Composite Order Bilinear Groups Research Articles

Revocable hierarchical identity-based encryption with adaptive security

Hierarchical identity-based encryption (HIBE) can be extended to revocable HIBE (RHIBE) if a private key of a user can be revoked when the private key is revealed or expired. Previously, many selectively secure RHIBE schemes were proposed, but it is still unsolved problem to construct an adaptively secure RHIBE scheme. In this work, we propose two RHIBE schemes in composite-order bilinear groups and prove their adaptive security under simple static assumptions. To prove the adaptive security, we use the dual system encryption framework, but it is not simple to use the dual system encryption framework in RHIBE since the security model of RHIBE is quite different with that of HIBE. We show that it is possible to solve the problem of the RHIBE security proof by carefully designing hybrid games.

Accountable and Revocable Large Universe Decentralized Multi-Authority Attribute-Based Encryption for Cloud-Aided IoT

The data collected, stored, shared, and accessed across different platforms in the dynamic IoT is mostly confidential and privacy-sensitive. Data security and access control issues urgently need to be addressed. Multi-authority attribute-based encryption (MA-ABE) is seen as a potential solution for addressing data access control security concerns in the dynamic IoT since it allows for dynamic access control over encrypted data. However, the existing key abuse problem is severely destroying the security access control of MA-ABE. The existing accountable attribute-based encryption schemes only support small attributes (users) universe and single authority. Moreover, they do not support revocation. Some schemes are inefficient since they are constructed in the composite order bilinear group. In this article, the author proposes the first accountable and revocable large universe decentralized multi-authority attribute-based encryption scheme with outsourcing decryption based on prime order bilinear groups. The proposed scheme allows for the dynamic capacity expansion of attributes, users, and authorities. An audit mechanism is given to judge if the suspicious key was leaked by a malicious user or by authorities and to determine the identity of the leaker. The malicious user who divulges key can be punished by user-attribute revocation. The revocation mechanism is resistant to collusion attacks undertaken by revoked users and non-revoked users. Meanwhile, it satisfies the requirements of forward and backward security. The proposed scheme is static security in the random oracle model under the q-DPBDHE2 assumption. To save resources, the outsourced decryption module is optional for users with restricted resources. According to the results of the performance analysis, it is suited for large-scale cross-domain cooperation in the dynamic cloud-aided IoT.

A Secure and Policy-Controlled Signature Scheme With Strong Expressiveness and Privacy-Preserving Policy

The policy-controlled signature (PCS) scheme uses the access policy to control signature verification permission. However public access policy that may contain private information will leak user privacy. At the same time, the expressiveness of access structures in the PCS schemes is weak. Therefore, we propose a policy-controlled signature scheme with strong expressiveness and privacy-preserving policy (PCS-PP), in which linear secret sharing schemes is to design access structure which has strong expression, the three primes composite order bilinear groups is used to hide the attribute value into the attribute name that may expose the privacy data by data distortion concept. The proposed PCS-PP scheme not only has correctness and privacy-preserving policy, but also supports fine-grained signature verification. In addition, the unforgeability is proved in the random oracle model. Compared to the related schemes, the proposed PCS-PP scheme has superiority in features, computation cost and storage.

Ternary subset difference revocation in public key framework supporting outsider anonymity

Broadcast encryption (BE) is a cryptographic primitive which sends encrypted message to the users securely. The BE scheme proposed by Naor, Naor, and Lotspiech (NNL) in 2001 is a popular BE scheme which uses a binary tree. The advanced access content system standard suggested to use it for digital right management in Blue-ray and DVD-discs. This paper puts forward an efficient broadcast encryption in public key setting employing ternary tree subset difference method for revocation. Our approach utilizes composite order bilinear group setting to achieve the tree based construction in public key setting. Our second construction is an extension of our first construction and provides outsider-anonymity by disabling the revoked users from getting any information of message and concealing the set of subscribed users from the revoked users. The construction of Fazio and Perera is the closest one to that of our second scheme (as both of these construction are in public key setting and provides outsider-anonymity). We have reduced the ciphertext size from $$r\log N/r$$ to min $$\{N/3,N-r,2r-1\}.$$ Thus reduces the communication bandwidth. We have also reduced the public key size. Our constructions enjoy the revocation property. Both of our constructions achieve selective semantic security in the standard model under reasonable assumptions and new users can join without updating the pre-existing setup.

An Expressive “Test-Decrypt-Verify” Attribute-Based Encryption Scheme With Hidden Policy for Smart Medical Cloud

With the rapid development of cloud computing and the Internet of Things, many companies or individuals store their data in the cloud server, which brings new challenges to the security and privacy. Although traditional encryption schemes could solve some problems, data owners (DOs) might lose the access control over the data, which is important in some specific application scenarios, such as the smart medical cloud system. In order to address these problems, some ciphertext-policy attribute-based encryption (CP-ABE) schemes have been proposed to protect the privacy and security of data; but these schemes still have the following defects: 1) most of the existing hidden policy CP-ABE schemes only enable restricted access structure, such as “AND” gate; 2) several schemes supporting flexible access control are inefficient in decryption, because most of them are constructed in the composite order bilinear group; and 3) many of the proposed schemes fail to check the correctness of decryption message. In this article, we construct a “test-decrypt-verify” CP-ABE scheme based on prime order bilinear group to solve the above-mentioned problems. The proposed scheme supports secure outsourcing decryption, because the return value is an intermediate value unrelated to the encapsulation value of message encrypted by the DO.

Outsourced ciphertext-policy attribute-based encryption with partial policy hidden

Attribute-based encryption is an efficient and flexible fine-grained access control scheme. However, how to realize the attribute privacy concerns in the access policy and optimize the heavy computing overhead have been not adequately addressed. First, in view of the open-access policies formulated by data owners in the cloud environment and the linear growth of bilinear pairing operations with the number of attributes in the decryption process, a verifiable outsourced attribute-based encryption with partial policy hidden scheme is proposed, in which the attribute name of access policy can be sent while attribute value involving sensitive information can be hidden, so nobody can infer information from the access policy. Second, the bilinear pairing operation and modular power operation are outsourced to the cloud server, then users only need to perform constant exponential operation to decrypt. In addition, the proposed scheme is based on the composite order bilinear group and satisfies full secure under the standard model. Finally, compared with other schemes in term of function and performance, it shows that this scheme is more efficient and suitable for resource-constrained mobile devices in outsourcing environment.

Fully secure wicked identity-based encryption resilient to continual auxiliary- inputs leakage

To allow more general key derivation patterns, the concept of wicked identity-based encryption (wicked IBE) was introduced. It is an extension of hierarchical identity based encryption (HIBE). Recently, research on leakage-resilient wicked IBE has attracted much attention for its consideration on the problem of key leakage in system. However, the existing works implement leakage resistance under the bounded leakage model and fail to capture general form of leakage attacks. Through designing the generation of the master secret key and the user secret key reasonably, a wicked IBE scheme resilient to continual auxiliary-inputs leakage is proposed in this paper. The leakage of our scheme is not only from the user secret key, but also from the master secret key. We show the scheme is proven fully secure in the standard model based on the subgroup decision assumption in composite-order bilinear groups and the Goldreich-Levin theorem in Galois field. To achieve this goal, the dual system encryption technology is exploited in the security proof. Compared with existing leakage-resilient wicked IBE, our scheme has a better performance in leakage resilience and security.

A CP-ABE Scheme Supporting Arithmetic Span Programs

Attribute-based encryption achieves fine-grained access control, especially in a cloud computing environment. In a ciphertext-policy attribute-based encryption (CP-ABE) scheme, the ciphertexts are associated with the access policies, while the secret keys are determined by the attributes. In recent years, people have tried to find more effective access structures to improve the efficiency of encryption systems. This paper presents a ciphertext-policy attribute-based encryption scheme that supports arithmetic span programs. On the composite-order bilinear group, the security of the scheme is proven by experimental sequence based on the combination of composite-order bilinear entropy expansion lemma and subgroup decision (SD) assumption. And, it is an adaptively secure scheme with constant-size public parameters.

Adaptively secure broadcast encryption with authenticated content distributors

In public key broadcast encryption systems, anyone could run the encryption algorithm to broadcast messages by using the public parameters. The unsupervised broadcast strategy allows malicious users (even though someone outside the system with the intentionally divulged public parameters) to distribute junk messages without responsibility. Consequently, content distributor authentication is essential for broadcast encryption systems to forbid spreading of junk information. In this work, we devise a solution for public key broadcast encryption system with adaptive security to resolve the aforementioned vicious broadcaster problem, which is neglected in the previous related works. In our scheme, any user could distribute an encryption of messages with both public parameters and his/her own secret keys, and each message is associated to its broadcaster. The construction is based on the composite order bilinear groups and its adaptive security depends on the hardness of the general subgroup decisional assumptions. Furthermore, this allows our scheme to be flexible in terms on the overhead of ciphertexts, which is constant sized. Compared with previous related broadcast encryption systems constructed in the composite order bilinear groups, our scheme inherits the superiority of adaptive security based non-interactive falsifiable assumption, and simultaneously achieves the optimal ciphertext overhead and the authentication of broadcasters.

Adaptively secure efficient broadcast encryption with constant-size secret key and ciphertext

In those broadcast application scenarios with a great quantity of receivers, e.g., the data access control system in cloud storage service, the single sender is apt to become the efficiency bottleneck of the system, because the computation and storage overhead of the sender will grow rapidly with the amount of qualified receivers. In order to overcome this problem, we first introduce the novel conception of complete binary identity tree which is adopted to manage the qualified receivers. Then we design the prune-merge algorithm to further optimize the structure of the tree and cut down the amount of receivers. The algorithm effectively reduces the computation and storage cost of the trusted authority in the system. Subsequently, in virtue of composite-order bilinear groups, we bring forward an efficient public key broadcast encryption scheme combined its application to the system of data access control in cloud storage service. Compared with the existing schemes, the lengths of system public parameters, secret key and ciphertext in our scheme are all constant. In addition, the number of secret keys in our scheme increases logarithmically with the maximum amount of receivers, while the numbers of secret keys in the existing schemes increase linearly with the maximum amount of receivers. Furthermore, the proposed scheme is proved to guarantee adaptive security under general subgroup decision assumption in the standard model. The performance analysis manifests that our scheme is feasible for those broadcast applications with fixed senders.

Succinct Predicate and Online-Offline Multi-Input Inner Product Encryptions under Standard Static Assumptions

This paper presents expressive predicate encryption (PE) systems, namely non-zero inner-product-predicate encryption (NIPPE) and attribute-based encryption (ABE) supporting monotone span programs achieving best known parameters among existing similar schemes under well-studied static complexity assumptions. Both the constructions are built in composite order bilinear group setting and involve only 2 group elements in the ciphertexts. More interestingly, our NIPPE scheme, which additionally features only 1 group element in the decryption keys, is the first to attain succinct ciphertexts and decryption keys simultaneously. For proving selective security of these constructions under the Subgroup Decision assumptions, which are the most standard static assumptions in composite order bilinear group setting, we apply the extended version of the elegant Déjà Q framework, which was originally proposed as a general technique for reducing the q-type complexity assumptions to their static counter parts. Our work thus demonstrates the power of this framework in overcoming the need of q-type assumptions, which are vulnerable to serious practical attacks, for deriving security of highly expressive PE systems with compact parameters. We further introduce the concept of online-offline multi-input functional encryption (OO-MIFE), which is a crucial advancement towards realizing this highly promising but computationally intensive cryptographic primitive in resource bounded and power constrained devices. We also instantiate our notion of OO-MIFE by constructing such a scheme for the multi-input analog of the inner product functionality, which has a wide range of application in practice. Our OO-MIFE scheme for multi-input inner products is built in asymmetric bilinear groups of prime order and is proven selectively secure under the well-studied k-Linear (k-LIN) assumption.

Hierarchical attribute based encryption with continuous leakage-resilience

Attribute based encryption (ABE) is widely applied in cloud computing settings due to its fine-grained access control. Most ABE schemes do not consider the side channel attacks which may leak the secret information of cryptosystems. Leakage-resilient cryptography aims to model security for various side channel attacks. In this paper, we first give the formal definition and security model of hierarchical attribute based encryption (HABE) with continuous leakage-resilience. Furthermore, we present a ciphertext-policy HABE scheme with continuous leakage-resilience. The proposed scheme is resilient to master key leakage and secret key leakage. We prove the security of our scheme under composite order bilinear group assumptions by using dual system encryption techniques. The performance of leakage-resilience is analyzed theoretically. If the depth of our proposed scheme is 1, the relative leakage ratio is almost up to 1/3. In addition, we give the performance comparison through experiments.

The generic construction of continuous leakage-resilient identity-based cryptosystems

In the leakage setting, the adversary is allowed to access the internal secret states of a cryptosystem, such as the private key of user and the master secret key. In the continuous leakage model, there is no predetermined bound on the leakage of internal secret states; therefore, it is more challenging. In this paper, we present a new primitive called updatable identity-based hash proof system (U-IB-HPS), which can serve as a fundamental tool for constructing continuous leakage-resilient identity-based cryptosystems. With the U-IB-HPS, we obtain the generic constructions of identity-based cryptosystem with continuous leakage-resilience, such as the continuous leakage-resilient identity-based encryption with leakage amplification, the continuous leakage-resilient identity-based hybrid encryption with leakage amplification, etc. As a feature of our generic constructions, we allow the leakage of multiple keys, i.e., leakage of the master secret key and the private key of user. In addition, we present a generic framework of one-round identity-based authenticated key exchange (AKE) protocol with continuous leakage resilience, which ensures the session key security even if the adversary performs continuous leakage attacks during the execution of a session. We also present instantiations of U-IB-HPS from bilinear groups and composite order bilinear groups, respectively. The security of our instantiations is based on the standard static assumptions, such as the decisional bilinear Diffie–Hellman assumption, the corresponding complexity assumptions over composite order bilinear groups, etc. Our instantiations can be easily extended to construct the updatable hierarchical identity-based hash proof system.

Efficient Public Key Encryption with Disjunctive Keywords Search Using the New Keywords Conversion Method

Public key encryption with disjunctive keyword search (PEDK) is a public key encryption scheme that allows disjunctive keyword search over encrypted data without decryption. This kind of scheme is crucial to cloud storage and has received a lot of attention in recent years. However, the efficiency of the previous scheme is limited due to the selection of a less efficient converting method which is used to change query and index keywords into a vector space model. To address this issue, we design a novel converting approach with better performance, and give two adaptively secure PEDK schemes based on this method. The first one is built on an efficient inner product encryption scheme with less searching time, and the second one is constructed over composite order bilinear groups with higher efficiency on index and trapdoor construction. The theoretical analysis and experiment results verify that our schemes are more efficient in time and space complexity as well as more suitable for the mobile cloud setting compared with the state-of-art schemes.

Improving Privacy and Security in Decentralizing Multi-Authority Attribute-Based Encryption in Cloud Computing

Decentralizing multi-authority attribute-based encryption (ABE) has been adopted for solving problems arising from sharing confidential corporate data in cloud computing. For decentralizing multi-authority ABE systems that do not rely on a central authority, collusion resistance can be achieved using a global identifier. Therefore, identity needs to be managed globally, which results in the crucial problems of privacy and security. A scheme is developed that does not use a central authority to manage users and keys, and only simple trust relations need to be formed by sharing the public key between each attribute authority (AA). User identities are unique by combining a user’s identity with the identity of the AA where the user is located. Once a key request needs to be made to an authority outside the domain, the request needs to be performed by the authority in the current domain rather than by the users, so, user identities remain private to the AA outside the domain, which will enhance privacy and security. In addition, the key issuing protocol between AA is simple as the result of the trust relationship of AA. Moreover, extensibility for authorities is also supported by the scheme presented in this paper. The scheme is based on composite order bilinear groups. A proof of security is presented that uses the dual system encryption methodology.

Attribute-based Encryption with Non-Monotonic Access Structures Supporting Fine-Grained Attribute Revocation in M-healthcare.

By sharing the personal health information (PHI) in the healthcare provider (HP) which is equipped with cloud servers, mobile-healthcare (m-healthcare) significantly promotes a huge revolution of medical consultation. Nonetheless there is a series of challenges such as PHI confidentiality and the attribute revocation. To deal with these problems, we propose a scheme based on the attribute-based encryption. The scheme which supports non-monotonic access structures and fine-grained attribute revocation is established over the composite order bilinear groups. By utilizing this scheme, we can well protect PHI and achieve the goal of revocation. Furthermore, the security analysis and comparison show that our scheme is more expressive despite of the lower efficiency.

Efficient large-universe multi-authority ciphertext-policy attribute-based encryption with white-box traceability

Traceable multi-authority ciphertext-policy attribute-based encryption (CP-ABE) is a practical encryption method that can achieve user traceability and fine-grained access control simultaneously. However, existing traceable multi-authority CP-ABE schemes have two main limitations that prevent them from practical applications. First, these schemes only support small universe: the attributes must be fixed at system setup and the attribute space is restricted to polynomial size. Second, the schemes are either less expressive (the access policy is limited to “AND gates with wildcard) or inefficient (the system is constructed in composite order bilinear groups). To address these limitations, we present a traceable large universe multi-authority CP-ABE scheme, and further prove that it is statically secure in the random oracle model. Compared with existing traceable multi-authority CP-ABE schemes, the proposed scheme has four advantages. First, the attributes are not fixed at setup and the attribute universe is not bounded to polynomial size. Second, the ciphertext polices can be expressed as any monotone access structures. Third, the proposed scheme is constructed in prime order groups, which makes this scheme more efficient than those in composite order bilinear groups. Finally, the proposed scheme requires neither a central authority nor an identity table for tracing.

Accumulable optimistic fair exchange from verifiably encrypted homomorphic signatures

Let us consider a situation where a client (Alice) frequently buys a certain kind of product from a shop (Bob) (e.g., an online music service sells individual songs at the same price, and a client buys songs multiple times in a month). In this situation, Alice and Bob would like to aggregate the total transactions and pay once per month because individual payments are troublesome. Though optimistic fair exchange (OFE) has been considered in order to swap electronic items simultaneously, known OFE protocols cannot provide such aggregate function efficiently because various costs are bounded by the number of transactions in the period. In order to run this aggregation procedure efficiently, we introduce a new kind of OFE called accumulable OFE (AOFE) that allows clients to efficiently accumulate payments in each period. In AOFE, any memory costs, computational costs, and communication complexity of the payment round must be constant in terms of the number of transactions. Since a client usually has just a low power and poor memory device, these efficiencies are desirable in practice. Currently, known approaches (e.g., based on verifiably encrypted signature scheme) are not very successful for constructing AOFE. Thus, we consider a new approach based on a new cryptographic primitive called verifiably encrypted homomorphic signature scheme (VEHS). In this paper, we propose a generic construction of AOFE from VEHS and also present a concrete VEHS scheme over a composite-order bilinear group by using the dual-form signature techniques. This VEHS scheme is also of independent interest. Since we can prove the security of VEHS without random oracles, our AOFE protocol is also secure without random oracles. Finally, we implemented our AOFE protocol, and it is efficient enough for practical use.

Efficient revocable identity-based encryption via subset difference methods

Providing an efficient revocation mechanism for identity-based encryption (IBE) is very important since a user's credential (or private key) can be expired or revealed. revocable IBE (RIBE) is an extension of IBE that provides an efficient revocation mechanism. Previous RIBE schemes essentially use the complete subtree (CS) scheme of Naor, Naor and Lotspiech (CRYPTO 2001) for key revocation. In this paper, we present a new technique for RIBE that uses the efficient subset difference (SD) scheme of Naor et al. instead of using the CS scheme to improve the size of update keys. Following our new technique, we first propose an efficient RIBE scheme in prime-order bilinear groups by combining the IBE scheme of Boneh and Boyen and the SD scheme and prove its selective security under the standard assumption. Our RIBE scheme is the first RIBE scheme in bilinear groups that has O(r) number of group elements in an update key where r is the number of revoked users. Next, we also propose another RIBE scheme in composite-order bilinear groups and prove its full security under static assumptions. Our RIBE schemes also can be integrated with the layered subset difference scheme of Halevy and Shamir (CRYPTO 2002) to reduce the size of a private key.

Almost-Tight Identity Based Encryption Against Selective Opening Attack

The paper presented an identity based encryption (IBE) under selective opening attack (SOA) whose security is almost-tightly related to a set of computational assumptions. Our result is a combination of Bellare, Waters, and Yilek’s method [TCC, 2011] for constructing (not tightly) SOA secure IBE and Hofheinz, Koch, and Striecks’ technique [PKC, 2015] on building almost-tightly secure IBE in the multi-ciphertext setting. In particular, we first tuned Bellare et al.’s generic construction for SOA secure IBE to show that a one-bit IBE achieving ciphertext indistinguishability under chosen plaintext attack in the multi-ciphertext setting (with one-sided publicly openability) tightly implies a multi-bit IBE secure under selective opening attack. Next, we almost-tightly reduced such a one-bit IBE to static assumptions in the composite-order bilinear groups employing the technique of Hofheinz et al. This yielded the first SOA secure IBE with almost-tight reduction.