Concrete Scheme Research Articles

Control model and the experimental study on the ultrasonic vibration-assisted electrolytic in-process dressing internal grinding

Based on the ultrasonic vibration technology and the electrochemical principle, the ultrasonic vibration-assisted electrolytic in-process dressing internal (UAEI) grinding is realized on the vertical machining center. The mathematical control model of the UAEI grinding is established to maintain the protrusion height of abrasive grains. Simulations and fittings show that the average current is positively associated with the increase of ultrasonic frequency, grinding speed or workpiece speed, and the decrease of grinding ratio. Concrete control schemes are made by adjusting the controllable parameters. The objective judgments are obtained by comparing the experimental results under different processing conditions. The experimental results show that the surface roughness of workpiece can research 0.0487 μm, the grinding force ratio maintains at relatively stable level, topography of oxide layer presents uniform-distributed cavities, and surface micro-topography of workpiece becomes smoother with the processing parameters determined by the control model of the UAEI grinding, proving the validity of this control model of the UAEI grinding.

A New ADS-B Authentication Framework Based on Efficient Hierarchical Identity-Based Signature with Batch Verification

Automatic dependent surveillance-broadcast (ADS-B) has become a crucial part of next generation air traffic surveillance technology and will be mandatorily deployed for most of the airspaces worldwide by 2020. Each aircraft equipped with an ADS-B device keeps broadcasting plaintext messages to other aircraft and the ground station controllers once or twice per second. The lack of security measures in ADS-B systems makes it susceptible to different attacks. Among the various security issues, we investigate the integrity and authenticity of ADS-B messages. We propose a new framework for providing ADS-B with authentication based on three-level hierarchical identity-based signature (HIBS) with batch verification. Previous signature-based ADS-B authentication protocols focused on how to generate signatures efficiently, while our schemes can also significantly reduce the verification cost, which is critical to ADS-B systems, since at any time an ADS-B receiver may receive lots of signatures. We design two concrete schemes. The basic scheme supports partial batch verification and the extended scheme provides full batch verification. We give a formal security proof for the extended scheme. Experiment results show that our schemes with batch verification are tremendously more efficient in batch verifying $n$ signatures than verifying $n$ signatures independently. For example, the running time of verifying 100 signatures is 502 and 484 ms for the basic scheme and the extended scheme respectively, while the time is 2500 ms if verifying the signatures independently.

Anonymous and secure aggregation scheme in fog-based public cloud computing

By using fog computing, cloud computing can be extended to the edge of the network. Generally, in the public cloud, fog computing comprises three components: terminal device, fog node and public cloud server (PCS). In this paper, we propose the concept of anonymous and secure aggregation scheme (ASAS) in fog-based public cloud computing. In the ASAS model, a fog node aggregates the data from terminal nodes and forwards the aggregated data to the public cloud server. By using the ASAS scheme, the fog node can help terminal devices upload their data to PCS. By using the data aggregation technique, our ASAS scheme can save bandwidth between the fog node and PCS. At the same time, our ASAS scheme not only protects the identities of terminal devices by using pseudonyms but it also guarantees data secrecy via a homomorphic encryption technique. In this paper, we design the first concrete ASAS scheme. We also examine the security and the performance of our proposal, which we show to be provably secure and efficient.

Non-Repudiable Provable Data Possession Scheme With Designated Verifier in Cloud Storage Systems

In cloud storage systems, users can upload their data along with associated tags (authentication information) to cloud storage servers. To ensure the availability and integrity of the outsourced data, provable data possession (PDP) schemes convince verifiers (users or third parties) that the outsourced data stored in the cloud storage server is correct and unchanged. Recently, several PDP schemes with designated verifier (DV-PDP) were proposed to provide the flexibility of arbitrary designated verifier. A designated verifier (private verifier) is trustable and designated by a user to check the integrity of the outsourced data. However, these DV-PDP schemes are either inefficient or insecure under some circumstances. In this paper, we propose the first non-repudiable PDP scheme with designated verifier (DV-NRPDP) to address the non-repudiation issue and resolve possible disputations between users and cloud storage servers. We define the system model, framework and adversary model of DV-NRPDP schemes. Afterward, a concrete DV-NRPDP scheme is presented. Based on the computing discrete logarithm assumption, we formally prove that the proposed DV-NRPDP scheme is secure against several forgery attacks in the random oracle model. Comparisons with the previously proposed schemes are given to demonstrate the advantages of our scheme.

CCA-secure revocable identity-based encryption schemes with decryption key exposure resistance

Key revocation functionality is important for identity-based encryption (IBE) to manage users dynamically. Revocable IBE (RIBE) realises such revocation functionality with scalability. In PKC 2013, Seo and Emura first considered decryption key exposure resistance (DKER) as a new realistic threat, and proposed the first RIBE scheme with DKER. Their RIBE scheme is adaptively secure against chosen plaintext attacks (CPA), and there is no concrete RIBE scheme adaptively secure against chosen ciphertext attacks (CCA) even without DKER so far. In this paper, we first propose three constructions of adaptively CCA-secure RIBE schemes with DKER. The first and second schemes are based on an existing transformation, which is called a BCHK transformation, that a CPA-secure hierarchical IBE scheme can be transformed into a CCA-secure scheme. The third scheme is constructed via the KEM/DEM framework. Specifically, we newly propose a revocable identity-based key encapsulation mechanism (RIB-KEM), and we show a generic construction of a CCA-secure RIBE scheme from the RIB-KEM and a data encapsulation mechanism (DEM). The third scheme is more efficient than the first and second ones in terms of the ciphertext size.

面向智能用电的智能家居能效管控系统设计

家用电器的使用是人们繁忙工作生活中必不可少的部分，但往往存在着人走忘记断电、用电不合理、浪费严重等现象，加剧了能源供需不平衡的矛盾，而且存在着安全隐患。随着国家智能电网的建设、峰谷分时电价的推行，使得节能环保、绿色低碳以及智能用电等需求更加引人注目。如果能够尽量在用电低谷时段启用家用电器(如洗衣机等)，从而科学用电，这样不但能够节省能源，还将对削峰填谷压力的缓解起到积极的促进作用。智能家居系统与传统家居系统最大的区别在于，赋予了家庭所有物品以“智慧”，使它们能够“自发”、“主动”地与家庭网关、与人沟通并实现信息的交互。本文首先介绍了智能家居系统国内外的发展现状、需要解决的问题以及对智能家居系统未来的展望。然后介绍了软件开发的环境搭建和涉及到的主要技术，主要包括ASP.NET、SQL Server、响应式Web设计等。并对用户的需求进行了较为详细的分析，提出了符合用户需求的智能家居能效管控系统的总体解决方法。接着提出了模块设计的具体方案，主要包括用户信息管理模块、信息模块、安防模块、窗帘模块、电器模块和光照模块等。文章最后详细地介绍了软件的具体实现过程，并展示了部分界面和主要的实现代码。 The use of household appliances is an indispensable part of people’s busy life, but it is a very usual thing for some people to forget to cut off the power supply or maybe they have bad habits of using the power. These phenomena lead to wasting a lot of electricity and intensifying the contradictions between energy supply and demand for energy. In addition, there are also potential safety problems. With the construction of the smart grid and the electricity policy, there is an increasing focus on energy conservation, environmental protection, low-carbon and intelligent electricity. If you try to use household appliances (such as washing machines) in the off-peak, you will not only save the energy, but also play a positive role in alleviating the pressure of the electricity. The biggest deference between the smart home system and the traditional home-system is that the smart home system giving wisdom to family belongings. They can spontaneously and actively communicate with family gateway and the users. And they can also realize the interaction of information. In this paper, the development of smart home system, problems needed to be resolved and the future of smart home system are firstly introduced at home and abroad. Then the Software development environment and the main technology, such as ASP.NET, SQL Server and software design, etc. have been introduced. We also put forward the concrete scheme of module design, includes the user information management module, information module, security module, curtain module, electrical module, light module, etc. Finally, the realization method of software is described in detail, and shows part of the interface and the main implementation codes.

Certificateless Key-Insulated Generalized Signcryption Scheme without Bilinear Pairings

Generalized signcryption (GSC) can be applied as an encryption scheme, a signature scheme, or a signcryption scheme with only one algorithm and one key pair. A key-insulated mechanism can resolve the private key exposure problem. To ensure the security of cloud storage, we introduce the key-insulated mechanism into GSC and propose a concrete scheme without bilinear pairings in the certificateless cryptosystem setting. We provide a formal definition and a security model of certificateless key-insulated GSC. Then, we prove that our scheme is confidential under the computational Diffie-Hellman (CDH) assumption and unforgeable under the elliptic curve discrete logarithm (EC-DL) assumption. Our scheme also supports both random-access key update and secure key update. Finally, we evaluate the efficiency of our scheme and demonstrate that it is highly efficient. Thus, our scheme is more suitable for users who communicate with the cloud using mobile devices.

Secure pay-TV for chained hotels

There is an increasing demand of securely selling pay-TV channels to large organizations such as chained hotels. Most solutions usually employ a key generation authority to distribute secret access credentials for all users, which would cause the single-point problem of inefficient key management. Further, there is a risk of the leakage of users' access credentials while countermeasures to find out the leaked credentials are lacking. To address such issues, we propose a leakage traceable hierarchical key distribution (LTHKD) framework with the key delegation and the key-leakage tracing. The key delegation allows the key generation authority to apportion the tasks of access credential generation to a number of group authorities; the tracing mechanism provides an efficient method to find out the leaked access credentials. We present a concrete LTHKD scheme by extending hierarchical identity-based encryption to groups with users' access credentials elegantly encoded by unique fingerprint codes. We formally prove the security of the proposed scheme in a rigorous definition and conduct thorough theoretical and experimental analyses to evaluate the system performance. Surprisingly, the results show that the added key-leakage tracing mechanism has little affection on data encryption and decryption procedures.

Cloud‐aided scalable revocable identity‐based encryption scheme with ciphertext update

SummaryKey revocation and ciphertext update are two critical issues for identity‐based encryption schemes. Designing an identity‐based encryption scheme with key revocation and ciphertext update functionalities simultaneously is still a tricky challenge. Recently, Liang et al. introduce the notion of cloud‐based revocable identity‐based proxy re‐encryption scheme and present a concrete scheme with aim to solve the challenge. In this paper, we first showed the scheme of Liang et al. cannot resist re‐encryption key forgery attack and collusion attack. We then introduced a new cryptographic primitive, named cloud‐aided revocable identity‐based encryption scheme with ciphertext update (CA‐RIBE‐CU), to achieve both ciphertext update and key revocation for identity‐based encryption schemes. We also defined the syntax and security model of CA‐RIBE‐CU scheme and proposed a CA‐RIBE‐CU scheme from bilinear pairings. Compared with the scheme of Liang et al., our proposed scheme is collusion resistant, takes lower decryption computation, and achieves constant size re‐encrypted ciphertext. Finally, we proved the proposed scheme is adaptively secure under the decisional bilinear Diffie–Hellman assumption in the standard model. Copyright © 2016 John Wiley & Sons, Ltd.

CCA-secure ABE with outsourced decryption for fog computing

Fog computing is not a replacement but an extension of cloud computing for the prevalence of the Internet of Things (IoT) applications. In particular, fog computing inserts a middle layer named fog into the infrastructure of cloud computing to obtain the low latency, mobility and location-awareness. Due to the fog layer, the sensitive data stored in fog computing is facing more sophisticated attacks, such as chosen ciphertext attacks, than that in cloud computing. Currently, the attribute-based encryption (ABE) with outsourced decryption is the best solution for data protection in cloud computing for IoT applications. However, none of the existing schemes are CCA secure. To fill this gap, we firstly propose the CCA security model for ABE with outsourced decryption, and then present a concrete CCA-secure ABE scheme with outsourced decryption. The security analysis and experimental results show that our proposal is secure and practical for fog computing.

Verifiable Computation over Large Database with Incremental Updates

The notion of verifiable database (VDB) enables a resource-constrained client to securely outsource a very large database to an untrusted server so that it could later retrieve a database record and update a record by assigning a new value. Also, any attempt by the server to tamper with the data will be detected by the client. When the database undergoes frequent while small modifications, the client must re-compute and update the encrypted version (ciphertext) on the server at all times. For very large data, it is extremely expensive for the resources-constrained client to perform both operations from scratch. In this paper, we formalize the notion of verifiable database with incremental updates (Inc-VDB). Besides, we propose a general Inc-VDB framework by incorporating the primitive of vector commitment and the encrypt-then-incremental MAC mode of encryption. We also present a concrete Inc-VDB scheme based on the computational Diffie-Hellman (CDH) assumption. Furthermore, we prove that our construction can achieve the desired security properties.

Variational integrators – A continuous time approach

SummaryThis article presents a family of variational integrators from a continuous time point of view. A general procedure for deriving symplectic integration schemes preserving an energy‐like quantity is shown, which is based on the principle of virtual work. The framework is extended to incorporate holonomic constraints without using additional regularization. In addition, it is related to well‐known partitioned Runge–Kutta methods and to other variational integration schemes. As an example, a concrete integration scheme is derived for the planar pendulum using both polar and Cartesian coordinates. Copyright © 2016 John Wiley & Sons, Ltd.

Policy-controlled signatures and their applications

In this paper, we present a new cryptographic primitive called “policy-controlled signatures”. In this notion, a signer can sign a message and attach it with some policies. Only a verifier who satisfies the policies attached can verify the authenticity of the message. This type of signature schemes has many applications, in particular to deal with sensitive data, where the signer does not want to allow anyone who is unauthorized to verify the authenticity of the messages. The notion of policy-controlled signatures resembles some similarities with designated verifier signatures, as it can also be used to designate a signature to multiple recipients. Nevertheless, we shall demonstrate that the notion of policy-controlled signatures generalize the notion of designated verifier signatures. A concrete scheme that is secure in our model is also provided. Furthermore, we also present an extension to “universal policy-controlled signature”. In this extended notion, we combine the idea of universal designated verifier signatures with policy-controlled signatures to allow more flexible delegations. We also provide a concrete scheme that is secure in our model.

Fuzzy certificateless signature

According to the inspirations from history, we introduce a new cryptography primitive called fuzzy certificateless signature, which not only eliminates the key escrow problem inherently existed in fuzzy identity-based signature but also possesses the error tolerance property of fuzzy identity-based signature that allows for a set of attributes ω to verify a signature produced with a private key for an identity ω' if and only if the distance between the two identities ω and ω' is within a certain threshold. In this paper, the concept of fuzzy certificateless signature is first proposed, and then, the syntax and security model of fuzzy certificateless signature are formally defined. In the next step, so far, the first concrete fuzzy certificateless signature scheme is proposed, which may be practicably implemented in biometric identification. In addition, a formal security proof is provided, so as to demonstrate that in the random oracle model, our newly proposed scheme is existentially unforgeable against Types I and II chosen message attacks formalized in the security model under the computational Diffie-Hellman assumption. Copyright © 2016 John Wiley & Sons, Ltd.

Key-Aggregate Searchable Encryption (KASE) for Group Data Sharing via Cloud Storage

The capability of selectively sharing encrypted data with different users via public cloud storage may greatly ease security concerns over inadvertent data leaks in the cloud. A key challenge to designing such encryption schemes lies in the efficient management of encryption keys. The desired flexibility of sharing any group of selected documents with any group of users demands different encryption keys to be used for different documents. However, this also implies the necessity of securely distributing to users a large number of keys for both encryption and search, and those users will have to securely store the received keys, and submit an equally large number of keyword trapdoors to the cloud in order to perform search over the shared data. The implied need for secure communication, storage, and complexity clearly renders the approach impractical. In this paper, we address this practical problem, which is largely neglected in the literature, by proposing the novel concept of key-aggregate searchable encryption and instantiating the concept through a concrete KASE scheme, in which a data owner only needs to distribute a single key to a user for sharing a large number of documents, and the user only needs to submit a single trapdoor to the cloud for querying the shared documents. The security analysis and performance evaluation both confirm that our proposed schemes are provably secure and practically efficient.

Public Integrity Auditing for Shared Dynamic Cloud Data with Group User Revocation

The advent of the cloud computing makes storage outsourcing become a rising trend, which promotes the secure remote data auditing a hot topic that appeared in the research literature. Recently some research consider the problem of secure and efficient public data integrity auditing for shared dynamic data. However, these schemes are still not secure against the collusion of cloud storage server and revoked group users during user revocation in practical cloud storage system. In this paper, we figure out the collusion attack in the exiting scheme and provide an efficient public integrity auditing scheme with secure group user revocation based on vector commitment and verifier-local revocation group signature. We design a concrete scheme based on the our scheme definition. Our scheme supports the public checking and efficient user revocation and also some nice properties, such as confidently, efficiency, countability and traceability of secure group user revocation. Finally, the security and experimental analysis show that, compared with its relevant schemes our scheme is also secure and efficient.

CP‐ABE with outsourced decryption and directionally hidden policy

AbstractCiphertext‐policy attribute‐based encryption (CP‐ABE) is a novel cryptographic primitive for access controlling. However, the existing CP‐ABE schemes are very inefficient as the decryptions involve many expensive pairing operations. Another drawback is that the access policy itself may disclose some privacies of the users. In certain applications, access structures also should be protected. In this work, we propose a notion of CP‐ABE with outsourced decryption and directionally hidden policy, which allows a semi‐trusted proxy in the cloud to help a user decrypt a ciphertext, but the proxy cannot learn the plaintext and the access policy. We construct a concrete scheme from Waters' CP‐ABE and prove its security, verifiability, and directionally hidden policy. Copyright © 2016 John Wiley & Sons, Ltd.

Design of additive homomorphic encryption with multiple message spaces for secure and practical storage services over encrypted data

Homomorphic encryption scheme is one of the useful tools for handling encrypted information in storage services. However, most of existing schemes have not been used in practical applications due to their inefficiency or lack of functionalities. For example, fully homomorphic encryption, which can provide arbitrary operations, is inefficient. On the other hand, other homomorphic encryptions, including additive homomorphic encryptions, which are efficient enough to be used in practice, are limited in operations for practical applications. In this paper, we devise a message-encoding technique which can split a message space of an additive homomorphic encryption into multiple sub-spaces for different messages. Our technique guarantees that we can deal with multiple sets of data (each data set is assigned to each sub-space), so that multiple data can be computed at once in an additive manner. Using our new technique, we construct two additive homomorphic encryptions with valuable properties. The first one is an additive homomorphic encryption scheme which can be used for evaluating some statistical information, such as the mean and the variance. To give a concrete scheme, we apply our technique to Paillier’s scheme which supports the additive homomorphism. Note that our scheme is the first additive homomorphic encryption which supports the evaluation of both the mean and the variance of encrypted data. We also give two modifications of the first application to improve its practicality. As the second application of our technique, we propose an additive homomorphic encryption scheme which can support the functionality of error detection in homomorphic operations. The second scheme is also designed based on Paillier’s scheme. Note that one of the remarkable advantages of our technique is that it can be applied to any additive homomorphic encryption for supporting the above-mentioned functionalities.

Adaptable key-policy attribute-based encryption with time interval

In this paper, we introduce a new cryptographic primitive: adaptable KP-ABE with time interval (KP-TIABE), which is an extension of key-policy attribute-based encryption (KP-ABE). Adaptable KP-TIABE specifies a decryption time interval for every ciphertext such that the ciphertext can only be decrypted within this time interval. To be more flexible, the decryption time interval associated with a ciphertext can be adjusted on demand by a semi-trusted server. We propose a formal model for adaptable KP-TIABE, present a concrete adaptable KP-TIABE scheme and prove its security under the security model.

A universal method for realizing non‐repudiable provable data possession in cloud storage

AbstractProvable data possession (PDP) and proofs of retrievability (POR) are techniques for a client to verify the integrity of outsourced data on an untrusted server, and numerous PDP/POR schemes with public or private verification have been proposed so far. However, existing schemes cannot handle the following issue satisfactorily: Driven by profits, a malicious client may accuse an honest server and repudiate the correct proof of data possession. Based on the commitment function, we present a universal method that can reform any private verification PDP/POR scheme into a non‐repudiable PDP (NRPDP)/POR scheme. As a case study, we propose a concrete NRPDP scheme with private verification, which allows both the client and the server to prove their innocence and verify whether the other side is honest. Moreover, we prove the security of both the method and NRPDP in the random oracle model and implement a prototype based on the NRPDP scheme in a realistic cloud platform. Experimental results on large dataset (10GB) show that the NRPDP can be executed efficiently as private verification schemes and outperforms the public schemes more than 60% in terms of verification time. Foremost, non‐repudiation can be guaranteed efficaciously in NRPDP. Copyright © 2016 John Wiley & Sons, Ltd.