Attribute-based Signature Research Articles

Dynamic fine-grained access control for smart contracts based on improved attribute-based signature

Dynamic fine-grained access control for smart contracts based on improved attribute-based signature

Privacy enhanced secure compact attribute-based signature from MQ problem for monotone span program

The rapid advancement of computer networks has led to an increase in the exposure of messages within an open environment (cloud). Therefore, the confidentiality of the user's signing information is extremely essential to handle unauthorized access and alterations. Attribute-based signature (ABS) scheme is a significant primitive that ensures the privacy of the user's signing information. To endorse a message, the signer can generate a signature with his/her attributes that satisfy a policy without revealing any other information. Post-quantum attribute-based signature schemes are attractive construction options whose safety do not collapse in presence of quantum computers. This article presents the first attribute-based signature scheme in multivariate quadratic (MQ) setting. To generate the secret signing key, the salted-UOV technique is employed in our protocol. While signing, the well-known 3-pass identification protocol is coupled with the Fiat-Shamir transformation. More positively, our candidate relies on presenting the policy as a monotone span program. We also study existential unforgeability and the perfect privacy feature which ensures that a signature cannot be linked to any signing information. Moreover, our scheme is compact in the sense that it performs efficiently in terms of storage when contrasted to the existing post-quantum attribute-based signature schemes.

A revocable and comparable attribute-based signature scheme from lattices for IoMT

The Internet of Medical Things (IoMT) refers to the utilization of the Internet of Things (IoT) technology in the healthcare industry. Access control is particularly important for IoMT due to the sensitive nature of patient data, such as electronic health records (EHR). Although fine-grained access control can be achieved by attribute-based signature (ABS), existing ABS schemes lacks the ability to provide range comparison access policy in which patients can check whether the attribute value is within a certain range. In addition, the dynamic change of doctors’ permissions and the development of quantum technology also require that ABS can provide user revocation and resist quantum attacks. In order to solve these problems and make ABS schemes for IoMT more useful and more secure, we come up with a novel revocable and comparable ABS (RC-ABS) from lattices for IoMT, enabling fine-grained access control, attribute range comparison, and user revocation. First of all, we provide a proof of the unforgeability of our scheme in the standard model (SM) under the selective user revocation list semi-adaptive attribute adaptive message attack, which can resist attacks by semi-honest adversaries and prevent adversaries from attacking the weaknesses of hash functions in IoMT. Furthermore, our ABS scheme leverages the small integer solution problem (SIS) to effectively defends against quantum algorithm attacks. Finally, detailed performance analysis demonstrates that our solution not only possesses enhanced security features and functionalities, such as revocability, comparability, and resistance against quantum attacks, but also maintains a constant computation cost of user revocation, making it more efficient compared to other revocation schemes.

Attribute-based linear homomorphic signature scheme based on key policy for mobile crowdsensing

Compared with traditional wireless sensor networks, mobile crowdsensing networks have advantages of low cost, easy maintenance, and high scalability, which will play a role in city-level data sensing scenarios in the future. So far, linear homomorphic signatures based on Public Key Instruction,identity, as well as certificateless, have been proposed in wireless sensor networks to resist the data contamination. However, these signature schemes cannot perform finer-grained signature verification, and these signature schemes do not realize the separation of users’ sensitive information from their data. To solve the above problems, we design an attribute-based linear homomorphic signature scheme for large-scale wireless network built with mobile smart devices. First, we give the definition of the attribute-based linear homomorphic signature scheme based on key policy (KP-ABLHS). Second, we construct KP-ABLHS by incorporating attribute-based signature and linear homomorphic coding signature scheme. Finally, we prove our protocol is secure in random oracle model (ROM) and use Python pairing-based cryptography library (pypbc) to implement the scheme. The experimental results show that our scheme is as efficient as Li et al.’s scheme and has the advantage of signing the set of attributes, while the efficiency of our scheme is significantly better than that of scheme Boneh et al.’s scheme.

ABAC-PA2: Attribute-Based Access Control Model with Privacy aware Anonymous Access

Cloud computing offers an excellent platform for sharing information and services among departments, partners, customers, and other parties. To ensure the effectiveness of a cloud deployment, it is imperative that resources and data are available in a secure and efficient manner. The protection of personally identifiable information (PII) is a critical requirement for many organizations in order to prevent unauthorized disclosure of that information. In spite of the fact that private information may not be stored within an authorized organization, it can still be protected. It has been shown in recent literature that anonymity can be used to preserve PII privacy. The current methodology for anonymous access is based on certificates rather than subject identity or attribute-based encryption. Identity-based access control is inflexible and violates privacy laws. Access to a certificate can be linked using a certificate that poses a risk of re-identification. The types of objects that can be encrypted by attributes are limited.To preserve the privacy of attributes set of subject and object, we extend the attribute-based access control (ABAC) model by expressing privacy requirements with anonymous access. It inherits several characteristics from ABAC, including fine-grained authorizations, unlimited object types, policy flexibility, and object privacy. ABAC-PA2 uses homomorphic attribute-based signature (HABS), a secure anonymous access framework that enhances ABAC's identity-less and incorporates privacy-preserving principles by assigning privacy levels to resources.

Efficient attribute-based strong designated verifier signature scheme based on elliptic curve cryptography.

In an attribute-based strong designated verifier signature, a signer who satisfies the access structure signs the message and assigns it to a verifier who satisfies the access structure to verify it, which enables fine-grained access control for signers and verifiers. Such signatures are used in scenarios where the identity of the signer needs to be protected, or where the public verifiability of the signature is avoided and only the designated recipient can verify the validity of the signature. To address the problem that the overall overhead of the traditional attribute-based strong designated verifier signature scheme is relatively large, an efficient attribute-based strong designated verifier signature scheme based on elliptic curve cryptography is proposed, as well as a security analysis of the new scheme given in the standard model under the difficulty of the elliptic curve discrete logarithm problem (ECDLP). On the one hand, the proposed scheme is based on elliptic curve cryptography and uses scalar multiplication on elliptic curves, which is computationally lighter, instead of bilinear pairing, which has a higher computational overhead in traditional attribute-based signature schemes. This reduces the computational overhead of signing and verification in the system, improves the efficiency of the system, and makes the scheme more suitable for resource-constrained cloud end-user scenarios. On the other hand, the proposed scheme uses LSSS (Linear Secret Sharing Schemes) access structure with stronger access policy expression, which is more efficient than the "And" gate or access tree access structure, making the computational efficiency of the proposed scheme meet the needs of resource-constrained cloud end-users.

Attribute Based Signature Encryption Scheme Based on Cloud Computing in Medical Social Networks

The emergence of mobile medical social networks has provided great convenience for patients to communicate with each other about their medical conditions, promoting efficient and high-quality communication and exchange among patients. However, at the same time, it has also raised issues of confidentiality and privacy of patient data. In response to this issue, this article proposes a cloud-based attribute-based signature encryption scheme that can effectively protect the privacy of patient data. The patient encrypts their medical information and uploads it to the cloud server. When the data user wants to access the patient’s information, the cloud server helps the data user partially decrypt and verify the integrity of the data, which to some extent reduces the computational workload of the data user. Meanwhile, under the random oracle model, it has been proven that the scheme satisfies the unforgeability under selective message attacks, indistinguishability under selective cipher text attacks, and attribute privacy security. Theoretical analysis and numerical simulation experiments show that this scheme has higher efficiency than existing schemes in the signing and decryption stages.

A study on the traceable attribute-based signature scheme provided with anonymous credentials

In order to provide the reliability of transmitted data in the era of big data, it is necessary to communicate by applying signature technology to data. There are various signature schemes, among which attribute-based signatures perform signatures based on user attributes. This ensures signer anonymity by allowing users to create and verify signatures without exposing the signer's sensitive information. However, the verifier can verify normally if the attribute period expires and a user without signing authority creates and transmits a signature with the existing signing key and attributes. In addition, signers who abuse anonymity can disclose their signing keys and attributes for some purpose (Money, profit) because there is no risk of being caught. Unauthorized users can use public information to sign and send messages. Therefore, in this paper, we propose a Traceable Attribute-based Signature scheme provided with anonymous credentials. The proposed scheme has the feature of verifying the validity of the signer by using the pseudonym ID included in the user list in the cloud server. In addition, the signer's identity is expressed as an Oblivious Transfer-based pseudonym ID. The signer's identity can be verified through tracing in case of a problem.

A novel lightweight decentralized attribute-based signature scheme for social co-governance

Social co-governance is an effective way to solve public safety incidents such as COVID-19 incident. But the insiders wouldn’t share the firsthand information for fear of cyber-violence. Though most of researches paid attention to the data access control and security, less attention focused on the identity privacy. So, in this work, it constructed a lightweight decentralized attribute-based signature scheme with unconditional full anonymity (LDABS-UFA) scheme to protect user’s identity privacy security. It confuses the user’s private key with fuzzy factors, and prevents user’s privacy in the signature from being disclosed. It outsources some complex computing to cloud servers to reduce the user device performance overhead. The security analysis result shows that the scheme is UFA security, unforgeability and non-collusion. Besides, a social co-governance system based on lightweight blackbox-based traceable decentralized attribute-based signature (LWBT-DABS) scheme is proposed. By generating fingerprints for the data owner in the signature, regulators can monitor the entire system and prevent malicious user from spreading rumors. And it constructs an accountability mechanism to prevent the abuse of supervisory power. The performance analysis shows that the data signature of our scheme size is constant, and the scheme is feasibility and practicability.

TFS-ABS: Traceable and Forward-Secure Attribute-Based Signature Scheme With Constant-Size

Attribute-based signature (ABS) is a versatile and useful cryptogrammic technology. In an ABS scheme, every signer is distributed a signing secret key in term of her/his attributes, and endorses a message in relation to some signing policy fulfilled by the signer's attributes. The verifier checks that the signature is indeed endorsed by the signer whose attributes match with the signing policy. However, existing ABS schemes suffer from the issue of abusing signature and key exposure. To address the above issues, we provide a traceable and forward-secure attribute-based signature (TFS-ABS) scheme with constant-size supporting flexible threshold predicates. Furthermore, we prove that the presented TFS-ABS scheme is existential unforgeability against selective predicate attack under the standard model. We reduce the security for the provided scheme to <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$q$</tex-math></inline-formula> -Diffie-Hellman exponentiation assumption. The designed scheme can be used to alleviate the damage induced by key exposure and traces the real identity of signer by attribute authority (AA) when the signer occurs abusing behavior. Furthermore, the signature size in presented scheme keeps constant and is independent of the number of attributes. Experimental evaluations exhibit that the presented TFS-ABS scheme is efficient in term of the communication and computation overhead.

Distributed Attribute-Based Signature With Attribute Dynamic Update for Smart Grid

Smart grid is gaining more and more attention as one of the typical applications of Internet of Things. However, in a distributed environment, how to guarantee the privacy of users in electricity trading while ensuring the efficiency of the transactions is one of the urgent issues to be solved. In this paper, we propose an attribute-based signature (DABS) scheme for distributed electricity trading, which can support users' free choice of trade objects without revealing their real identities. We construct a signature generation and verification method by taking advantage of the open and hard-to-tamper properties of blockchain to achieve signature verifiability independent of dynamic changes in attributes. To improve the update efficiency, we propose an improved scheme that enables the update complexity to be reduced from <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$O(n)$</tex-math></inline-formula> to <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$O(\log n)$</tex-math></inline-formula> , where <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$n$</tex-math></inline-formula> is the number of users. Finally, performance analysis and simulation experiments demonstrate the security and practicality of DABS.

Efficient and Flexible Multiauthority Attribute-Based Authentication for IoT Devices

The correctness and reliability of data sources are the keys to the practicality of data collected by IoT devices. Attribute-based signature(ABS) is a cryptographic primitive for users to sign with their own attributes, which can be applied to the authentication process in IoT scenarios. The attribute authority is responsible for issuing the attribute key to the user in ABS. Multiple authorities can complete attribute management tasks to avoid the threat of a single authority. However, attribute authorities need to execute multiple interactions to collaborate to generate attribute keys for users, which brings a large transmission burden. In addition, a lot of resource-constrained terminals in the IoT mostly play the role of signer or verifier in authentication protocols. The signature generation and verification algorithms often have heavy pairing and exponentiation operations. Currently, no ABS scheme takes into account the efficiency of all participating entities simultaneously. In this paper, we present an aggregated anonymous key issue (AAKI) protocol to reduce the transmission burden between multiple authorities. Meanwhile, the non-interactive zero-knowledge proof aggregate exponentiation (NI-ZKPoKAE) protocol is designed to aggregate the transmitted secret values in AAKI. To reduce the computational burden of signers and verifiers, Blakley secret sharing, where the Hadamard matrix is used more efficiently to handle the (n,n)-threshold, is used to construct an efficient and fine-grained multi-authority ABS (EFMA-ABS) scheme. This brings high efficiency to all three types of parties involved in IoT authentication. Our above-mentioned protocols have been proven to be feasible and effective.

PIRAP: AASM: An Advanced Attribute-Based Security Model for Enhancing Trustworthy Data Sharing in Cloud Computing

In today’s world, cloud computing is widely used in various applications and services, which refers to the utilization of computational resources as per user requirements through the Internet. However, despite the numerous advancements in cloud services and applications, there are various security threats associated with it, mainly due to data outsourcing to third-party controlled data centers. In this context, this paper introduces a new model called Attribute-based Advanced Security Model (AASM) for Reliable Data Sharing in the Cloud. This model combines the Advanced Encryption Technique (AET) with Attribute-Based Signature (ABS) to ensure secure data sharing in the Cloud while efficiently controlling data access. The model enables encrypted access control from the data owner’s side with advanced access privileges, ensuring user privacy with an anonymous authentication model using ABS. By implementing these measures, the model provides security for cloud providers and users while safeguarding against malicious attacks. The effectiveness of the proposed model is evaluated based on factors such as time complexities, security and accountability.

Efficient Attribute-Based Signature With Collusion Resistance for Internet of Vehicles

Internet of Vehicles (IoV) realizes information interaction between vehicles and all networked entities, and the heterogeneous, openness, and diversity make it suffer from various security challenges such as authentication and access control problems. Attribute-based signature (ABS) is a promising cryptographic tool for addressing the above concerns, however, some existing ABS schemes take heavy computation overheads for signature verification. Though some server-aided ABS schemes are proposed to enhance performance, those schemes suffer from devastating collusion attacks. In addition, current signature-policy ABS schemes only support the single threshold access policy, which fails to meet various access control requirements of IoV. To address the above problems, we propose an efficient server-aided ABS with collusion resistance (SAABS-CR) for IoV. It utilizes server-aided computation technology to mitigate the computation burden of verifiers, while resisting perfectly the collusion attacks that include between signers and between the signer and the aided server. Moreover, SAABS-CR supports flexible expressions of access policy under the signature-policy framework by using the linear secret-sharing scheme (LSSS), and it is proved to be secure in the security model of strong unforgeability against chosen-message attacks (SU-CMA). Theoretical analyses and experimental evaluations show that SAABS-CR improves efficiency by reducing the time cost of signature generation at least 34.8% and user verification at least 15%.

A Hybrid Blockchain-Edge Architecture for Electronic Health Record Management With Attribute-Based Cryptographic Mechanisms

This paper presents a hybrid blockchain-edge architecture for managing Electronic Health Records (EHRs) with attribute-based cryptographic mechanisms. The architecture introduces a novel attribute-based signature aggregation (ABSA) scheme and multi-authority attribute-based encryption (MA-ABE) integrated with Paillier homomorphic encryption (HE) to protect patients&#x2019; anonymity and safeguard their EHRs. All the EHR activities and access control events are recorded permanently as blockchain transactions. We develop the ABSA module on Hyperledger Ursa cryptography library, MA-ABE module on OpenABE toolset, and blockchain network on Hyperledger Fabric. We measure the execution time of ABSA&#x2019;s signing and verification functions, MA-ABE with different access policies and homomorphic encryption schemes, and compare the results with other existing blockchain-based EHR systems. We validate the access activities and authentication events recorded in blockchain transactions and evaluate the transaction throughput and latency using Hyperledger Caliper. The results show that the performance meets real-world scenarios&#x2019; requirements while safeguarding EHR and is robust against unauthorized retrievals.

Blockchain-Based Privacy-Preserving Sensor Data Sharing with Fine-Grained Authorization in Microgrid

Microgrid is a power system that includes various energy sources (e.g., solar panels and wind turbines), where a number of device status and sensing data are collected and transmitted by smart sensors. Based on sensing-as-a-service in microgrid, sensor owners and sensor data consumers can effectively perform data sharing operations. However, the state-of-the-art sensor data sharing works in microgrid have the following two limitations: (i) cannot support fine-grained authorization for sensor owners and sensor data consumers and (ii) fail to simultaneously consider confidentiality and authenticity for sensor data sharing. To address the problems, in this article, we propose a lightweight privacy-preserving sensing data sharing system with fine-grained authorization in microgrid. Technically, we employed attribute-based signature methodology to design a fined-grained authorization mechanism for sensor data users. Moreover, a lightweight hyper elliptic curve-based signcryption scheme is employed to provide confidentiality and authenticity for sensor data sharing. To clarify the feasibility of our proposed system, we implement the system and evaluate the performance. The experimental results show that the system achieves small communication and time overhead, as well as highly acceptable gas consumption of smart contract.

Wildcarded identity-based ring signatures based on linearly homomorphic signatures

In identity-based ring signatures (IBRS) (Zhang and Kim, 2002), a binary string ID∈{0,1}L for L∈N, representing a unique information about a signer (e.g., e-mail address, telephone number), is associated with a secret-key. Its owner can anonymously signs a message under a set of IDs called ring including the signer’s ID. Wildcarded IBRS (WIBRS) (Ishizaka&Kiyomoto, ISC’20) is a generalization of IBRS, in which the ring consists of wildcarded IDs. The signer correctly signs iff her ID matches at least one of the wildcarded IDs. To the best of our knowledge, the only one known WIBRS scheme adaptively secure under standard assumptions is obtained as an instantiation of the attribute-based signatures scheme by Sakai et al. (PKC’16). It has signatures of length O(kL) and secret-keys of (constant) length O(1), where k denotes cardinality of the ring. In this paper, we propose a generic WIBRS construction, built by linearly homomorphic signatures and non-interactive witness-indistinguishable proof. We instantiate it to obtain a concrete WIBRS scheme secure under standard assumptions, whose length of signatures (resp. secret-keys) O(k+L) (resp. O(L)).

Secure Blockchain Transactions for Electronic Health Records based on an Improved Attribute-Based Signature Scheme (IASS)

Electronic Health Records (EHRs) are entirely controlled by hospitals, not patients, making it difficult to obtain medical advice from individual hospitals. Patients need to keep tabs on their health details and take back control of their medical data. The rapid development of blockchain technology has facilitated large-scale healthcare, including medical records and patient-related data. The technology provides comprehensive and immutable patient records and free access to electronic medical records for providers and treatment portals. To ensure the validity of the blockchain-connected EHR, the Improved Attribute-Based Signature Scheme (IASS) has considerable powers, allowing patients to approve messages based on attributes but not validated. In addition, it avoids the problem of having multiple authorities without a single or central source of trust for generating and distributing patient public/private keys and fits into the blockchain model for distributed data storage. By sharing a secret, pseudo-random activity seed between authorities, the protocol resists collusive attacks by corrupt officials. The technology provides patients with a comprehensive, immutable record and free access to their EHR from providers and treatment portals. To ensure the validity of blockchain-connected EHRs, propose an attribute-based multi-authority signature scheme that authorizes messages based on their attributes without revealing any information.

Provable Secure Attribute-Based Proxy Signature Over Lattice Small Integer Solution Problem in Random Oracle Model

Current proxy signature schemes are mostly identity-based proxy signatures that distinguish users by identity. This signature method faces some problems, such as identity information leakage and single access control. Attribute-based proxy signature (ABPS) divides the signer’s identity information into a collection of attributes; thus, users’ identity information can be protected and access control can become fine-grained. With the development of quantum computers, the security of signature schemes based on traditional number theory problems is under threat. Therefore, we construct a new attribute-based proxy signature scheme on a lattice that can resist quantum attacks. This scheme has the properties of both attribute-based signatures and proxy signatures, i.e., fine-grained access control and strong undeniability properties. Moreover, based on the small integer solution problem (SIS), our scheme is provably secure in the random oracle model and protects the proxy signer in the adaptive security model.

Short attribute-based signatures for arbitrary Turing machines from standard assumptions

This paper presents the first attribute-based signature (ABS) scheme supporting signing policies representable by Turing machines (TM), based on well-studied computational assumptions. Our work supports arbitraryTMs as signing policies in the sense that the TMs can accept signing attribute strings of unbounded polynomial length and there is no limit on their running time, description size, or space complexity. Moreover, we are able to achieve input-specific running time for the signing algorithm. All other known expressive ABS schemes could at most support signing policies realizable by either arbitrary polynomial-size circuits or TMs having a pre-determined upper bound on the running time. Consequently, those schemes can only deal with signing attribute strings whose lengths are a priori bounded, as well as suffers from the worst-case running time problem. On a more positive note, for the first time in the literature, the signature size of our ABS scheme only depends on the size of the signed message and is completely independent of the size of the signing policy under which the signature is generated. This is a significant achievement from the point of view of communication efficiency. Our ABS construction makes use of indistinguishability obfuscation (IO) for polynomial-size circuits and certain IO-compatible cryptographic tools. Note that, all of these building blocks including IO for polynomial-size circuits are currently known to be realizable under well-studied computational assumptions.