Search

In today's globalized agricultural system, information leakage of agricultural biological risk factors can lead to business risks and public panic, jeopardizing corporate reputation. To solve the above problems, this study constructs a blockchain network for agricultural product biological risk traceability based on agricultural product biological risk factor data to achieve traceability of biological risk traceability data of agricultural product supply chain to meet the sustainability challenges. To guarantee the secure and flexible sharing of agricultural product biological risk privacy information and limit the scope of privacy information dissemination, the blockchain-based proxy re-encryption access control method (BBPR-AC) is designed. Aiming at the problems of proxy re-encryption technology, such as the third-party agent being prone to evil, the authorization judgment being cumbersome, and the authorization process not automated, we design the proxy re-encryption access control mechanism based on the traceability of agricultural products' biological risk factors. Designing an attribute-based access control (ABAC) mechanism based on the traceability blockchain for agricultural products involves defining the attributes of each link in the agricultural supply chain, formulating policies, and evaluating and executing these policies, deployed in the blockchain system in the form of smart contracts. This approach achieves decentralization of authorization and automation of authority judgment. By analyzing the data characteristics within the agricultural product supply chain to avoid the malicious behavior of third-party agents, the decentralized blockchain system acts as a trusted third-party agent, and the proxy re-encryption is combined with symmetric encryption to improve the encryption efficiency. This ensures a efficient encryption process, making the system safe, transparent, and efficient. Finally, a prototype blockchain system for traceability of agricultural biological risk factors is built based on Hyperledger Fabric to verify this research method's reliability, security, and efficiency. The experimental results show that this research scheme's initial encryption, re-encryption, and decryption sessions exhibit lower computational overheads than traditional encryption methods. When the number of policies and the number of requests in the access control session is 100, the policy query latency is less than 400 ms, the request-response latency is slightly more than 360ms, and the data uploading throughput is 48.7 tx/s. The data query throughput is 81.8 tx/s, the system performance consumption is low and can meet the biological risk privacy protection needs of the agricultural supply chain. The BBPR-AC method proposed in this study provides ideas for achieving refined traceability management in the agricultural supply chain and promoting digital transformation in the agricultural industry. [ABSTRACT FROM AUTHOR]

Abstract In today’s globalized agricultural system, information leakage of agricultural biological risk factors can lead to business risks and public panic, jeopardizing corporate reputation. To solve the above problems, this study constructs a blockchain network for agricultural product biological risk traceability based on agricultural product biological risk factor data to achieve traceability of biological risk traceability data of agricultural product supply chain to meet the sustainability challenges. To guarantee the secure and flexible sharing of agricultural product biological risk privacy information and limit the scope of privacy information dissemination, the blockchain-based proxy re-encryption access control method (BBPR-AC) is designed. Aiming at the problems of proxy re-encryption technology, such as the third-party agent being prone to evil, the authorization judgment being cumbersome, and the authorization process not automated, we design the proxy re-encryption access control mechanism based on the traceability of agricultural products’ biological risk factors. Designing an attribute-based access control (ABAC) mechanism based on the traceability blockchain for agricultural products involves defining the attributes of each link in the agricultural supply chain, formulating policies, and evaluating and executing these policies, deployed in the blockchain system in the form of smart contracts. This approach achieves decentralization of authorization and automation of authority judgment. By analyzing the data characteristics within the agricultural product supply chain to avoid the malicious behavior of third-party agents, the decentralized blockchain system acts as a trusted third-party agent, and the proxy re-encryption is combined with symmetric encryption to improve the encryption efficiency. This ensures a efficient encryption process, making the system safe, transparent, and efficient. Finally, a prototype blockchain system for traceability of agricultural biological risk factors is built based on Hyperledger Fabric to verify this research method’s reliability, security, and efficiency. The experimental results show that this research scheme’s initial encryption, re-encryption, and decryption sessions exhibit lower computational overheads than traditional encryption methods. When the number of policies and the number of requests in the access control session is 100, the policy query latency is less than 400 ms, the request-response latency is slightly more than 360ms, and the data uploading throughput is 48.7 tx/s. The data query throughput is 81.8 tx/s, the system performance consumption is low and can meet the biological risk privacy protection needs of the agricultural supply chain. The BBPR-AC method proposed in this study provides ideas for achieving refined traceability management in the agricultural supply chain and promoting digital transformation in the agricultural industry.

The exponential growth of the Internet of Things (IoT) technologies requires high data security. Here, data security is very critical as all IoT devices transfer data over the Internet. The fine-grained access control provided by the ciphertext policy attribute-based encryption (CP-ABE) technique can be considered as a potential solution to this issue. However, most of the CP-ABE schemes use bilinear pairing operations for its internal working, which is expensive for any resource constraint device. An elliptic curve cryptography (ECC) based CP-ABE scheme can be well suited for resource constraint IoT framework because ECC takes less computational time. This article proposes a novel CP-ABE technique based on ECC to achieve fine-grained access control over data or resources. The proposed technique includes multiple attribute authorities to manage attributes and key generation, which can reduce the work overhead of having a single authority in traditional CP-ABE systems. In addition, the proposed scheme outsources the decryption process to a user assistant entity to reduce the decryption overhead of the end-users. To prove the efficiency of the proposed scheme, both formal security analysis and performance comparisons are presented in this article. The result and findings prove the effectiveness of the proposed scheme over some well-known schemes. [ABSTRACT FROM AUTHOR]

As a result of the declaration of the COVID-19 pandemic, several proposals of blockchain-based solutions for digital COVID-19 certificates have been presented. Considering that health data have high privacy requirements, a health data management system must fulfil several strict privacy and security requirements. On the one hand, confidentiality of the medical data must be assured, being the data owner (the patient) the actor that maintain control over the privacy of their certificates. On the other hand, the entities involved in the generation and validation of certificates must be supervised by a regulatory authority. This set of requirements are generally not achieved together in previous proposals. Moreover, it is required that a digital COVID-19 certificate management protocol provides an easy verification process and also strongly avoid the risk of forgery. In this paper we present the design and implementation of a protocol to manage digital COVID-19 certificates where individual users decide how to share their private data in a hierarchical system. In order to achieve this, we put together two different technologies: the use of a proxy re-encryption (PRE) service in conjunction with a blockchain-based protocol. Additionally, our protocol introduces an authority to control and regulate the centers that can generate digital COVID-19 certificates and offers two kinds of validation of certificates for registered and non-registered verification entities. Therefore, the paper achieves all the requirements, that is, data sovereignty, high privacy, forgery avoidance, regulation of entities, security and easy verification. [ABSTRACT FROM AUTHOR]

The robot system is a significant application that has attracted great attention, and deep learning is a powerful feature extraction technology that has achieved significant breakthroughs in many fields, especially in robot systems. However, the required massive dataset for a deep learning model in a robot system easily leads to privacy leakage. There have been few reports on privacy-preserving deep learning models, and none on multikeys, in robot systems. Existing privacy-preserving deep learning schemes in multiple keys have low efficiency and high interactions in non-robotic environments. To address these issues, this article proposes a privacy-preserving deep learning model with homomorphic re-encryption (PDLHR) and secure calculation tools in a robot system. The proposed re-encryption scheme is based on the Bresson-Catalano-Pointcheval (BCP) cryptosystem, which solves the multiple keys question, keeps the homomorphic nature, and is more simplified than the existing re-encryption scheme based on the BCP cryptosystem. The secure calculation tools are designed to realize efficient ciphertext computations. Compared to the previous work, PDLHR decreases the interactions in the decryption process, improves the ciphertext training efficiency, and preserves the privacy of input data, training model, and inference results. Security analysis and performance evaluations demonstrate that the proposed scheme realizes security, efficiency, and effectiveness with low communication and computation costs. [ABSTRACT FROM AUTHOR]

Since image processing algorithms can work with a vast volume of data easily, optical cryptographic techniques are commonly used in image security. Since the proposed DRPE, image encryption in particular has gotten a lot of coverage. DRPE employs various approaches for example-4f and Fourier Transform (FT) to encrypt local as well as spectral data; image encryption is done on the basis of input along with the Fourier planes using random phase coding. The complete process of encryption transforms the input image to a white sound in this manner. Confidentiality is obtained by the method of translation. Only when the information of location and the secret key are perfectly matched would the secret picture be revealed. Random category masks may be thought of as hidden keys in general, and since the key space is too big, blind deconvolution alone is insufficient to reconstruct the original picture. The standard DRPE methodology was discussed in this paper, as well as its numerical emulation, sampling considerations in the spatial as well as frequency domains, and the benefits and drawbacks of different transforms. Additionally, certain optical coding and scrambling methods are investigated. The paper ends with a discussion of recent advances in the area of optical image encryption, as well as a look forward to the future challenges. [ABSTRACT FROM AUTHOR]

Encryption, which is essential for the protection of sensitive information can also transform any malicious content to illegible form, which can then reside in any network, undetected. Encryption of malicious payload is used by malware authors to mask their code, however, the objective of hiding the malicious code can be further improved by techniques of re-randomization. The concept of re-randomization using asymmetric cryptography has been emerged as a new area of interest for malware designers. Re-randomizing is a technique which can prevent detection of source path of a malware and makes it indistinguishable. This article extends the idea of using asymmetric cryptography for re-randomization and has proposed a novel scheme using Pailliar’s asymmetric cryptosystem. Moreover, this research work illustrates the limitations of RSA for malware re-randomization. A comprehensive performance analysis of the re-randomization techniques for various malware payloads is also presented, which can be used for the detection of re-randomized malware effectively.

Machine Learning as a Service (MLaaS) has been widely used, such as logistic regression models trained in the cloud to provide people with classification predictions. However, these services allow the cloud to collect data from a large number of users, which could raise privacy concerns. With sharing of local models rather than user data, Federated Learning (FL) alleviates data privacy. But, in FL setting the difference between the predictive value provided by the optimal model and the shared global model (called maturing model) that approximates it is not significant, which still raises a security risk. In this paper, we design a flexible and privacy-preserving FL system to tackle these issues. This system makes the training process divide into two stages by analyzing whether the metrics of the iterative global gradient reach a set threshold or not. The two stages are implemented with Re-Encryption and CKKS homomorphism, which not only enables a secure aggregation in the cloud, but also maintains the security of the maturing model. Through detailed analysis, we prove the security of our protocol. Moreover, quantitative comparisons in the final experiments demonstrates that our scheme can achieve trade-off between accuracy, training time cost and communication overhead. [ABSTRACT FROM AUTHOR]

Data deduplication technique has been widely adopted by commercial cloud storage providers, which is both important and necessary in coping with the explosive growth of data. To further protect the security of users’ sensitive data in the outsourced storage mode, many secure data deduplication schemes have been designed and applied in various scenarios. Among these schemes, secure and efficient re-encryption for encrypted data deduplication attracted the attention of many scholars, and many solutions have been designed to support dynamic ownership management. In this paper, we focus on the re-encryption deduplication storage system and show that the recently designed lightweight rekeying-aware encrypted deduplication scheme (REED) is vulnerable to an attack which we call it stub-reserved attack. Furthermore, we propose a secure data deduplication scheme with efficient re-encryption based on the convergent all-or-nothing transform (CAONT) and randomly sampled bits from the Bloom filter. Due to the intrinsic property of one-way hash function, our scheme can resist the stub-reserved attack and guarantee the data privacy of data owners’ sensitive data. Moreover, instead of re-encrypting the entire package, data owners are only required to re-encrypt a small part of it through the CAONT, thereby effectively reducing the computation overhead of the system. Finally, security analysis and experimental results show that our scheme is secure and efficient in re-encryption. [ABSTRACT FROM AUTHOR]

Spectrum auction is one of the most effective ways to achieve dynamic spectrum allocation in cognitive radio networks, and it provides one effective way to manage the spectrum demands of IoT devices with limited resources. Most spectrum auctions focus on protecting bidder privacy and achieving excellent social efficiency, but few tackles the verification of auction results that are controlled by the auctioneer. In this paper, we propose a cloud-based framework for verifiable privacy-preserving spectrum auctions. Our framework adopts a modified AFGH re-encryption algorithm that achieves both bid privacy protection and auction results verification at the same time. The cloud server helps to compute auction results based on homomorphic encryption, and an auctioneer decrypts the encrypted data from the server to obtain auction results. Meanwhile, the property of re-encryption makes it possible for any bidder to verify the auction results without compromising other bidders’ privacy.

With the development of information and communication technologies, especially wireless networks and cell phones, the e-voting system becomes popular as its cost-effectiveness, swiftness, scalability, and ecological sustainability. However, the current e-voting schemes are faced with the problem of privacy leakage and further cause worse vote-buying and voter-coercion problems. Moreover, in large-scale voting, some previous e-voting system encryption scheme with pairing operation also brings huge overhead pressure to the voting system. Thus, it is a vital problem to design a protocol that can protect voter privacy and simultaneously has high efficiency to guarantee the effective implementation of e-voting. To address these problems, our paper proposes an efficient unidirectional proxy re-encryption scheme that provides the re-encryption of vote content and the verification of users' identity. This function can be exactly applied in the e-voting system to protect the content of vote and preserve the privacy of the voter. Our proposal is proven to be CCA secure and collusion resistant. The detailed analysis also shows that our scheme achieves higher efficiency in computation cost and ciphertext size than the schemes in related fields. [ABSTRACT FROM AUTHOR]

Cloud storage technology has attracted a considerable number of users owing to its exponential growth. Storing data in the cloud can save the resources of local storage configuration and reduce the cost of local hardware investment. However, the data stored in the cloud is out of the physical control (out of control) of the user. Based on the service characteristics of the cloud environment and the security requirements of user privacy data in the cloud environment, this paper proposes an improved identity proxy re-encryption algorithm based on the advanced encryption standard algorithm. The performance of the algorithm is optimized by reducing the number of bilinear mapping operations, whose calculation takes the longest time in the proxy re-encryption scheme. Only two bilinear mapping operations are required in this scheme. In addition, the encrypted data are tested to different degrees. The experimental results show that this scheme satisfies encryption and decryption performance requirements of the user. [ABSTRACT FROM AUTHOR]

Congestion Control is a critical issue of Named Data Networking (NDN). Facing limited link resources, howto guarantee the QoS of the authorized user is puzzling NDN researchers. By introducing the idea of Access Class Barring, this paper designs a congestion control mechanism based on identity authentication (IACCM). In IACCM, a signature is added to the interest packet for router to distinguish the identity of requester. When network suffers congestion, the router will restrict the unauthorized user to access the congestion link, and protect the authorized user against congestion. To avoid managing too many users’ public keys in the router when the scale of requesters is massive, IACCM generates the signature using the re-encryption technology. Under this design, the router only needs save one public key of the network service provider. The simulation results show that IACCM can effectively defend congestion for the authorized users and it has good dynamic adaptability, but this improvement is based on the performance sacrifice of the unauthorized users. [ABSTRACT FROM AUTHOR]

Storing only one unique copy of the same cloud data and guaranteeing its integrity are two main goals for cloud storage auditing and deduplication schemes. In such schemes, data owners can firmly believe the data integrity by periodically auditing and the cloud server can save lots of storage space by exploiting the duplication techniques. However, when a data owner deletes or modifies his outsourced data, he should lose the ownership for the original data and should not be able to successfully retrieve this data any more. For all we know, existing cloud storage auditing and deduplication literatures fail to support the modifications of ownership, which actually occur quite often in actual cloud storage scenarios. In this paper, we propose the first deduplicated data integrity auditing scheme supporting the ownership modification. It guarantees the integrity of the outsourced data and supports the dynamic access control over the outsourced data. We employ a re-encryption algorithm and the secure identity-based broadcast encryption technology, which prevent data from being disclosed to the revoked owners, even if they previously had prior ownership of these data. The security and efficiency of our proposed scheme have been validated by detailed analysis and experiments. [ABSTRACT FROM AUTHOR]

Internet-based online cloud services provide enormous volumes of storage space, tailor-made computing resources and eradicate the obligation of native machines for data maintenance as well. Cloud storage service providers claim to offer the ability of secure and elastic data-storage services that can adapt to various storage necessities. Most of the security tools have a finite rate of failure, and intrusion comes with more complex and sophisticated techniques; the security failure rates are skyrocketing. Once we upload our data into the cloud, we lose control of our data, which certainly carries new security hazards toward integrity and privacy of our information. In this paper, we discuss a secure file sharing mechanism for the cloud with proxy re-encryption (PRE). PRE-scheme is implemented with the Disintegration Protocol to secure storage data in storage and in the flight. The paper introduces a new contribution of a seamless file sharing technique among different clouds without sharing an encryption key. [ABSTRACT FROM AUTHOR]

Cloud data sharing allows users to access data stored on the web object. Security and protecting cloud data sharing form different attacks is recently considered one of the most challenges. In this paper, we are proposing a framework for cloud data sharing protection against unauthorized access. The proposed framework is based on DNA-proxy re-encryption. Firstly, three keys are generated for the owner, proxy and the user who need to access the data. Then, the owner stores his data encrypted on the cloud using his key. If the user wants to access this data then he can access it via the proxy after re-encrypting using the second generated key for the proxy. Finally, the user can decrypt the re-encrypted data with the third generated key. The framework was implemented using various plaintext files and real DNA sequences. The experimental results show that the framework has an outstanding performance in terms of execution time. [ABSTRACT FROM AUTHOR]

Recently, cloud computing becomes a main platform for the distribution of multimedia content. The paradigm of multimedia distribution has been shifted from the models in traditional ways to the one in cloud computing. Security and privacy are two most important issues in multimedia distribution. The new model in cloud computing concerns the following issues. Firstly, outsourced content should be confidential except a data owner (DO). Secondly, the CSP is semi-trusted in the public cloud computing environment. A malicious data user (DU) may collude with the CSP to harm the DO's rights and interests. Thirdly, the rights and interests of DU, including anonymity and unlinkability, should be protected. Based on the above problems, we propose and analyze a Multimedia Distribution based Re-encryption and Fingerprinting (MDRF) scheme in cloud computing. The proposed scheme 1) allows efficient distribution of the content while preserving security and privacy of copyright holders and end users, 2) resolve the problems of piracy tracing, collusion resistance, and dispute resolution, and 3) protect the rights and interests of DU, including anonymity and unlinkability. The analysis part demonstrates that the security of DO and DU are well provided in the proposed scheme. The experimental results evaluate the performance of our framework in terms of collusion resistance of the fingerprint and imperceptibility of fingerprint embedding. [ABSTRACT FROM AUTHOR]

Sensors are the modules or electronic devices that are used to measure and get environmental events and send the captured data to other devices, usually computer processors allocated on the cloud. One of the most recent challenges is to protect and save the privacy issues of those sensors data on the cloud sharing. In this paper, sensors data collection framework is proposed using mobile identification and proxy re-encryption model for data sharing. The proposed framework includes: identity broker server, sensors managing and monitoring applications, messages queuing sever and data repository server. Finally, the experimental results show that the proposed proxy re-encryption model can work in real time. [ABSTRACT FROM AUTHOR]

An outsourcing re-encryption program can help a ciphertext owner (delegator) transform his/her ciphertext into another ciphertext of delegatee. For example, an e-mail receiver can re-transfer an encrypted e-mail to his secretary while allowing the e-mail to be readable for her. For a multi-hop re-encryption, the delegatee can re-encrypt the ciphertext to another user in delegation chain, repeatedly. Traditionally, this transformation is usually conducted by a proxy or an outsourcing server. However, the proxy or outsourcing server needs a re-encryption key (i.e., re-key) and the re-encryption program must execute in a black-box manner (cannot trace into or debug and monitor the program), and thus the outsource server must be semi-trusted. Actually, as the outsource program was run and fully controlled by the server, in this paper, we consider a stronger attack in the case that the re-encryption program was run on an untrusted/malicious server and even the server can trace into the codes and monitor the variables during the executing. We design a secure multi-hop re-encryption scheme, and then convert the re-encryption program into an obfuscated version with constant-hiding to ensure no sensitive information be revealed. The obfuscator of multi-hop re-encryption is to faithfully hide the program and its sensitive data that takes a re-encryption program/circuit as input and outputs another program with the same functionality, while revealing no more sensitive information (i.e., sensitive key and plaintext) than learns from the blackbox oracle access to the original program. We also present a flexible and controllable construction of re-encryption scheme, functionality model and its obfuscation version in leveled multilinear groups, and exemplify some scenarios to deploy in various applications. Finally, we provide the performance analysis of the obfuscator, such as functionality preservation of consistency, polynomial slowdown of performance, and average-case virtual black-box of security, and show that the obfuscator is efficient and practical in use.

By only storing a unique copy of duplicate data possessed by different data owners, deduplication can significantly reduce storage cost, and hence is used broadly in public clouds. When combining with confidentiality, deduplication will become problematic as encryption performed by different data owners may differentiate identical data which may then become not deduplicable. The Message-Locked Encryption (MLE) is thus utilized to derive the same encryption key for the identical data, by which the encrypted data are still deduplicable after being encrypted by different data owners. As keys may be leaked over time, re-encrypting outsourced data is of paramount importance to ensure continuous confidentiality, which, however, has not been well addressed in the literature. In this paper, we design SEDER, a SEcure client-side Deduplication system enabling Efficient Re-encryption for cloud storage by (1) leveraging all-or-nothing transform (AONT), (2) designing a new delegated re-encryption (DRE), and (3) proposing a new proof of ownership scheme for encrypted cloud data (PoWC). Security analysis and experimental evaluation validate security and efficiency of SEDER, respectively.

Advanced cloud computing technology provides cost saving and flexibility of services for users. With the explosion of multimedia data, more and more data owners would outsource their personal multimedia data on the cloud. In the meantime, some computationally expensive tasks are also undertaken by cloud servers. However, the outsourced multimedia data and its applications may reveal the data owner's private information because the data owners lose the control of their data. Recently, this thought has aroused new research interest on privacy-preserving reversible data hiding over outsourced multimedia data. In this paper, two reversible data hiding schemes are proposed for encrypted image data in cloud computing: reversible data hiding by homomorphic encryption and reversible data hiding in encrypted domain. The former is that additional bits are extracted after decryption and the latter is that extracted before decryption. Meanwhile, a combined scheme is also designed. This paper proposes the privacy-preserving outsourcing scheme of reversible data hiding over encrypted image data in cloud computing, which not only ensures multimedia data security without relying on the trustworthiness of cloud servers, but also guarantees that reversible data hiding can be operated over encrypted images at the different stages. Theoretical analysis confirms the correctness of the proposed encryption model and justifies the security of the proposed scheme. The computation cost of the proposed scheme is acceptable and adjusts to different security levels. [ABSTRACT FROM AUTHOR]

Due to users’ network flow requirement and usage amount nowadays, TCP/IP networks may face various problems. For one, users of video services may access simultaneously the same content, which leads to the host incurring extra costs. Second, although nearby nodes may have the file that a user wants to access, the user cannot directly verify the file itself. This issue will lead the user to connect to a remote host rather than the nearby nodes and causes the network traffic to greatly increase. Therefore, the named data network (NDN), which is based on data itself, was brought about to deal with the aforementioned problems. In NDN, all users can access a file from the nearby nodes, and they can directly verify the file themselves rather than the specific host who holds the file. However, NDN still has no complete standard and secure file transfer protocol to support the ciphertext transmission and the problem of the unknown potential receivers. The straightforward solution is that a sender uses the receiver's public key to encrypt a file before she/he sends the file to NDN nodes. However, it will limit the behavior of users and incur significant storage costs of NDN nodes. This paper presents a complete secure file transfer protocol, which combines the data re-encryption, satisfies the requirement of secure ciphertext transmission, solves the problem of the unknown potential receivers, and saves the significant storage costs of NDN nodes. The proposed protocol is the first one that achieves data confidentiality and solves the problem of the unknown potential receivers in NDN. Finally, we also provide formal security models and proofs for the proposed FTP-NDN. [ABSTRACT FROM PUBLISHER]

Cryptographic proxy re-encryption is a very useful primitive which is capable of transforming a ciphertext under one public key PK1 into a new ciphertext under another public key PK2 without private information leakage, while the two ciphertexts are encryptions of the same message. Re-encryption schemes at first are constructed under the public-key encryption (PKE) scenario. While it is a powerful primitive naturally required in not only PKE but also other scenarios, various extensions from PKE to other advanced encryption schemes like identity-based encryption (IBE), attribute-based encryption (ABE) as well as functional encryption (FE) are needed as well. In this work we have concentrated on how to reduce the workloads in the user/client side at large. To this end, we have put forth a novel identity-based proxy re-encryption (IBPRE) scheme with the feature that the re-encryption key gen­eration for the users is highly lightweight - actually almost free. Although this will lead to possibly extra decryption workload due to the utilization of homomorphic encryption, it is the first scheme realizing such almost free RK generation. In addition, it can also avoid some other shortcomings like re-encryption key management. [ABSTRACT FROM AUTHOR]

A smart watch is a kind of emerging wearable device in the Internet of Things. The security and privacy problems are the main obstacles that hinder the wide deployment of smart watches. Existing security mechanisms do not achieve a balance between the privacy-preserving and data access control. In this paper, we propose a fine-grained privacy-preserving access control architecture for smart watches (FPAS). In FPAS, we leverage the identity-based authentication scheme to protect the devices from malicious connection and policy-based access control for data privacy preservation. The core policy of FPAS is two-fold: (1) utilizing a homomorphic and re-encrypted scheme to ensure that the ciphertext information can be correctly calculated; (2) dividing the data requester by different attributes to avoid unauthorized access. We present a concrete scheme based on the above prototype and analyze the security of the FPAS. The performance and evaluation demonstrate that the FPAS scheme is efficient, practical, and extensible.

Outsource computing might reveal some private information in open cloud systems and the concern of users' privacy will be a crucial issue. Program obfuscation is an important cryptographic primitive that perfectly hides the secrets inside a program while preserving its functionality. In this paper, we give a two-form re-encryption scheme that achieves the security against adaptively chosen-ciphertext attacks, which allows any third party (e.g., cloud server) to re-encrypt the ciphertext that delegates the decryption right from one to another. However, as the third party knows the sensitive secret (i.e., re-key), and thus we should guarantee the trustworthy of this cloud server. Based the re-encryption algorithm, we propose an efficient obfuscator that implements the re-encryption functionality in such a way that not only the private information is protected but also cloud users' privacy is preserved, and thus the re-encryption procedure can be run on untrusted outsourcing server. We prove the virtual black-box security of the obfuscation. The proposed obfuscator can be run on untrusted server to help the perform of the functionality of re-encryption without any sensitive secret revealing. [ABSTRACT FROM AUTHOR]

To protect the sensitive data outsourced to cloud server, outsourcing data in an encrypted way has become popular nowadays. However, it is not easy to find the corresponding ciphertext efficiently, especially the large ciphertext stored on cloud server. Besides, some data owners do not want those users who attempt to decrypt to know the sensitive access structure of the ciphertext because of some business or private reasons. In addition, the user attributes revocation and key updating are important issues, which affect application of ciphertext-policy attribute-based encryption (CP-ABE) in cloud storage systems. To overcome the previous problems in cloud storage, we present a searchable CP-ABE with attribute revocation, where access structures are partially hidden so that receivers cannot extract sensitive information from the ciphertext. The security of our scheme can be reduced to the decisional bilinear Diffie-Hellman (DBDH) assumption and decisional linear (DL) assumption. Copyright © 2015 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

Deduplication, which stores only one copy of duplicate data, is used extensively in cloud storage to reduce the overhead associated with storage. Unfortunately, client-side encryption prevents cloud storage from performing deduplication due to the randomness of traditional encryption. Some existing schemes can balance encryption and deduplication, but their interaction with third-party servers or online users adds additional overhead to the system. Also, the ownership of outsourced data will change frequently due to users' requests to upload/delete/modify the data. But many existing schemes that can achieve dynamic ownership management have security flaws or require users to manage multiple keys. By focusing on these troubles, we have developed a secure deduplication scheme that does not rely on any third-party entities and supports data ownership management. More specifically, we take advantage of elliptic curve cryptography to design a key-sharing method so that different owners of the same data can share a random key only by interacting with the cloud service provider. And the broadcast encryption is used to manage the ownership of data, and this allows the cloud service provider to control users' access to outsourced data by updating the broadcast key. In addition, the security analysis shows that the proposed scheme can meet the required security and that it outperforms other related schemes. The detailed simulation comparisons with other related schemes demonstrate that the proposed scheme has good performance. [ABSTRACT FROM AUTHOR]

With the increasing number of mobile applications and the popularity of cloud computing, the combination of these two techniques that named mobile cloud computing (MCC) attracts great attention in recent years. However, due to the risks associated with security and privacy, mobility security protection in MCC has become an important issue. In this paper, we propose an efficient traceable access control scheme with reliable key delegation named KD-TABE in MCC. Firstly, we present a traceable CP-ABE system and realize key delegation without loss of traceability. Secondly, a new type of re-encryption method is proposed, which is based on an intuitive method that supports any monotonic access tree instead of the re-encryption key. Lastly, to reduce trust on authority, we separate the authority into three parts, and each authority is responsible for generating different components of the key. The analysis shows that the proposed scheme can meet the security requirement of MCC. In addition, it cost less compared with the other popular models. [ABSTRACT FROM AUTHOR]

The intersection operation on multisets has many applications in different scenarios, such as data mining and pattern matching. This motivates us to study the problem that when users outsource their private encrypted sets and delegate the set-intersection operation on the corresponding plaintexts to the cloud, the cloud can manage to conduct the operation and make the result verifiable without the decryption capability. We formally introduced a model of Verifiable Intersection Operations on Encrypted Data in Cloud and presented the definitions of the correctness and security properties. We also proposed a concrete scheme basing on the bilinear-map accumulator and re-encryption. The scheme was proved secure under some cryptographic assumptions. And the experimental results of the algorithm implementation show the scheme is partly practical for real scenarios. Copyright © 2016 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

SUMMARY Cloud computing as a promising technology and paradigm can provide various data services, such as data sharing and distribution, which allows users to derive benefits without the need for deep knowledge about them. However, the popular cloud data services also bring forth many new data security and privacy challenges. Cloud service provider untrusted, outsourced data security, hence collusion attacks from cloud service providers and data users become extremely challenging issues. To resolve these issues, we design the basic parts of secure re-encryption scheme for data services in a cloud computing environment, and further propose an efficient and secure re-encryption algorithm based on the EIGamal algorithm, to satisfy basic security requirements. The proposed scheme not only makes full use of the powerful processing ability of cloud computing but also can effectively ensure cloud data security. Extensive analysis shows that our proposed scheme is highly efficient and provably secure under existing security model. Copyright © 2015 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

Commutative re-encryption techniques are important tools for different applications where the encryption and decryption operations are performed in arbitrary order. These techniques also enable one to transfer information securely in a network without any knowledge of public keys of other parties. The process of message transmission vastly depends on the performance of underlying commutative technique used for cryptographic operations. The aim of this paper is to inquest some recently invented commutative re-encryption techniques at every step of their operation and expose the technique with better performance. The content of the paper is broadly divided into three parts—describing the importance of the commutative re-encryption techniques, presenting some latest techniques along with proposing a modification for making their operations faster, and analyzing every operational step of both the naive and proposed techniques. The modification is proposed only for experimentally proved slow techniques to faster their operation and a comparison is made at the end to show the effectiveness of the modification in making the operations faster. [ABSTRACT FROM PUBLISHER]

Program obfuscation is a compiler that transfers a program into an unintelligible form while preserving the original functionality. Secure obfuscation for several particular function families has been raised out despite the general impossibility result presented by Barak et al. Re-encryption function is a useful primitive, which transforms ciphertexts for one party into ciphertexts under another party's public key. Hohenberger et al. constructed a special re-encryption function and securely obfuscated it in TCC'07, and the security is based on classical hardness assumption. In this paper, we construct a new re-encryption function and securely obfuscate it based on the standard learning with error (LWE) assumption. LWE is proved to be reducible to standard lattice problems, which are conjectured immune to quantum cryptanalysis or 'post-quantum'. Besides, we discuss about the relations between these two cryptographic primitives in detail: proxy re-encryption and obfuscation for re-encryption functions. Copyright © 2014 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

A proxy re-encryption (PRE) scheme allows a semi-trusted proxy to convert a ciphertext intended for some recipient, say Alice, into another ciphertext which can only be decrypted by the other designated one, say Bob. It is required that the semi-trusted proxy cannot learn any information about the encrypted message. When a PRE scheme enables the semi-trusted proxy to convert a ciphertext intended for Alice into the one intended for Bob and then again convert this ciphertext into another one intended for Candy and so on, it is called multi-hop PRE scheme. In this paper, the author will propose a new multi-hop PRE scheme for secure content distribution. The security assumption is based on the bilinear inverse Diffie-Hellman problem. Compared with related PRE schemes, ours can earn more computational efficiency. [ABSTRACT FROM AUTHOR]

We present a positive obfuscation result for a traditional cryptographic functionality. This positive result stands in contrast to well-known impossibility results (Barak et al. in Advances in Cryptology-CRYPTO'01, ), for general obfuscation and recent impossibility and implausibility (Goldwasser and Kalai in 46th IEEE Symposium on Foundations of Computer Science (FOCS), pp. 553-562, ) results for obfuscation of many cryptographic functionalities. Whereas other positive obfuscation results in the standard model apply to very simple point functions (Canetti in Advances in Cryptology-CRYPTO'97, ; Wee in 37th ACM Symposium on Theory of Computing (STOC), pp. 523-532, ), our obfuscation result applies to the significantly more complex and widely-used re-encryption functionality. This functionality takes a ciphertext for message m encrypted under Alice's public key and transforms it into a ciphertext for the same message m under Bob's public key. To overcome impossibility results and to make our results meaningful for cryptographic functionalities, our scheme satisfies a definition of obfuscation which incorporates more security-aware provisions. [ABSTRACT FROM AUTHOR]

With the explosive growth of data on the internet, the trend is for users to store these large amounts of data on the cloud. To protect the privacy of data, users need to encrypt their data before uploading them to the cloud. This brings a big challenge for cloud to perform deduplication. In order to tackle this challenge, we design a secure deduplication scheme for big data with efficient dynamic ownership updates. The proposed scheme can efficiently support user enrollment and revocation. We adopt a new locating technique to effectively locate the re-encrypted data block. As a result, only a small proportion of data needs to be re-encrypted. When one user deletes or updates one file, this user will lost the access to the original data. We also provide the security analysis and experimental evaluation results for the proposed scheme. [Display omitted] • We propose a secure deduplication scheme for big data with efficient dynamic ownership updates. • We utilize CP-ABE and re-encryption techniques to realize user enrollment and revocation. • We adopt the locating technique to effectively locate the data block to be re-encrypted. • Our proposed scheme achieves efficient deduplication for big data. [ABSTRACT FROM AUTHOR]

By only storing a unique copy of duplicate data possessed by different data owners, deduplication can significantly reduce storage cost, and hence is used broadly in public clouds. When combining with confidentiality, deduplication will become problematic as encryption performed by different data owners may differentiate identical data which may then become not deduplicable. The Message-Locked Encryption (MLE) is thus utilized to derive the same encryption key for the identical data, by which the encrypted data are still deduplicable after being encrypted by different data owners. As keys may be leaked over time, re-encrypting outsourced data is of paramount importance to ensure continuous confidentiality, which, however, has not been well addressed in the literature. In this paper, we design SEDER, a SEcure client-side Deduplication system enabling Efficient Re-encryption for cloud storage by (1) leveraging all-or-nothing transform (AONT), (2) designing a new delegated re-encryption (DRE), and (3) proposing a new proof of ownership scheme for encrypted cloud data (PoWC). Security analysis and experimental evaluation validate security and efficiency of SEDER, respectively. [ABSTRACT FROM AUTHOR]

A smart watch is a kind of emerging wearable device in the Internet of Things. The security and privacy problems are the main obstacles that hinder the wide deployment of smart watches. Existing security mechanisms do not achieve a balance between the privacy-preserving and data access control. In this paper, we propose a fine-grained privacy-preserving access control architecture for smart watches (FPAS). In FPAS, we leverage the identity-based authentication scheme to protect the devices from malicious connection and policy-based access control for data privacy preservation. The core policy of FPAS is two-fold: (1) utilizing a homomorphic and re-encrypted scheme to ensure that the ciphertext information can be correctly calculated; (2) dividing the data requester by different attributes to avoid unauthorized access. We present a concrete scheme based on the above prototype and analyze the security of the FPAS. The performance and evaluation demonstrate that the FPAS scheme is efficient, practical, and extensible. [ABSTRACT FROM AUTHOR]