Search

A smart watch is a kind of emerging wearable device in the Internet of Things. The security and privacy problems are the main obstacles that hinder the wide deployment of smart watches. Existing security mechanisms do not achieve a balance between the privacy-preserving and data access control. In this paper, we propose a fine-grained privacy-preserving access control architecture for smart watches (FPAS). In FPAS, we leverage the identity-based authentication scheme to protect the devices from malicious connection and policy-based access control for data privacy preservation. The core policy of FPAS is two-fold: (1) utilizing a homomorphic and re-encrypted scheme to ensure that the ciphertext information can be correctly calculated; (2) dividing the data requester by different attributes to avoid unauthorized access. We present a concrete scheme based on the above prototype and analyze the security of the FPAS. The performance and evaluation demonstrate that the FPAS scheme is efficient, practical, and extensible.

Outsource computing might reveal some private information in open cloud systems and the concern of users' privacy will be a crucial issue. Program obfuscation is an important cryptographic primitive that perfectly hides the secrets inside a program while preserving its functionality. In this paper, we give a two-form re-encryption scheme that achieves the security against adaptively chosen-ciphertext attacks, which allows any third party (e.g., cloud server) to re-encrypt the ciphertext that delegates the decryption right from one to another. However, as the third party knows the sensitive secret (i.e., re-key), and thus we should guarantee the trustworthy of this cloud server. Based the re-encryption algorithm, we propose an efficient obfuscator that implements the re-encryption functionality in such a way that not only the private information is protected but also cloud users' privacy is preserved, and thus the re-encryption procedure can be run on untrusted outsourcing server. We prove the virtual black-box security of the obfuscation. The proposed obfuscator can be run on untrusted server to help the perform of the functionality of re-encryption without any sensitive secret revealing. [ABSTRACT FROM AUTHOR]

To protect the sensitive data outsourced to cloud server, outsourcing data in an encrypted way has become popular nowadays. However, it is not easy to find the corresponding ciphertext efficiently, especially the large ciphertext stored on cloud server. Besides, some data owners do not want those users who attempt to decrypt to know the sensitive access structure of the ciphertext because of some business or private reasons. In addition, the user attributes revocation and key updating are important issues, which affect application of ciphertext-policy attribute-based encryption (CP-ABE) in cloud storage systems. To overcome the previous problems in cloud storage, we present a searchable CP-ABE with attribute revocation, where access structures are partially hidden so that receivers cannot extract sensitive information from the ciphertext. The security of our scheme can be reduced to the decisional bilinear Diffie-Hellman (DBDH) assumption and decisional linear (DL) assumption. Copyright © 2015 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

Deduplication, which stores only one copy of duplicate data, is used extensively in cloud storage to reduce the overhead associated with storage. Unfortunately, client-side encryption prevents cloud storage from performing deduplication due to the randomness of traditional encryption. Some existing schemes can balance encryption and deduplication, but their interaction with third-party servers or online users adds additional overhead to the system. Also, the ownership of outsourced data will change frequently due to users' requests to upload/delete/modify the data. But many existing schemes that can achieve dynamic ownership management have security flaws or require users to manage multiple keys. By focusing on these troubles, we have developed a secure deduplication scheme that does not rely on any third-party entities and supports data ownership management. More specifically, we take advantage of elliptic curve cryptography to design a key-sharing method so that different owners of the same data can share a random key only by interacting with the cloud service provider. And the broadcast encryption is used to manage the ownership of data, and this allows the cloud service provider to control users' access to outsourced data by updating the broadcast key. In addition, the security analysis shows that the proposed scheme can meet the required security and that it outperforms other related schemes. The detailed simulation comparisons with other related schemes demonstrate that the proposed scheme has good performance. [ABSTRACT FROM AUTHOR]

The universal re-encryption scheme URE and its extension EURE were reviewed,discovering their vulnerabilities to Pfitzmann attack.Then a novel re-encryption scheme WGRe（WonGoo Re-encryption） was proposed.WGRe could en-sure the correctness of the outputs from a node and protect against replay attack,which was hard in layered encryption sys-tems.The experimental results show WGRe is practical and more efficient than URE and EURE schemes due to the fact that its ciphertext is only double the size of the corresponding plaintext,instead of four times as URE or EURE.

Replay attack against MIX was studied and a hybrid-structured onion scheme of MIX against replay attack was proposed.In hybrid scheme, probabilistic encryption and semantic security of universal re-encryption were utilized to protect MIX against replay attack, and the authentication property of layered encryption was utilized to protect integrity of messages.Meanwhile, symmetric encryption was imported to improve efficiency.Analysis shows that the hybrid-structured onion scheme can resist replay attack with guarantee of security and efficiency.

With the increasing number of mobile applications and the popularity of cloud computing, the combination of these two techniques that named mobile cloud computing (MCC) attracts great attention in recent years. However, due to the risks associated with security and privacy, mobility security protection in MCC has become an important issue. In this paper, we propose an efficient traceable access control scheme with reliable key delegation named KD-TABE in MCC. Firstly, we present a traceable CP-ABE system and realize key delegation without loss of traceability. Secondly, a new type of re-encryption method is proposed, which is based on an intuitive method that supports any monotonic access tree instead of the re-encryption key. Lastly, to reduce trust on authority, we separate the authority into three parts, and each authority is responsible for generating different components of the key. The analysis shows that the proposed scheme can meet the security requirement of MCC. In addition, it cost less compared with the other popular models. [ABSTRACT FROM AUTHOR]

The intersection operation on multisets has many applications in different scenarios, such as data mining and pattern matching. This motivates us to study the problem that when users outsource their private encrypted sets and delegate the set-intersection operation on the corresponding plaintexts to the cloud, the cloud can manage to conduct the operation and make the result verifiable without the decryption capability. We formally introduced a model of Verifiable Intersection Operations on Encrypted Data in Cloud and presented the definitions of the correctness and security properties. We also proposed a concrete scheme basing on the bilinear-map accumulator and re-encryption. The scheme was proved secure under some cryptographic assumptions. And the experimental results of the algorithm implementation show the scheme is partly practical for real scenarios. Copyright © 2016 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

SUMMARY Cloud computing as a promising technology and paradigm can provide various data services, such as data sharing and distribution, which allows users to derive benefits without the need for deep knowledge about them. However, the popular cloud data services also bring forth many new data security and privacy challenges. Cloud service provider untrusted, outsourced data security, hence collusion attacks from cloud service providers and data users become extremely challenging issues. To resolve these issues, we design the basic parts of secure re-encryption scheme for data services in a cloud computing environment, and further propose an efficient and secure re-encryption algorithm based on the EIGamal algorithm, to satisfy basic security requirements. The proposed scheme not only makes full use of the powerful processing ability of cloud computing but also can effectively ensure cloud data security. Extensive analysis shows that our proposed scheme is highly efficient and provably secure under existing security model. Copyright © 2015 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

Commutative re-encryption techniques are important tools for different applications where the encryption and decryption operations are performed in arbitrary order. These techniques also enable one to transfer information securely in a network without any knowledge of public keys of other parties. The process of message transmission vastly depends on the performance of underlying commutative technique used for cryptographic operations. The aim of this paper is to inquest some recently invented commutative re-encryption techniques at every step of their operation and expose the technique with better performance. The content of the paper is broadly divided into three parts—describing the importance of the commutative re-encryption techniques, presenting some latest techniques along with proposing a modification for making their operations faster, and analyzing every operational step of both the naive and proposed techniques. The modification is proposed only for experimentally proved slow techniques to faster their operation and a comparison is made at the end to show the effectiveness of the modification in making the operations faster. [ABSTRACT FROM PUBLISHER]

Program obfuscation is a compiler that transfers a program into an unintelligible form while preserving the original functionality. Secure obfuscation for several particular function families has been raised out despite the general impossibility result presented by Barak et al. Re-encryption function is a useful primitive, which transforms ciphertexts for one party into ciphertexts under another party's public key. Hohenberger et al. constructed a special re-encryption function and securely obfuscated it in TCC'07, and the security is based on classical hardness assumption. In this paper, we construct a new re-encryption function and securely obfuscate it based on the standard learning with error (LWE) assumption. LWE is proved to be reducible to standard lattice problems, which are conjectured immune to quantum cryptanalysis or 'post-quantum'. Besides, we discuss about the relations between these two cryptographic primitives in detail: proxy re-encryption and obfuscation for re-encryption functions. Copyright © 2014 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

A proxy re-encryption (PRE) scheme allows a semi-trusted proxy to convert a ciphertext intended for some recipient, say Alice, into another ciphertext which can only be decrypted by the other designated one, say Bob. It is required that the semi-trusted proxy cannot learn any information about the encrypted message. When a PRE scheme enables the semi-trusted proxy to convert a ciphertext intended for Alice into the one intended for Bob and then again convert this ciphertext into another one intended for Candy and so on, it is called multi-hop PRE scheme. In this paper, the author will propose a new multi-hop PRE scheme for secure content distribution. The security assumption is based on the bilinear inverse Diffie-Hellman problem. Compared with related PRE schemes, ours can earn more computational efficiency. [ABSTRACT FROM AUTHOR]

We present a positive obfuscation result for a traditional cryptographic functionality. This positive result stands in contrast to well-known impossibility results (Barak et al. in Advances in Cryptology-CRYPTO'01, ), for general obfuscation and recent impossibility and implausibility (Goldwasser and Kalai in 46th IEEE Symposium on Foundations of Computer Science (FOCS), pp. 553-562, ) results for obfuscation of many cryptographic functionalities. Whereas other positive obfuscation results in the standard model apply to very simple point functions (Canetti in Advances in Cryptology-CRYPTO'97, ; Wee in 37th ACM Symposium on Theory of Computing (STOC), pp. 523-532, ), our obfuscation result applies to the significantly more complex and widely-used re-encryption functionality. This functionality takes a ciphertext for message m encrypted under Alice's public key and transforms it into a ciphertext for the same message m under Bob's public key. To overcome impossibility results and to make our results meaningful for cryptographic functionalities, our scheme satisfies a definition of obfuscation which incorporates more security-aware provisions. [ABSTRACT FROM AUTHOR]

With the explosive growth of data on the internet, the trend is for users to store these large amounts of data on the cloud. To protect the privacy of data, users need to encrypt their data before uploading them to the cloud. This brings a big challenge for cloud to perform deduplication. In order to tackle this challenge, we design a secure deduplication scheme for big data with efficient dynamic ownership updates. The proposed scheme can efficiently support user enrollment and revocation. We adopt a new locating technique to effectively locate the re-encrypted data block. As a result, only a small proportion of data needs to be re-encrypted. When one user deletes or updates one file, this user will lost the access to the original data. We also provide the security analysis and experimental evaluation results for the proposed scheme. [Display omitted] • We propose a secure deduplication scheme for big data with efficient dynamic ownership updates. • We utilize CP-ABE and re-encryption techniques to realize user enrollment and revocation. • We adopt the locating technique to effectively locate the data block to be re-encrypted. • Our proposed scheme achieves efficient deduplication for big data. [ABSTRACT FROM AUTHOR]

By only storing a unique copy of duplicate data possessed by different data owners, deduplication can significantly reduce storage cost, and hence is used broadly in public clouds. When combining with confidentiality, deduplication will become problematic as encryption performed by different data owners may differentiate identical data which may then become not deduplicable. The Message-Locked Encryption (MLE) is thus utilized to derive the same encryption key for the identical data, by which the encrypted data are still deduplicable after being encrypted by different data owners. As keys may be leaked over time, re-encrypting outsourced data is of paramount importance to ensure continuous confidentiality, which, however, has not been well addressed in the literature. In this paper, we design SEDER, a SEcure client-side Deduplication system enabling Efficient Re-encryption for cloud storage by (1) leveraging all-or-nothing transform (AONT), (2) designing a new delegated re-encryption (DRE), and (3) proposing a new proof of ownership scheme for encrypted cloud data (PoWC). Security analysis and experimental evaluation validate security and efficiency of SEDER, respectively. [ABSTRACT FROM AUTHOR]

A smart watch is a kind of emerging wearable device in the Internet of Things. The security and privacy problems are the main obstacles that hinder the wide deployment of smart watches. Existing security mechanisms do not achieve a balance between the privacy-preserving and data access control. In this paper, we propose a fine-grained privacy-preserving access control architecture for smart watches (FPAS). In FPAS, we leverage the identity-based authentication scheme to protect the devices from malicious connection and policy-based access control for data privacy preservation. The core policy of FPAS is two-fold: (1) utilizing a homomorphic and re-encrypted scheme to ensure that the ciphertext information can be correctly calculated; (2) dividing the data requester by different attributes to avoid unauthorized access. We present a concrete scheme based on the above prototype and analyze the security of the FPAS. The performance and evaluation demonstrate that the FPAS scheme is efficient, practical, and extensible. [ABSTRACT FROM AUTHOR]