A Ciphertext Database Construction Scheme Based on an Improved Encrypted Index Construction

Abstract

In the era of the digital economy, data has become a fundamental resource, a critical factor of production, and a key driver of socio-economic development. As the volume of data generated and collected increases, issues concerning data security and privacy protection have gained widespread attention. To enhance data security during storage and retrieval, this study proposes an improved ciphertext index construction scheme based on the Verifiable Delay Function (VDF) and Learning with Errors (LWE). The scheme employs k-flat partitioning to organize multidimensional structured data and constructs group-level ciphertext indexes based on attribute coverage values. VDF-generated salts and attribute-specific LWE keys derived through a Key Derivation Function (KDF) are combined with randomized encryption to reduce the correlation leakage associated with deterministic indexes. During retrieval, the server performs homomorphic subtraction on ciphertext indexes, while the client determines equality by comparing the resulting noise with a decision threshold. Role-based access control (RBAC) is incorporated to enforce attribute-level key isolation and unauthorized-access rejection. Experimental results demonstrate that the proposed scheme achieves effective ciphertext equality queries without directly exposing plaintext index values, while maintaining acceptable computational overhead.

1. Introduction

In today’s data-driven era, data is no longer merely an input to system operations, but has become a fundamental asset for value creation, decision support, and security assurance. Once maliciously exfiltrated or misused during transmission or storage, it can lead to severe security and privacy breaches. Therefore, how to achieve efficient data storage and querying without exposing raw data has become one of the core issues in data security research. As a security paradigm that integrates cryptographic techniques with database retrieval capabilities, encrypted databases enable efficient data operations while preserving data confidentiality. They have thus emerged as a key mechanism for protecting sensitive information in cloud environments and other untrusted third-party infrastructures.

To address the query requirements of encrypted databases, existing research has primarily developed several technical approaches, including order-preserving encryption (OPE) [1,2], searchable symmetric encryption (SSE) [3], Order-Revealing Encryption (ORE), and homomorphic encryption [4,5]. SSE enables the server to perform keyword or condition matching without accessing plaintext data by constructing search tokens. For instance, Zhu et al. [6] proposed CoD-DSSE, which reduces client-side state storage overhead through a hierarchical index structure, and enhances forward and backward security using randomized search tokens and Bloom filters. Related work has further optimized dynamic SSE and conjunctive queries [7]. However, some SSE schemes still rely on deterministic search tokens, which may leak search patterns and access patterns, and such leakage can be further exploited to infer query contents or underlying data [8,9]. OPE and ORE support range queries and comparison operations by preserving or revealing the order relationships among plaintext values, but they may also leak statistical information such as data distribution and duplicate values [10]. Homomorphic encryption enables computation directly over ciphertexts and offers strong security and expressive functionality; however, its high computational and communication overheads limit its applicability to large-scale encrypted databases.

In addition to query mechanisms, index construction is another critical factor affecting both the efficiency and security of encrypted database queries. Existing studies typically build ciphertext indexes using deterministic encryption, pseudorandom functions (PRFs), hash mapping, or multidimensional data partitioning, so as to avoid full-table scans over ciphertext data. Sabrina De Capitani di Vimercati et al. [11] proposed a k-flat partitioning algorithm for organizing and retrieving multidimensional encrypted data, providing effective approaches for grouping and indexing such data; however, the security of their index encryption mechanism still warrants further investigation. Wang et al. [12] constructed a secure database system for multi-cloud environments, leveraging RSA-based homomorphic encryption and a multi-layer key mechanism for data protection, but the multi-encryption incurs additional computational overhead. Sun Xize et al. [13] integrated order-preserving encryption, homomorphic encryption, and AES-CBC to support various SQL queries, reflecting the trend of synergistically combining multiple cryptographic primitives to support encrypted database queries.

As database scales grow, indexes themselves gradually become significant sources of leakage as well [14,15]. Traditional hash-based, deterministic encryption, and PRF-based indexes typically employ fixed mappings, causing identical attribute values to correspond to identical index representations:

$$v_1=v_2\Rightarrow I\left(v_1\right)=I\left(v_2\right)$$

(1)

The server can thus observe equality relationships among different records, resulting in equality pattern leakage. Therefore, protecting only the data ciphertexts in the database does not fully guarantee index security. Moreover, existing salting mechanisms are primarily designed for password storage and key derivation scenarios—for example, Argon2 [16] and PBKDF2 [17] introduce salts to increase the randomness of derived outputs—but for multi-attribute encrypted databases, further consideration must be given to attribute independence, attribute binding, and authorized access issues in the salt design.

In summary, existing research faces three major challenges:

(1)

Index organization for multidimensional data.

(2)

Correlation leakage from deterministic indexes.

(3)

Queryability of randomized indexes.

To address these issues, this paper focuses on the secure construction and efficient querying of ciphertext indexes, and proposes an improved ciphertext index construction strategy along with a corresponding encrypted database scheme. The main contributions are as follows:

(1)

A group-based ciphertext index construction method. We introduce k-flat partitioning to recursively partition records according to multidimensional data features, and use the attribute coverage ranges of data groups as the indexing objects, thereby reducing the granularity and overall size of the index.

(2)

An attribute-independent salting strategy. We employ a Verifiable Delay Function (VDF) to generate a master salt, and then derive attribute-specific salts via a Key Derivation Function (KDF), which reduces the correlation among indexes of different attributes and strengthens index security.

(3)

A randomized ciphertext equality index based on Learning With Errors (LWE). We combine attribute coverage values with attribute salts through a coding scheme, and construct randomized ciphertext indexes using LWE. Equality matching is achieved via homomorphic subtraction and noise threshold comparison, which preserves query capability while enhancing index confidentiality.

(4)

A secure management and query mechanism for ciphertext indexes. The attribute salts and index keys are managed in isolation, and attribute-level authorization is enforced through access control. The scheme is further validated in terms of security, query correctness, and overheads of construction and storage.

The remainder of this paper is organized as follows. Section 2 introduces the relevant background, including k-flat partitioning, Verifiable Delay Functions (VDFs), and LWE. Section 3 presents the proposed encrypted database construction scheme based on the improved ciphertext index strategy, covering attribute-level key generation, group-level LWE-based ciphertext index construction, ciphertext equality query processing, and the access control mechanism. Section 4 analyzes the scheme in terms of index construction overhead, query correctness, and query performance through experiments, and compares it with related approaches. Section 5 concludes the paper, discusses the limitations of the proposed scheme, and outlines directions for future research.

2. Related Technologies

2.1. Learning with Errors

The Learning With Errors problem, introduced by Regev in 2005, is one of the important hard problems in post-quantum cryptography. Its security is based on the difficulty of solving noisy linear equations. The LWE problem is typically defined over a finite field ${\mathbb{Z}}_q$, where the core idea is to add random noise to solvable linear equations, making it infeasible for an adversary to recover the hidden vector from a large number of samples, while a legitimate user can remove the noise using the secret key and recover the original message. Due to its resistance to quantum attacks and its support for homomorphic computations, LWE has been widely used in homomorphic encryption, privacy-preserving computations, and secure database queries in recent years.

We adopt a symmetric LWE encryption scheme that supports homomorphic subtraction for ciphertext equality testing.

Encryption $En{c}_s\left(u\right)$: Given a message $u\in {\mathbb{Z}}_q^n$ and a secret key $s\in {\mathbb{Z}}_q^n$:

(1)

Randomly sample $A\in {\mathbb{Z}}_q^{n\times n}$;

(2)

Sample noise $e\sim {\chi }^m$ with $|e_i|\le B$;

(3)

Compute $b=A·s+e+u\left(\mathrm{mod}q\right)$;

(4)

Output the ciphertext $ct=(A,b)$.

Decryption $De{c}_s\left(ct\right)$: Compute

$$m^{\prime }=b-A·s\left(\mathrm{mod}q\right)$$

(2)

After centering to the range $(-q/2,q/2]$, we obtain $m^{\prime }=u+e$. The decryption result is “message plus noise”; it does not directly recover the exact plaintext but can be used for threshold-based decision.

Homomorphic subtraction $HomSub(c{t}_1,c{t}_2)$: For $c{t}_1=(A_1,b_1)$ and $c{t}_2=(A_2,b_2)$, output

$$(A_1-A_2,b_1-b_2)\left(\mathrm{mod}q\right)$$

(3)

Its decryption result is

$$Dec(·)=(u_1-u_2)+(e_1-e_2).$$

(4)

If $u_1=u_2$, the result reduces to the difference of noises, whose infinity norm is ≤$2B=\tau$. If $u_1\ne u_2$, the vector difference is far from zero, with norm much larger than $\tau$. Therefore, we set $\tau =2B$ to perform ciphertext equality testing.

By removing the linear part, we obtain a plaintext result that contains a small amount of noise. Since the LWE problem is equivalent to solving a noisy linear equation system without the secret key, an adversary cannot effectively distinguish ciphertexts corresponding to different plaintexts, thus ensuring the confidentiality of encrypted data.

2.2. Salt Strategy

Salt [18] is a random string combination of characters, numeric digits, or special characters combined with a password so as to increase the level of randomness in the resulting hash value. As a light-weight security enhancement technique, it was originally introduced in the field of cryptography to increase the unpredictability of hash outputs by injecting random perturbations, thereby effectively mitigating common threats such as dictionary attacks [19,20] and rainbow table attacks [21]. In password storage systems, a unique random salt is typically generated for each user password and combined with the password before hashing. This ensures that even if multiple users choose the same password, their stored hash values remain different [22], thereby improving collision resistance and protection against replay attacks.

With the development of encrypted databases, searchable encryption (SE) technologies [23,24], and order-preserving encryption [25], salting mechanisms have gradually been incorporated into encrypted index construction to enhance the security of index identifiers. Traditional salting approaches often rely on static concatenation (e.g., salt∥keyword) or hash perturbation (e.g., hash(keyword + salt)). Although these methods increase the randomness of index values to some extent, they still suffer from two major limitations:

(1)

The generation and usage of salts lack structural design, making them difficult to adapt to complex data types and retrieval scenarios;

(2)

The association between salts and attributes is relatively coarse-grained and is not bound to access permissions, which renders the system vulnerable to frequency analysis or enumeration attacks by unauthorized users reconstructing index values.

To address these issues, recent studies have proposed structured composite salt mechanisms [26], dual-salt HMAC schemes [27], and dynamically perturbed salts [28]. Although these improved mechanisms have advanced index security, enhancing the unpredictability and access-control capability of index structures—while preserving query functionality—remains one of the key challenges in current research.

2.3. k-Flat Partitioning Algorithm

Before constructing the index, the raw data must be partitioned into groups. Sabrina De Capitani di Vimercati et al. [11] proposed a partitioning strategy known as the k-Flat Partitioning Algorithm. The k-flat partitioning process is implemented through recursive splitting: at each step, the relation (or subgroup) is divided into two subsets until all subsets satisfy the k-flat partitioning condition, where k denotes the cardinality of each group, i.e., the number of tuples contained within each partition. More specifically, the partitioning procedure recurses by splitting along one dimension of the multi-dimensional space at each iteration, and continues recursively within the resulting subspaces until each subspace contains k (or k + 1) tuples. During each iteration, the dimension selected for splitting is the attribute with the largest number of distinct values. If the attribute is continuous, the partitioning is performed at the median; if the attribute is nominal, the first-fit decreasing strategy based on frequency is applied. The detailed steps of the algorithm are presented in

Table 1. Detailed procedure of the k-Flat Partitioning Algorithm.

k-Flat Partitioning Algorithm
Input: Multidimensional relational dataset R; grouping cardinality k
Output: Set of subspaces P that satisfy the partitioning condition
Algorithm Procedure:
(1) Initialization: Set the partitioning set $S=R$; (2) Check if $\left|S\right|\le k$; if the condition is satisfied, add S to P; (3) Select splitting dimension: Choose the attribute with the largest number of distinct values; (4) Apply splitting rule: For continuous attributes → split at the median; For nominal attributes → split based on frequency (first-fit decreasing strategy); (5) Obtain subsets $S_1$ and $S_2$; recursively partition each subset; (6) Repeat recursively until each $|S_i|\le k$ (or $k+1$); (7) Output all subspaces in P that satisfy the partitioning condition.

.

2.4. Verifiable Delay Function

A Verifiable Delay Function is a type of function that exhibits a time delay in sequential computation while allowing the correctness of its output to be efficiently verified in a short period of time. The design goal of a VDF is that any party must perform at least T sequential steps to obtain the output y, whereas other verifiers can quickly check the correctness of y in a time significantly shorter than T. Formally, a VDF is defined as a triple (Setup, Eval, Verify) [29]:

Setup($\lambda$, T): Given a security parameter $\lambda$ and a delay parameter T, generate the public parameters pp;

Eval(pp, x): On input x, perform a sequential computation that cannot be parallelized, producing output y and optionally a proof $\pi$;

Verify(pp, x, y, $\pi$): Check whether y and $\pi$ constitute a valid output.

Requirements: The evaluation phase (Eval) cannot be accelerated through parallelism; the verification phase (Verify) must be much faster than the evaluation phase; the output y is uniquely determined by the input x.

The core properties of a VDF are sequentiality and verifiability. Sequentiality ensures that computing the function $f^{\left(T\right)}\left(x\right)$ requires T consecutive operations (e.g., modular squaring, group operations) that cannot be skipped or accelerated via parallel processing or specialized hardware, thus guaranteeing the authenticity of the time delay. Verifiability means that in addition to producing the output y, the VDF generates a short proof $\pi$, which allows a verifier to efficiently check

$$\mathrm{Verify}(pp,x,y,\pi )=1$$

(5)

without re-executing the entire computation. This property ensures traceability and tamper-resistance of the system.

3. Research Methodology

3.1. Overall Design

The input data of the proposed scheme is a CSV file containing record information, and the output is a constructed ciphertext database. The detailed procedure is shown in

Table 2. Overall construction process of the ciphertext database.

Overall Construction Process of the Ciphertext Database
Input: Raw dataset D (a collection of records with multi-dimensional attributes)
Output: Cipher-text database $D{B}_{\mathrm{enc}}$, consisting of mappings between ciphertext index entries and the corresponding group ciphertext file paths.
Algorithm Procedure:
(1) Partition the original dataset D into groups using the k-Flat Partitioning Algorithm, resulting in multiple record groups containing multi-dimensional attributes; (2) For each record group, compute the coverage value of each attribute; (3) Generate a master salt for each attribute using Verifiable Delay Function (VDF), and perform attribute-level key derivation; (4) Encrypt the raw data in each record group using AES to produce group ciphertext files, and save the ciphertext files to the designated storage locations; (5) Invoke the Learning With Errors (LWE)-based ciphertext index construction algorithm to encrypt the attribute coverage values of each record group, generating the ciphertext index entries; (6) Associate each ciphertext index entry with the corresponding group ciphertext file path, and store the resulting mappings in the ciphertext database $D{B}_{\mathrm{enc}}$. $$D{B}_{\mathrm{enc}}=\left\{(I_i,{\mathrm{path}}_i)\mid 1\le i\le g\right\}$$ where $I_i$ denotes the ciphertext index entry of the i-th record group, ${\mathrm{path}}_i$ denotes the corresponding group ciphertext file path, and g denotes the total number of record groups.

.

During the data preprocessing phase of the system, the raw record data is first read from CSV files and partitioned into multiple record groups satisfying balance constraints using the k-Flat Partitioning Algorithm. This partitioning strategy recursively splits the attribute space, effectively improving the efficiency and precision of subsequent index construction, and providing a structured data foundation for the construction of the ciphertext database.

To enhance the queryability of encrypted data, attribute indexes are constructed based on the record groups obtained from the k-Flat Partitioning Algorithm. In this paper, we adopt the k-flat partitioning concept proposed by De Capitani di Vimercati et al. [11], where k is defined as the target number of records contained in each data group. The original work notes that k is a parameter that can be set by the data owner according to actual requirements; a larger k allows more records to share the same index value, thereby enhancing protection against static inference attacks, but at the same time increases the potential processing overhead during query execution. Therefore, the setting of k involves a trade-off between the degree of privacy protection and the system processing overhead. Considering the data scale in our experiments and the subsequent requirements for ciphertext index construction and querying, we set the target number of records per group to $k=10$. This setting maintains a relatively small group size, avoids excessive intra-group data processing overhead, and reduces the exposure of individual record characteristics through the sharing of index values within the group. Consequently, all subsequent experiments adopt $k=10$ as the default parameter for k-flat partitioning.

The core goal of the index construction phase is to identify the value ranges of each attribute within every record group. To achieve this, the system extracts boundary values (e.g., minimum and maximum) for each attribute via custom getter methods, thereby generating structured attribute ranges. Subsequently, a unique salt is generated for each attribute by invoking a VDF, as detailed in Section 3.2. The salt, acting as a light-weight perturbation factor, is combined with the attribute ranges through the salting operation described in Section 3.3, producing irreversible attribute index identifiers that enhance the security and resistance to analysis of the indexes.

Once the index identifiers are generated, the raw data in each record group is symmetrically encrypted using the AES algorithm to ensure confidentiality during storage and transmission. The encrypted data is then serialized into structured JSON files and stored at designated paths on local disk, ensuring manageable and recoverable. The operation can be represented as

$$\mathrm{Write}\left(\mathrm{Serialize}\left({\mathrm{E}}_{{\mathrm{K}}_{\mathrm{AES}}}\left({\mathrm{D}}_j\right)\right),{\mathrm{P}}_j\right)$$

(6)

where ${\mathrm{D}}_j$ denotes the raw data of the j-th record group, ${\mathrm{E}}_{{\mathrm{K}}_{\mathrm{AES}}}(·)$ represents the AES encryption algorithm, ${\mathrm{P}}_j$ is the storage path, and $\mathrm{Serialize}(·)$ denotes the serialization process.

Finally, the ciphertext hashes of the index entries are mapped to the corresponding storage paths of the encrypted data and stored collectively in the encrypted groups table in the database, forming the foundation for the query service. This process establishes a complete workflow from raw data partitioning, index construction, encrypted storage, to index mapping, constituting the core architecture of the ciphertext database in the system. The specific procedure is shown in the Figure 1.

3.2. Salt Generation Based on Verifiable Delay Functions

To support fine-grained access control, this paper requires generating mutually independent and unpredictable salts for different attributes, and using them for subsequent ciphertext index construction. Considering that the salt generation process necessitates a certain level of unpredictability as well as verifiability of the results, we introduce the VDF as the salt generation tool. By leveraging the “delayed computation, fast verification” property of existing VDF constructions, we provide a verifiable randomization mechanism for attribute salt generation.

The VDF-based random number generation proceeds through four main stages:

Stage 1: Initial Random Seed Generation: A random seed r is first obtained, either from a secure random source or from system-defined parameters, ensuring the unpredictability of the entire process.

Stage 2: VDF Delay Computation: Using r as input, perform T sequential modular exponentiation iterations to obtain the output y:

$$y\equiv r^{2^T}\mathrm{mod}N$$

(7)

where N denotes the RSA modulus used in the VDF computation, T denotes the delay parameter, r is the random seed, and y is the VDF output (result).

Stage 3: Salt Definition: The resulting value y is defined as the salt, to be used as a security parameter in subsequent encrypted indexes or access control mechanisms.

Stage 4: Verification Mechanism: Other participants can quickly verify y using the VDF’s short proof mechanism, confirming that it is indeed generated from the initial seed r through T rounds of sequential computation, thereby ensuring correctness and tamper-resistance of the salt.

The short proof mechanism of the VDF introduces the challenge prime l

$$l=H(r,y)$$

(8)

and decomposes the exponent as

$$\begin{array}{cc}\hfill 2^T& =q·l+\mathrm{rem},\hfill \\ \hfill y& ={\left(r^q\right)}^l{r}^{\mathrm{rem}}\mathrm{mod}N\hfill \end{array}$$

(9)

The prover only needs to send $\pi =rq$ mod N, and the verifier checks

$$y={\pi }^l{r}^{\mathrm{rem}}\mathrm{mod}N$$

(10)

This reduces the verification workload from $2^T$ squarings to a single exponentiation and a multiplication, achieving the “slow generation, fast verification” property. Consequently, VDF-based salts not only meet the security requirements but also maintain high efficiency and scalability for practical system deployment.

3.3. Construction of Ciphertext Equivalent Index Based on LWE

To ensure the security and anti-analysis properties of the index during the storage and query processes, on the record groups obtained from k-flat partitioning, an LWE ciphertext index is established for the attribute coverage values of the groups, and equivalent retrieval is accomplished through homomorphic subtraction and noise thresholding.

3.3.1. Domain Separation Encoding of Attribute Value Ranges

For any attribute attr and its corresponding group coverage value v, the domain separation encoding rule is defined as follows:

$$u=H_q(\mathrm{attr}\parallel v)\in {\mathbb{Z}}_q^n$$

(11)

The specific implementation method is as follows: Firstly, the hash value of the concatenated string $attr\parallel v$ is calculated using the SHA-256 hash algorithm as the seed. Then, the hash output is expanded by a counter, and finally, it is mapped block by block to n coefficients modulo q, thereby obtaining a fixed-length vector u. This encoding has the following functions:

(1)

Domain Separation: Even if the coverage strings of different attributes are the same, the encoding results are different, avoiding cross-attribute mis-matching;

(2)

Fixed-length Embedding: The variable-length string is stably mapped to $Z_q^n$, adapting to the LWE message space;

(3)

Resistance to Direct Embedding with Low Entropy: It is prohibited to fill short strings with byte cycling into vectors to reduce the risk of different plaintexts falling into similar vectors.

Under the ideal random oracle model, the encoding vectors u and $u^{\prime }$ corresponding to different attribute values can be considered approximately uniform and independent of each other, providing theoretical support for the correctness of subsequent ciphertext equivalence determination.

3.3.2. Algorithm for Building Ciphertext Index Based on LWE

Based on the grouping results, value range encoding and LWE encryption mechanism, a group-level ciphertext index table is constructed to achieve the association and binding of grouped data and ciphertext index. The complete algorithm flow is shown in

Table 3. Algorithm for constructing ciphertext index based on LWE.

Algorithm for Constructing Ciphertext Index Based on LWE
Input: Group set $\left\{G_j\right\}$, attribute set A, attribute key set $\left\{s_{\mathrm{attr}}\right\}$, public parameters $(n,q,\chi )$
Output: Ciphertext index table I
Algorithm flow:
Iterate over all attributes $\mathrm{attr}\in A$ in the attribute set, and execute sequentially: (1) Calculate the group attribute coverage value $v\in \mathrm{cov}(G_j,\mathrm{attr})$; (2) Generate a message vector through pre-discrete encoding $u=H_q(\mathrm{attr}\parallel v)$; (3) Encrypt based on the attribute key to obtain the index ciphertext $ct={\mathrm{Enc}}_{s_{\mathrm{attr}}}\left(u\right)$; (4) Write the ciphertext $ct$ into the corresponding group and corresponding attribute field of the index table I; (5) Return the ciphertext index table I

.

The core characteristic of the algorithm is the same-key different-ciphertext feature: the same attribute uses a fixed key throughout, but the random matrix and noise vector are independently sampled in each encryption process. Even if the coverage values of the two grouped attributes are exactly the same, the generated index ciphertexts will still be different. This feature avoids the deterministic matching defect of traditional PRF labels, eliminates the situation where the server directly compares and judges the grouped coverage values through ciphertext strings, and effectively improves the privacy security of the index.

3.3.3. Ciphertext Equivalence Query and Threshold Determination

Based on the homomorphic subtraction property of LWE and the noise-threshold decision mechanism, a ciphertext-domain equality query and threshold verification scheme is constructed. The proposed scheme enables privacy-preserving equality matching without decrypting the index ciphertexts. By integrating permission verification, ciphertext scanning, threshold evaluation, group decryption, and intra-group secondary filtering into a complete query workflow, the scheme supports both single-attribute exact queries and multi-attribute conjunctive queries. The complete algorithm for single-attribute exact querying is presented in

Table 4. Single-attribute precise query algorithm.

Single-Attribute Precise Query Algorithm
Input: Query request $Q=(\mathrm{attr},v^{*})$, user role role, ciphertext index table I, determination threshold $\tau$
Output: Collection of records that meet the query conditions $R_{\mathrm{ans}}$
Algorithm flow:
(1) Key application and permission verification: $$S_{\mathrm{attr}}\leftarrow \mathrm{RequestKey}(\mathrm{role},\mathrm{attr}),$$ If key application fails, directly reject the query request. (2) Generate query ciphertext: Execute attribute encoding and LWE encryption to obtain $$u^{*}\leftarrow H_q(\mathrm{attr}\parallel v^{*}),c{t}^{*}\leftarrow {\mathrm{Enc}}_{s_{\mathrm{attr}}}\left(u^{*}\right);$$ (3) Initialize the hit set Hits; (4) Traverse all index items $(c{t}_j,pt{r}_j)$ in the index table and compare and determine one by one: Calculation of ciphertext homomorphic difference: $$ct\leftarrow \mathrm{HomSub}(c{t}_j,c{t}^{*});$$ Client-side local decryption: $$m\leftarrow {\mathrm{Dec}}_{s_{\mathrm{attr}}}\left(ct\right);$$ Threshold matching determination: If ${\parallel m\parallel }_{\infty }\le \tau$, update the hit set $$\mathrm{Hits}\leftarrow \mathrm{Hits}\cup \left\{pt{r}_j\right\};$$ (5) Fine-grained processing of the results: Edit the multiple data pointers in the hit set, decrypt the corresponding AES group data, and complete the secondary filtering of the plaintext within the group according to the query accuracy requirements; (6) Output the precise query result set after filtering $R_{\mathrm{ans}}$.

. Since the core comparison process is performed entirely over ciphertexts, the server cannot infer plaintext semantics or query decision results, thereby achieving a balance between query functionality and data privacy protection.

Multi-attribute conjunctive queries (such as constraints on both age and classname) can perform the above determination for each attribute separately, and then take the intersection of the hit pointer sets; accordingly, the client needs to have the authorization keys for each attribute respectively.

3.4. Access Control and Security Management for Attribute Private Keys

To enhance data security and the flexibility of access control, this paper generates independent salts for different data attributes and establishes a mapping between each salt and its corresponding attribute. The attribute salts are encrypted with a key and then uniformly stored in ciphertext form in the salt table of the database. Meanwhile, a role-based access control (RBAC) mechanism is introduced to further enforce attribute-level salt access control on top of role permissions.

(1) Role Management and Permission Mapping.

The system adopts a three-tier permission management model of “user–role–attribute permissions.” Users and roles are associated through a user--role mapping table. Administrators configure the corresponding attribute access scopes for different roles according to business requirements, and establish the permission relationships between roles and attributes via a role–attribute permission mapping table.

When a user requests access to an attribute salt, the system first verifies the user’s identity and queries their current active role, and then determines whether the user has the required access permission for the target attribute based on the role–attribute mapping. Only after the permission check succeeds does the system allow the subsequent salt retrieval operation to proceed. When a user’s role or permissions change, their attribute access scope can be dynamically adjusted by updating the role mapping relationships, and all subsequent requests will re-undergo permission verification accordingly.

(2) Encapsulation and Storage of Attribute Private Keys.

To prevent direct exposure of attribute salts in the event of a database breach, this paper encrypts and encapsulates the salts before storage. The encryption and decryption keys are maintained uniformly by a key management service and are not stored directly in the database. After a legitimate request has passed identity authentication and attribute permission verification, the system requests the corresponding key from the key management module and performs salt decryption. This establishes a separated management approach in which “the database stores the salt ciphertexts, the key management service maintains the keys, and the permission module controls the conditions under which the keys are used,” thereby reducing the risk of salt exposure resulting from database compromise.

(3) Access Auditing Mechanism.

To ensure the traceability of salt access activities, the system deploys an audit logging module at the salt access interface, recording each access request and generating corresponding audit events regardless of whether the authorization succeeds or fails. Each audit record includes at least the user identifier, role identifier, accessed attribute, request timestamp, access result, and operation type. The audit logs are stored separately from business data and salt ciphertexts, and modification permissions are restricted for regular users, thereby enabling the tracking of abnormal access and permission-denied behaviors.

In summary, the access flow for attribute salts is illustrated in the Figure 2: the user first initiates an attribute salt access request; the system performs identity authentication and retrieves the user’s current role; and it then conducts permission verification based on the role–attribute permission mapping table. If the verification fails, the request is rejected and an audit log is recorded. If the verification succeeds, the system locates the target salt ciphertext in the salt table, requests the corresponding key from the key management module to perform decryption, and finally provides the attribute salt to the subsequent index construction or query module, while logging the access event.

This mechanism not only achieves hierarchical protection of attribute private keys, but also supports dynamic permission adjustment and auditing of access activities, thereby enhancing overall security and controllability while preserving the availability of the encrypted database.

3.5. Extensibility of the Proposed Method to Multiple Data Types

The proposed scheme is primarily designed for relational structured data, but its core security mechanisms possess a certain degree of extensibility. For time-series, image, audio, and graph data, one can first extract corresponding structured features or metadata, then perform grouping based on the data characteristics, and leverage attribute-level key derivation and LWE-based ciphertext indexing to achieve privacy-preserving queries.

It should be noted that query requirements differ across data types; for example, range queries over time-series data and similarity queries over image features cannot be directly realized by the equality determination mechanism based on homomorphic subtraction (HomSub) used in this paper. Therefore, the VDF-based master salt generation, KDF-based attribute-level key isolation, and LWE-based randomized encryption mechanisms of this work can be reused, but the specific data grouping and query algorithms still need to be adapted according to the respective data types.

3.6. Complexity Analysis

To further evaluate the computational, storage, and communication overheads of the proposed encrypted database construction scheme, this section provides a formal complexity analysis of the main processing steps. Let the dataset contain n records and d attributes. After applying k-flat partitioning, we obtain g record groups. Let the VDF delay parameter be T, and the LWE vector dimension be m.

(1) Computational Complexity

For each attribute, the VDF requires T sequential modular squarings. Hence, generating salts for d attributes requires approximately $dT$ modular squarings, giving a computational complexity of $O\left(dT\right)$.

During the k-flat partitioning process, each level processes d attributes of n records, and the partitioning proceeds for about ${\log }_{2}k$ levels. The total workload is approximately $nd{\log }_{2}k$, yielding a complexity of $O\left(nd{\log }_{2}k\right)$.

After data grouping, a total of $gd$ LWE ciphertext index entries need to be constructed. If a single LWE encryption involves matrix operations of size $m\times m$, the index construction complexity is $O\left(gd{m}^2\right)$.

Therefore, the overall computational complexity of the main procedures can be expressed as $O(dT+nd{\log }_{2}k+gd{m}^2)$.

Among these, the VDF mainly affects the initialization phase, while the LWE operations dominate the index construction and query phases.

(2) Storage Complexity

Each attribute corresponds to an independent salt, so the storage overhead for salts is $O\left(d\right)$.

The ciphertext indexes are built per record group, containing $gd$ LWE index entries. If a single LWE index entry has storage size $O\left(m^2\right)$, then the storage complexity of the ciphertext indexes is $O(d+gd{m}^2)$.

(3) Communication Complexity

A single query requires sending an LWE query ciphertext to the server. If the size of one query ciphertext is proportional to $m^2$, the request communication overhead is $O\left(m^2\right)$.

Suppose a query hits r record groups, and the average ciphertext payload size of each group is s. Then the communication overhead for the server response is $O\left(rs\right)$.

Thus, the total communication complexity for one query is $O(m^2+rs)$.

In practice, $r\ll n$, so the data transfer volume of the query response does not grow linearly with the original number of records n.

4. Experiments and Discussion

To evaluate the effectiveness of the proposed scheme, we implemented a prototype system and conducted a series of experiments.

4.1. Experimental Environment and Data

The experiments were conducted on a Windows 11 (v[25H2]) operating system, and the implementation was carried out using the IntelliJ IDEA development environment (v2020.2). The machine used in the experiments is equipped with an Intel(R) Core(TM) i5-11320H processor (Intel Corporation, Santa Clara, CA, USA) at 3.20 GHz, which supports index construction and cryptographic operations. The back-end database system is implemented using the MySQL relational database (v8.0.36), which is responsible for storing the mapping between encrypted index identifiers and the paths of encrypted data. In the experiment, AES uses a 256-bit key, the hash function uses SHA-256, and the LWE parameters are set as follows: dimension n = 512, modulus q = 12,289, noise distribution = 3.2.

To evaluate the performance of our proposed scheme against different types of indexing approaches, we select four representative schemes as baselines: Plain Index, PRF-based deterministic token index (PRF Token), AES-based full table scan (AES Scan), and the recent dynamic searchable symmetric encryption scheme CoD-DSSE. Our scheme is denoted as Proposed LWE.

Plain Index builds traditional database indexes directly on raw attribute values, serving as a baseline to reflect the ideal query performance under non-encrypted conditions. PRF Token maps attribute values to deterministic search tokens using a pseudorandom function, simulating ciphertext indexing methods based on deterministic tokens. AES Scan first encrypts data with AES and then performs equality matching during query processing through decryption and full table scan over the ciphertext, reflecting the query cost when no dedicated ciphertext index is built. CoD-DSSE, as a recent searchable symmetric encryption scheme, is included to further compare the performance differences between our scheme and modern searchable encryption methods.

4.2. Experimental Results and Analysis

4.2.1. Index Construction and Storage Overhead Analysis

To evaluate the computational overhead of different schemes during the database initialization phase, this subsection tests the index construction time and storage overhead under varying data scales.

Figure 3 and Figure 4 presents the index construction time and storage overhead of each scheme under different data scales, with both vertical axes plotted on a logarithmic scale. As the data scale increases, the construction time and storage overhead of all schemes generally exhibit an upward trend. Plain Index and PRF Token incur relatively low construction and storage overhead, followed by AES Scan. CoD-DSSE, owing to its fixed-size drawer structure, maintains a largely stable storage overhead under the current dataset where the number of distinct keywords is limited; however, compared with our scheme, it employs record-level indexing, resulting in a different index granularity.

The proposed LWE scheme in this paper exhibits relatively higher construction time and storage overhead, with a more pronounced increase as the data scale expands. This is mainly attributed to the introduction of k-flat partitioning, VDF-based salt generation, and LWE ciphertext computations during index construction, among which the LWE ciphertext vectors and associated index information incur substantial computational and storage costs. Nevertheless, these overheads are primarily concentrated in the index initialization and update phases, and do not directly add to the computational burden of each individual query. At a scale of ${10}^5$ records, the proposed scheme is still able to complete index construction, indicating a certain capability for large-scale data processing. In addition, this extra overhead is traded for the ability to perform equality retrieval directly over randomized ciphertexts, while also supporting attribute-level access control.

4.2.2. Query Performance and Communication Overhead Analysis

To further evaluate the execution efficiency and data interaction overhead of the proposed ciphertext indexing scheme during actual query processing, this subsection conducts experimental analysis from two perspectives: query performance and communication overhead.

Figure 5 and Figure 6 presents the average query time and per-query communication overhead of each scheme under different data scales, with both vertical axes on a logarithmic scale. Overall, Plain Index, PRF Token, and CoD-DSSE exhibit relatively high query efficiency, with CoD-DSSE maintaining the lowest level across all scales; AES Scan shows an increasing query time as the data scale grows. In contrast, the proposed LWE scheme exhibits substantially higher query times, still on the order of several seconds at N = 50,000 and N = 100,000. This is mainly because the query process involves homomorphic subtraction of LWE ciphertexts, client-side decryption, and noise-threshold judgment, which introduce additional cryptographic computation overhead compared to direct index lookups and token matching.

In terms of communication overhead, the proposed LWE scheme incurs approximately 1.8–2.6 MB per query, significantly higher than PRF Token and CoD-DSSE, primarily due to the need to transmit the LWE ciphertext query vector and associated ciphertext information during the query. However, as the data scale increases from 1000 to 100,000 records, the communication overhead of our scheme remains at a similar level and does not show a linear growth with the number of records, indicating that the per-query communication cost is mainly determined by the ciphertext parameters and query information rather than by the database size. Therefore, although the proposed scheme incurs certain costs in query time and per-query communication, it enables equality retrieval directly over ciphertexts and mitigates the risk of plaintext index information leakage, reflecting a trade-off between query efficiency and security.

4.2.3. Query Correctness and Threshold Sensitivity Analysis

Since LWE ciphertexts contain random noise, equality determination requires setting a decision threshold $\tau$ within the noise range of the homomorphic subtraction result between ciphertexts. Therefore, it is necessary to analyze the impact of different threshold settings on query correctness, so as to verify the feasible decision interval under the theoretical noise constraints. The evaluation metrics are defined as follows: TPR denotes the true-positive rate, FPR denotes the false-positive rate, and FNR denotes the false-negative rate.

Figure 7 illustrates the variation of TPR, FPR, and FNR under different threshold values $\tau$. When $\tau$ is small, the LWE noise prevents true matches from passing the decision, resulting in a low TPR and a high FNR. As $\tau$ increases, the TPR gradually improves and the FNR decreases. When $\tau \ge 24$, the TPR stabilizes at approximately 0.98 and the FNR drops to 0, while the FPR remains at 0 throughout the entire experimental interval. This indicates that, under the current LWE parameters and plaintext encoding configuration, $\tau =24$ is already sufficient to cover the predominant noise range generated by homomorphic subtraction of equality ciphertexts, while maintaining good discriminative ability for non-equality cases.

This paper adopts a unified global threshold $\tau$, rather than setting separate thresholds for individual ciphertexts. The threshold experiments are conducted to verify the feasible decision interval corresponding to the theoretical noise constraints. Considering TPR, FPR, and FNR collectively, $\tau =24$ is selected as the default decision threshold for subsequent experiments under the current experimental parameter configuration. It should be noted that $\tau$ is dependent on the LWE parameters, the plaintext encoding interval, and the depth of homomorphic operations; when these parameters change, the threshold should be re-determined according to the new noise bound. Therefore, $\tau =24$ is applicable only to the experimental configuration used in this paper.

4.2.4. VDF Parameters and Salt Generation Overhead

To verify the practical feasibility of using VDFs as a tool for attribute salt generation, this subsection experimentally evaluates the salt generation time and verification time under different delay parameters T. The modulus is fixed at $N=1024$, and only the delay parameter T is varied.

Figure 8 and Figure 9 show the effect of different delay parameters T on VDF salt generation and verification times. As T increases from 32 to 1024, the salt generation time rises from approximately 0.3 ms to about 5.0 ms, mainly due to the increased number of sequential squaring operations. In contrast, the verification time remains at a relatively low level throughout, approximately 0.07–0.21 ms, without showing a clear linear growth trend. This indicates that the delayed computation of the VDF is primarily reflected in the salt generation phase, while the verification process can leverage the proof information for fast verification, embodying the characteristic of “delayed computation, fast verification.” Since salts are generated only during attribute initialization and index construction, and do not need to be recomputed for each query, the additional computational overhead incurred in the generation phase is acceptable in our application scenario.

Based on the experimental results of both salt generation time and verification time, we select $T=512$ as the default delay parameter for subsequent experiments. At this setting, the salt generation time is approximately 2.55 ms and the verification time is approximately 0.08 ms, achieving a reasonably balanced trade-off between computational delay and system overhead.

4.3. Security Analysis

In this paper, we conduct a formal analysis of the proposed encrypted database from four aspects: the security of VDF-based salt generation, index confidentiality, equality unlinkability, and the correctness of ciphertext equality determination. All security analyzes are performed under the following assumptions: the adversary is able to obtain all ciphertext indexes, ciphertext data files, and public system parameters stored on the storage server, but cannot obtain the master key held in the key management module; the storage server follows the protocol in executing index computations, yet attempts to infer plaintext information from the observed data.

4.3.1. Security Model and LWE Parameter Conventions

Let the security parameter be denoted as $\lambda$, the LWE dimension as n, the modulus as q, and the number of LWE samples as m, and let the error distribution follow a discrete Gaussian distribution or a corresponding bounded Gaussian distribution ${\chi }_{\sigma }$, where $\sigma$ is the noise parameter. Define the message encoding interval as $\Delta$. Then the index ciphertext takes the following form:

$$ct=(A,b)$$

(12)

where

$$A\leftarrow {\mathbb{Z}}_q^{m\times n},b=As+e+\Delta u\left(\mathrm{mod}q\right)$$

(13)

where $s\in {\mathbb{Z}}_q^n$ is the attribute private key, $e\leftarrow {\chi }_{\sigma }^m$ is the noise vector, and $u\in {\mathbb{Z}}_q^m$ is the message vector obtained by encoding the attribute coverage value through domain-separation encoding.

This paper does not preset a fixed single set of parameters as a security conclusion; instead, it requires that the parameters satisfy the following three constraints:

$$Se{c}_{\mathrm{LWE}}(n,m,q,{\chi }_{\sigma })\ge \lambda$$

(14)

$$2\tau <\Delta$$

(15)

$$\Delta {∥u-u^{\prime }∥}_{\infty }>\tau +B_e$$

(16)

where $Se{c}_{\mathrm{LWE}}$ denotes the computational security strength obtained from security evaluation for the chosen LWE parameters, $\tau$ is the equality decision threshold, and $B_e$ denotes the upper bound of the noise term after ciphertext subtraction.

4.3.2. Security of VDF-Based Salt Generation

Randomness: The salt is derived from a secure random seed r, which is evaluated through a sequential function via repeated iterations (see Equation (7)).

Since the input r is pseudorandom, and the VDF $f\left(x\right)=x^2\left(\mathrm{mod}N\right)$ does not introduce any predictable bias during iteration, the resulting output y preserves statistical randomness.

Resistance to parallel attacks: The core security of a VDF lies in its inherent sequentiality. Salt generation requires performing T consecutive squaring operations:

$$\left\{\begin{array}{c}{z}_0=r\hfill \\ z_{i+1}=z_i^2\left(\mathrm{mod}N\right)\hfill \end{array}\right.$$

(17)

Each step depends on the previous computation, making parallel acceleration infeasible. Even with powerful GPUs or large-scale distributed platforms, an adversary cannot significantly reduce the overall computation time, thereby ensuring delay-based security.

Verifiability: In addition to producing the delayed output y, the VDF also generates a succinct proof $\pi$. This allows any verifier to efficiently check the correctness of y with substantially lower computational cost than recomputing the entire sequential process, thereby ensuring high-confidence verification.

4.3.3. LWE Ciphertext Index Confidentiality

Define the index confidentiality game

$$Gam{e}_{\mathrm{IND}}$$

(18)

The adversary $\mathcal{A}$ is given the public parameters and any number of legitimate index ciphertexts, and may choose two equal-length message vectors

$$u_0,u_1$$

(19)

The challenger randomly selects

$$b\in \{0,1\}$$

(20)

and generates

$$c{t}^{*}\leftarrow En{c}_{sk}\left(u_b\right)$$

(21)

and returns $c{t}^{*}$ to the adversary. The adversary outputs a guess $b^{\prime }$ for b. If for any probabilistic polynomial-time adversary $\mathcal{A}$, it holds that

$$Ad{v}_{\mathrm{IND}}\left(\mathcal{A}\right)=\left|\mathrm{Pr}[b^{\prime }=b]-{\displaystyle \frac{1}{2}}\right|\le \mathrm{negl}\left(\lambda \right)$$

(22)

then the LWE index scheme is said to satisfy index confidentiality in the computational sense.

Theorem 1.

Under the decisional LWE assumption, for the randomized LWE index encryption scheme adopted in this paper, if each index encryption independently samples the random matrix A and the noise vector e, then any probabilistic polynomial-time adversary cannot distinguish the index ciphertexts corresponding to two different messages with non-negligible advantage.

Proof. 

The proof proceeds via a hybrid argument. Three games are defined:

$$G_0\to G_1\to G_2$$

(23)

where $G_0$ is the real index confidentiality game. In $G_0$, the challenge ciphertext is

$$c{t}^{*}=(A,As+e+\Delta u_b)$$

(24)

where

$$A\leftarrow {\mathbb{Z}}_q^{m\times n},s\in {\mathbb{Z}}_q^n,e\leftarrow {\chi }_{\sigma }^m.$$

(25)

Step 1:

$$G_0\to G_1$$

(26)

Replace the real LWE sample

$$(A,As+e)$$

(27)

with a uniformly random sample:

$$(A,r)$$

(28)

where

$$r\leftarrow {\mathbb{Z}}_q^m$$

(29)

Thus, the challenge ciphertext in $G_1$ becomes

$$c{t}^{*}=(A,r+\Delta u_b)$$

(30)

If an adversary can effectively distinguish $G_0$ from $G_1$, then that adversary can be used to construct an algorithm $\mathcal{B}$ that distinguishes the real LWE distribution $(A,As+e)$ from the uniform random distribution $(A,r)$, yielding

$$\left|\mathrm{Pr}[G_0=1]-\mathrm{Pr}[G_1=1]\right|\le Ad{v}_{\mathrm{LWE}}\left(\mathcal{B}\right)$$

(31)

According to Regev’s hardness result for LWE [30], when the security parameters are satisfied,

$$Ad{v}_{\mathrm{LWE}}\left(\mathcal{B}\right)\le \mathrm{negl}\left(\lambda \right)$$

(32)

Step 2:

$$G_1\to G_2$$

(33)

In $G_1$:

$$c{t}^{*}=(A,r+\Delta u_b)$$

(34)

where r is a uniformly random vector.

If the message encoding adopts a valid encoding in the modulo-q space and satisfies the corresponding message spacing and modulus constraints, then the randomness observed by the adversary in the ciphertext is mainly provided by A and r.

Furthermore, since the message vector satisfies

$$u_b=Expand\left(H(attr\parallel v_b)\right)$$

(35)

under the random oracle model, if an adversary attempts to recover the full input from the hash output, its preimage attack advantage [31] satisfies

$$Ad{v}_{\mathrm{preimage}}\left(\mathcal{C}\right)\le 2^{-256}$$

(36)

In a more general security parameter notation, this can be written as

$$Ad{v}_{\mathrm{preimage}}\left(\mathcal{C}\right)\le \mathrm{negl}\left(\lambda \right)$$

(37)

Therefore,

$$\left|\mathrm{Pr}[G_0=1]-\mathrm{Pr}[G_1=1]\right|\le Ad{v}_{\mathrm{preimage}}\left(\mathcal{C}\right)$$

(38)

Combining the above two steps, by the triangle inequality for hybrid games, we have

$$Ad{v}_{\mathrm{IND}}\left(\mathcal{A}\right)\le Ad{v}_{\mathrm{LWE}}\left(\mathcal{B}\right)+Ad{v}_{\mathrm{preimage}}\left(\mathcal{C}\right)+\mathrm{negl}\left(\lambda \right)$$

(39)

When the LWE parameters meet the target security strength, and SHA-256 satisfies preimage resistance under the random oracle model, we have

$$Ad{v}_{\mathrm{LWE}}\left(\mathcal{B}\right)\le \mathrm{negl}\left(\lambda \right)$$

(40)

$$Ad{v}_{\mathrm{preimage}}\left(\mathcal{C}\right)\le \mathrm{negl}\left(\lambda \right)$$

(41)

Thus:

$$Ad{v}_{\mathrm{IND}}\left(\mathcal{A}\right)\le \mathrm{negl}\left(\lambda \right)$$

(42)

This proves that the LWE ciphertext index constructed in this paper satisfies index confidentiality in the computational sense. □

4.3.4. Equality Unlinkability

Proving IND–CPA security alone does not directly imply that there is no equality relationship between ciphertexts. Therefore, we further define equality unlinkability.

Definition of Game

$$Gam{e}_{\mathrm{Link}}$$

(43)

The adversary is given two indexes $c{t}_0,c{t}_1$, with the following two challenge cases:

When $b=0$, the two ciphertexts correspond to the same attribute coverage value;

When $b=1$, the two ciphertexts correspond to different attribute coverage values.

The adversary may observe the two ciphertexts and the public parameters, but cannot obtain the attribute private key. The adversary outputs a guess $b^{\prime }$.

The adversary’s equality-linkage advantage is defined as

$$Ad{v}_{\mathrm{Link}}\left(\mathcal{A}\right)=\left|\mathrm{Pr}[b^{\prime }=b]-{\displaystyle \frac{1}{2}}\right|$$

(44)

If for any probabilistic polynomial-time adversary $\mathcal{A}$, it holds that

$$Ad{v}_{\mathrm{Link}}\left(\mathcal{A}\right)\le \mathrm{negl}\left(\lambda \right)$$

(45)

then the scheme is said to satisfy equality unlinkability.

Theorem 2.

Under the decisional LWE assumption, provided that A and e are freshly resampled for each index generation, and the attribute salts are inaccessible to the adversary, the LWE ciphertext index in this paper is computationally equality-unlinkable.

Proof. 

For two identical plaintext encodings u, their corresponding ciphertexts are, respectively,

$$c{t}_1=(A_1,A_{1}s+e_1+\Delta u)$$

(46)

$$c{t}_2=(A_2,A_{2}s+e_2+\Delta u)$$

(47)

where

$$A_1,A_2,e_1,e_2$$

(48)

are all independently and randomly generated. Therefore, even if u is exactly the same, the two ciphertexts still exhibit independent randomness.

If the adversary attempts to determine whether the two ciphertexts correspond to the same attribute value by directly comparing them, it would need to eliminate the influence of the independent random matrices and noise from

$$(A_1,A_{1}s+e_1+\Delta u)$$

(49)

and

$$(A_2,A_{2}s+e_2+\Delta u)$$

(50)

so as to obtain information about u. This process can be reduced to the problem of distinguishing LWE samples.

Thus, we have

$$Ad{v}_{\mathrm{Link}}\left(\mathcal{A}\right)\le Ad{v}_{\mathrm{LWE}}\left(\mathcal{B}\right)+Ad{v}_{\mathrm{Hash}}\left(\mathcal{C}\right)+\mathrm{negl}\left(\lambda \right)$$

(51)

where $Ad{v}_{\mathrm{Hash}}\left(\mathcal{C}\right)$ denotes the adversary’s distinguishing advantage obtained through hash collisions or encoding collisions. When SHA-256 collision resistance and the LWE assumption hold, the adversary’s equality-linkage advantage is negligible.

Consequently, the server cannot determine whether two record groups have the same attribute coverage value merely by comparing the indexes. □

4.3.5. Correctness of Ciphertext Equality Determination

Let the query ciphertext be

$$c{t}_q=(A_q,A_{q}s+e_q+\Delta u_q)$$

(52)

For the index ciphertext,

$$c{t}_i=(A_i,A_{i}s+e_i+\Delta u_i)$$

(53)

The server performs homomorphic subtraction

$$c{t}_d=c{t}_i-c{t}_q$$

(54)

obtaining

$$c{t}_d=\left(A_i-A_q,(A_i-A_q)s+(e_i-e_q)+\Delta (u_i-u_q)\right)$$

(55)

The client decrypts using the attribute private key s and obtains

$$z_i=\Delta (u_i-u_q)+(e_i-e_q)$$

(56)

When the query value equals the index value, we have

$$u_i=u_q$$

(57)

Therefore,

$$z_i=e_i-e_q$$

(58)

If we define the noise difference such that

$${\parallel e_i-e_q\parallel }_{\infty }\le B_e$$

(59)

and choose

$$\tau \ge B_e$$

(60)

then it must hold that

$${\parallel z_i\parallel }_{\infty }\le \tau$$

(61)

and thus it is correctly determined as equal.

When

$$u_i\ne u_q$$

(62)

if the following holds,

$$\Delta {\parallel u_i-u_q\parallel }_{\infty }>B_e+\tau$$

(63)

then

$${\parallel z_i\parallel }_{\infty }>\tau$$

(64)

and thus, it is determined as not equal.

Therefore, the threshold should satisfy

$$B_e\le \tau <\Delta d_{min}-B_e$$

(65)

where

$$d_{min}=\underset{u_i\ne u_q}{min}{\parallel u_i-u_q\parallel }_{\infty }$$

(66)

This inequality provides the theoretical basis for threshold selection: a threshold that is too small may cause noise to be mistakenly judged as inequality, while a threshold that is too large increases the probability that different messages are mistakenly judged as equal.

5. Conclusions

This study proposed an improved ciphertext index construction scheme that combines k-flat partitioning, VDF-based salt generation, LWE-based randomized encryption, and role-based access control. By constructing ciphertext indexes at the record-group level and employing attribute-specific keys, the scheme reduces the granularity of index construction and improves attribute-level key isolation. The experimental results demonstrate that the proposed scheme supports ciphertext equality queries without directly exposing plaintext index values, while maintaining acceptable computational and storage overhead.

Despite these advantages, the scheme still has limitations. LWE-based ciphertext operations introduce additional computational costs, and the analysis of access-pattern and query-pattern leakage remains limited. Future work will focus on improving query efficiency, developing a more rigorous security model, and extending the scheme to support range and similarity queries over unstructured and time-series data.