Privacy Preserving Range Queries with Provable Security and Sublinear Scalability