Certificateless Public Key Encryption Research Articles

A lattice-based efficient certificateless public key encryption for big data security in clouds

With the advancement of technology and the development of digitization, big data has become an integral component of modern society. Due to the huge volume of big data, users generally upload data to the cloud for storage and computation. Because data in the cloud is beyond the control of users, it faces threats such as data security and personal privacy leakage. To address these concerns and achieve big data security and privacy protection in clouds, data encryption is crucial. Traditional public key encryption involves complex certificate management in a public key infrastructure (PKI). Although the identity-based encryption (IBE) scheme avoids the management of public key certificates, it has issues with key escrows and identity revocation. The certificateless public key encryption (CL-PKE) not only solves the key escrows problem in IBE, but also maintains its advantage of not requiring the use of certificate in PKI, making it suitable for the security protection of big data in clouds. However, most CL-PKE schemes are constructed based on large integer factorization and discrete logarithm problems, which cannot resist quantum computing attacks. Therefore, this paper proposes an efficient lattice-based CL-PKE scheme for big data security in clouds. In addition, the proposed scheme is extended to a lattice-based certificateless proxy re-encryption scheme, facilitating secure big data sharing in clouds. The proposed CL-PKE scheme can resist attacks from both internal and external adversaries, and has been proven to be IND-CPA secure under the learning with errors (LWE) assumption. Experiments have shown that the proposed CL-PKE scheme has lower computational and communication costs. The proposed lattice-based schemes can effectively provide post quantum security for the security and privacy protection of big data in clouds.

Dual-server certificateless public key encryption with authorized equality test for outsourced IoT data

The Internet of Things (IoT) devices with restricted storage and computing sources are unable to store and handle massive data at local. A promising method is to engage some cloud server for maintaining outsourced encrypted IoT data and responding user request, in the meantime, the privacy of outsourced data can be protected. Existing encryption techniques with equality test allow the authorized cloud server to compare encrypted data and perform data classification. However, these schemes in the single server model cannot resist internal keyword guessing attacks. Also, the existing schemes in public key setting confront the burden of maintaining public key certificates, and the ones in identity-based setting face the key escrow problem. To address these issues, this paper proposes a dual-server certificateless public key encryption scheme supporting authorized equality test (DS-CL-AET) in bilinear groups. Security analysis indicates that the proposed DS-CL-AET scheme offers confidentiality protection for outsourced ciphertext and authentication tokens. Performance analysis demonstrates the practicality of our DS-CL-AET scheme in securing outsourced IoT data in clouds.

A designated tester-based certificateless public key encryption with conjunctive keyword search for cloud-based MIoT in dynamic multi-user environment

One of the essential technologies in the medical industry for achieving high performance and accuracy is the Medical Internet of Things (MIoT). The MIoT technology processes a large amount of patient information in real-time. And therefore, it poses a high risk of leaking personal information. Furthermore, as data is sent over public networks, security is critical in MIoT. To overcome the above issues, we developed a designated tester-based Certificateless Public-key Encryption with Conjunctive Keyword search for cloud-based MIoT in dynamic multi-user environment (dCL-PECK). This study explores three features: (1). A secure channel is not necessary to transfer the data from the data-user (i.e., data owner or data receiver) to the designated tester (i.e., medical cloud server) and allows only the designated tester to execute the test algorithm. (2). Data is encrypted only once for multiple data users and supports conjunctive keyword search. (3). Users are added and revoked dynamically. Furthermore, the proposed scheme is provably secure under ciphertext indistinguishable against inside and outside adversaries and trapdoor indistinguishable against outside adversaries. Finally, theoretical and experimental analyses have been performed, demonstrating that the proposed system is better than similar Certificateless Keyword Search (CLKS) systems. As a result, we feel that it is suitable for cloud-based MIoT.

Revocable Certificateless Public Key Encryption with Equality Test

Traditional public key cryptography requires certificates as a link between each user’s identity and her/his public key. Typically, public key infrastructures (PKI) are used to manage and maintain certificates. However, it takes a lot of resources to build PKI which includes many roles and complex policies. The concept of certificateless public key encryption (CL-PKC) was introduced to eliminate the need for certificates. Based on this concept, a mechanism called certificateless public key encryption with equality test (CL-PKEET) was proposed to ensure the confidentiality of private data and provide an equality test of different ciphertexts. The mechanism is suitable for cloud applications where users cannot only protect personal private data but also enjoy cloud services which test the equality of different ciphertexts. More specifically, any two ciphertexts can be tested to determine whether they are encrypted from the same plaintext. Indeed, any practical system needs to provide a solution to revoke compromised users. However, these existing CL-PKEET schemes do not address the revocation problem, and the related research is scant. Therefore, the aim of this article is to propose the first revocable CL-PKEET scheme called RCL-PKEET which can effectively remove illegal users from the system while maintaining the effectiveness of existing CL-PKEET schemes in encryption, decryption, and equality testing processes. Additionally, we formally demonstrate the security of the proposed scheme under the bilinear Diffie-Hellman assumption.

Blockchain-Based Privacy Access Control Mechanism and Collaborative Analysis for Medical Images

Medical image analysis technology based on deep learning has played an important role in computer-aided disease diagnosis and treatment. Classification accuracy has always been the primary goal pursued by researchers. However, the image transmission process also faces the problems of limited wireless ad-hoc network (WAN) bandwidth and increased security risks. Moreover, when user data are exposed to unauthorized users, platforms can easily leak personal privacy. Aiming at the abovementioned problems, a system model and an access control scheme for the collaborative analysis of the diagnosis of diabetic retinopathy (DR) are constructed in this paper. The system model includes two stages of data cleaning and lesion classification. In the data cleaning phase, the private cloud writes the model obtained after training into the blockchain, and other private clouds use the best-performing model on the chain to identify the image quality when cleaning data and pass the high-quality image to the lesion classification model for use. In the lesion classification stage, each private cloud trains the classification model separately; uploads its own model parameters to the public cloud for aggregation to obtain a global model; and then sends the global model to each private cloud to achieve collaborative learning, reduce the amount of data transmission, and protect personal privacy. Access control schemes include improved role-based access control (RAC) used within the private cloud and blockchain-based access control used during the interaction between the private cloud and the public cloud program (BAC). RAC grants both functional rights and data access rights to roles and takes into account object attributes for fine-grained level control. Based on certificateless public-key encryption technology and blockchain technology, BAC can realize the identity authentication and authority identification of the private cloud while requesting the transmission of model parameters from the private cloud to the public cloud and protect the security of the identity, authority, and model parameters of the private cloud to achieve the effect of lightweight access control. In the experimental part, two retinal datasets are used for DR classification analysis. The results show that data cleaning can effectively remove low-quality images and improve the accuracy of early lesion classification for doctors, with an accuracy rate of 90.2%.

A designated cloud server-based multi-user certificateless public key authenticated encryption with conjunctive keyword search against IKGA

With the massive growth of the World Wide Web (i.e., internet), individual users or companies can store and manage large amounts of sensitive data to outsource it to the cloud server. Despite its advantages, such as reducing local storage, reducing overhead, and providing backups, it faces security and data privacy issues. Many public-key encryption with keyword search (PEKS) schemes are developed to resolve the above problems. Nevertheless, those are not efficiently suitable for multi-user scenario applications. Recently, a new scheme developed called Multi-user certificateless public key encryption with a conjunctive keyword search (mCLPECK) scheme. It contains two features: the multi-user environment and the conjunctive keyword search function. Nevertheless, it requires a secure channel while transmitting the trapdoor to the cloud server, which is not practical in applications, and it cannot resist the keyword guessing attack (KGA). We propose a primitive called a designated cloud server-based multi-user certificateless public key authenticated encryption with conjunctive keyword search (dmCLPAECKS) scheme. It doesn’t require a secure channel between the designated cloud server and a data receiver and provides security against keyword guessing attack (KGA) in random oracle model. Furthermore, our proposed scheme shows better results than other related schemes in terms of communication and computation cost.

An improved secure certificateless public-key searchable encryption scheme with multi-trapdoor privacy

An improved secure certificateless public-key searchable encryption scheme with multi-trapdoor privacy

An efficient and secure certificateless searchable encryption scheme against keyword guessing attacks

As the wave of data breaches continues crashing down on companies, specially for companies that provide cloud storage services, the data security and privacy have become the main concern of most clients that use this kind of services. Certificateless public key encryption with keyword search (CLPEKS) is a novel cryptographic primitives that if implemented correctly, provides the possibility to search over an encrypted data that has been outsourced to the cloud server, while guaranteeing the privacy of the search-keyword used in the process. Several CLPEKS schemes have been presented in the literature, but many of them are found vulnerable to offline/online keyword guessing attacks either performed by inside attackers, outside attackers or by both. To overcome these security weaknesses, we propose an efficient and secure certificateless searchable encryption scheme that is proven to be resistant against different keyword guessing attacks under both, the hardness of solving the discrete logarithm (DL) and the computational Diffie-Hellman (CDH) problems in the random oracle model. Then, by conducting a comprehensive comparison between our proposed scheme and other related schemes, we found that the proposed scheme has better overall performance in terms of communication and computation complexities, while guaranteeing security against online and offline KGA performed by either outside attackers or inside attacker.

Multi-user certificateless public key encryption with conjunctive keyword search for cloud-based telemedicine

With the development of communication and information technologies, the telemedicine system has infiltrated many aspects of medicine field. It allows doctors to simultaneously diagnose patients in different areas, which provides great convenience to people. However, the increasing medical data brings serious challenges to people, such as data storage and processing. To reduce data management costs and enjoy convenient services, more and more individuals and medical institutions prefer to store data in the cloud. Recently, many public key encryption with keyword search (PEKS) schemes have been designed to address the security and privacy of the outsourced data. However, most of the existing schemes support only single-keyword search, and cannot suitable for multi-user environment. To resolve these issues, we construct a certificateless public key encryption with conjunctive keyword search scheme for multi-user system (mCLPECK), in which the same data only needs to be encrypted once and can be searched by multi-receiver. At the same time, the mCLPECK scheme supports multi-keyword search. Furthermore, we show the proposed scheme can resist chosen keyword attacks, and has lower storage and computation overhead compared to other related schemes.

An efficient certificateless public key encryption scheme with authorized equality test in healthcare environments

The challenges confronting the privacy of outsourcing medical data have become a significant concern for patients and healthcare providers. The encryption of this sensitive data before outsourcing to the healthcare server present an effective solution for protection. However, searching on different ciphertexts while protecting the privacy of data remains a research challenge. Indeed, most of the existing schemes are inefficient, particularly for deployment on mobile devices due to limited resources (e.g. computing power, battery lifetime, and storage capacity). In this paper, we propose a CertificateLess Public-Key Encryption with Authorized Equality Test (CLPKE-AET) scheme. With the CLPKE-AET scheme, an authorized cloud server is permitted to check the equivalence of two different ciphertexts consisting of the same messages. Moreover, We provide four types of authorizations, base on which an authorized user can directly search on different user’s ciphertext using different methods while enhancing the privacy of the user’s data. We present our construction from bilinear pairing and demonstrate its security under modified Bilinear Diffie-Hellman (mBDHI) assumption in the Random Oracle Model (ROM). Finally, compared with other’s similar schemes, the performance analysis shows that our CLPKE-AET scheme is practical and more suitable for healthcare environments.

Certificateless public key encryption with cryptographic reverse firewalls

Abstract The Snowden incident shows that powerful attackers can compromise users’ machines to steal users’ private information. Currently, many encryption schemes that have proven to be secure cannot detect vulnerabilities. These vulnerabilities may reveal users’ secrets, e.g., a machine hides some backdoors without a user’s awareness, and an attacker can steal the user’s private information through these backdoors. In 2015, Mironov and Stephens-Davidowitz proposed a new framework for solving this problem: cryptographic reverse firewall (CRF). However, their protocols can’t protect certificateless public key encryption (CL-PKE). In this paper, we design a CRF protocol for CL-PKE, which is a one-round CL-PKE with CRFs (CL-PKE-CRF) deployed on a receiver and a key generating centre (KGC). This protocol is proved to achieve indistinguishability against chosen plaintext attack (IND-CPA). Compared with existing protocol with CRFs and two CL-PKE schemes, our protocol has the least communication cost. Meanwhile, we use JPBC library to implement our one-round CL-PKE-CRF. The experimental results indicate that under high security levels, our protocol has a advantage in the percentage of the running time. Since our protocol can resist exfiltration attacks from internal attackers, it is efficient and practical. Finally, we apply the same method to design a secure and effective one-round certificateless public key signature with a CRF (CL-PKS-CRF). This means that our protocol is not only targeted at a single CL-PKE scheme, but also can inspire the design of other certificateless public key cryptography schemes with CRFs.

VCLPKES: Verifiable Certificateless Public Key Searchable Encryption Scheme for Industrial Internet of Things

Nowadays the data of the industrial Internet of Things (IIOT) have been stored in cloud servers. The security and privacy of stored data have been hot research topics. The technique of public key searchable encryption (PKSE) may contribute to protect the privacy of industrial data. It is extremely significant how to use PKSE to encrypted data and retrieve the encrypted data without revealing users’ private information. Meanwhile, most of the existing PKSE schemes do not consider the identity verification of the data owner who may upload bad ciphertext if he is malicious. In this paper, we firstly analyze the security of a certificateless searchable encryption scheme in the IIOT environment (Ma et al. scheme), and propose a feasible attack to demonstrate that their scheme is not secure. Through this attack, Type I adversary $A_{\mathrm {I}}$ can forge the trapdoor value for all keywords. Then we proposed a verifiable certificateless public key searchable encryption (VCLPKSE) scheme. The scheme not only overcomes the security issue of Ma et al. scheme, but also offers the authentications of data owners and data users. Via the authentication mechanism, data owners could not repudiate the fact they uploaded the ciphertext. Finally, we proved that the VCLPKSE scheme satisfies the ciphertext indistinguishability, trapdoor indistinguishability and unforgeability in the random oracle model. Meanwhile, we also do the simulation experiment to demonstrate the scheme’s efficiency.

Revocable Certificateless Public Key Encryption With Outsourced Semi-Trusted Cloud Revocation Agent

Certificateless public key cryptography (CL-PKC) not only eliminates the need for certificates in traditional certificate-based PKC but also solves the inherent key escrow problem in identity-based PKC. However, an unsolved but critical issue in CL-PKC is how to revoke a misbehaving user. Some revocable certificateless public key encryption (RCL-PKE) schemes have been proposed, but these schemes have two main drawbacks: 1) public key uniqueness is not guaranteed, thus allowing the existence of multiple copies of each initial secret key. 2) The existing outsourced RCL-PKE schemes place excessive trust in the cloud server, which may continue to update decryption keys stealthily for misbehaving users. In this paper, we address these issues by proposing a novel RCL-PKE with semi-trusted cloud revocation agents (s-CRAs). We describe the framework and the security model for the RCL-PKE with s-CRA and prove that the proposed scheme is semantically secure against adaptive chosen-ciphertext attacks under the bilinear Diffie-Hellman assumption in the random oracle model. Furthermore, we compare the proposed scheme with previous RCL-PKE schemes in terms of performance and robustness. The evaluation results show that the proposed scheme achieves public key uniqueness and reliable revocation flexibility at low computational and communication costs.

An efficient certificateless public key encryption with equality test toward Internet of Vehicles

AbstractWith the rapid development of the Internet of Vehicles, a great amount of vehicles are connected to Internet of Vehicles environment. These vehicles can exchange data to each other and upload the data to a cloud server for backup. Since the data contains some sensitive information, it is necessary to encrypt the data before uploading to the cloud server. However, this method severely hampers the utilization of data because of the tremendous difficulty in the search for encrypted data. For addressing the above issue, we propose a novel certificateless public key encryption supporting the equality test on ciphertexts that are performed by the cloud server while revealing nothing about the corresponding plaintexts. Our scheme has proved to be secure in bilinear Diffie‐Hellman assumption under the model of random oracle. At the same time, both theoretical analysis and experimental evaluation indicate the security, efficiency, as well as effectiveness of the proposed scheme.

Constructing pairing-free certificateless public key encryption with keyword search

Searchable public key encryption enables a storage server to retrieve the publicly encrypted data without revealing the original data contents. It offers a perfect cryptographic solution to encrypted data retrieval in encrypted data storage systems. Certificateless cryptography (CLC) is a novel cryptographic primitive that has many merits. It overcomes the key escrow problem in identity-based cryptosystems and the cumbersome certificate problem in conventional public key cryptosystems. Motivated by the appealing features of CLC, three certificateless encryption with keyword search (CLEKS) schemes were presented in the literature. However, all of them were constructed with the costly bilinear pairing and thus are not suitable for the devices that have limited computing resources and battery power. So, it is interesting and worthwhile to design a CLEKS scheme without using bilinear pairing. In this study, we put forward a pairing-free CLEKS scheme that does not exploit bilinear pairing. We strictly prove that the scheme achieves keyword ciphertext indistinguishability against adaptive chosen-keyword attacks under the complexity assumption of the computational Diffie-Hellman problem in the random oracle model. Efficiency comparison and the simulation show that it enjoys better performance than the previous pairing-based CLEKS schemes. In addition, we briefly introduce three extensions of the proposed CLEKS scheme.

Certificateless public key encryption with conjunctive keyword search and its application to cloud-based reliable smart grid system

A public key encryption scheme with conjunctive keyword search allows a semi-trusted third party (or a cloud server) to search over an encrypted data after receiving a trapdoor generated from a conjunctive keyword set. Assume that a sender sends a number of data to a receiver and those data are all stored in the same cloud server. Normally, if the receiver uses one keyword or separate keywords to look for through hundreds of data, it might get in return a huge number of associated data and most of them are unwanted. In this paper, we design a new certificateless public key encryption scheme with conjunctive keyword search, which only returns the desired data. We also prove that the designed scheme is secure against adaptive chosen keyword attacks in the random oracle model under bilinear Diffie-Hellman (BDH) problem assumption. Experimental results show that our scheme has better performance during the testing phase and has a lower communication cost than two related schemes. The comparison about security properties also shows that our scheme is more secure than them. Finally, we give an application example of our scheme in a cloud-based reliable smart grid system.

Design and Theoretical Analysis of the Application of the Certificateless Public Key Encryption Scheme for Home Monitoring System Security

Internet of Things (IOT) is becoming a trend in the field of information and technology today. IoT provides many benefits such as to turn on the lights, make temperature measurements, and measure heart rate. However, behind the benefits offered, there are also various security issues. Imagine if IoT is utilized in a strategic work environment and should have high security priorities but certain security mechanisms are not implemented, then the transmitted data can be interrupted and misused by unauthorized parties. Therefore, safeguarding the data transmitted through the system and technology is very necessary. One method that can be used for security is to implement a certificateless-based public key encryption scheme. In this study, to get the right security scheme, a literature study was conducted first, then a design was made for the application of the scheme for home monitoring system.

A provably secure certificateless public key encryption with keyword search

ABSTRACTPublic key encryption with keyword search, known as PEKS, is a useful technology in some Storage-as-a-Service clouds. This technology allows the cloud server to search on a keyword, which is received from the data owner/user, over encrypted data without having the ability to decrypt the stored data. PEKS with designated verifier, known as dPEKS, further advances the security of PEKS such that only a designated server can perform the keyword searching.Combining the certificateless technology, which aims to avoid the key escrow problem in ID-based cryptography, produces a certificateless dPEKS scheme that inherits the property of certificatelessness in key management in the dPEKS. This paper presents a provably secure certificateless dPEKS which has fixed an insecure scheme which was proposed earlier. The scheme presented in this paper is proven to be secure under Bilinear Diffie–Hellman problem.

A New Message Authentication Scheme for Multiple Devices in Intelligent Connected Vehicles Based on Edge Computing

Intelligent connected vehicles are autonomous vehicles. With the increasing degree of automation of autonomous vehicles and the development of open applications in the future, the computing tasks of autonomous vehicles are becoming more and more complex. In practice, the computing resources of vehicles are limited and the processing of data is not always guaranteed to be completed in time. However, the timely processing and integrity of the data are very important for vehicles because it affects the path selection of the traveling vehicle and the passenger experience. Therefore, it is necessary to reduce latency in processing data and verify the integrity of data for vehicles. In this paper, a novel message authentication scheme for multiple mobile devices in intelligent connected vehicles based on edge computing is proposed. The task of processing data in the vehicle is migrated to mobile devices, and tasks are executed utilizing the computing resources of multiple mobile devices in the edge computing model. The vehicle use certificateless ring signature technology to ensure the integrity of data processed by mobile devices. A security analyses show that our proposed schemes are secure in the random oracle model and can resist two types of adversaries under certificateless public key encryption. One type of adversary may be able to replace the mobile device's public key and the other type of adversary has access to the system master key. The results of performance analysis indicate the proposed scheme has high efficiency and applicability in practical intelligent connected vehicles system.

Certificateless Public Key Authenticated Encryption With Keyword Search for Industrial Internet of Things

Industrial Internet of Things (IIoT) integrates various types of intelligent terminals, mobile devices, and communication technologies to enable the upgrade of traditional industries to intelligent industries. IIoT relies on the powerful data processing capabilities of cloud computing to reduce the cost of various on-demand services as per the requirements of users. However, the privacy and confidentiality of the outsourced data should be protected in this environment because the data are typically “handled” by a third-party service provider. An encryption technique can guarantee the confidentiality of the data but it limits data retrieval due to its innate “all-or-nothing” decryption feature. To apply encryption to privacy-preserving data retrieval, many public key encryption techniques with keyword search systems have been proposed in the literature. However, most of the existing schemes are vulnerable to inside keyword guessing attack (IKGA), which is caused by a small keyword space. To address this problem, we propose a certificateless public key authenticated encryption with keyword search scheme, which is provably secure against IKGA. A performance analysis of the proposed scheme demonstrates that it is more secure and effective compared with other certificateless public key encryption with keyword search schemes.