Search

In cloud-assisted electronic health (eHealth) systems, outsourced electronic health records (EHRs) have attribute-value type formats: an EHR corresponds to an entry with a unique identity and has multiple types of attribute values. Such formatted EHRs form an attribute-value type database, where both the attribute values and unique identities can serve as keywords for searching. Since EHRs are very sensitive, they are always encrypted before being outsourced, which makes retrieval of target EHRs by either identity or attribute value hard. Moreover, the EHRs are encrypted by different doctors, a researcher, who is delegated to research a certain kind of disease, cannot find out all corresponding EHRs due to the difference of encryption keys. In this article, we construct a triple dictionary index structure for the attribute-value type database to allow a researcher to retrieve encrypted EHRs by the identity and attribute value and to perform dynamic operations over them. We employ an identity server to assist doctors in generating encryption keys via an oblivious way. By doing so, the researcher can retrieve encrypted EHRs without leaking any information to the identity server. We analyze the security and evaluate the performance of our scheme to demonstrate that it achieves $L$ -adaptive security and forward security with high efficiency.

With the popularization of the geo-positioning technologies and Location Based Service (LBS), the spatial range query has gained increasing attention in VANET. To eliminate local data storage and computation burden, the data owner outsources his/her spatial data and the processing of range query tasks to location based service providers. However, outsourcing tasks may bring the risk of privacy leakage as location based service providers and clients, including data owner and data users are not in the same trusted domain. Besides, malicious service providers may forge or tamper retrieval results due to interest incentives such as saving storage or computational capacity. Therefore, we first propose and construct the Verifiable Spatial Range Query (VSRQ) scheme in VANET by using the hierarchical cell based encoding method, G-tree and the accumulator. To guarantee the correctness and completeness of search results, we leverage an accumulator-based technology. Then, we develop an improved G-tree to accelerate query processing and extend it to support multi-dimensional range queries. Security analysis shows that basic VSRQ and extension of VSRQ schemes are secure in terms of the privacy of index and confidentiality of spatial data. Extensive experiments further show that, basic (or extension of) VSRQ scheme can achieve result integrity while supporting spatial range query and lower computational and storage burden compared with existing schemes.

To date, cloud computing has emerged as a primary utility for providing remote data storage services for users, since users can thus be relieved from cumbersome document maintenance. Despite of the benefits brought by data outsourcing, the unexpected data breaches raise concerns about data confidentiality and privacy. To deal with this, a straightforward and convincing strategy is to encrypt data before outsourcing them to the cloud. However, securely sharing and searching over outsourced encrypted data has turned into a challenge due to the hindrance led by data encryption. To address the challenge, this article proposes a new highly-scalable searchable encryption scheme for encrypted cloud storage. The scheme achieves sub-linear Boolean keyword searching, and moreover allows the data owner to authorize which clients could search or access the documents in the cloud. Technically, we revisit searchable symmetric encryption primitive by non-trivially combining it with a novel access control technique, and build an inverted index data structure for both attribute-based access control and sub-linear search process. Furthermore, we introduce a formalized security definition for the system, and prove its security in the simulation-based security model. Finally, we conduct a couple of experiments over a representative real-world dataset to show practicality.

Artificial intelligence (AI) has demonstrated huge potential in a variety of real-world applications. However, some significant considerations like fairness, transparency and trustworthiness are still challenging when applying AI to trust-oriented applications such as E-voting. E-voting plays a significant role in democratic societies, which requires voters and initiators have strong mutual trust. In this paper, we aim to facilitate the consolidation of AI ecosystems by developing a blockchain-based traceable self-tallying e-voting system. We take advantage of an event-oriented linkable group signature and a homomorphic time-lock puzzle to balance the anonymity and accountability, and the voting scale and efficiency of an e-voting system. The proposed e-voting protocol supports additional functions like multi-choice and self-tallying. We prove that the proposed protocol satisfies anonymity, time-bounded privacy, linkability and full-traceability. We also evaluate the time cost of off-chain operations and the gas cost of on-chain operations, which show the proposed e-voting protocol is practical and can be adopted in real-world applications.

Location-based service (LBS) provides more and more conveniences to people. However, it also brings potential threats of offending users’ privacy. How to protect users’ privacy in LBS schemes has aroused increasing research interests in recent years. Most of the existing privacy-preserving LBS schemes are based on the hardness of traditional number-theoretic problems such as the integer factorization or the discrete logarithm problems. However, with the development of large scale quantum computers, these traditional problems can be easily solved by Shor's algorithms, hence the security of these LBS schemes is greatly threatened. In this paper, we solve this problem by constructing a privacy-preserving LBS scheme against quantum attacks from an LWE-based key-homomorphic pseudorandom functions (PRF). In our scheme, due to the key-homomorphic property of the PRF, an LBS user only has to compute one PRF value of the target location and the remaining computation is outsourced to a cloud server, which releases the user from heavy computation burden. In addition, by dividing the key encrypting LBS data into two parts and assigning the two parts to the cloud sever and each user respectively, our scheme avoids the threats of key abuse and information leaking of LBS data. Moreover, we use this PRF to realize an authenticated protocol, which protects the communications between the LBS users and the cloud server. We stress that the security of our scheme is based only on the security of the LWE-based key-homomorphic PRF, hence our scheme is the first LBS scheme secure against quantum attacks.

Functional encryption (FE) and predicate encryption (PE) can be utilized in deploying and executing machine learning (ML) algorithms to improve efficiency. However, most of existing FE and PE algorithms only consider generic functions. Actually, quadratic-functions-based FE and PE can be used to further reduce the computation costs significantly. In this paper, we present a functional encryption scheme for quadratic functions from those for generic functions. In our constructions, ciphertexts are associated with a pair of vectors $(\mathsf {x},\mathsf {y})\in \mathbb {Z}^{n}_{q}\times \mathbb {Z}^{m}_{q}$ , private keys are associated with a quadratic function, and the decryption of ciphertexts CT(x,y) with a private key skF, where F is a n × m-dimensional matrix, recovers $(\mathsf {x})^{\top }\mathsf {F}\mathsf {y}\in \mathbb {Z}_{q}$ . Compared with Baltico et al.’s FEs for quadratic functions (at Crypto 2017), our schemes could obtain almost the same ciphertexts size of $O((n+m)\log q)$ as their schemes (in contrast to O(n) in Baltico et al.’s schemes), and the computation for quadratic functions in our scheme does not rely on bilinear maps, while their schemes must rely on this assumption. In particular, our schemes under the standard assumptions achieve adaptive security, while Baltico et al.’s scheme only obtains selective security. Moreover, beyond the MDDH and GGM assumptions, our schemes allow for instantiations under standard assumptions such as LWE, LPN, and etc.

With cloud services, data users can retrieve encrypted data while preserving data confidentiality. However, this new paradigm suffers from many security concerns. A major concern is how to avoid insider Keyword-Guessing Attacks (KGA), which implies that the internal attackers can guess the candidate keywords successfully in an off-line manner. To address this issue, recently, two verifiable searchable encryption schemes (published in IEEE Transactions on Cloud Computing, doi: 10.1109/TCC.2020.2989296) in cloud storage were proposed which enjoys many desirable features. In this letter, we demonstrate that the schemes are insecure against insider keyword-guessing attack. Specifically, we show that the adversary can derive the keywords in an off-line manner.

Cloud storage services allow users to outsource their data to remote cloud servers to relieve from the burden of local data storage and maintenance. Despite the benefits, data outsourcing has also made the data integrity protection in cloud storage a very challenging issue. Plenty of public auditing schemes have been proposed, which allow a third-party auditor to check the data integrity on behalf of users. However, most of these schemes are constructed on homomorphic authenticators, which require strong computation capability on the user side and incur high storage overhead. In this paper, a novel public data integrity auditing scheme is proposed from indistinguishability obfuscation. In our scheme, each user processes the entire data to be outsourced by using only symmetric key primitives, and the server only needs to store the outsourced data. In comparison with existing works, the proposed scheme frees users from the heavy burden on calculating the authenticators and reduces the storage overhead significantly. Moreover, we show the security of the proposed scheme with rigorous proofs. Finally, the performance analysis and comparison with existing works demonstrate the proposed scheme achieves better performance in terms of data processing cost on the user side and storage overhead.

For data owners of restricted cloud access with a delegated proxy, public auditing technology for cloud data integrity, plays critical roles in ensuring powerful productivity that flexible cloud services provide for their business. In order to address the scalability of data owners and storage clouds for secure public auditing, Yu et al. (2017) proposed an Identity-Based Public Auditing for Dynamic Outsourced Data with Proxy Processing (https://doi.org/10.3837/tiis.2017.10.019), which also overcomes complicated public key certificates management issue. In this article, we figure out that this scheme is vulnerable to data loss attack where clouds could pass integrity auditing without original data. Meanwhile, a threat of system security is demonstrated, i.e., any entities are able to recover proxy private keys and impersonate proxy to forge proxy tag, with two arbitrary data tag pairs of same data owner. To enable secure identity-based batch public auditing with proxy processing, we propose an improved scheme without these security flaws and prove its security under CDH hard problem in the random oracle model. With complexity analysis, our scheme shows better efficiency over identity-based proxy-oriented data uploading and remote data integrity checking in public cloud (ID-PUIC) in a single owner effort on a single cloud. Especially, we give the detailed analysis for how efficiently the attacks on Yu et al.’s scheme could be launched with an experiment, and demonstrate complete reduction on probability and time for proving security of our improved scheme. For potential application in big data storage, we first evaluate the error detection probability varying on number of auditing blocks, and then conduct detailed performance analysis by simulating our scheme and ID-PUIC scheme on the different number of data owners and storage clouds, with up to 106 data blocks.

Public integrity auditing enables a user to delegate a third-party auditor (TPA) to periodically audit the integrity of the outsourced data. Whereas, the security of public auditing schemes relies on the trustworthiness of TPA: once TPA misbehaves, the data integrity auditing would be invalidated. In this paper, we propose a blockchain-based efficient public integrity auditing scheme to resist misbehaved TPA, where the user is required to check the behaviors of TPA in a much longer period compared with that of the data integrity auditing performed by TPA. To free users from heavy computation costs during the checking, our scheme uses two key techniques. We first design a smart contract to (1) enable TPA to record each auditing entry (which records the information about each auditing task) into the blockchain and (2) ensure the validity of each recorded entry. Then, we propose an auditing record chain built on the Ethereum blockchain to link all auditing entries corresponding to the same data in the chronological order. By doing so, the user only needs to check the last auditing entry generated by TPA to verify the trustworthiness of TPA (i.e., whether TPA has correctly performed the prescribed auditing tasks). Compared with existing schemes, where the user has to check multiple entries one by one, our scheme achieves the same security guarantee with constant and low costs in terms of communication and computation.

Cloud 5G and Cloud 6G technologies are strong backbone infrastructures to provide high data rate and data storage with low latency for preserving QoS (Quality of Service) and QoE (Quality of Experience) in applications such as driverless vehicles, drone-based deliveries, smart cities and factories, remote medical diagnosis and surgery, and artificial-intelligence-based personalized assistants. There are many techniques to support the aforementioned applications, but for privacy preservation of Cloud 5G, the existing methods are still not sufficient. Public key encryption (PKE) scheme is an important means to protect user data privacy in Cloud 5G. Currently, the most common PKE used in Cloud 5G is CCA or CPA secure ones. However, its security level maybe not enough. SOA security is a stronger security standard than CPA and CCA. Roughly speaking, PKE with SOA security means that the adversary is allowed to open a subset of challenger ciphertexts and obtains the corresponding encrypted messages and randomness, but the unopended messages and randomness remain secure in the rest of the challenger ciphertexts. Security against SOA in PKEs has been a research hotspot, especially with the wide discussion in Cloud 5G. We revisited the SOA-CLE and proposed a new security proof, which is more concise and user friendly to understand privacy preservation in Cloud 5G applications.

Access control encryption (ACE), as a new cryptographic framework was proposed by Damgard et al. (at TCC 2016), enables controlling both the writing users and the reading users. Recently, a number of access control encryptions are proposed, but none of them are able to implement the verifiability of the sanitized ciphertexts which may lead to incorrect decryption. To solve this problem, by adapting Kim and Wu’s techniques (at ASIACRYPT 2017) and combining with the strong randomness extractor, we put forward a generic framework of access control encryption with verifiable sanitized decryption for arbitrary policy. The instantiabilities of the used building blocks from standard assumptions illustrates that our new construction works well. Moreover, we prove that our scheme not only satisfies the standard security definitions of access control encryption but also achieves the verifiability security for the sanitized ciphertexts.

Connected vehicles are generally equipped with many (dozens of, or even hundreds of) electronic and intelligent devices so that drivers can gain a more comfortable driving experience. Despite their numerous benefits, these technological developments have also created serious safety/security concerns. This article recapitulates the diversified attack surfaces of connected vehicles related to the technological developments from the perspective of the in-vehicle network. For each of the attacks, we discuss the rationale and the concrete methods presented in the literature. In particular, we illustrate how to launch successful attacks through the controlled area network (CAN) bus, electronic control units (ECUs), and in-vehicle infotainment system. The article also suggests some feasible solutions to the attacks demonstrated by the community. Considering the fact that vehicles are safety- critical, more practical and effective steps should be taken within the connected vehicle network toward securing connected vehicles and protecting drivers and passengers. Introduction

In this letter, we point out that the privacy-preserving adaptive trapdoor hash authentication tree scheme (published in IEEE TIFS, doi: 10.1109/TIFS.2020.2986879) can be invalidated by an adversarial cloud server: if the outsourced data is arbitrarily modified, the cloud server still can pass the third-party auditor’s auditing.

Password-based authentication is the current dominant technology for online service providers to confirm the (claimed) identities of legitimate users. Semantic patterns reflect how people choose their passwords, and understanding the patterns is useful in developing policies, guidelines and good practices to secure the password-based mechanism. Semantic patterns are hard to recognize in general and they may vary for people of different spoken languages, cultures, and ethnicity groups, etc. However, it is possible to investigate them in a specific context. In this paper, we manage to characterize the Pinyin semantics of passwords from the Chinese Netizens (up to 591 million), thanks to the well-defined structures of the Pinyin phonetic system.We perform a comprehensive analysis on the (publicly available) compromised password datasets from several leading Chinese sites for social networking, (micro)blogging, Internet forums, gaming, dating, and various other online service providers in China. The number of passwords in total sums to over 141 million, of which the largest site leaks more than 30 million on its own. Our findings show that over 4% of passwords from our datasets represent Pinyin (including names), another nearly 5% of passwords represent concatenations of Pinyin and date (i.e., Pinyin with a date prefix/suffix), and the next 17% of passwords are combinations of Pinyin and numeric (non-date) prefix/suffix. A majority (over 93%) of pure Pinyin passwords are transcribed from only 24 Chinese characters. The pure numeric pattern and the pattern containing special symbols are also studied. Over 76% of the passwords can be covered by the patterns of pure numeric and concatenation of Pinyin and digits. Special symbols appear in only 2.66% of the passwords, and they are most likely (with a percentage of 82.85%) in the middle. To the best of our knowledge, this is the first large scale study of its kind, and might yield other interesting insights into the semantic role Pinyin plays (either as good practice guidance on strengthening password security, or for improving password guessing attack). HighlightsSemantic patterns are hard to recognize in general.The work manages to characterize the Pinyin semantics of passwords from the Chinese Netizens (up to 591 million).The number of passwords in total sums to over 141 million.This is the first large scale study of its kind, and might yield other interesting insights into the semantic role Pinyin plays.

Data security and privacy protection issues are the primary restraints for adoption of cloud computing. Selective opening security (SOA security) focuses on such a scenario of cloud computing: Multiple senders encrypt their own data with the public key of a single receiver. Given the ciphertexts, the adversary is allowed to corrupt some of the senders, seeing not only their plaintexts but also the random coins used during the encryption. The security requirement of SOA security is that the privacy of the unopened data is preserved. On the other hand, non-malleability is also a very important security notion for data security in cloud computing and public-key cryptography. The security requirement of non-malleability is that given a challenge ciphertext, it should be infeasible to generate a ciphertext vector whose decryption is “meaningfully related” to the corresponding challenge plaintext. However, as far as we know, the relations between non-malleability and SOA security are still undiscovered, and the security notion of non-malleability under selective opening attacks has not yet been formally defined or researched. In this paper, we formalize the security notion of non-malleability under selective opening attacks (NM-SO security), and explore the relations between NM-SO security and the standard SOA security, the relations between NM-SO security and the standard non-malleability, and the relations among NM-SO security notions.

Authenticated key exchange (AKE) protocol allows a user and a server to authenticate each other and generate a session key for the subsequent communications. With the rapid development of low-power and highly-efficient networks, such as pervasive and mobile computing network in recent years, many efficient AKE protocols have been proposed to achieve user privacy and authentication in the communications. Besides secure session key establishment, those AKE protocols offer some other useful functionalities, such as two-factor user authentication and mutual authentication. However, most of them have one or more weaknesses, such as vulnerability against lost-smart-card attack, offline dictionary attack, de-synchronization attack, or the lack of forward secrecy, and user anonymity or untraceability. Furthermore, an AKE scheme under the public key infrastructure may not be suitable for light-weight computational devices, and the security model of AKE does not capture user anonymity and resist lost-smart-card attack. In this paper, we propose a novel dynamic ID-based anonymous two-factor AKE protocol, which addresses all the above issues. Our protocol also supports smart card revocation and password update without centralized storage. Further, we extend the security model of AKE to support user anonymity and resist lost-smart-card attack, and the proposed scheme is provably secure in extended security model. The low-computational and bandwidth cost indicates that our protocol can be deployed for pervasive computing applications and mobile communications in practice.

User authentication protocol is an important security mechanism for mobile networks. Recently, Wu et al. proposed a biometrics-based three-factor user authentication scheme using elliptic curve cryptography for mobile networks. However, in this paper, we find out that their scheme is vulnerable to the impersonation attack, because de/encryption key of the server and the user can be computed by an adversary. And then an improved three-factor authentication scheme for mobile client-server networks is proposed to overcome the weakness. The proposed scheme uses a random nonce to decrypt and encrypt messages without using the server's public key for reducing computation cost and avoiding the key management problem, and it also achieves user's anonymity. In addition, we apply the pi calculus-based formal verification tool ProVerif for security evaluations, and compare our scheme with some related schemes to show that the proposed scheme is both secure and efficient.

In the certificateless cryptography, users generate their partial private key and the Key Generation Centre (KGC) generates the other partial private key of users. In some certificateless application scenarios, a sender might want to send messages to a receiver which registers with another KGC. Unfortunately, no certificateless authenticated encryption scheme under multi-KGC has been put forward so far. In this work, we propose the first certificateless identity-concealed authenticated encryption scheme under multi-KGC. Our proposed scheme hides the public identity information of both sender and receiver from any third party. We build a security model for certificateless identity-concealed authenticated encryption scheme under multi-KGC. We prove that our proposed scheme is secure under the random oracle model. We also present a variant of our proposed scheme which supports bilateral identity-concealed authentication key exchange.

The revocable ciphertext-policy attribute-based encryption (R-CP-ABE) is an extension of ciphertext-policy attribute-based encryption (CP-ABE), which can realize user direct revocation and maintain a short revocation list. However, the revoked users can still decrypt the previously authorized encrypted data with their old key. The R-CP-ABE scheme should provide a mechanism to protect the encrypted data confidentiality by disqualifying the revoked users from accessing the previously encrypted data. Motivated by practical needs, we propose a new user R-CP-ABE scheme that simultaneously supports user direct revocation, short revocation list, and ciphertext update by incorporating the identity-based and time-based revocable technique. The scheme provides a strongly selective security proof under the modified decisional q -parallel bilinear Diffie–Hellman Exponent problem, where “strongly” means that the adversary can query the secret key of a user whose attribute set satisfies the challenge ciphertext access structure and whose identity is in the revocation list.

Unmanned scene recognition means that unmanned vehicles can collect environmental data from equipped sensors and make decisions through algorithms, in which deep learning has become one of key technologies. Especially, with the discovery of adversarial examples against deep learning, the research on offensive and defensive against adversarial examples illustrates that the deep learning model for unmanned scene recognition also has the safety vulnerability. However, as far as we know, few studies have tried to explore the adversarial example attack in this field. Therefore, we try to address this problem by generating adversarial examples againist scene recognition classification model through experiments. In addition, we also try to improve the adversarial model robustness by the adversarial training. Extensive experiments have been conducted, and experimental results show that adversarial examples have an efficient attack effect on the neural network for scene recognition.

The notion of selective opening attacks (SOAs) was first introduced by Dwork et al. at FOCS'99. Informally, an encryption scheme is SOA secure if an adversary is given a vector of ciphertexts and can adaptively corrupt some fraction of them by obtaining not only their messages but also their randomness, the uncorrupted ciphertexts retain secure. Provably achieving security against SOA has been proven extremely challenging. In this paper, we propose a security model to capture simulation-based selective opening chosen-plaintext attacks (SIM-SO-CPA) for certificateless encryption. We provide a concrete construction and prove its security in our simulation-based selective opening chosen-plaintext attack security model, based on the real or random and computational Diffie–Hellman assumptions. Compared with previous SOA-secure public key encryption and identity-based encryption, our certificateless encryption scheme is more simple and efficient. Copyright © 2017 John Wiley & Sons, Ltd.

Attribute-based encryption (ABE) provides a mechanism for complex access control over encrypted data. However in most ABE systems, the ciphertext size and the decryption overhead, which grow with the complexity of the access policy, are becoming critical barriers in applications running on resource-limited devices. Outsourcing decryption of ABE ciphertexts to a powerful third party is a reasonable manner to solve this problem. Since the third party is usually believed to be untrusted, the security requirements of ABE with outsourced decryption should include privacy and verifiability. Namely, any adversary including the third party should learn nothing about the encrypted message, and the correctness of the outsourced decryption is supposed to be verified efficiently. We propose generic constructions of CPA-secure and RCCA-secure ABE systems with verifiable outsourced decryption from CPA-secure ABE with outsourced decryption, respectively. We also instantiate our CPA-secure construction in the standard model and then show an implementation of this instantiation. The experimental results show that, compared with the existing scheme, our CPA-secure construction has more compact ciphertext and less computational costs. Moreover, the techniques involved in the RCCA-secure construction can be applied in generally constructing CCA-secure ABE, which we believe to be of independent interest.

With increasing interest in on-farm experiments, there is a pressing need to develop rigorous statistical methods for analysing these experiments. The adoption of advanced technologies such as yield monitors and variable-rate fertilizer applicators has enabled farmers and researchers to collect biophysical data linked to spatial information at a scale which allows them to investigate the role of spatial variability in the development of optimum management practices. A relevant topic for investigation could be: “what are the optimum rates of nitrogen and how/why do these differ across the field”? Although it has been recently understood that traditional statistical methods that are appropriate for analysing small-plot experiments are inappropriate for answering these questions, a unifying approach to inference for on-farm experiments is still missing and this limits the adoption of the technique. In this paper we propose a unifying approach to the analysis of on-farm strip experiments adapting the core ideas of local likelihood or geographically weighted regression. We propose a statistical model that allows spatial nonstationarity in modelled relationships and estimates spatially-varying parameters governing these relationships. A crucial step is bandwidth selection in implementing these models, and we develop bandwidth selection methods for two important scenarios relevant to the modelling of yield monitor data in on-farm experiments. Local t-scores have been introduced for inferential purposes and the associated problem of multiple testing has been described in the context of analysing on-farm experiments. We demonstrate in this paper how local p-values can be adjusted to overcome this problem. To illustrate the applicability of our proposed method, we analysed two publicly available datasets. Graphical displays are created to guide practitioners to make informed decisions on optimal management practices.

We point out that the key agreement and key protection scheme (published in IEEE Transactions on Information Forensics and Security, doi: 10.1109/TIFS.2018.2850299) fails to achieve the two-factor security. We demonstrate that in the scheme, if an adversary can control the master device of a target user, he can impersonate the user to pass the server’s authentication.

To deal with the key-exposure protection problem in attribute-based signature systems, we extend the parallel key-insulated mechanism to attribute-based signature scenarios, and then introduce the primitive of an Attribute-Based Parallel Key-Insulated Signature (ABPKIS). After formalizing the definition and security notions for ABPKIS, a concrete ABPKIS scheme is presented. The security of our proposed ABPKIS scheme can be proved on a standard model. According to our knowledge, this is the first ABPKIS scheme up to now. Moreover, this is also the first concrete attribute-based key-insulated signature construction supporting multi-helpers.

Fehr et al. (2010) proposed the first sender-equivocable encryption scheme secure against chosen-ciphertext attacks (NCCCA) and proved that NC-CCA security implies security against selective opening chosen-ciphertext attacks (SO-CCA). The NC-CCA security proof of the scheme relies on security against substitution attacks of a new primitive, the “crossauthentication code”. However, the security of the cross-authentication code cannot be guaranteed when all the keys used in the code are exposed. Our key observation is that, in the NC-CCA security game, the randomness used in the generation of the challenge ciphertext is exposed to the adversary. Based on this observation, we provide a security analysis of Fehr et al.’s scheme, showing that its NC-CCA security proof is flawed. We also point out that the scheme of Fehr et al. encrypting a single-bit plaintext can be refined to achieve NC-CCA security, free of the cross-authentication code. Furthermore, we propose the notion of “strong cross-authentication code”, apply it to Fehr et al.’s scheme, and show that the new version of the latter achieves NC-CCA security for multi-bit plaintexts.

At Eurocrypt’06, Lu et al. presented the first Sequential aggregate signature (SAS) provably secure without random oracles. The drawback of their scheme is that users need long public keys and the security model makes the Knowledge of secure key (KOSK) assumption. We present the first SAS scheme, which the user needs short public keys and the security is proven without random oracles, in the plain public key model. We also present the first Multisignature (MS) scheme in the plain public key model, which the security is proven without random oracles.

In big data age, flexible cloud service greatly enhances productivity for enterprises and individuals in different applications. When cloud access is restricted, data owner could authorize a proxy to process the data, and upload them to enjoy the powerful cloud storage service. Meanwhile, outsourced data integrity breach becomes a serious security issue for cloud storage. Identity Based Provable Data Possession (PDP) as a critical technology, could enable each data owner to efficiently verify cloud data integrity, without downloading entire copy and complicated public key certificate management issue. But it remains a great challenge for multiple data owners to efficiently and securely perform batch data integrity checking on huge data on different storage clouds, with proxy processing. Yu et al. recently proposed an Identity-Based Public Auditing for Dynamic Outsourced Data with Proxy Processing (https://doi.org/10.3837/tiis.2017.10.019), which tried to address this problem. In this article, we first demonstrate that this scheme is insecure since malicious clouds could pass integrity auditing without original data. Additionally, malicious clouds are able to recover the proxys private key and thus impersonate proxy to arbitrarily forge tags for any modified data. Secondly, in order to repair these security flaws, we propose an improved scheme to enable secure identity based batch public auditing with proxy processing. Thirdly, the security of our improved scheme is proved under CDH hard problem in the random oracle model. The complexity analysis of its performance shows better efficiency over identity-based proxy-oriented data uploading and remote data integrity checking in public cloud on single owner effort on a single cloud, which will benefit big data storage if it is extrapolated in real application.

Many certificateless cryptosystems have been proposed for cloud security applications. These applications have to face the inherent issues of dealing with low authority trust levels, especially when the cloud server takes charge of doing the role of the key generation center (KGC), that is the authority to trust. This paper focuses on popular authority trust problems in certificateless signatures and proposes a public cloud auditing scheme with high trust level. In current cloud security applications based on certificateless cryptography, the level of trust can at most detect and prove that the authority is guilty but can never punish it for its malicious behavior; precisely, in those settings where malicious servers have to be punished, an external arbitrator becomes necessary. We develop a novel notion of enhanced authority trust level, that we call 3+, where even if KGCs can impersonate any entity, still there is no way to avoid an immediate penalty for its malicious behavior. First, we construct a certificateless signature scheme with authority trust level 3+, then we prove its security in the random oracle model, illustrating some benefits in applications made for clouds. In particular, we propose a certificateless homomorphic authenticable signature scheme and a cloud public auditing scheme. Our proposed trust level 3+ sensibly boosts the trustworthiness and acceptability of such cloud computation environments by its ordinary customers.

In current cloud computing system, large amounts of sensitive data are shared to other cloud users. To keep these data confidentiality, data owners should encrypt their data before outsourcing. We choose proxy reencryption (PRE) as the cloud data encryption technique. In a PRE system, a semi-trusted proxy can transform a ciphertext under one public key into a ciphertext of the same message under another public key, but the proxy cannot gain any information about the message. In this paper, we propose a certificateless PRE (CL-PRE) scheme without pairings. The security of the proposed scheme can be proved to be equivalent to the computational Diffie-Hellman (CDH) problem in the random oracle model. Compared with other existing CL-PRE schemes, our scheme requires less computation cost and is significantly more efficient. The new scheme does not need the public key certificates to guarantee validity of public keys and solves the key escrow problem in identity-based public key cryptography.

In an attribute-based signature (ABS) system, a signature does not give proof of the identity of the individual who signed a message; it instead gives proof to a claim regarding the attributes that the underlying signer owns. For ABS, investigators have found many practical applications that require signer-attribute privacy. However, this approach is inadequate for handling scenarios in which the signing key is exposed due to viruses, worms or other break-ins that are allowed by operating-system holes. To overcome the limitation of existing ABS systems, we introduce the notion of an attribute-based key-insulated signature (ABKIS), in which signing keys are refreshed at discrete time periods via an interaction between the user and the helper (a physically-secure but computationally-limited device). We formalize this security model and propose a concrete ABKIS scheme, which is proven to be secure under the standard computational Diffie–Hellman assumption. Furthermore, as an application, a time-conditioned attribute-based proxy signature (TC-ABPS) is derived from our proposed ABKIS scheme. Another typical application of our scheme is for anonymous provider authentication in a bidirectional broadcasting service.

Signcryption is functional combination of encryption and signature, efficiency higher than the sep- arate signing and encrypting. Recently, Youn et al. presented a new signcryption scheme, which has fast online signing and short signcryptext, and is efficient enough for mobile applications. This scheme is claimed to be both existentially unforgeable and semantically secure. However, in this paper we shall show that it is not existentially unforgeable.

Chosen-ciphertext security has been well-accepted as a standard security notion for public-key encryption. But in a multi-user surrounding, it may not be sufficient, because the adversary may corrupt some users to obtain the random coins as well as the plaintexts used to generate ciphertexts. The attack is named 'selective opening attack'. We study how to achieve full-fledged chosen-ciphertext security in selective opening setting directly from the Decisional Diffie-Hellman assumption. Our construction is actually a tag-based public-key encryption scheme free of chameleon hashing and has a tight security reduction to the Decisional Diffie-Hellman assumption and the collision-resistant assumption of hash functions. The tag for each ciphertext is generated in a flexible way to serve the chosen-ciphertext security proof in selective opening settings. Copyright © 2013 John Wiley & Sons, Ltd.

User authentication has been widely deployed to prevent unauthorized access in the new era of Internet of Everything (IOE). When user passes the legal authentication, he/she can do series of operations in database. We mainly concern issues of data security and comparable queries over ciphertexts in IOE. In traditional database, a Short Comparable Encryption (SCE) scheme has been widely used by authorized users to conduct comparable queries over ciphertexts, but existing SCE schemes still incur high storage and computational overhead as well as economic burden. In this paper, we first propose a basic Short Comparable Encryption scheme based on sliding window method (SCESW), which can significantly reduce computational and storage burden as well as enhance work efficiency. Unfortunately, as the cloud service provider is a semitrusted third party, public auditing mechanism needs to be furnished to protect data integrity. To further protect data integrity and reduce management overhead, we present an enhanced SCESW scheme based on position-aware Merkle tree, namely, PT-SCESW. Security analysis proves that PT-SCESW and SCESW schemes can guarantee completeness and weak indistinguishability in standard model. Performance evaluation indicates that PT-SCESW scheme is efficient and feasible in practical applications, especially for smarter and smaller computing devices in IOE.

It is increasingly common for enterprises and other organizations to outsource firewalls to public clouds in order to reduce the cost and complexity in deploying and maintaining dedicated hardware middleboxes. However, this poses a serious threat to the enterprise network security because sensitive network policies, such as firewall rules, are revealed to cloud providers, which may be leaked and exploited by attackers. In this paper, we design and implement a SE- FWaaS, a secured system that enables cloud providers to support middlebox (e.g., firewall) outsourcing while preserving the network policy confidentiality. The key ingredients in our SE-FWaaS are the distribution of the firewall primitives, namely policy checking and verdict enforcing, to two independent public clouds, and the enabling techniques of efficient firewall rule obfuscation and oblivious rule-matching. Our SE-FWaaS provides the maximum achievable level of protection of network policies by enforcing the principle of the least privilege and removing the threat of offline probing attacks. We evaluate the proposed system over real-world firewall rules and demonstrate its effectiveness and feasibility.

We present a new primitive of randomized message-locked encryption (MLE) in this paper and define a new security model for it. The new primitive, named message-locked encryption3 (hereafter referred as MLE3), is actually a variant of randomized message-locked encryption (Bellare et al. Eurocrypt13). In order to prevent trivial attacks, our primitive admits a semi-trusted server, which is allowed to hold a secret key of public key encryption (PKE), to verify the correctness of a tag. The new security notion, called privacy chosen-distribution attacks3 (PRV-CDA3), requires that a ciphertext generated by encrypting an unpredictable message and another ciphertext (possible invalid) chosen randomly from a ciphertext space are indistinguishable. Compared with the priori proposed security notion, privacy chosen-distribution attacks (PRV-CDA) (Bellare et al. Eurocrypt13), which requires that two ciphertexts generated by encrypting two unpredictable messages are indistinguishable, the security notion we propose is much stronger. Based on the new primitive, under the blackbox reductions, we put forward a novel construction which achieves both privacy chosen-distribution attacks3 (PRV-CDA3) and strong tag consistency (STC) securities in the standard model via universal computational extractors (UCEs) (Bellare et al. Crypto13). In addition, our scheme also provides the validity-testing for ciphertext.

With the development of the wireless communication technology and the popularity of mobile devices, the mobile wireless network (MWN) has been widely used in our daily life. Through the access point (AP), users could access the Internet anytime and anywhere using their mobile devices. Therefore, MWNs can bring much convenience to us. Due to the limitation of APs coverage, the seamless handover frequently occurs in practical applications. How to guarantee the users privacy and security and identify the real identity when he/she brings harm to the system becomes very challenging. To achieve such goals, many anonymous handover authentication (AHA) protocols have been proposed in the last several years. However, most of them have high computation costs because mobile nodes need to carry out the bilinear pairing operations or the hash-to-point operations. Besides, most of them cannot satisfy some critical requirements, such as non-traceability and perfect forward secrecy. In this paper, we first outline the security requirements of AHA protocols, and then propose a new AHA protocol to eliminate weaknesses existing in previous AHA protocols. Based on the hardness of two famous mathematical problems, we demonstrate that the proposed AHA protocol is secure against different kinds of attacks and can meet a variety of security requirements. It can be seen from the details of implementations that the proposed AHA protocol also has much less computation cost than three latest AHA protocols.

We present an accountable authority key policy attribute-based encryption (A-KPABE) scheme. In this paper, we extend Goyal’s work to key policy attribute-based encryption setting. We first generalize the notion of accountable authority in key policy attribute-based encryption scenario, and then give a construction. In addition, our scheme is shown to be secure in the standard model under the modified Bilinear Decisional Diffie-Hellman (mBDDH) assumption.

SUMMARY In this paper, we first showed that Lou and Huang's three-party password-based key exchange protocol is still vulnerable to offline dictionary attacks. Thereafter, we proposed an enhanced protocol that can defeat the attack described and yet is efficient. Finally, we provided the rigorous proof of the security for it. Copyright © 2011 John Wiley & Sons, Ltd.

Key-insulated cryptography is an important technique to protect private keys in identity-based (IB) cryptosytems. Despite the flurry of recent results on IB key-insulated encryption (IBKIE) and signature (IBKIS), a problem regarding the security and efficiency of practicing IBKIE and IBKIS as a joint IB key-insulated signature/encryption scheme with a common set of parameters and keys remains open. To deal with the above question, we propose an identity-based key-insulated signcryption (IBKISC) scheme. Compared with the Sign-then-Encrypt (StE) and Encrypt-then-Sign (EtS) using IBKIE and IBKIS in the standard model, our proposed IBKISC scheme is the fastest with the shortest ciphertext size.

To tackle the key-exposure problem in signature settings, this paper introduces a new cryptographic primitive named threshold key-insulated signature (TKIS) and proposes a concrete TKIS scheme. For a TKIS system, at least k out of n helpers are needed to update a user’s temporary private key. On the one hand, even if up to k−1 helpers are compromised in addition to the exposure of any of temporary private keys, security of the non-exposed periods is still assured. On the other hand, even if all the n helpers are compromised, we can still ensure the security of all periods as long as none of temporary private keys is exposed. Compared with traditional key-insulated signature (KIS) schemes, the proposed TKIS scheme not only greatly enhances the security of the system, but also provides flexibility and efficiency.

In an identity based proxy signature (IBPS) scheme, a designated proxy signer can generate the signature on behalf of an original signer. Traditional IBPS schemes normally rely on the assumption that private keys are kept perfectly secure. However, due to viruses, worms or other break-ins allowed by operating-system holes, key exposure seems inevitable. To minimize the damage caused by key exposure in IBPS, we propose an identity-based key-insulated proxy signature (IBKIPS) scheme in the standard model, i.e. without random oracles.

Recently, Liu et al. [26] discovered that Certificateless Public Key Encryption (CL-PKE) suffers the Denial-of-Decryption (DoD) attack. Based on CL-PKC, the authors introduced a new paradigm called Self-Generated-Certificate Public Key Cryptography (SGC-PKC) that captured the DoD attack and proposed the first scheme derived from a novel application of Water's Identity-Based Encryption scheme [43]. In this paper, we propose a new SGC-PKE scheme that does not depend on the bilinear pairings and hence, is more efficient and requires shorter public keys than Liu et al.'s scheme. More importantly, our scheme reaches Girault's trust level 3 [16] (cf. Girault's trust level 2 of Liu and Au's scheme), the same trust level achieved by a traditional PKI. In addition, we also discuss how our scheme can lead to a secure and self-organized key management and authentication system for ad hoc wireless networks with a function of user-controlled key renewal.

Key revocation is critical for the practicality of any public key cryptosystem and identity-based encryption (IBE) system. When a user's private key is compromised, it is important for him/her to revoke his/her key. Up to now, little work has been published on key revocation in IBE systems. We propose a low-complexity key update technique to solve the revocation problem in an IBE system in which any revoked user is able to re-join the system without changing his or her identity or re-setup the system.

Up to now, it is still an open question of how to construct a chosen-ciphertext secure unidirectional proxy re-encryption scheme in the adaptive corruption model. To address this problem, we propose a new unidirectional proxy re-encryption scheme, and prove its chosen-ciphertext security in the adaptive corruption model without random oracles. Compared with the best known unidirectional proxy re-encryption scheme proposed by Libert and Vergnaud in PKC’08, our scheme enjoys the advantages of both higher efficiency and stronger security.

By exploiting a smart card, this paper presents a robust and efficient password-authenticated key agreement scheme. This paper strengthens the security of the scheme by addressing untraceability property such that any third party over the communication channel cannot tell whether or not he has seen the same (unknown) smart card twice through the authentication sessions. The proposed remedy also prevents a kind of denial of service attack found in the original scheme. High performance and other good functionalities are preserved.

Recently, democratic group signatures (DGSs) particularly catch our attention due to their great functionalities, i.e., no group manager, anonymity, and individual traceability. In existing DGS schemes, individual traceability says that any member in the group can reveal the actual signer's identity from a given signature. In this paper, we strengthen the security notions of DGS by taking insider attack against anonymity into account, and present a concrete DGS construction with collective traceability. The idea behind collective traceability is that a sender can first choose (ad-hoc) a set of n members (including himself), and then sign a message by using the public keys of all the members, in such a way that his identity would be recovered, in case of disputes, if and only if all n members collectively cooperate. The security properties of our scheme are formally proved under reasonable assumptions.