Certificateless Proxy Re-encryption Research Articles

Certificateless Proxy Re-encryption with Cryptographic Reverse Firewalls for Secure Cloud Data Sharing

Cloud computing has enabled data-sharing to be more convenient than ever before. However, data security is a major concern that prevents cloud computing from being widely adopted. A potential solution to secure data-sharing in cloud computing is proxy re-encryption (PRE), which allows a proxy to transform encrypted data from one key to another without accessing the plaintext. When using PRE, various challenges arise, including the leak of information by a trusted third party, collusion attacks, and issues associated with revocation. To overcome these challenges, this paper proposes a novel Certificateless Proxy Reencryption with Cryptographic Reverse Firewall for Secure Cloud Data Sharing (CLPRE-CRF). The new scheme enables secure distribution of encrypted data from a data owner to users through public clouds. Meanwhile, the CLPRE-CRF scheme can resist exfiltration of secret information and forgery of ciphertext in case the scheme is compromised. In addition, the scheme provides a flexible revocation mechanism to prevent unauthorized access to private data. The security analysis demonstrates that the CLPRE-CRF resists chosen-plaintext attacks and collusion attacks. Moreover, performance evaluation indicates that our scheme achieves a 14% and 22% reduction in computation costs during the encryption and decryption algorithms, respectively. Therefore, the proposed CLPRE-CRF scheme is well-suited for cloud computing environments.

A lattice-based efficient certificateless public key encryption for big data security in clouds

With the advancement of technology and the development of digitization, big data has become an integral component of modern society. Due to the huge volume of big data, users generally upload data to the cloud for storage and computation. Because data in the cloud is beyond the control of users, it faces threats such as data security and personal privacy leakage. To address these concerns and achieve big data security and privacy protection in clouds, data encryption is crucial. Traditional public key encryption involves complex certificate management in a public key infrastructure (PKI). Although the identity-based encryption (IBE) scheme avoids the management of public key certificates, it has issues with key escrows and identity revocation. The certificateless public key encryption (CL-PKE) not only solves the key escrows problem in IBE, but also maintains its advantage of not requiring the use of certificate in PKI, making it suitable for the security protection of big data in clouds. However, most CL-PKE schemes are constructed based on large integer factorization and discrete logarithm problems, which cannot resist quantum computing attacks. Therefore, this paper proposes an efficient lattice-based CL-PKE scheme for big data security in clouds. In addition, the proposed scheme is extended to a lattice-based certificateless proxy re-encryption scheme, facilitating secure big data sharing in clouds. The proposed CL-PKE scheme can resist attacks from both internal and external adversaries, and has been proven to be IND-CPA secure under the learning with errors (LWE) assumption. Experiments have shown that the proposed CL-PKE scheme has lower computational and communication costs. The proposed lattice-based schemes can effectively provide post quantum security for the security and privacy protection of big data in clouds.

A Comprehensive Privacy-Preserving Federated Learning Scheme With Secure Authentication and Aggregation for Internet of Medical Things.

Data mining, integration, and utilization are the inevitable trend of the Internet of Medical Things (IoMT) in the context of Big Data. With the increasing demand for data privacy, federated learning has emerged as a new paradigm, which enables distributed joint training of medical data sources without leaving the private domain. However, federated learning is suffering from security threats as the shared local model will reveal original datasets. Privacy leakage is even more fatal in healthcare because medical data contains critically sensitive information. In addition, open wireless channels are susceptible to malicious attacks. To further safeguard the privacy of IoMT, we propose a comprehensive privacy-preserving federated learning scheme with a tactful dropout handling mechanism. The proposed scheme leverages blind masking and certificateless proxy re-encryption (CL-PRE) for secure aggregation, ensuring the confidentiality of the local model and rendering the global model invisible to any parties other than clients. It also provides authentication of uploaded models while protecting identity privacy. Compared with other relevant schemes, our solution has better performance on functional features and efficiency, and is more applicable to IoMT systems with many devices.

CLAP-PRE: Certificateless Autonomous Path Proxy Re-Encryption for Data Sharing in the Cloud

In e-health systems, patients encrypt their personal health data for privacy purposes and upload them to the cloud. There exists a need for sharing patient health data with doctors for healing purposes in one’s own preferred order. To achieve this fine-gained access control to delegation paths, some researchers have designed a new proxy re-encryption (PRE) scheme called autonomous path proxy re-encryption (AP-PRE), where the delegator can control the whole delegation path in a multi-hop delegation process. In this paper, we introduce a certificateless autonomous path proxy re-encryption (CLAP-PRE) using multilinear maps, which holds both the properties (i.e., certificateless, autonomous path) of certificateless encryption and autonomous path proxy re-encryption. In the proposed scheme, (a) each user has two public keys (user’s identity and traditional public key) with corresponding private keys, and (b) each ciphertext is first re-encrypted from a public key encryption (PKE) scheme to an identity-based encryption (IBE) scheme and then transformed in the IBE scheme. Our scheme is an IND-CPA secure CLAP-PRE scheme under the k-multilinear decisional Diffie–Hellman (k-MDDH) assumption in the random oracle model.

Confidentiality and Integrity Schemes for Multicore Shared Memory Systems

In embedded multicore shared memory systems, processing elements (PEs) are mutually untrusted since they carry different computing tasks independently. Therefore, the sharing of secret constants (SCs) between PEs, which is applied in the existing confidentiality protection schemes, will lead to the leakage of nonshared data. Besides, for integrity protection, tree construction checking over the whole counter space leads to the increase of both memory occupation and the average delay of verification. In this paper, we propose a ciphertext sharing confidentiality protection scheme based on certificateless proxy re-encryption and an integrity protection scheme based on a multigranularity scalable hash tree for secure data sharing between untrusted processing elements (SDSUP). With our schemes, the SC does not need to be shared and the scale of the checking tree is reduced, thus solving the leakage of nonshared data and reducing the high cost in integrity check. The results from the Rice Simulator for ILP Multiprocessors (RSIM) multicore simulator show that compared with the unprotected system, the performance degradation from applying the confidentiality protection scheme is 17.3% on average. Moreover, the performance degradation of the integrity protection scheme is 12.89%, which is superior to 35.36% for the bonsai Merkle tree (BMT), 29.49% for the multigrained hash tree (MGT) and 21.82% for the multigranularity incremental hash tree (MIT).

Certificateless Proxy Reencryption Scheme (CPRES) Based on Hyperelliptic Curve for Access Control in Content-Centric Network (CCN)

Information-centric networking is the developing model envisioned by an increasing body of the data communication research community, which shifts the current network paradigm from host centric to data centric, well-known to information-centric networking (ICN). Further, the ICN adopts different types of architectures to extend the growth of the Internet infrastructure, e.g., name-based routing and in-network caching. As a result, the data can be easily routed and accessed within the network. However, when the producer generates contents for authentic consumers, then it is necessary for him/her to have a technique for content confidentiality, privacy, and access control. To provide the previously mentioned services, this paper presents a certificateless proxy reencryption scheme (CPRES) based on the hyperelliptic curve for access control in the content-centric network (CCN). Using certificateless PRE, the power of the key generation center (KGC) is limited to only the generation of partial keys to secure the access to the content. With the help of these partial keys, the producer further calculates keys for encryption and reencryption process. The simulation results show that the proposed scheme provides secure access to content during end-to-end communication. Moreover, the proposed CPRES scheme outperforms in terms of low computational energy and efficient utilization of communication bandwidth.

A cloud data deduplication scheme based on certificateless proxy re-encryption

Abstract Cloud data deduplication removes redundant data blocks or files and keeps only one copy in the cloud storage server. In order to improve on security, we need to encrypt data files and blocks such that all same files and blocks are detectable based on ciphertext for deduplication. So how to detect a ciphertext to find the same files is a challenging problem. In this paper, we propose a cloud data deduplication scheme based on certificateless proxy re-encryption. It contains certificateless proxy re-encryption (CL-PRE) and proof of ownership based on certificateless signature (PoW-CLS). Compared with the existing scheme, we use certificateless cryptography to solve the problem of key escrow and avoid the situation where a key generation center (KGC) impersonates a user to decrypt the ciphertext. Our CL-PRE realizes data deduplication across users and our PoW-CLS improves the efficiency of the proof of ownership (PoW).

Parallel Certificateless Proxy Reencryption Scheme Applicable for Cloud Storage

Parallel Certificateless Proxy Reencryption Scheme Applicable for Cloud Storage

Efficient and provably-secure certificateless proxy re-encryption scheme for secure cloud data sharing

In current cloud computing system, large amounts of sensitive data are shared to other cloud users. To keep these data confidentiality, data owners should encrypt their data before outsourcing. We choose proxy reencryption (PRE) as the cloud data encryption technique. In a PRE system, a semi-trusted proxy can transform a ciphertext under one public key into a ciphertext of the same message under another public key, but the proxy cannot gain any information about the message. In this paper, we propose a certificateless PRE (CL-PRE) scheme without pairings. The security of the proposed scheme can be proved to be equivalent to the computational Diffie-Hellman (CDH) problem in the random oracle model. Compared with other existing CL-PRE schemes, our scheme requires less computation cost and is significantly more efficient. The new scheme does not need the public key certificates to guarantee validity of public keys and solves the key escrow problem in identity-based public key cryptography.

A scalable certificateless architecture for multicast wireless mesh network using proxy re-encryption

Wireless mesh networks are promising means of providing network coverage to areas where infrastructure is difficult to install. However, little work has been done on leveraging security and transmission overheads among multicast members in a multihop wireless network. This paper proposes a novel architecture for multicast wireless mesh network by exploiting a cryptographic primitive, certificateless proxy re-encryption. The methodology we present reduces the transformation ciphertexts from ki¾?n down to k+n, where k and n denote the length of the best route from the sender to the target users and the number of the valid receivers in the group, respectively. The proxy re-encryption scheme used in our architecture is newly constructed. Our proxy re-encryption scheme is against adaptive chosen- ciphertext attacks in the standard model. Copyright © 2013 John Wiley & Sons, Ltd.