left(\mathbf{x}\right)\right)=\mathrm{1},\hfill \\ 0,\hfill & \text{otherwise}.\hfill \end{array}\end{array}$$

(5)

For instance, a range query $P=(\mathrm{2}\le x_{\mathrm{1}}\le \mathrm{3})\wedge (\mathrm{2}\le x_{\mathrm{2}}\le \mathrm{4})\wedge (\mathrm{3}\le x_{\mathrm{3}}\le \mathrm{5})$ can be divided into two parts: $P_g=(x_{\mathrm{1}}\ge \mathrm{2})\wedge (x_{\mathrm{2}}\ge \mathrm{2})\wedge (x_{\mathrm{3}}\ge \mathrm{3})$ and $P_s=(x_{\mathrm{1}}\le \mathrm{3})\wedge (x_{\mathrm{2}}\le \mathrm{4})\wedge (x_{\mathrm{3}}\le \mathrm{5})$ . Thus, $w_g=(\mathrm{2,2},\mathrm{3})$ , $w_s=(\mathrm{3,4},\mathrm{5})$ . Two query tokens $T_{Pg}$ and $T_{Ps}$ are computed under the vectors ${\sigma }_g^{*}(w)=(*\mathrm{1}***,*\mathrm{1}***,**\mathrm{1}**)$ and ${\sigma }_s^{*}(w)=(**\mathrm{1}**,***\mathrm{1}*,****\mathrm{1})$ , respectively.

(4)

In the data query phase, when the query tokens $T_{Pg}$ and $T_{Ps}$ are deposited to the DB. As shown in Table 1, if the corresponding position of vectors ${\sigma }_g(\mathbf{x})$ and ${\sigma }_g^{*}(\mathbf{w})$ are equal for all $k\in s({\sigma }_g^{*}(w))$ , the ciphered $f_{\mathrm{0}}$ can be recovered by using $C{T}_{\mathrm{0}}$ and $T_{Pg}$ . Similarly, as shown in Table 2, if the corresponding position of vectors ${\sigma }_s(\mathbf{x})$ and ${\sigma }_s^{*}(w)$ are equal for all $k^{\prime }\in s({\sigma }_s^{*}(w))$ , $f_{\mathrm{1}}$ will be recovered by using $C{T}_{\mathrm{1}}$ and $T_{Ps}$ . Then, the ciphertext C can be computed from $f_{\mathrm{0}}$ and $f_{\mathrm{1}}$ when $P_{({\sigma }_g^{*}(\mathbf{w}),{\sigma }_s^{*}(\mathbf{w}))}({\sigma }_g(\mathbf{x}),{\sigma }_s(\mathbf{x}))=\mathrm{1}$ .

(5)

In the data decryption phase, with the help of the $\text{BS}$ , the ciphertext C can be decrypted. Finally, the $\text{BS}$ distributes the data M to the requester in a secure channel.

Table 1

The larger condition vectors.

${\sigma }_g(\mathbf{x})$	j					${\mathrm{\sigma }}_g^{*}(\mathbf{w})$	j
	1	2	3	4	5		1	2	3	4	5
${\sigma }_g\left(x_{\mathrm{1}}\right)$	1	1	0	0	0	${\mathrm{\sigma }}_g^{*}\left(w_{\mathrm{1}}\right)$	*	1	*	*	*
${\sigma }_g\left(x_{\mathrm{2}}\right)$	1	1	1	0	0	${\mathrm{\sigma }}_g^{*}\left(w_{\mathrm{2}}\right)$	*	1	*	*	*
${\sigma }_g\left(x_{\mathrm{3}}\right)$	1	1	1	1	0	${\mathrm{\sigma }}_g^{*}\left(w_{\mathrm{3}}\right)$	*	*	1	*	*

Table 2

The less condition vectors.

${\sigma }_s(\mathbf{x})$	j					${\sigma }_s^{*}(\mathbf{w})$	j
	1	2	3	4	5		1	2	3	4	5
${\sigma }_s\left(x_1\right)$	0	1	1	1	1	${\sigma }_s^{*}\left(w_1\right)$	*	*	1	*	*
${\sigma }_s\left(x_2\right)$	0	0	1	1	1	${\sigma }_s^{*}\left(w_2\right)$	*	*	*	1	*
${\sigma }_s\left(x_3\right)$	0	0	0	1	1	${\sigma }_s^{*}\left(w_3\right)$	*	*	*	*	1

6. Proposed SSE Scheme

In this section, we describe the details of our SSE scheme. There are also five phases: key generation phase, data encryption phase, token generation phase, data query phase, and data decryption and verification phase.

6.1. Key Generation Phase

For our scheme, we assume that there is a TA (actually is the $\text{BS}$ ) which can bootstrap the whole system. Specifically, in this system initialization phase, the TA generates a bivariate t-degree polynomial $h(x,y)={\sum }_{i,j=\mathrm{0}}^t‍{\alpha }_{ij}{x}_i{y}_j$ . TA computes two polynomial share: $h(x,\text{BS})$ for $\text{BS}$ itself and $h(i,y)$ for the node $N_i$ . $h(N_i,y)$ will be preloaded in the S's memory. A symmetric encryption algorithm $\text{Enc}(·)$ is used to encrypt the data $m_i$ , for example, AES. Given the security parameter ${\mathrm{1}}^k$ , the TA first generates $(q,g,{𝔾}_{\mathrm{1}},{𝔾}_{\mathrm{2}},e)$ by running $𝒢en({\mathrm{1}}^k)$ . TA selects some random elements $g,g_{\mathrm{1}},g_{\mathrm{2}},(h_{\mathrm{1}},u_{\mathrm{1}},{\psi }_{\mathrm{1}}),\dots$ , $(h_{nl},u_{nl},{\psi }_{nl})\in {𝔾}_{\mathrm{1}}$ . It also picks random numbers $y_{\mathrm{1}},y_{\mathrm{2}},v_{\mathrm{1}},\dots ,v_{nl}$ , $t_{\mathrm{1}},\dots ,t_{nl}\in {\mathbb{Z}}_p$ . Then, it computes $Y_{\mathrm{1}}=g^{y_{\mathrm{1}}},Y_{\mathrm{2}}=g^{y_{\mathrm{2}}},v_k=g^{v_k}\in {𝔾}_{\mathrm{1}}$ for $(k=\mathrm{1},\dots ,nl)$ . In addition, it computes $A=e(g_{\mathrm{1}},Y_{\mathrm{1}})·e(g_{\mathrm{2}},Y_{\mathrm{2}})\in {𝔾}_{\mathrm{2}}$ . Then, TA distributes the public/private key pair $(\text{PK},\text{SK})$ to the $\text{BS}$ as follows:

$$\begin{array}{cc}& \text{PK}=(g,Y_{\mathrm{1}},Y_{\mathrm{2}},(h_{\mathrm{1}},u_{\mathrm{1}},{\psi }_{\mathrm{1}},V_{\mathrm{1}},T_{\mathrm{1}}),\dots ,(h_{nl},u_{nl},{\psi }_l,V_{nl},T_{nl}))\\ \text{SK}=(g_{\mathrm{1}},g_{\mathrm{2}},y_{\mathrm{1}},y_{\mathrm{2}},v_{\mathrm{1}},\dots ,v_{nl},t_{\mathrm{1}},\dots ,t_{nl}).\end{array}$$

(6)

6.2. Data Encryption Phase

If $N_i\hspace{0.17em}(\mathrm{1}\le i\le n)$ wants to report a data $m_i$ to the $\text{BS}$ , each data has l searchable attributes; $N_i$ chooses a vector ${\mathbf{x}}_i=(x_{i\mathrm{1}},\dots ,x_{il})\in {\sum }_{}^l$ to characterize its data $m_i$ in different dimensions. $N_i$ computes a message authentication code (MAC) for $m_i$ by using its secret key with the $\text{BS}$ as follows: $N_i$ inputs $\text{BS}$ 's identity into its polynomial share $h(N_i,y)$ and obtains a shared secret key $k_i=h(N_i,\text{BS})$ with the $\text{BS}$ . $N_i$ encrypts his data $m_i$ by using $k_i$ as $C_i=E{n}_{k_i}(m_i)$ . Then, the $\text{BS}$ computes an ${\text{MAC}}_i=H{\text{MAC}}_{k_i}(m_i)$ for authenticating data $m_i$ 's integrity. Also, $N_i$ computes another ${\text{MAC}}_i^{\prime }=H{\text{MAC}}_{k_i}(N_i)$ to authenticate his identity $N_i$ .

In order to support range query “ $a_j\le x_{ij}\le b_j$ ” $(\mathrm{1}\le j\le l)$ , $C_i$ should be divided into two parts as we described in Section 5. Only when both conditions “ $x_{ij}\ge a_j$ ” and “ $x_{ij}\le b_j$ ” are satisfied, $C_i$ can be recovered. Therefore, the $N_i$ divides each $C_i$ into two parts: $f_{i\mathrm{0}}$ and $f_{i\mathrm{1}}$ . $f_{i\mathrm{0}}$ is encrypted by using the encryption vector ${\sigma }_g({\mathbf{x}}_i)$ ; $f_{i\mathrm{1}}$ is encrypted by using the encryption vector ${\sigma }_s({\mathbf{x}}_i)$ . Thus, the $\text{BS}$ can recover $C_i$ only when both encryption vectors are satisfied with the corresponding query vectors in the range query tokens. The encryption details are as follows:

• (1)

$N_i$ maps ${\mathbf{x}}_i$ to an encryption vector ${\sigma }_g({\mathbf{x}}_i)$ as (1). It selects two random numbers $r_{i\mathrm{1}},r_{i\mathrm{2}}\in Z_p$ , and computes some tags for the partial data $f_{i\mathrm{0}}$ by using the mapped vector ${\sigma }_g({\mathbf{x}}_i)$ as

$$\begin{array}{l}{C}_{i\mathrm{10}}=Y_{\mathrm{1}}^{r_{i\mathrm{1}}},\hspace{1em}\hspace{1em}{C}_{i\mathrm{20}}=Y_{\mathrm{2}}^{r_{i\mathrm{2}}},\\ C_{i\mathrm{3,10}}={\left(h_{\mathrm{1}}{u}_{\mathrm{1}}^{{\sigma }_g\left(x_{i\mathrm{1}}\right)}\right)}^{r_{\mathrm{1}}}{V}_{\mathrm{1}}^{r_{i\mathrm{2}}},\\ \dots ,\\ C_{i\mathrm{3},nl\mathrm{0}}={\left(h_{nl}{u}_{nl}^{{\sigma }_g\left(x_{inl}\right)}\right)}^{r_{i\mathrm{1}}}{V}_{nl}^{r_{i\mathrm{2}}},\\ C_{i\mathrm{4,10}}={\psi }_{\mathrm{1}}^{r_{i\mathrm{1}}}{T}_{\mathrm{1}}^{r_{i\mathrm{2}}},\\ \dots ,\\ C_{i\mathrm{4},nl\mathrm{0}}={\psi }_{nl}^{r_{i\mathrm{1}}}{T}_{nl}^{r_{i\mathrm{2}}},\\ C_{i\mathrm{50}}=g^{r_{i\mathrm{2}}},\\ C_{i\mathrm{60}}=A^{r_{i\mathrm{1}}}C.\end{array}$$

(7)

Let $C{T}_{i\mathrm{0}}=(C_{i\mathrm{10}},C_{i\mathrm{20}},C_{i\mathrm{3,10}},\dots ,C_{i\mathrm{3},nl\mathrm{0}},C_{i\mathrm{4,10}},\dots ,C_{i\mathrm{4},nl\mathrm{0}},C_{i\mathrm{50}},C_{i\mathrm{60}})$ . Similarly, $N_i$ maps ${\mathbf{x}}_i$ to an encryption vector ${\sigma }_s({\mathbf{x}}_i)$ as (4). $N_i$ can encrypt the partial data $m_{i\mathrm{1}}$ into ciphertext $C{T}_{i\mathrm{1}}$ by using the encryption vector ${\sigma }_s({\mathbf{x}}_i)$ . Then, $N_i$ deposits $C{T}_{i\mathrm{0}}$ and $C{T}_{i\mathrm{1}}$ to its cluster head ${\text{CH}}_i$ as

$$\begin{array}{cc}& N_i⟶{\text{CH}}_i:\left\{N_i,C{T}_{i\mathrm{0}},C{T}_{i\mathrm{1}},t{s}_i,{\text{MAC}}_i,{\text{MAC}}_i^{\prime }\right\}.\end{array}$$

(8)

(2)

The CH also adds the cluster number $c{l}_i$ to the ciphertexts and transmits them to the $\text{BS}$

$$\begin{array}{cc}& {\text{CH}}_i⟶\text{DB}:\{N_i,C{T}_{i\mathrm{0}},C{T}_{i\mathrm{1}},t{s}_i,{\text{MAC}}_i,{\text{MAC}}_i^{\prime },c{l}_i\}.\end{array}$$

(9)

6.3. Token Generation Phase

In this phase, firstly, the $\text{BS}$ will authenticate the requester S's identity by using any identity-based mechanism [24]. Then, if S is a valid data user, the $\text{BS}$ will help requester to transfer its range query into query tokens. If the range query is $P=(a_{\mathrm{1}}\le x_{\mathrm{1}}\le b_{\mathrm{1}})\wedge (a_{\mathrm{2}}\le x_{\mathrm{2}}\le b_{\mathrm{2}})\cdots \wedge (a_l\le x_l\le b_l)$ . For each querying interval

$$\begin{array}{cc}& S⟶\text{BS}:\left\{P\right\}.\end{array}$$

(10)

Then, $\text{BS}$ divides P into two parts: $P_g=(x_{\mathrm{1}}\ge a_{\mathrm{1}})\wedge (x_{\mathrm{2}}\ge a_{\mathrm{2}})\cdots \wedge (x_l\ge a_l)$ and $P_s=(x_{\mathrm{1}}\le b_{\mathrm{1}})\wedge (x_{\mathrm{2}}\le b_{\mathrm{2}})\cdots \wedge (x_{\mathrm{1}}\le b_l)$ . Let $w_g=(a_{\mathrm{1}},\dots ,a_l)$ and $w_s=(b_{\mathrm{1}},\dots ,b_l)$ .

The $\text{BS}$ generates a predicate vector ${\sigma }_g^{*}(\mathbf{w})\in ({\sum }_{*}‍{)}^{nl}$ to represent $P_g$ . The wildcard * in the vector ${\sigma }_g^{*}(\mathbf{w})$ means that he does not care about the attributes related to *. Let $s({\sigma }_g^{*}(w))$ be the set of all indexes k such that ${\sigma }_g^{*}(w)\ne *$ . Then, a token $T_{Pg}$ will be computed under the vector ${\sigma }_g^{*}(\mathbf{w})$ as follows.

• (1)

Select a random $\alpha ,\beta \in Z_p$ and generate ${\lambda }_j,k_j,{\gamma }_j,{\tau }_j\in Z_p$ such that ${\lambda }_j{y}_{\mathrm{1}}+{\psi }_j{y}_{\mathrm{2}}=\alpha$ , ${\gamma }_j{y}_{\mathrm{1}}+{\tau }_j{y}_{\mathrm{2}}=\beta$ for all $j\in s({\sigma }_g^{*}(w))$ .

(2)

Compute the token $T_{Pg}$ as

$$\begin{array}{l}{K}_{u\mathrm{10}}=g_{\mathrm{1}}{\displaystyle \prod }_{k\in s\left({\sigma }^{*}\right(w_g\left)\right)}‍{\left(h_k{u}_k^{{\sigma }^{*}\left(w_{gk}\right)}\right)}^{{\lambda }_k}{\psi }_k^{{\gamma }_k},\\ K_{u\mathrm{20}}=g_{\mathrm{2}}{\displaystyle \prod }_{k\in s\left({\sigma }^{*}\right(w_g\left)\right)}‍{\left(h_k{u}_k^{{\sigma }^{*}\left(w_{gk}\right)}\right)}^{{\phi }_k}{\psi }_k^{{\tau }_k},\\ K_{u\mathrm{30}}=g^{\alpha },\\ K_{u\mathrm{40}}=g^{\beta },\\ K_{u\mathrm{50}}=g^{-{{\displaystyle \sum }}_{k\in s\left({\sigma }^{*}\right(w_g\left)\right)}^{}(v_k\alpha +t_k\beta )}.\end{array}$$

(11)

Let $T_{Pg}=(K_{u\mathrm{10}},K_{u\mathrm{20}},K_{u\mathrm{30}},K_{u\mathrm{40}},K_{u\mathrm{50}})$ . In the same way, $\text{BS}$ can generate the $T_{Ps}$ for partial query $P_s$ . Then, the $\text{BS}$ gets query tokens $T_{Pg}$ and $T_{Ps}$ and sends them to the requester S

$$\begin{array}{cc}& \text{BS}⟶S:T_{Pg},T_{Ps}.\end{array}$$

(12)

6.4. Data Query Phase

In this phase, S deposits its range query tokens to the DB to query their required data. After finish receiving the query tokens from S, the DB searches its database to find if there is a data ciphertext which matches S's query. For each data ciphertext, the DB checks that

$$\begin{array}{cc}& f_{i\mathrm{0}}=\frac{D_{\mathrm{1}}·D_{\mathrm{2}}·e(K_{u\mathrm{50}},C_{u\mathrm{50}})}{e(K_{u\mathrm{10}},C_{u\mathrm{10}})·e(K_{u\mathrm{20}},C_{u\mathrm{20}})},\end{array}$$

(13)

where $D_{\mathrm{1}}=e(K_{u\mathrm{30}},{\prod }_{k\in s({\sigma }_g^{*}(w))}‍C_{u\mathrm{30},k})$ and $D_{\mathrm{2}}=e(K_{u\mathrm{40}},{\prod }_{k\in s({\sigma }_g^{*}(w))}‍C_{u\mathrm{40},k})$ . If for all $k\in s({\sigma }_g^{*}(w))$ , ${\sigma }_g^{*}(w_k)$ and ${\sigma }_g(x_{ik})$ are equal, $f_{i\mathrm{0}}$ will be recovered. Similarly, $f_{i\mathrm{1}}$ will be recovered when ${\sigma }_s^{*}(w_k)$ and ${\sigma }_s(x_{ik})$ are equal at the corresponding position. Then, the $\text{BS}$ can derive the coefficients of $f(x)$ by interpolation and hence calculate the secret $C_i={\Sigma }_{v=\mathrm{1}}^t{f}_{iv}{L}_v(\mathrm{0})$ , where $L_v(\mathrm{0})$ is the Lagrange coefficient such as

$$\begin{array}{cc}& L_v\left(x\right)=\frac{{{\displaystyle \prod }}_{j\ne v}^{}(x-x_j)}{{{\displaystyle \prod }}_{j\ne v}^{}(x_v-x_j)}.\end{array}$$

(14)

Thus, the DB can recover $C_i$ by using $f_{i\mathrm{0}}$ and $f_{i\mathrm{1}}$ and Lagrange coefficient. Then, DB distributes these data to S

$$\begin{array}{cc}& \text{DB}⟶S:\left(C_i,{\text{MAC}}_i,{\text{MAC}}_i^{\prime },N_i\right),\left(C_{i^{\prime }},\dots ,N_{i^{\prime }}\right)\dots .\end{array}$$

(15)

6.5. Data Decryption and Verification

Note that, there are more than one query results which match and the range query tokens. When S received the query results from DB, it will send them to the $\text{BS}$ for decryption and verification

$$\begin{array}{cc}& S⟶\text{BS}:(C_i,{\text{MAC}}_i,{\text{MAC}}_i^{\prime },N_i),(C_{i^{\prime }},\dots ,N_{i^{\prime }})\dots .\end{array}$$

(16)

The $\text{BS}$ recovers original data from the ciphertexts by using its shared secret key $k_i$ with S. The $\text{BS}$ inputs data owner's identity $N_i$ into its polynomial share $f(x,\text{BS})$ and obtains its shared key $k_i=f(N_i,\text{BS})$ with the $N_i$

$$\begin{array}{cc}& \text{BS}:m_i={\text{Dec}}_{k_i}\left(C_i\right),\dots .\end{array}$$

(17)

$\text{Dec}(·)$ is the symmetric decryption algorithm corresponding to the opposite operation of $\text{Enc}(·)$ .

Then, the $\text{BS}$ computes a new MAC as ${\text{MAC}}_{\mathrm{1}}=H{\text{MAC}}_{k_i}(m_i)$ by using the recovered $m_i$ and $k_i$ . The $\text{BS}$ checks whether ${\text{MAC}}_{\mathrm{1}}={\text{MAC}}_i$ . If so, the data verification succeeds, which means that the recovered $m_i$ is the original data; otherwise, the verification fails and $m_i$ can be discarded. Next, the $\text{BS}$ computes another MAC by using the received identity as ${\text{MAC}}_{\mathrm{2}}=H{\text{MAC}}_{k_i}(N_i)$ . If ${\text{MAC}}_{\mathrm{2}}={\text{MAC}}_i^{\prime }$ , the identity verification succeeds, which means that $N_i$ is the original valid sender; otherwise, nothing will be returned. If all the verifications are successful, the $\text{BS}$ distributes the correct query results to the requester in a secure channel as

$$\begin{array}{cc}& \text{BS}⟶S:\{(m_i,N_i),\dots \}.\end{array}$$

(18)

As a result, the requester obtains the original data.

7. Security Analysis

In this section, we analyze the security properties of the proposed SSE scheme. In particular, following the security requirements discussed earlier, our analysis will focus on how the proposed SSE scheme can achieve the data confidentiality, data integrity, source authentication, and data query privacy.

• (i)

The SN's data confidentiality is preserved in the proposed SSE scheme. In the SSE, each SN's data $m_i$ is encrypted by using the HVE-based encryption vectors ${\sigma }_g(\mathbf{x})$ and ${\sigma }_s(\mathbf{x})$ . Anyone, including the cluster head CH and DB who does not know the $\text{BS}$ 's secret key and query tokens can not recover $C_i$ and $m_i$ from the ciphertexts $C{T}_{i\mathrm{0}}$ and $C{T}_{i\mathrm{1}}$ . Thus, the data confidentiality is preserved in the SSE.

(ii)

The SN's data integrity is preserved in the proposed SSE scheme. In the SSE, each SN's data packet is followed by an MAC. The MAC is generated by using the shared secret key $k_i$ between the SN and the $\text{BS}$ . If any intermediate node, including the CH, forges or modifies the MAC, its malicious behavior can be detected during the data verification phase. The reason is that they have little knowledge of the secret keys $k_i$ and $m_i$ . Any modification will fail in the verification. Therefore, the data integrity is preserved in the SSE.

(iii)

The source authentication is preserved in the proposed SSE scheme. In the SSE, except the data authentication message, ${\text{MAC}}_i^{\prime }$ is followed with the data packet, and another identity authentication message ${\text{MAC}}_i^{\prime }$ is also attached. After data verification, the $\text{BS}$ also will check the source authentication by verifying if ${\text{MAC}}_i^{\prime }={\text{MAC}}_2^{}=H{\text{MAC}}_{k_i}(N_i)$ to authenticate sender's identity $N_i$ . Similarly, any impersonation and modification will fail in the source authentication. By this means, the source authentication is preserved in the SSE.

(iv)

The data query privacy is achieved in the proposed SSE scheme. In the SSE, when the query vectors in the query tokens match the HVE-base encryption vectors, the original data will not expose to the DB. The reason is that the secret keys needed for data decryption phase is kept secret. As described in the key generation phase, the polynomial share $h(i,y)$ for each node $N_i$ is preloaded in $N_i$ 's memory. Only the $\text{BS}$ and $N_i$ can correctly generate the secret key $k_i=h(N_i,\text{BS})=h(\text{BS},N_i)$ . Anyone who does not get the polynomial share $h(i,y)$ or $h(x,\text{BS})$ cannot compute the key $k_i$ . As a result, even if the adversary 𝒜 can get the data ciphertext and MAC message by eavesdropping, it also can not obtain any information about $k_i$ and $m_i$ . As a result, the data query privacy is preserved in the SSE.

Compared with the original OPE-based scheme [15], Buck-based scheme [6], and the original HVE-based scheme [20], as shown in Table 3, our SSE is the only one which can achieve all of the data confidentiality and intergrity, source authentication, and data query privacy. Furthermore, our SSE has no false positive results when querying the DB, which makes it more secure and efficient than the Buck-based scheme [6].

Table 3

Comparison of security properties.

Properties	SSE	OPE [15]	Buket [6]	HVE [20]
Confidentiality	Yes	partial	partial	Yes
Data integrity	Yes	No	No	No
Source authentication	Yes	No	No	No
Data query privacy	Yes	No	partial	partial
False positive	No	No	Yes	No

8. Conclusion

In this paper, we propose a secure searchable encryption scheme, named SSE, for urban sensing and querying to address the data security, source authentication, and range query problems of the sensed data in smart cities. The SSE allows the sensed data to be stored on a untrusted server in encrypted form. An authorized requester can obtain the correct ciphertexts when his authorized range query matches the HVE-based encryption predicate. With the help of the base station, the data integrity and source authentication can be verified. Security analysis demonstrates that the SSE can achieve data confidentiality and integrity, source authentication, and data query privacy. For our future work, we intend to enhance our SSE to support fine-grained search with logical operations.