Attribute-based Proxy Re-encryption Research Articles

Secure collaborative EHR Sharing using multi-authority attribute-based proxy re-encryption in Web 3.0

Web 3.0 represents a transformative shift toward a decentralized, intelligent, and user-centric Internet. Existing electronic health record (EHR) sharing systems depend on centralized cloud servers for storage and management, with hospitals serving as primary custodians. This centralization often results in patients losing control and visibility over their EHR data, including who accesses it and how it is utilized, which contradicts the decentralized principles of Web 3.0. In this context, we propose a multi-authority attribute-based proxy re-encryption scheme that facilitates collaborative EHR sharing in Web 3.0. Our design allows the updating of ciphertext policies, thereby eliminating the need for frequent re-encryption of plaintext data amid varying cross-domain access policies. Furthermore, our scheme utilizes blockchain technology to create a decentralized and transparent environment that enables traceable cross-domain EHR sharing records. Additionally, we integrate hybrid encryption with decentralized data hosting platforms, significantly reducing the on-chain storage burden. The use of smart contracts automates the cross-domain EHR sharing and guarantees a fair distribution of benefits among all participants. Security analysis confirms that our scheme is secure against chosen plaintext attacks and resistant to collusion. Performance analysis and simulation experiments validate the efficiency and robustness of our scheme.

Time-based attribute-based proxy re-encryption with decryption key update

Time-based attribute-based proxy re-encryption with decryption key update

Weighted Attribute-Based Proxy Re-Encryption Scheme with Distributed Multi-Authority Attributes.

Existing attribute-based proxy re-encryption schemes suffer from issues like complex access policies, large ciphertext storage space consumption, and an excessive authority of the authorization center, leading to weak security and controllability of data sharing in cloud storage. This study proposes a Weighted Attribute Authority Multi-Authority Proxy Re-Encryption (WAMA-PRE) scheme that introduces attribute weights to elevate the expression of access policies from binary to multi-valued, simplifying policies and reducing ciphertext storage space. Simultaneously, the multiple attribute authorities and the authorization center construct a joint key, reducing reliance on a single authorization center. The proposed distributed attribute authority network enhances the anti-attack capability of cloud storage. Experimental results show that introducing attribute weights can reduce ciphertext storage space by 50%, proxy re-encryption saves 63% time compared to repeated encryption, and the joint key construction time is only 1% of the benchmark scheme. Security analysis proves that WAMA-PRE achieves CPA security under the decisional q-parallel BDHE assumption in the random oracle model. This study provides an effective solution for secure data sharing in cloud storage.

Verifiable and hybrid attribute-based proxy re-encryption for flexible data sharing in cloud storage

Cloud computing is a promising service architecture that enables a data owner to share data in an economic and efficient manner. To ensure data privacy, a data owner will generate the ciphertext of the data before outsourcing. Attribute-based encryption (ABE) provides an elegant solution for a data owner to enforce fine-grained access control on the data to be outsourced. However, ABE cannot support ciphertext transformation when needing to share the underlying data with a public-key infrastructure (PKI) user further. In addition, an untrusted cloud server may return random ciphertexts to the PKI user to save expensive computational costs of ciphertext transformation. To address above issues, we introduce a novel cryptographic primitive namely verifiable and hybrid attribute-based proxy re-encryption (VHABPRE). VHABPRE provides a transformation mechanism that re-encrypts an ABE ciphertext to a PKI-based public key encryption (PKE) ciphertext such that the PKI user can access the underlying data, meanwhile this PKI user can ensure the validity of the transformed ciphertext. By leveraging a key blinding technique and computing the commitment of the data, we construct two VHABPRE schemes to achieve flexible data sharing. We give formal security proofs and comprehensive performance evaluation to show the security and efficiency of the VHABPRE schemes.

A lattice-based data sharing functional encryption scheme with HRA security for IoT

In the dynamic and resource-constrained landscape of IoT, securing sensitive data access is paramount. This paper introduces an innovative access control scheme (ACPRE) blending conditional attribute-based proxy re-encryption with inner product encryption, tailored for IoT security needs. ACPRE integrates attribute-based conditions, expands plaintext space, and restricts proxy privileges, bolstering access control. Leveraging inner product encryption, it confines decrypted information to inner product values, ensuring data confidentiality. By limiting proxies’ transformation abilities, ACPRE prevents unauthorized data alterations. It offers a secure, flexible solution for data access management, allowing only entities with specific attributes to utilize inner product values. ACPRE’s lattice-based construction enables resistance against quantum attacks and achieves honestly re-encryption attacks security, fostering robust, privacy-aware IoT ecosystems. Detailed security proofs and experimental validation underscore its efficacy.

A Reliable and Equitable Attribute-Based Proxy Re-encryption System for Cloud Data Sharing

The widespread acceptance and quick growth of cloud computing have made data sharing easier than ever before. What is preventing widespread adoption of cloud computing, however, is how to guarantee the security of the user's data in the cloud. Safe data sharing in cloud computing can be achieved through the use of proxy re-encryption. With the use of a semi trusted cloud server, a data owner can encrypt shared data in the cloud using their own public key, converting it into an encryption meant only for authorized recipients to control access. To help us grasp this fundamental better, this paper provides a thorough and motivating overview of re-encryption of proxy servers from a variety of angles. For granular access control of shared data, Ciphertext-Policy Attribute based Aes (CP-ABE) is a possible cryptographic primitive. Each user in CP-ABE has a set of attributes, and access structures based on attributes are used to encrypt data. If and only if a user's characteristics meet the requirements of the ciphertext access structure, the user can decrypt a ciphertext. Practical applications typically call for additional requirements in addition to this fundamental one. Our research centers on the significant problem of attribute revocation, which poses a challenge for CP-ABE methods

Searchable Attribute-Based Proxy Re-encryption: Keyword Privacy, Verifiable Expressive Search, and Outsourced Decryption

Searchable Attribute-Based Proxy Re-encryption: Keyword Privacy, Verifiable Expressive Search, and Outsourced Decryption

How can the holder trust the verifier? A CP-ABPRE-based solution to control the access to claims in a Self-Sovereign-Identity scenario

The interest in Self-Sovereign Identity (SSI) in research, industry, and governments is rapidly increasing. SSI is a paradigm where users hold their identity and credentials issued by authorized entities. SSI is revolutionizing the concept of digital identity and enabling the definition of a trust framework wherein a service provider (verifier) validates the claims presented by a user (holder) for accessing services. However, current SSI solutions primarily focus on the presentation and verification of claims, overlooking a dual aspect: ensuring that the verifier is authorized to access the holder's claims. Addressing this gap, this paper introduces an innovative SSI-based solution that integrates decentralized wallets with Ciphertext-Policy Attribute-Based Proxy Re-Encryption (CP-ABPRE). This combination effectively addresses the challenge of verifier authorization. Our solution, implemented on the Ethereum platform, enhances accountability by notarizing key operations through a smart contract. This paper also offers a prototype demonstrating the practicality of the proposed approach. Furthermore, it provides an extensive evaluation of the solution's performance, emphasizing its feasibility and efficiency in real-world applications.

Attribute-Based Proxy Re-Encryption With Direct Revocation Mechanism for Data Sharing in Clouds

Cloud computing, which provides adequate storage and computation capability, has been a prevalent information infrastructure. Secure data sharing is a basic demand when data was outsourced to a cloud server. Attribute-based proxy re-encryption has been a promising approach that allows secure encrypted data sharing on clouds. With attribute-based proxy re-encryption, a delegator can designate a set of shared users through issuing a re-encryption key which will be used by the cloud server to transform the delegator's encrypted data to the shared users'. However, the existing attribute-based proxy re-encryption schemes lack a mechanism of revoking users from the sharing set which is critical for data sharing systems. Therefore, in this paper, we propose a concrete attribute-based proxy re-encryption with direct revocation mechanism (ABPRE-DR) for encrypted data sharing that enables the cloud server to directly revoke users from the original sharing set involved in the re-encryption key. We implemented the new schemes and evaluated its performance. The experimental results show that the proposed ABPRE-DR scheme is efficient and practical.

DAPRE:Efficient and Reliable Attribute-Based Proxy Re-Encryption Using DAG for Data Sharing in IoT

dAPRE:Efficient and Reliable Attribute-Based Proxy Re-Encryption Using DAG for Data Sharing in IoT

HRA-secure attribute-based threshold proxy re-encryption from lattices

Proxy re-encryption (PRE) allows a semi-trust proxy with a re-encryption key to transform a ciphertext encrypted under one key to an encryption of the same message under another key. Attribute-based proxy re-encryption (AB-PRE) is a generalization of PRE which enables fine-grained access control and delegation of encrypted data. However, traditional AB-PRE suffers from the single point of failure as it relies on a single proxy to perform ciphertext transformations. To resolve this problem, this paper introduces a new primitive called attribute-based threshold proxy re-encryption (AB-TPRE), that utilizes multiple (N) proxies for the transformations. In AB-TPRE, the re-encryption key is split into N shares, with each proxy receiving one share to generate a transformed ciphertext share. Only when a threshold (t) number of transformed ciphertext shares are combined can the transformed ciphertext be correctly generated. Furthermore, to address the security risk of shares leakage, we introduce a share updatable property that allows the re-encryption key shares to be refreshed. We propose a construction of AB-TPRE from lattices, and prove its security against the honest re-encryption attacks under the learning with errors (LWE) assumption, which is assumed to be quantum secure since up to now there is no known quantum algorithm to solve LWE in polynomial time.

A Blockchain-Based Efficient and Verifiable Attribute-Based Proxy Re-Encryption Cloud Sharing Scheme

When choosing a third-party cloud storage platform, the confidentiality of data should be the primary concern. To address the issue of one-to-many access control during data sharing, it is important to encrypt data with an access policy that enables fine-grained access. The attribute-based encryption scheme can be used for this purpose. Additionally, attribute-based proxy re-encryption (ABPRE) can generate a secret key using the delegatee’s secret key and access policy to re-encrypt the ciphertext, allowing for one-to-many data sharing. However, this scheme still has some flaws, such as low efficiency, inability to update access rules, and private data leakage. To address these issues, we proposed a scheme that combines attribute-based encryption (ABE) and identity-based encryption (IBE) to achieve efficient data sharing and data correctness verification. We also integrated this scheme with blockchain technology to ensure tamper-proof and regulated data storage, addressing issues such as data tampering and lack of supervision on third-party servers. Finally, to demonstrate the security of our scheme, we evaluated the communication overhead and computation overhead. Our results showed that our scheme is more efficient than other schemes and is secure against chosen plaintext attacks with verifiable properties.

Blockchain aware proxy re-encryption algorithm-based data sharing scheme

The blockchain stores transaction data in a distributed shared global ledger. It is challenging to strike a balance between privacy protection and usefulness while sharing data. Moreover, the dynamic adjustment of blockchain data access rights is a challenging problem. To this end, this paper suggests a blockchain data-controlled sharing scheme based on proxy re-encryption. First, a proxy re-encryption algorithm is constructed based on SM2 and the blockchain. Blockchain data sharing can give businesses a secure way to store and share data. Since this network is decentralized, and data is transmitted across a peer-to-peer network under the protection of an unchangeable cryptographic signature. Blockchain makes it more difficult to alter or hack the data. The data-controlled sharing scheme uses proxy re-encryption to protect transaction data privacy and realize data security sharing. Secondly, a dynamic adjustment mechanism for user rights is proposed. Blockchain nodes divide labor and manage re-encryption key parameters separately to achieve user access rights determinism Update, the visibility of transaction data is dynamically adjusted. Finally, the performance and security evaluation demonstrate that this scheme can realize the dynamic sharing of blockchain data while protecting transaction privacy and has advantages in computing overhead, which is better applicable to the Controlled sharing of blockchain data. This research suggests a regulated blockchain-based data-sharing system that makes use of proxy re-encryption. They are developing a proxy re-encryption algorithm with SM2 in order to fully safeguard the privacy of transaction data and to achieve data access authority determination by controlling proxy re-encryption key parameters. It is suggested to employ a hybrid attribute-based proxy re-encryption method that enables the proxy server to change attribute-encrypted cypher texts into identity-based encrypted cypher texts so that users with limited resources can access the previously encrypted material.

ATTRIBUTE-BASED PROXY RE-ENCRYPTION WITH KEYWORD SEARCH ON PERSONAL HEALTH RECORD

Personal health records (PHRs) contain sensitive health information that needs to be protected from unauthorized access. At the same time, patients may need to share their PHRs with healthcare providers or researchers to receive appropriate care or participate in medical studies. Attribute-based proxy re-encryption with keyword search (ABPRE-KS) is a what cryptographic technique that enables secure and controlled sharing of encrypted PHR data while preserving privacy and confidentiality of sensitive patient information. ABPRE-KS works by encryption of the PHR data using a key derived from the patient's attributes and allowing the patient to delegate access to the data to third parties using a proxy re-encryption scheme. To enable keyword search on the encrypted PHR data, an additional searchable encryption scheme can be used. ABPRE-KS provides a powerful tool for securely sharing and searching PHR and it can be used to facilitate better healthcare outcomes and medical research while protecting patient privacy.

Everything Under Control: Secure Data Sharing Mechanism for Cloud-Edge Computing

Cloud-edge computing is a new paradigm for data sharing. Many computation tasks are assigned to multiple edge nodes to mitigate the computing burden of the cloud and data is also outsourced to them to provide real-time services for IoT devices. However, two major issues remain, namely data privacy and real-world deployment. According to the data privacy rights and principles that stated by General Data Protection Regulation (GDPR), data access control, restriction of data processing and finding inaccuracy data are critical issues that should be tackled in cloud-edge computing. Besides, since there are various types of devices and many of them are resource-constrained, how to efficiently apply deployment in cloud-edge computing is challenging for practice. In this work, we propose a new cryptographic primitive Controllable Outsourced Attribute-Based Proxy Re-Encryption (COAB-PRE) and a universal WebAssembly-based implementation framework for cross-platform deployment. In particular, COAB-PRE achieves bilateral and distributed access control whereby data producers and data consumers can both specify policies the other party must satisfy without a centralized access control server. The property, that we called controllable delegation, restricts the data processing on the edge nodes. COAB-PRE also supports comprehensive verifiability to find out a wrong result produced by the edge nodes and locate the misbehaved one. Moreover, we further discussed the potential property of COAB-PRE and put forward an improved scheme with high efficiency on devices. We also implemented our scheme using the approach and deployed it on different devices for experiment. All theoretical and experimental results indicate that our solution is secure and practical, and our implementation is suitable for cloud-edge computing.

A Verifiable and Fair Attribute-Based Proxy Re-Encryption Scheme for Data Sharing in Clouds

To manage outsourced encrypted data sharing in clouds, attribute-based proxy re-encryption (ABPRE) has become an elegant primitive. In ABPRE, a cloud server can transform an original recipient’s ciphertext to a new one of a shared user’s. As the transformation is computation consuming, a malicious cloud server may return an incorrect re-encrypted ciphertext to save its computation resources. Moreover, a shared user may accuse the cloud server of returning an incorrect re-encrypted ciphertext to refuse to pay the cost of using the cloud service. However, existing ABPRE schemes do not support a mechanism to achieve verifiability and fairness. In this article, a novel verifiable and fair attribute-based proxy re-encryption (VF-ABPRE) scheme is introduced to support verifiability and fairness. The verifiability enables a shared user to verify whether the re-encrypted ciphertext returned by the server is correct and the fairness ensures a cloud server escape from malicious accusation if it has indeed conducted the re-encryption operation honestly. Additionally, we conduct a performance experiment to show the efficiency and practicality of the new VF-ABPRE scheme.

A Ring Learning with Errors-Based Ciphertext-Policy Attribute-Based Proxy Re-Encryption Scheme for Secure Big Data Sharing in Cloud Environment.

Owing to the huge volume of big data, users generally use the cloud to store big data. However, because the data are out of the control of users, sensitive data need to be protected. The ciphertext-policy attribute-based encryption scheme can not only effectively control the access of big data, but also decrypt the ciphertext as long as the user's attributes satisfy the access structure of ciphertext, so as to realize one to many big data sharing. When the user's attributes do not satisfy the access structure of ciphertext, the attribute-based proxy re-encryption scheme can be used for big data sharing. The ciphertext-policy attribute-based proxy re-encryption (CP-ABPRE) scheme combines the characteristics of the ciphertext-policy attribute-based encryption scheme and proxy re-encryption scheme. In a CP-ABPRE scheme, on the one hand, the data owner can use the ciphertext-policy attribute-based encryption scheme to encrypt the big data for cloud storage, to realize the access control of the big data. On the other hand, the proxy (cloud service provider) can convert ciphertext under one access structure into ciphertext under another access structure, thus realizing big data sharing between users of different attribute sets. In this article, we modify the existing attribute-based encryption scheme based on Ring Learning With Errors (RLWE), add re-encryption key generation algorithm, re-encryption ciphertext generation algorithm, and re-encryption ciphertext decryption algorithm, and construct CP-ABPRE scheme. In the construction of the re-encryption key, we introduce a random vector and hide the vector in the key by threshold technology. Finally, a CP-ABPRE scheme supporting threshold access structure is constructed based on RLWE. Compared with the existing attribute-based proxy re-encryption schemes, our scheme has smaller public parameters, can encrypt multiple plaintext bits at a time, and can resist selective access structure and chosen plaintext attack, so it is more suitable for big data sharing in cloud environment.

Revocable attribute-based proxy re-encryption

Abstract Attribute-based proxy re-encryption (ABPRE), which combines the notions of proxy re-encryption (PRE) and attribute-based encryption (ABE), allows a semi-trusted proxy with re-encryption key to transform a ciphertext under a particular access policy into a ciphertext under another access policy, without revealing any information about the underlying plaintext. This primitive is very useful in applications where encrypted data need to be stored in untrusted environments, such as cloud storage. In many practical applications, and in order to address scenarios where users misbehave or the re-encryption keys are compromised, an efficient revocation mechanism is necessary for ABPRE. Previously, revocation mechanism was considered in the settings of identity-based encryption (IBE), ABE, predicate encryption (PE), and broadcast PRE, but not ABPRE, which is what we set to do in this paper. We first formalize the concept of revocable ABPRE and its security model. Then, we propose a lattice-based instantiation of revocable ABPRE. Our scheme not only supports an efficient revocation mechanism but also supports polynomial-depth policy circuits and has short private keys, where the size of the keys is dependent only on the depth of the supported policy circuits. In addition, we prove that our scheme is selectively chosen-plaintext attack (CPA) secure in the standard model, based on the learning with errors assumption.

Attribute-based proxy re-encryption from standard lattices

Attribute-based proxy re-encryption (ABPRE), which combines the notions of proxy re-encryption (PRE) and attribute-based encryption (ABE), allows a semi-trusted proxy to transform a ciphertext under a particular access-policy into a ciphertext under another access policy, without revealing any information about the underlying plaintext. This primitive is very useful in some applications, where encrypted data needs to be stored in untrusted environments, such as cloud storage. In its key-policy flavor, the secret key is associated with an access policy that specifies which type of ciphertexts can be decrypted by that key, where ciphertexts are marked with different sets of attributes. However, all existing key-policy attribute-based proxy re-encryption (KP-ABPRE) schemes are based on classical number-theoretic assumptions, which are vulnerable to quantum attacks. This paper proposes the first KP-ABPRE scheme based on the learning with errors (LWE) problem, which is widely believed to be quantum-resistant. Our scheme is multi-hop, supports polynomial-depth policy circuits and has short private keys, where the size of the keys is dependent only on the depth of the supported policy circuits. In addition, we prove that our scheme is CPA secure in the selective security model, based on the LWE assumption.

Secure Ride-Sharing Services Based on a Consortium Blockchain

Due to poor traffic conditions and the high costs of traveling by private cars, ride sharing has become a popular means to trip. In view of the security threats and centralization existing in the current ride-sharing service, we propose a secure ride-sharing scheme based on a consortium blockchain, which can guarantee the security, confidentiality, and privacy of data interaction via attribute-based proxy re-encryption algorithm. First, the passenger presets the access structure and encrypts the data using attribute-based encryption. The ciphertext is then sent to the roadside unit (RSU), which broadcasts the carpooling request to the driver. After receiving the request, the driver sends the itinerary attribute to RSU, which performs carpool matching according to received ciphertext and itinerary attributes, then the ciphertext is re-encrypted and sent to the matched driver. Second, the master node uses an improved Delegated Proof-of-Stake (DPoS) consensus to verify the carpool record, which is stored on the blockchain after the verification is successful. In case of disputes, block data can be utilized for traceability. Third, drivers and passengers use the credibility mechanism to score each other after ride sharing. In addition, trusted authority can reveal the real identity of malicious users. Finally, we conduct a security analysis and performance evaluation for our proposed scheme. The results manifest that our scheme not only meets the security and privacy requirements of ride-sharing services but also effectively resists potential security risks. Therefore, our scheme is feasible, efficient, and suitable for ride-sharing services.