Attribute-based Encryption Research Articles

A Cross-domain Data Sharing Scheme for VANETs Based on Blockchain

With the continuous development of the Vehicular Ad Hoc Network (VANET), cross-domain sharing of vehicle data has become a significant concern. The Ciphertext-Policy Attribute-Based Encryption (CP-ABE) algorithm plays a key role in data sharing as it can achieve “one-to-many” transmission. In this paper, we propose a cross-domain data sharing scheme based on unpaired CP-ABE in VANETs, utilizing the blockchain and InterPlanetary File System (IPFS) system. The blockchain network is composed of trusted authorities (TAs) from different domains. Due to the high-speed movement characteristics of vehicles, we divide vehicle attributes into two categories: static and dynamic. we design a cross-domain data verification contract based on attribute bloom filter (ABF) for decryption testing. Vehicles that pass the test will receive dynamic attribute decryption keys generated by TAs in the data sharing domain to achieve cross-domain access. In addition, we design an outsourced decryption scheme to reduce the computational overhead during vehicle decryption and propose a direct permission revocation mechanism to ensure the flexibility and security of the system. The simulation experiment results show that our scheme optimizes the efficiency of cross-domain data access significantly compared with other approaches.

Data-Sharing System with Attribute-Based Encryption in Blockchain and Privacy Computing

With the development of the data-sharing system in recent years, financial management systems and their privacy have sparked great interest. Existing financial data-sharing systems store metadata, which include a hash value and database index on the blockchain, and store high-capacity actual data in the center database. However, current data-sharing systems largely depend on centralized systems, which are susceptible to distributed denial-of-service (DDoS) attacks and present a centralized attack vector. Furthermore, storing data in a local center database has a high risk of information disclosure and tampering. In this paper, we propose the ChainMaker Privacy Computing (CPC) system, a new decentralized data-sharing system for secure financial data, to solve this problem. It provides a series of financial data information and a data structure rather than actual data on the blockchain to protect the privacy of data. We utilize a smart contract to establish a trusted platform for the local database to obtain encrypted data. We design a resource catalog to provide a trusted environment of data usage in the privacy computing system that is visible for members on the blockchain. Based on cipher-policy attribute-based encryption (CP-ABE), We design a CPC-CP-ABE algorithm to enable fine-grained access control through attribute based encryption. Finally, We propose an efficient scheme that allows authenticated data-sharing systems to perform Boolean searches on encrypted data information. The results of experiment show that the CPC system can finish trusted data sharing to all organizations on the blockchain.

OSL-ABE: an optimal secure and lightweight attribute-based encryption method for blockchain-enabled IoT-based healthcare systems

OSL-ABE: an optimal secure and lightweight attribute-based encryption method for blockchain-enabled IoT-based healthcare systems

Secure Search of Smart Home Data Based on Access Control Encryption

Abstract: In recent years, the increasing variety of smart home devices, such as smart locks, surveillance cameras, and various sensors, has led to a significant rise in related data. To facilitate the sharing of smart home data, manufacturers store these data on the Internet of Things (IoT). However, since IoT servers are not fully trustworthy and the data often contain sensitive commercial information, any leakage could result in a commercial crisis for manufacturers. To address security concerns, manufacturers encrypt the data before storing them on the IoT. A challenge arises: how can users search for target data in encrypted form? This paper proposes a new search encryption scheme for smart home data, addressing the limitations of existing attribute-based encryption (ABE) searchable encryption schemes. The proposed scheme integrates access control trees and bilinear mapping technology, supporting multiple access policies including AND gates, OR gates, and threshold gates. Experimental results demonstrate a comprehensive analysis of the attribute-based searchable encryption protocol under a multi-authority architecture, covering four dimensions: correctness, security, complexity, and real-world application scenarios. In specific scenarios, when a data user, out of privacy concerns, is unwilling to reveal all attribute information to a single authority during a query for shared datathus avoiding identity disclosureor when the users identity information is managed by multiple independent authorities, this protocol proves highly effective. It ensures smooth data sharing while maintaining data security for both data owners and users, fully safeguarding data privacy and shareability.

Private approximate nearest neighbor search for on-chain data based on locality-sensitive hashing

Blockchain manages data with immutability, decentralization and traceability, offering new solutions for traditional information systems and greatly facilitating data sharing. However, on-chain data query still faces challenges such as low efficiency and difficulty in privacy protection. We propose a private Approximate Nearest Neighbor (ANN) search method for on-chain data based on Locality-Sensitive Hashing (LSH), which mainly includes two steps: query initialization and query implementation. In query initialization, the data management node builds hash tables for on-chain data through improved LSH, which are encrypted and stored on the blockchain using attribute-based encryption. In query implementation, node with correct privileges utilizes random smart contracts to query on-chain data privately by distributed point function and a privacy protection technique called oblivious masking. To validate the effectiveness of this method, we compare the performance with two ANN search algorithms, the query time is reduced by 57% and 59.2%, the average recall is increased by 4.5% and 2%, the average precision is increased by 7.7% and 6.9%, the average F1-score is increased by 6% and 4.3%, the average initialization time is reduced by 34 times and 122 times, respectively. We also compare the performance with private ANN search methods using homomorphic encryption, differential privacy and secure multi-party computation. The results show that our method can reduce the query time by several orders of magnitude, which is more applicable to the blockchain environment. To the best of our knowledge, this is the first private ANN search method for on-chain data, which consider the query efficiency and privacy protection, achieving efficient, accurate, and private data query.

An optimized dynamic attribute-based searchable encryption scheme.

Cloud computing liberates enterprises and organizations from expensive data centers and complex IT infrastructures by offering the on-demand availability of vast storage and computing power over the internet. Among the many service models in practice, the public cloud for its operation cost saving, flexibility, and better customer support popularity in individuals and organizations. Nonetheless, this shift in the trusted domain from the concerned users to the third-party service providers pops up many privacy and security concerns. These concerns hindrance the wide adaptation for many of its potential applications. Furthermore, classical encryption techniques render the encrypted data useless for many of its valuable operations. The combined concept of attribute-based encryption (ABE) and searchable encryption (SE), commonly known as attribute-based keyword searching (ABKS), emerges as a promising technology for these concerns. However, most of the contemporary ABE-based keyword searching schemes incorporate costly pairing and computationally heavy secret sharing mechanisms for its realization. Our proposed scheme avoids the expensive bilinear pairing operation during the searching operation and costly Lagrange interpolation for secret reconstruction. Besides, our proposed scheme enables the updation of access control policy without entirely re-encrypting the ciphertext. The security of our scheme in the selective-set model is proved under the Decisional Bilinear Diffie-Hellmen (DBDH) assumption and collision-free. Finally, the experimental results and performance evaluation demonstrate its communication and overall efficiency.

An Efficient Pairing-Free Ciphertext-Policy Attribute-Based Encryption Scheme for Internet of Things.

The Internet of Things (IoT) is a heterogeneous network composed of numerous dynamically connected devices. While it brings convenience, the IoT also faces serious challenges in data security. Ciphertext-policy attribute-based encryption (CP-ABE) is a promising cryptography method that supports fine-grained access control, offering a solution to the IoT's security issues. However, existing CP-ABE schemes are inefficient and unsuitable for IoT devices with limited computing resources. To address this problem, this paper proposes an efficient pairing-free CP-ABE scheme for the IoT. The scheme is based on lightweight elliptic curve scalar multiplication and supports multi-authority and verifiable outsourced decryption. The proposed scheme satisfies indistinguishability against chosen-plaintext attacks (CPA) under the elliptic curve decisional Diffie-Hellman (ECDDH) problem. Performance analysis shows that our proposed scheme is more efficient and better suited to the IoT environment compared to existing schemes.

Privacy preserving spatio-temporal attribute-based encryption for cloud applications

Privacy preserving spatio-temporal attribute-based encryption for cloud applications

A traceable and revocable decentralized attribute-based encryption scheme with fully hidden access policy for cloud-based smart healthcare

Smart healthcare is an emerging technology for enabling interaction between patients and medical personnel, medical institutions, and medical devices utilizing advanced Internet of Things (IoT) technologies. It has attracted significant attention from researchers because of the convenience of storing and sharing electronic medical records (EMRs) in the cloud. Given that a patient’s EMR contains sensitive individual information, it must be encrypted before uploading it to the cloud. As a solution for data confidentiality and fine-grained access control, the Ciphertext Policy Attribute-Based Encryption (CP-ABE) technique is proposed, which helps manipulate private personal data without explicit authorization. However, most CP-ABE schemes use a centralized mechanism which may lead to performance bottlenecks and single-point-of-failure issues. They will also be at risk of key abuse and privacy breaches in smart healthcare applications. To this end, in this paper, we investigate a traceable and revocable decentralized attribute-based encryption scheme with a fully hidden access policy (TR-HP-DABE). Firstly, to overcome the issues of user privacy leakage and single-point-of-failure, a fully hidden access policy is established for multiple attribute authorities. Secondly, to prevent key abuse, the proposed TR-HP-DABE can achieve the tracking and revocation of malicious users by using Key Encryption Key (KEK) trees and updating the partial ciphertext. Furthermore, the online/offline encryption and verifiable outsourced decryption are applied to improve its efficiency in practical smart healthcare. According to our analysis, the security and traceability of TR-HP-DABE can be proved. Finally, the performance evaluation of TR-HP-DABE is more effective than some existing typical ones.

An efficient hierarchical attribute-based encryption scheme with cross-domain data sharing

With the rapid advancement of data sharing technology, an increasing amount of data is being stored on cloud servers. To enable fine-grained access control over the data stored on cloud servers, the Ciphertext-Policy Attribute-Based Encryption (CP-ABE) technology has been widely adopted. Recognizing that shared data and files often possess a hierarchical structure, hierarchical CP-ABE technology has been proposed recently. However, most existing schemes are restricted to single-domain data access, which limits their flexibility and universal applicability in practical applications. To address this limitation, an access control scheme based on hierarchical CP-ABE, named CDS-CP-ABE, is proposed to facilitate secure and efficient cross-domain data sharing. The scheme is capable of not only realizing fine-grained hierarchical access control within a single domain but also enabling cross-domain data sharing. Security analysis confirms that our scheme effectively resists chosen-plaintext attack. Furthermore, empirical results indicate that the time consumption associated with our scheme is lower compared to other existing schemes.

Decoupling Online Ride-Hailing Services: A Privacy Protection Scheme Based on Decentralized Identity

Online ride-hailing services have become a vital component of urban transportation worldwide due to their convenience and flexibility. However, the expansion of their user base has dramatically heightened the risks of user privacy information leakage. Among these risks, the privacy leakage problem caused by the direct correlation between user (driver and passenger) identity information and location-based ride information is of particular concern. This paper proposes a novel privacy protection scheme for ride-hailing services. In this scheme, decentralized identities are employed for user authentication, separating the identity registration service from the ride-hailing platform, thereby preventing the platform from obtaining user privacy data. The scheme also employs a fuzzy matching strategy based on location Points of Interest (POI) and a ciphertext-policy attribute-based hybrid encryption algorithm to hide the user’s precise location and restrict access to location information. Crucially, the scheme achieves the complete decoupling of identity registration services and location-based ride services on the ride-hailing platform, ensuring that users’ real identities and ride data cannot be directly associated, effectively protecting user privacy. Within the decoupled architecture, regulatory authorities are established to handle emergencies within ride-hailing services. Through simulation experiments and security analysis, this scheme is demonstrated to be both feasible and practical, providing a new privacy protection solution for the ride-hailing industry.

Verifiable attribute-based multi-keyword search scheme with sensitive information hiding for cloud-assisted e-healthcare sharing systems

Cloud-assisted e-healthcare sharing systems (EHSSs) play an increasingly pivotal role in the contemporary healthcare field. By outsourcing electronic medical records (EMRs) to the cloud, hospitals can alleviate local storage and management burdens while facilitating data sharing. Due to the highly sensitive nature of EMRs, encryption is necessary before storing them on the cloud. Attribute-based keyword search (ABKS) enables the privacy protection of EMRs with efficient search services. However, there remain some limitations in practical application. Firstly, most ABKS schemes only support single keyword queries, resulting in inaccurate results and wastage of computing and bandwidth resources. Secondly, since sensitive information within EMRs is encrypted as a whole, different data users (including internal doctors and external researchers) should have varying access rights to prevent leakage of this sensitive information. Thirdly, incorrect search results could lead to misdiagnosis or endanger patients' lives and affect researchers' decision-making processes. To effectively tackle these challenges, this paper proposes a verifiable attribute-based multi-keyword search scheme with sensitive information hiding (VABMKS-SIH) for cloud-assisted EHSSs, where we present a secure model for multi-keyword search with two-level access structure by incorporating an improved blindness filtering technique into ciphertext-policy attribute-based encryption (CP-ABE) within existing keyword search framework. Our scheme employs a super-increasing sequence to aggregate multiple filtered data blocks into one unified ciphertext, thereby greatly reducing communication overhead during the transmission phases of ciphertext. To check the correctness of returned results, we introduce a lightweight algebraic signature algorithm based on fundamental algebraic operations. A security analysis demonstrates that VABMKS-SIH is provably secure under the random oracle mode. Additionally, we also evaluate the proposed scheme's performance to demonstrate its utility in cloud-assisted EHSSs.

Enhancing Smart Healthcare Networks: Integrating Attribute-Based Encryption for Optimization and Anti-Corruption Mechanisms

This study investigates the feasibility and effectiveness of integrating Attribute-Based Encryption (ABE) into smart healthcare networks, with a particular focus on its role in enhancing anti-corruption mechanisms. The study provides a comprehensive analysis of current vulnerabilities in these networks, identifying potential data security risks. An anti-corruption mechanism is designed to ensure data integrity and reliability. The ABE approach is then empirically compared to other prominent encryption algorithms, such as Identity-Based Encryption, Data Encryption Standard, Advanced Encryption Standard, and Rivest-Shamir-Adleman algorithms. These methods are evaluated based on access latency, data transmission speed, system stability, and anti-corruption capabilities. Experimental results highlight the strengths of the ABE algorithm, demonstrating an average access latency of 31.6 milliseconds, a data transmission speed of 3.56 MB/s, and an average system stability of 98.74%. Furthermore, when integrated into anti-corruption mechanisms, ABE effectively protects against data tampering and misuse, ensuring secure data transmission. Compared to alternative algorithms, ABE offers a more efficient, secure, and stable solution for data management within smart healthcare networks, supported by its robust anti-corruption capabilities. This positions ABE as an optimal choice for safeguarding the integrity and security of healthcare data.

RT-PPS: Real-time privacy-preserving scheme for cloud-hosted IoT data

The Internet of Things (IoT) is a rapidly growing network of devices that can communicate with each other and with cloud-based services. These devices generate vast amounts of data that can be used to provide valuable insights into user behavior, environmental conditions, and other important factors. However, as this data is collected and processed by cloud-hosted services, there is a growing concern about privacy and security. Without adequate protection, sensitive information could be exposed to hackers or other malicious actors, putting both individuals and organizations at risk. To address this challenge, real-time privacy-preserving techniques can be used to protect IoT data without compromising its value. This paper introduces an efficient Real-time privacy-preserving scheme (RT-PPS) for cloud-hosted IoT data. RT-PPS employs multi-authority attribute-based encryption on a hybrid cloud environment to keep data secure and private, while still allowing it to be processed and analyzed by cloud-hosted services. RT-PPS has efficient response time and resource consumption, which gives it the ability to handle a huge number of concurrent users at the same time without notable delay. The proposed RT-PPS has been validated through extensive experimental evaluation on a variety of configurations. Moreover, the proposed scheme has been computationally compared with the state-of-the-artwork. RT-PPS has shown excellent performance, effectiveness, and efficiency. The RT-PPS encryption time for a 1 GB dataset while considering 1024 slices is approximately 1000 ms. Also, the RT-PPS decryption time for a 1 GB ciphertext while considering 1024 slices are approximately 235 ms. Finally, RT-PPS is proven secure against any polynomial-time attacks and their variations that have at most a negligible advantage in the introduced security model. Moreover compared to most of the state-of-the-artwork, RT-PPS reduced the ciphertext size and lowered the computations in the encryption, key generation, decryption, and ciphertext update while assuring their security. By implementing RT-PPS, organizations can take advantage of the benefits of IoT data while protecting the privacy of their users and maintaining the security of their systems.

Efficient quantum multi-authority attribute-based encryption and generalizations

Efficient quantum multi-authority attribute-based encryption and generalizations

A robust algorithm for authenticated health data access via blockchain and cloud computing.

In modern healthcare, providers increasingly use cloud services to store and share electronic medical records. However, traditional cloud hosting, which depends on intermediaries, poses risks to privacy and security, including inadequate control over access, data auditing, and tracking data origins. Additionally, current schemes face significant limitations such as scalability concerns, high computational overhead, practical implementation challenges, and issues with interoperability and data standardization. Unauthorized data access by cloud providers further exacerbates these concerns. Blockchain technology, known for its secure and decentralized nature, offers a solution by enabling secure data auditing in sharing systems. This research integrates blockchain into healthcare for efficient record management. We proposed a blockchain-based method for secure EHR management and integrated Ciphertext-Policy Attribute-Based Encryption (CP-ABE) for fine-grained access control. The proposed algorithm combines blockchain and smart contracts with a cloud-based healthcare Service Management System (SMS) to ensure secure and accessible EHRs. Smart contracts automate key management, encryption, and decryption processes, enhancing data security and integrity. The blockchain ledger authenticates data transactions, while the cloud provides scalability. The SMS manages access requests, enhancing resource allocation and response times. A dual authentication system confirms patient keys before granting data access, with failed attempts leading to access revocation and incident logging. Our analyses show that this algorithm significantly improves the security and efficiency of health data exchanges. By combining blockchain's decentralized structure with the cloud's scalability, this approach significantly improves EHR security protocols in modern healthcare setting.

Secured fog-based vehicular crowd-sensing protocol by Modified Attribute based Encryption Model

The contemporary fog computing paradigm evolved from traditional cloud computing to give storage and computation resources at the network’s edge. Fog enabled vehicular processing is anticipated to be a fundamental component that may expedite a variety of applications, notably crowd-sensing, when applied to vehicular networks. As a result, the confidentiality and safety of vehicles participating in the crowd-sensing platform are now recognized as critical challenges for smart police and cyber defence. Furthermore, sophisticated access control is essential to meet the requirements of crowd-sensing users of information. This work presents a novel secured fog-based protocol for vehicular crowd sensing utilizing an attribute-based encryption model. The proposed framework incorporates a two-layered fog architecture termed fog layer A and fog layer B. Fog layer A includes data owners (vehicles) and fog nodes, while fog layer B consists of fog nodes integrated with Road Side Units (RSUs). The Transport Triggered Architecture (TTA) governs the retrieval of regular or specialized data as per the request of data users. The data collection procedure varies based on the type of data being processed. Regular data is gathered from data owners, aggregated using the Multiple Kernel Induced in Kernel Least Mean Square (MKI-KLMS) technique, which employs kernel least mean square and hierarchical fractional bidirectional least mean square methods to handle redundancy in data aggregation. Subsequently, the aggregated data is encrypted using the Proposed Fusion Key for Encryption (PFKE) technique, which employs a fusion key for message encryption. Additionally, an enhanced Blowfish algorithm is applied for an extra layer of encryption on the already encrypted data. The encrypted data is then transmitted to the TTA. The decryption process utilizes the same key to retrieve the original message. The Modified Attribute based Encryption Model (MAEM) scheme achieves the highest efficiency of 90.9476.

A Combination of Attribute-Based Encryption and Blockchain Access Control Scheme in Smart Home Environment

In response to the problems of excessive decryption computation burden on users, inability to protect users' privacy information, and the inability of traditional cloud storage methods to meet users' faster file upload and download speed requirements and track malicious users, this paper proposes an attribute-based encryption and blockchain-based trusted data access control scheme for smart home environments. The scheme combines symmetric encryption algorithms and attribute-based encryption algorithms to achieve fine-grained access control of data. At the same time, it leverages edge computing technology to outsource most of the decryption and computation operations to edge computing nodes, reducing the user's decryption and computation burden. Furthermore, the introduction of blockchain technology enables the monitoring and auditing of users within the system, achieving full traceability of access control. Finally, the proposed scheme was analyzed and validated through simulation experiments, which showed that the scheme is safe and effective, protecting users' security and privacy, and enabling secure data sharing.

Anonymous Attribute-Based Searchable Encryption for Smart Health System

Anonymous Attribute-Based Searchable Encryption for Smart Health System

Self-sovereign identity management in ciphertext policy attribute based encryption for IoT protocols

In the Internet of Things, access control and identity management rely on centralized platforms. However, centralized platforms will compromise user privacy with identity leakage. Self-sovereign identity (SSI) is a novel model for identity management that does not require third-party centralized authority. Thus, SSI is a potential solution to the identity management problem in IoT access control. This paper’s motivation is to address the problems of lack of identity sovereignty, centralized authorization, and high computational overhead for IoT access control. We propose a novel access control scheme for IoT that decentralizes identity management and tackles single-point-of-failure issues. This scheme leverages ciphertext policy attribute-based encryption (CP-ABE) and SSI to achieve the overall goal. Specifically, Our scheme eliminates the central authority and empowers users to manage their identity, allowing users to decide what attributes they disclose. Regarding the distribution of roles in the architecture, this paper follows the generic SSI model (ISSUER–HOLDER—VERIFIER) that allows a user to access a service from a service provider. To enable real-world deployment of our scheme, we establish an attribute authorization authority(such as the government) as a trusted identity point of entry. Users generate decentralized identifiers to enjoy services of interest in a privacy-preserving manner. The analysis demonstrates the practicality and superiority of our scheme. Our scheme requires less computation and is suitable for resource-constrained IoT scenarios.