Decryption Operations Research Articles

A group key exchange and secure data sharing based on privacy protection for federated learning in edge‐cloud collaborative computing environment

SummaryFederated learning (FL) is widely used in internet of things (IoT) scenarios such as health research, automotive autopilot, and smart home systems. In the process of model training of FL, each round of model training requires rigorous decryption training and encryption uploading steps. The efficiency of FL is seriously affected by frequent encryption and decryption operations. A scheme of key computation and key management with high efficiency is urgently needed. Therefore, we propose a group key agreement technique to keep private information and confidential data from being leaked, which is used to encrypt and decrypt the transmitted data among IoT terminals. The key agreement scheme includes hidden attribute authentication, multipolicy access, and ciphertext storage. Key agreement is designed with edge‐cloud collaborative network architecture. Firstly, the terminal generates its own public and private keys through the key algorithm then confirms the authenticity and mapping relationship of its private and public keys to the cloud server. Secondly, IoT terminals can confirm their cryptographic attributes to the cloud and obtain the permissions corresponding to each attribute by encrypting the attributes. The terminal uses these permissions to encrypt the FL model parameters and uploads the secret parameters to the edge server. Through the storage of the edge server, these ciphertext decryption parameters are shared with the other terminal models of FL. Finally, other terminal models are trained by downloading and decrypting the shared model parameters for the purpose of FL. The performance analysis shows that this model has a better performance in computational complexity and computational time compared with the cited literature.

Security Evaluation of Initialization Phases and Round Functions of Rocca and AEGIS

Authenticated-Encryption with Associated-Data (AEAD) plays an important role in guaranteeing confidentiality, integrity, and authenticity in network communications. To meet the requirements of high-performance applications, several AEADs make use of AES New Instructions (AES-NI), which can conduct operations of AES encryption and decryption dramatically fast by hardware accelerations. At SAC 2013, Wu and Preneel proposed an AES-based AEAD scheme called AEGIS-128/128L/256, to achieve high-speed software implementation. At FSE 2016, Jean and Nikolić generalized the construction of AEGIS and proposed more efficient round functions. At ToSC 2021, Sakamoto et al. further improved the constructions of Jean and Nikolić, and proposed an AEAD scheme called Rocca for beyond 5G. In this study, we first evaluate the security of the initialization phases of Rocca and AEGIS family against differential and integral attacks using MILP (Mixed Integer Linear Programming) tools. Specifically, according to the evaluation based on the lower bounds for the number of active S-boxes, the initialization phases of AEGIS-128/128L/256 are secure against differential attacks after 4/3/6 rounds, respectively. Regarding integral attacks, we present the integral distinguisher on 6 rounds and 6/5/7 rounds in the initialization phases of Rocca and AEGIS-128/128L/256, respectively. Besides, we evaluate the round function of Rocca and those of Jean and Nikolić as cryptographic permutations against differential, impossible differential, and integral attacks. Our results indicate that, for differential attacks, the growth rate of increasing the number of active S-boxes in Rocca is faster than those of Jean and Nikolić. For impossible differential and integral attacks, we show that the round function of Rocca achieves the sufficient level of the security against these attacks in smaller number of rounds than those of Jean and Nikolić.

Privacy‐preserving remote sensing images recognition based on limited visual cryptography

AbstractWith the arrival of new data acquisition platforms derived from the Internet of Things (IoT), this paper goes beyond the understanding of traditional remote sensing technologies. Deep fusion of remote sensing and computer vision has hit the industrial world and makes it possible to apply Artificial intelligence to solve problems such as automatic extraction of information and image interpretation. However, due to the complex architecture of IoT and the lack of a unified security protection mechanism, devices in remote sensing are vulnerable to privacy leaks when sharing data. It is necessary to design a security scheme suitable for computation‐limited devices in IoT, since traditional encryption methods are based on computational complexity. Visual Cryptography (VC) is a threshold scheme for images that can be decoded directly by the human visual system when superimposing encrypted images. The stacking‐to‐see feature and simple Boolean decryption operation make VC an ideal solution for privacy‐preserving recognition for large‐scale remote sensing images in IoT. In this study, the secure and efficient transmission of high‐resolution remote sensing images by meaningful VC is achieved. By diffusing the error between the encryption block and the original block to adjacent blocks, the degradation of quality in recovery images is mitigated. By fine‐tuning the pre‐trained model from large‐scale datasets, we improve the recognition performance of small encryption datasets for remote sensing images. The experimental results show that the proposed lightweight privacy‐preserving recognition framework maintains high recognition performance while enhancing security.

A Searchable Encryption with Forward/Backward Security and Constant Storage

Dynamic searchable encryption satisfies users’ needs for ciphertext retrieval on semi-trusted servers, while allowing users to update server-side data. However, cloud servers with dynamically updatable data are vulnerable to information abuse and file injection attacks, and current public key-based dynamic searchable encryption algorithms are often complicated in construction and high in computational overhead, which is not efficient for practical applications. In addition, the client’s storage costs grow linearly with the number of keywords in the database, creating a new bottleneck when the size of the keyword set is large. To solve the above problems, a dynamic searchable encryption scheme that uses a double-layer structure, while satisfying forward and backward security, is proposed. The double-layer structure maintains a constant client-side storage cost while guaranteeing forward and backward security and further reduces the algorithm overhead by avoiding bilinear pairings in the encryption and decryption operations. The analysis results show that the scheme is more advantageous in terms of security and computational efficiency than the existing dynamic searchable encryption scheme under the public key cryptosystem. It is also suitable for the big data communication environment.

A Flexible and High-Performance Lattice-Based Post-Quantum Crypto Secure Coprocessor

Progress of quantum computing technology seriously threaten the industrial information security based on traditional public-key cryptosystem. Thus, the cryptosystem with anti-quantum attack characteristics is gradually becoming a significant research in the security field. In this article, a flexible and high-performance secure coprocessor is designed for security in industrial processes, which can execute the post-quantum cryptographic algorithm Saber efficiently. Custom instruction set and arithmetic accelerators are proposed to effectively optimize the flexibility of system architecture, and improve the performance of calculation. The hardware implementation results show that the maximum operating frequency of the coprocessor can reach 345 MHz. Compared with related state-of-the-art works, it achieves the highest operating frequency on the same Xilinx UltraScale+ FPGA platform, performing the encryption and decryption operations within 13.5 and 15.4 <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">μ</i> s, respectively. Meanwhile, this article achieves 1.7/3.1/5.9× area-time product improvements in look-up table flip-flop block memory storage with good flexibility.

Overview of Cryptography

Until very recently, the term "cryptography" was almost always used to refer to "encryption," which is the act of transforming plaintext or conventional information into an unintelligible form (called cipher text). Decryption is the opposite, or the process of returning plaintext from the unintelligible cipher text. The encryption and reversing decryption operations are carried out by a pair of algorithms known as cyphers (or cyphers). The algorithm and, in each case, a "key" work together just to regulate the precise operation of a cypher. The key, which is required to decrypt the cipher text, is a secret that should ideally only be known by the communicants. It typically takes the form of a short string of characters that the user can remember. A "cryptosystem" is the ordered list of elements with a finite number of potential combinations in formal mathematics.

Computer Network Communication Security Encryption System Based on Ant Colony Optimization Algorithm

With the increasing number of computer network users, the problem of network communication security has become more and more serious. Encryption technology, as one of the key technologies for securing communication, has important research and application values. However, the security of conventional encryption methods is gradually challenged, and at the same time, traditional encryption algorithms require a large amount of computing resources, which makes it difficult to realize real-time encryption and decryption operations. Therefore, how to improve the confidentiality and efficiency of computer network communication security encryption system has become a current urgent problem to be solved. This paper firstly discussed the analysis of its application in the computer network communication security encryption system based on the ant colony optimization (ACO) algorithm. Through the theoretical analysis of the ACO algorithm in terms of bioheuristic optimization algorithm and the analysis of the characteristics of the algorithm, the optimization scheme of key distribution based on the ACO algorithm was discussed. Then, the differences between the ACO algorithm and the traditional encryption algorithm in terms of encryption duration, key distribution time, encryption strength and random number generation speed were further analyzed and verified by experimental data. The data results showed that the key distribution of the encryption system using the ACO algorithm had higher security and better performance compared with the traditional key distribution algorithm. By counting and comparing the data, it was found that the ACO algorithm showed very obvious advantages in terms of encryption and decryption time, key distribution time, encryption strength and random number generation. This indicates that the ACO algorithm has very important application prospects in computer network communication security encryption systems.

A Privacy-Preserving Scheme for Smart Grid Using Trusted Execution Environment

The increasing transformation from the legacy power grid to the smart grid brings new opportunities and challenges to power system operations. Bidirectional communications between home-area devices and the distribution system empower smart grid functionalities. More granular energy consumption data flows through the grid and enables better smart grid applications. This may also lead to privacy violations since the data can be used to infer the consumer’s residential behavior, so-called power signature. Energy utilities mostly aggregate the data, especially if the data is shared with stakeholders for the management of market operations. Although this is a privacy-friendly approach, recent works show that this does not fully protect privacy. On the other hand, some applications, like nonintrusive load monitoring, require disaggregated data. Hence, the challenging problem is to find an efficient way to facilitate smart grid operations without sacrificing privacy. In this paper, we propose a privacy-preserving scheme that leverages consumer privacy without reducing accuracy for smart grid applications like load monitoring. In the proposed scheme, we use a trusted execution environment (TEE) to protect the privacy of the data collected from smart appliances (SAs). The scheme allows customer-oriented smart grid applications as the scheme does not use regular aggregation methods but instead uses customer-oriented aggregation to provide privacy. Hence the accuracy loss stemming from disaggregation is prevented. Our scheme protects the transferred consumption data all the way from SAs to Utility so that possible false data injection attacks on the smart meter that aims to deceive the energy request from the grid are also prevented. We conduct security and game-based privacy analysis under the threat model and provide performance analysis of our implementation. Our results demonstrate that the proposed method overperforms other privacy methods in terms of communication and computation cost. The execution time of aggregation for 10,000 customers, each has 20 SAs is approximately 1 second. The decryption operations performed on the TEE have a linear complexity e.g., 172800 operations take around 1 second while 1728000 operations take around 10 seconds. These results can scale up using cloud or hyper-scalers for real-world applications as our scheme performs offline aggregation.

Privacy‐preserving and fine‐grained data sharing for resource‐constrained healthcare CPS devices

AbstractMedical cyber‐physical systems (CPS) provide the possibility for real‐time health monitoring of patients and flexible diagnostic services based on expert systems by collaboratively integrating and connecting various physical devices including sensors, terminals, and cloud infrastructure. However, the ubiquitous security threats in cyberspace have raised concerns about data security and user privacy. Although related works propose to protect data security and user privacy with cryptographic protocols, their heavy computational and storage overheads incur performance and battery life challenges for resource‐constrained devices in the healthcare CPS. This article proposes an energy‐saving and privacy‐preserving data sharing (ESPPDS) scheme to address the challenge. ESPPDS inherits the anonymous fine‐grained access control from attribute‐based encryption (ABE) while protecting data integrity and supporting efficient user revocation. We also eliminate the repetitive computations of ciphertext components by utilizing the online/ offline encryption technology, and design a subtle and secure trick to delegate the decryption operations to the edge device, thereby reducing the computational overheads of the resource‐constrained devices. We then show the security proof, and discuss the construction in the untrusted/ compromised server setting. The comparison and experiment indicate that ESPPDS is practical and more efficient than related schemes.

Generation Initial Key of the AES Algorithm based on Randomized and Chaotic System

information security is a critical concern and a top priority for many communications networks. Cryptography is a suitable method of data security that can be used to maintain the secrecy and authenticity of information and can improve the privacy aspect of the data. The AES algorithm is one of the most important encryption algorithms and the best in protecting data. In this paper, a comparison was made between two different methods for the generation initial key of the key expansion of the AES-192 algorithm, in the first method, the initial key generated by the user (chose a random key by the user), and in the second method, the initial key generated by the chaotic system (which used the logistic function to generate the numbers chaotically). After testing the two methods, the second method that used a chaotic system is faster and more secure than the first method. Also, the encryption and decryption operations using the key generated by the chaotic system were faster when applying it to various sizes of text files and the plaintext is difficult to discover from the ciphertext. When comparing the proposed method to earlier experiments, it is both quicker and messier than earlier encryption techniques.

Verifiable Outsourced Decryption of Encrypted Data From Heterogeneous Trust Networks

Cloud-based Internet of Things (IoT) management services can be utilized to acquire data from devices at any point on Earth. Accordingly, controlling access to data managed by possibly untrusted cloud servers is crucial. Attribute-based encryption (ABE) provides flexible access control and the capability to delegate, facilitating decryption operations with high computationally costs to be outsourced to cloud servers. Earlier studies discussed guarantees to the accuracy of delegated computation through various cryptographic encoding techniques, thus helping data receivers verify the precision of outsourced decryption operations. In this article, we investigate two state-of-the-art schemes addressing verifiable outsourced decryption of encrypted data, and show their vulnerability to our verification bypassing attacks. We then propose a securitywise enhanced encoding scheme that disables such attacks. In addition, a rigorous security analysis is conducted, demonstrating the capabilities of the proposed scheme against bypassing attacks. An experimental analysis finds that the method proposed in this article outperforms the two state-of-the-art works by 82% and 87%, respectively, on the encoding computation cost.

Practical Privacy Preserving-Aided Disease Diagnosis with Multiclass SVM in an Outsourced Environment

With the rapid development of cloud computing and machine learning, using outsourced stored data and machine learning model for training and online-aided disease diagnosis has a great application prospect. However, training and diagnosis in an outsourced environment will cause serious challenges to the privacy of data. At present, many scholars have proposed privacy preserving machine learning schemes and made a lot of progress, but there are still great challenges in security and low client load. In this paper, we propose a complete privacy preserving outsourced multiclass SVM training and aided disease diagnosis scheme. We design some efficient basic operation algorithms for encrypted data. Then, we design an efficient and privacy preserving SVM model training protocol using the basic operation algorithms. We propose a secure maximum finding algorithm and secure comparison algorithm. Then, we design an efficient online-aided disease diagnosis scheme based on the BFV cryptosystem and blinding technique. Detailed security analysis proves that our scheme can protect the privacy of each participant. The experimental results illustrate that our proposed scheme significantly reduces the computation overhead compared with the previous similar works. Our proposed scheme completes most of the operations of aided disease diagnosis by the cloud servers and the client only needs to complete a small amount of encryption and decryption operations. The overall computation overhead is 0.175 s, and the efficiency of online aided disease diagnosis is improved by 85.4%. At the same time, our proposed scheme provides multiclass diagnosis results, which can better assist doctors in their treatment.

Blockchain Security Using Merkle Hash Zero Correlation Distinguisher for the IoT in Smart Cities

Internet of Things (IoT) data is one of the most important assets in business models for offering various ubiquitous and brilliant services. The IoT is provided with the advantage of susceptibility that cybercriminals and other malicious users. Even though smart cities are intended to extend productivity and efficiency, residents and authorities face risks when they avoid cybersecurity. The conventional blockchain methods were introduced to ensure the secure management and examination of the smart city big data. But, the blockchains are found to have computationally high costs, and failed to improve the security, not adequate resource-constrained IoT devices have been designated for smart cities. In order to address these issues, the proposed novel blockchain model called blockchain secured Merkle hash zero correlation distinguisher (BSMH-ZCD) is suitable for IoT devices within the cloud infrastructure. The objective of the BSMH-ZCD method is to enhance security and reduce the run time and computational overhead. Initially, the Merkle hash tree is used to create the hash value with every transaction. Next, the zero correlation distinguisher is applied to perform the data encryption and decryption operation for the ARX block for obtaining proficient secure data access in the IoT devices. Experimental assessment of the proposed BSMH-ZCD method and existing methods are carried out by using the taxi driver data set and Novel Corona Virus 2019 data set with different factors, such as running time, computational complexity, and security with respect to a number of blocks and executions. By using the taxi driver data set, the experimental results reveal that the BSMH-ZCD method performs better with a 19% improvement in security, 20% reduction of computational complexity, and 29% faster running time for IoT compared to existing works.

Anonymous Identity Based Broadcast Encryption against Continual Side Channel Attacks in the State Partition Model

In the past 10 years, many side-channel attacks have been discovered and exploited one after another by attackers, which have greatly damaged the security of cryptographic systems. Since no existing anonymous broadcast encryption scheme can resist the side-channel attack, the paper presents an anonymous identity-based broadcast encryption against continual side-channel attacks in the state partition model (CLR-SS-AIBBE). Based on split-state technology, the proposed scheme divides the private key into two states, and the decryption operations are correspondingly divided into two steps. Based on the three static hypotheses for a bilinear group with composite order, the proposed scheme can be proved to be fully secure by the dual system encryption technology in the standard model. The leakage ratio about the private key can reach 1/3.

An Attribute-Based Encryption Method Using Outsourced Decryption and Hierarchical Access Structure

Cloud computing is being rapidly adopted by many organizations from different domains and large amounts of data is stored in the cloud. In order to ensure data security, the attribute-based access control mechanism has been emerging recently as a fine-grained access control model that grants access based on the data user’s attributes. In this model, the data owner builds the access policy using the attributes of the data users and access to the data is granted only if the requirements of such an access policy are satisfied. Ciphertext policy-based attribute-based encryption (CPABE) is one of the most widely used methods for providing encrypted access control. Complex, time consuming and costly paring operations are the major issue with the CPABE method. Hence, another efficient method is needed to reduce the data user’s overhead while decrypting data. This paper presents an efficient method consisting in outsourcing decryption operations to a third-party server, so that complex operations may be performed by that machine with only some simple calculations left on the data user’s side. The concept of a hierarchical access structure is also integrated with the traditional CPABE technique. The hierarchical approach enables the data owner to encrypt multiple data using a single common hierarchical access structure. This allows the user to decrypt only the relevant part of ciphertext, depending on which fragment of the hierarchical access structure is satisfied. The paper evaluates also the performance of the proposed model in terms of time and storage cost.

Image encryption algorithm based on digital filters controlled by 2D robust chaotic map

This paper introduces a new cryptosystem algorithm based on digital filters; as an encryption operation, second-order and third-order IIR digital filters are used, and as a decryption operation, second-order and third-order FIR digital filters are used: Chaos in digital filters is caused by the overflow non-linearity function. Both IIR and FIR digital filters are controlled by the first random sequence of zeros and ones produced by the 2D robust chaotic map, while the filters coefficients are generated by the second sequence, so that each pixel is encrypted and decrypted with different coefficients. Fisher-Yates shuffle has been used to obtain a random permutation of the position of the pixels of the original image, so that, the rows are shuffled first, then the columns, based on random numbers obtained by a hyperchaotic map 2D-LICM and 2D-SLIM respectively. Another algorithm based only on a single digital IIR/FIR filter is also presented in this work to allow us to demonstrate the development and high security of the proposed approach. Simulation and experimental results with performance analysis are carried out to demonstrate that our algorithm has high security and can resist various attacks such as differential attacks and statistical attacks.

Area-Time Efficient Hardware Architecture for CRYSTALS-Kyber

This paper presents a novel area-time efficient hardware architecture of the lattice-based CRYSTALS-Kyber, which has entered the third round of the post-quantum cryptography standardization competition hosted by the National Institute of Standards and Technology. By developing a dual-path delay feedback number theoretic transform multiplier dedicating for Kyber parameter set and deploying this multiplier in the Kyber architecture, the key generation, encryption, and decryption operations are accelerated substantially. Furthermore, the proposed architecture offers the best value of area-time product in comparison with existing approaches. The implementation results on Xilinx Vivado targeted for Virtex-7 FPGA board demonstrate that the proposed Kyber cryptoprocessor completes encryption and decryption operations in approximately 57.5 μs at the highest frequency of 226 MHz. Furthermore, the area-time product value when using the proposed Kyber architecture is improved by at least twofold compared with existing architectures.

Enhanced Dual-Policy Attribute-Based Encryption for Secure Data Sharing in the Cloud

As a promising service paradigm, cloud computing has attracted lots of enterprises and individuals to outsource big data to public cloud. To facilitate secure data using and sharing, dual-policy attribute-based encryption (DP-ABE) is a suitable solution. It allows two access control mechanisms over encrypted data at the same time: one involves access policies over subjective attributes ascribed to user credentials, and the other involves policies over objective attributes ascribed to data. In this work, we are exploring methods to make DP-ABE more flexible, more efficient, and more secure for deployments in cloud scenes. Our proposal features the following achievements simultaneously: (1) beyond the access control mechanisms of DP-ABE, it also supports two flexible features called encryption and key generation in single-policy modes; (2) most operations of key generation, encryption, and decryption are securely outsourced to cloud servers, leaving extremely low overheads for the PKG, data owners, and users; and (3) it realizes the strongest security notion of public-key encryption schemes, namely, CCA security. We formalize the security definition and formally prove its security in the random oracle model. Moreover, we implement the proposed schemes using the Charm framework. The experiment results demonstrate that our schemes are efficient and practical.

Separable Reversible Data Hiding in Encrypted VQ-Encoded Images

In this paper, a reversible data-hiding scheme in encrypted, vector quantization (VQ) encoded images is proposed. During image encryption, VQ-encoded image, including codebook and index table, is encrypted by content owner with stream-cipher and permutation to protect the privacy of image contents. As for additional-data embedding, a baseline method is first proposed and its corresponding optimized method is then given. By grouping one high-occurrence index with one or multiple low-occurrence indices, a series of index groups are constructed. Thus, by modifying the high-occurrence index to the corresponding index within the same group according to the current to-be-embedded bits, data embedding can be realized. The optimal hiding capacity is obtained by optimizing the coefficient vector for different types of index groups. Separable operations of data extraction, image decryption, and recovery can be achieved on the receiver side based on the availability of the encryption and data-hiding keys. Experimental results show that our scheme can achieve high hiding capacity and satisfactory directly decrypted image quality and guarantee security and reversibility simultaneously.

Novel Searchable Attribute-Based Encryption for the Internet of Things

As the product of the third information technology revolution, the Internet of Things (IoT) has greatly altered our way of lifetime. Cloud storage has gradually become the best choice for data processing due to its scalability and flexibility. However, the cloud is not a completely trusted entity, such as tampering with user data or leaking personal privacy. Therefore, cloud storage usually adopts attribute-based encryption schemes to accomplish data confidentiality and fine-grained access control. However, applying the ABE scheme to the Internet of Things still faces many challenges, such as dynamic user revocation, data sharing, and excessive computational burden. In this paper, we propose a novel searchable attribute encryption system that replaces the traditional key generation center with consortium blockchain to generate and manage partial keys. In addition, our scheme can perform predecryption operations in the cloud, and users only need to spend a small amount of computational cost to achieve decryption operations. Security analysis proves that our scheme achieves security under both the chosen keyword attack and the chosen plaintext attack. Compared with other schemes, this scheme is more economical in terms of computing and storage.