Fuzzy Identity-based Encryption Research Articles

A Self-Sovereign Identity Privacy-Preserving Scheme for Logistics Transportation Based on One-Time-Use Tokens

The advancement of the logistics industry has fostered the enhancement of operational efficacy within the socioeconomic domain. However, the current inevitable privacy leaks in the process of logistics transportation have seriously affected the development of the industry, which led to a crisis of consumer trust and even caused economic recession. This paper proposes a self-sovereign identity privacy protection scheme tailored specifically for logistics transportation contexts. First, the scheme entails furnishing users with one-time-use tokens while establishing decentralized identities capable of concealing identity information and ensuring the secure transmission of data. Furthermore, the scheme integrates fuzzy identity-based encryption to encrypt identity information, thereby guaranteeing the confidentiality and integrity of logistics user identities along with their associated data. Compared with other schemes, this scheme exhibits superior security in the realm of logistics transportation. Its targeted encryption technology and self-sovereignty strategies address the critical issue of privacy leakage, thereby safeguarding consumer privacy rights and interests while facilitating the sustainable development of the logistics industry.

IoT-friendly, pre-computed and outsourced attribute based encryption

The Internet of Things (IoT) and its applications are growing at an unprecedented rate. In such a complex network with an enormous number of nodes, an important challenge is how to securely handle the access control problem. Attribute Based Encryption (ABE) is a powerful and flexible cryptographic primitive to address the challenge of realizing fine-grained access control in many systems. However, using ABE in IoT systems is often problematic due to the heavy computational overhead originating from the bilinear pairing operations and the relatively large key sizes of ABE schemes.This paper deals with this challenge by proposing some solutions to overcome the limitations of using ABE in IoT systems. The contributions of this paper are divided into three parts. In the first part, we propose modified fuzzy identity-based encryption (FIBE) schemes that use fewer optimal ate pairing operations compared to the original FIBE. FIBE is a special case of ABE, in which the access structure simplifies to a threshold gate. We also introduce a new security notion named the Conditional Chosen Ciphertext Attack-2 (Conditional CCA-2) selective security which is stronger than the CPA selective security notion. We prove that the proposed FIBE schemes have Conditional CCA-2 selective security, under the Asymmetric Decisional Modified Bilinear Diffie–Hellman (ADMBDH) assumption. In the second part, we proposed Key Policy Attribute Based Encryption (KP-ABE) schemes that use fewer pairing operations compared to the previous KP-ABE schemes. Our FIBE and KP-ABE schemes use elliptic curve groups which ensure shorter keys. In the third part of our contribution, we propose secure methods to outsource the heavy operations in FIBE and KP-ABE schemes (i.e. scalar multiplication by a curve point, exponentiation, and pairing) such that IoT devices can cope with the complexity.

Fuzzy Identification-Based Encryption for healthcare user face authentication

Background: Internet of Medical Things (IOMT) has the potential to monitor health continuously and in real-time. One of the main issues that arise in IOMT is how securely the data can be transmitted to the clinical team. In this project, biometric Identity-based encryption was utilized using the Fuzzy-IBE (Identity-based encryption) scheme that uses face features of the clinicians to create the public key. Figure 1 shows the testbed setup designed to improve the privacy and security of the patients’ healthcare data. Methods: The testbed comprises an ESP32 platform sensing and encrypting data, the Nvidia Jetson Nano for data collection and decryption, and the Thingsboard online platform for vital information visualization. Fuzzy Identity-Based Encryption (FIBE)1–3 uses legitimate users’ facial features. The encrypted vital information is transmitted to the Edge-device (Jetson Nano) through BLE/Wi-Fi. On the edge-device of the healthcare system, the face authentication mechanism verifies the user's (clinician) legitimacy to assess the data. Upon user authentication, their facial features will be used to generate a private decryption key that can decrypt the received encrypted data. The data is further sent to the core cloud (Thingsboard) for storage and visualization. To secure the data on the cloud, we deployed an Intrusion Detection System (IDS) model using deep learning to identify the inter-domain stream of malicious traffic. Results: The face authentication testing using Fuzzy Identity-based Cryptography relied on a public data set. The execution time was calculated for Encryption (time to encrypt the patient's vital data using a public key of health physician's facial features) and decryption (time to match at least d components of the ciphertext and perform message decryption). The experimental results are reported in Table 1. Conclusion: In today's age of advanced telecommunication technology, cyber security is a very important factor. The designed testbed setup in this work showcases how healthcare data can be secured against malicious attacks.

Efficient self-adaptive access control for personal medical data in emergency setting

The notion of access control allows data owners to outsource their data to cloud server, while encouraging the sharing of data with legally authorised users. Note that the traditional access control techniques only allow authorised users to access the sharing data. However, it is intractable to obtain the required data when the data owner encounters some emergency circumstances, such as, medical first-aid. Recently, Yang et al. proposed a self-adaptive access control scheme, which can ensure secure data sharing in both normal and emergency medical scenarios. However, their construction needs to involve an emergency contact person. We argue that Yang et al.'s scheme suffers from two weaknesses: 1) it is vulnerable to single point of failure when the emergency contact person is offline; 2) the two cloud model brings extra computation and communication overhead. To overcome the above shortcomings, we present a new efficient self-adaptive medical data access control by integrating fuzzy identity-based encryption and convergent encryption. Specifically, our proposed construction can achieve patients' data access by their fingerprint in emergency setting. Furthermore, the proposed scheme supports cross-user data deduplication and improves the performance of system by convergent encryption. Experiment results show that our scheme has an advantage in efficiency.

Efficient self-adaptive access control for personal medical data in emergency setting

The notion of access control allows data owners to outsource their data to cloud server, while encouraging the sharing of data with legally authorised users. Note that the traditional access control techniques only allow authorised users to access the sharing data. However, it is intractable to obtain the required data when the data owner encounters some emergency circumstances, such as, medical first-aid. Recently, Yang et al. proposed a self-adaptive access control scheme, which can ensure secure data sharing in both normal and emergency medical scenarios. However, their construction needs to involve an emergency contact person. We argue that Yang et al.'s scheme suffers from two weaknesses: 1) it is vulnerable to single point of failure when the emergency contact person is offline; 2) the two cloud model brings extra computation and communication overhead. To overcome the above shortcomings, we present a new efficient self-adaptive medical data access control by integrating fuzzy identity-based encryption and convergent encryption. Specifically, our proposed construction can achieve patients' data access by their fingerprint in emergency setting. Furthermore, the proposed scheme supports cross-user data deduplication and improves the performance of system by convergent encryption. Experiment results show that our scheme has an advantage in efficiency.

Identity-Based Steganography in Spatial Domain

This paper proposed an identity-based steganographic scheme, where a receiver with certain authority can recover the secret message ready for him, but cannot detect the existence of other secret messages. The proposed scheme created several separate covert communication channels tagged by the Fuzzy Identity-Based Encryption (FIBE) in one grayscale image. Then each channel is used to embed one secret message by using any content-aware steganographic scheme. Receivers with different attributes can extract different messages corresponded. The Experiments illustrated the feasibility of this identity-based secret message extraction. Further, the proposed scheme presents high undetectability against steganalytic attack launched by receivers without corresponded attributes.

Distance-Based Encryption: How to Embed Fuzziness in Biometric-Based Encryption

We introduce a new encryption notion called distance-based encryption (DBE) to apply biometrics in identity-based encryption. In this notion, a ciphertext encrypted with a vector and a threshold value can be decrypted with a private key of another vector, if and only if the distance between these two vectors is less than or equal to the threshold value. The adopted distance measurement is called Mahalanobis distance, which is a generalization of Euclidean distance. This novel distance is a useful recognition approach in the pattern recognition and image processing community. The primary application of this new encryption notion is to incorporate biometric identities, such as face, as the public identity in an identity-based encryption. In such an application, usually the input biometric identity associated with a private key will not be exactly the same as the input biometric identity in the encryption phase, even though they are from the same user. The introduced DBE addresses this problem well as the decryption condition does not require identities to be identical but having small distance. The closest encryption notion to DBE is the fuzzy identity-based encryption, but it measures biometric identities using a different distance called an overlap distance (a variant of Hamming distance) that is not widely accepted by the pattern recognition community, due to its long binary representations. In this paper, we study this new encryption notion and its constructions. We show how to generically and efficiently construct such a DBE from an inner product encryption (IPE) with reasonable size of private keys and ciphertexts. We also propose a new IPE scheme with the shortest private key to build DBE, namely, the need for a short private key. Finally, we study the encryption efficiency of DBE by splitting our IPE encryption algorithm into offline and online algorithms.

Fully secure fuzzy identity-based encryption for secure IoT communications

How to securely transmit data is an important problem in Internet of Things (IoT). Fuzzy identity-based encryption (FIBE) is a good candidate for resolving this problem. However, existing FIBE schemes suffer from the following disadvantages: rely on random oracle models, merely secure in selective-ID model, long public parameters, and loose security reduction. In this paper, we propose a new FIBE scheme. Our scheme is secure in the full model without random oracles, and at the same time has a tight security reduction and short public parameters. This means that our scheme is quite suitable for secure transmitting data in IOT.

SECURITY ANALYSIS OF A FUZZY IDENTITY-BASED ENCRYPTION SCHEME

Fuzzy identity-based encryption (FIBE) scheme is a kind of identity-based encryption (IBE) scheme, in which any user's identity is composed by a set of attributes and any ciphertext encrypted under identity ID can be decrypted by using a private key corresponding to identity ID′ if ID′ is close to ID as measured by some metric. Due to the error-tolerance property, FIBE scheme is very useful in real-world applications. However, most FIBE schemes are provable secure only in a weaker security model. In order to eliminate this problem, Ren et al. recently proposed a new FIBE scheme and proved that it is fully chosen-ciphertext secure in the standard model. Unfortunately, in this paper, we will show that their FIBE scheme is even not chosen-plaintext secure.

Improvement on a Fuzzy Identity-based Encryption Scheme

Sahai and Waters introduced a fuzzy id-based encryption (FIBE) scheme in which an identity was viewed as a set of descriptive attributes, and any user with a private key for an identity was allowed to decrypt a ciphertext encrypted with an identity , if and only if the identity and were close to each other as measured by the “set overlap” distance metric. After that, Shweta Agrawal, Xavier Boyen, Vinod Vaikuntanathan, Panagiotis Voulgaris and Hoeteck Weeto constructed a fuzzy id-based encryption scheme from the hardness of the Learning With Errors ( ) problem. The two schemes both had more longer public and private keys, and it was not very efficient. This paper gives more efficient fuzzy id-based encryption scheme from lattice, in which the public keys are greatly reduced, and there are two vectors corresponding to each bit of the identity by using of the algorithm Sampleleft introduced by Shweta Agrawal, Dan Boneh and Xavier Boyen, and only a trapdoor basis is the secret key. Furthermore, the scheme is dealing with information and is also secure from the hardness of the Learning With Errors ( ) problem, and all these greatly raise efficiency.

Revisits and Transformations Among Functional Encryption Systems

ABSTRACTFunctional encryption provides a general access control over the encrypted data, where only the receiver with attribute that satisfies control policy function of policy parameter (i.e. ) can decrypt its ciphertext. Special cases of functional encryption include (anonymous-) (hierarchical) identity-based encryption, fuzzy identity-based encryption, attribute-based encryption, public key encryption with keyword search, spatial encryption, inner-product encryption, hidden-vector encryption and predicate encryption. In general functional encryption systems, the control policy function can be set flexibly. The main gap among these functional encryption schemes lies in the policy functions that associates with the secret keys. In this work, we first investigate several functional encryption schemes, and then formalize and unify the functionality description of the control policies for these schemes. After giving a general definition and security model, we present the relationship and transformations among functional encryption schemes when the equivalence of these different policy functions is employed.

Private mutual authentications with fuzzy matching

A private mutual authentication, or unlinkable secret handshake, originally allows two members from the same organisations to anonymously authenticate each other. In this paper, a new privacy-preserving mutual authentication protocol is constructed to achieve fuzzy private matching. The proposed protocol supports more flexible threshold-based appropriate matching under the multiple-groups environment, which is not limited to authenticate between members from the same groups. Our new protocol is constructed from the fuzzy identity-based encryption scheme and constant-size group signature. Without using the random oracle, the new protocol is proved secure by assuming the intractability of the decisional bilinear Diffie-Hellman problems. Compared with previous works, our proposed protocol can adapt to many different applications.

Fuzzy Certificateless Identity-Based Encryption Protocol from Lattice

Due to their conjectured resistance to quantum cryptanalysis, strong worst-case/average-case security guarantees, ease of implementation and increasing practicality, lattice-based cryptography is one of the hottest and fastest moving areas in mathematical cryptography today. In this paper, we give a fuzzy certificateless identity-based encryption scheme from lattice, whose security is based on the hardness of the Learning With Errors (LWE) problem. In the scheme, the user can choose his own secret key that the KGC cannot obtain, which is an efficient approach to mitigate the key escrow problem in fuzzy identity-based encryption scheme.

Secure Symmetric Key Fuzzy Identity-Based Encryption

Symmetric key fuzzy Identity-Based Encryption (IBE) is a special type of IBE in secret key model. In this paper we extend the notion to the case of fuzzy Identity-Based Encryption, and give a formal definition of symmetric key fuzzy IBE and its security requirements. Moreover, we propose a construction of symmetric key fuzzy IBE based on the public key fuzzy IBE of Sahai and Waters, and prove its security.

Oblivious Transfer with Threshold Access Control

In this paper, we introduce the concept of oblivious transfer with threshold access control. Namely, for each message in a database, the server associates an attribute set τ with it such that the message can only be available, on request, to the users who possess at least t attributes out of τ. Meanwhile, after the server and users execute the protocol, the server will not learn anything about the identities, attributes or message choices of the users. The essential idea of ”threshold” access control is to define the minimum number of attributes from a given set of attributes that users have to possess in order to obtain the message. Combining Sahai and Waters' fuzzy identity-based encryption with a credential signature scheme, we present a concrete construction for the oblivious transfer with threshold access control which is proved secure in the standard model.

A provable secure fuzzy identity based signature scheme

To use biometrics identities in an identity based encryption system, Sahai and Waters first introduced the notion of fuzzy identity based encryption (FIBE) in 2005. Yang et al. extended it to digital signature and introduced the concept of fuzzy identity based signature (FIBS) in 2008, and constructed an FIBS scheme based on Sahai and Waters’s FIBE scheme. In this paper, we further formalize the notion and security model of FIBS scheme and propose a new construction of FIBS scheme based on bilinear pairing. The proposed scheme not only provides shorter public parameters, private key and signature, but also have useful structures which result in more efficient verification than that of Yang et al.’s FIBS scheme. The proposed FIBS scheme is proved to be existentially unforgeable under a chosen message attack and selective fuzzy identity attack in the random oracle model under the discrete logarithm assumption.

Cryptanalysis of a Fuzzy Identity Based Encryption Scheme in the Standard Model

Fuzzy identity based encryption (FIBE), proposed by Sahai and Waters, is a new kind of identity based encryption. It allows users with identity w can decrypt ciphertext for w' if and only if w is close enough to w'. Recently, Ren et al. proposed a new FIBE scheme and claimed it is fully CCA2 secure in the standard model with a tight reduction. However, in this paper we will show that their scheme is not correct. Furthermore, the key generation process of their scheme cannot resist the collusion attack, which is a basic security requirement for FIBE. At last, we propose a new fully secure FIBE scheme based on the Sahai–Waters FIBE scheme and prove its security by using the “dual system encryption” technique.

Fuzzy identity based signature with applications to biometric authentication

We introduce a new cryptographic primitive which is the signature analog of fuzzy identity based encryption (FIBE). We call it fuzzy identity based signature (FIBS). It possesses similar error-tolerance property as FIBE that allows a user with the private key for identity ω to decrypt a ciphertext encrypted for identity ω′ if and only if ω and ω′ are within a certain distance judged by some metric. We give the definition and security model of FIBS and present the first practical FIBS scheme. We prove that our scheme is existentially unforgeable against adaptively chosen message attack in the standard model. To our best knowledge, this primitive was never considered in the identity based signature before. FIBS is of particular value for biometric authentication, where biometric identifiers such as fingerprints, iris, voice and gait are used in human identification. We demonstrate the applicability of our construction to secure biometric authentication.

ABACS: An Attribute-Based Access Control System for Emergency Services over Vehicular Ad Hoc Networks

In this paper, we propose an Attribute-Based Access Control System (ABACS) for emergency services with security assurance over Vehicular Ad Hoc Networks (VANETs). ABACS aims to improve the efficiency of rescues mobilized via emergency communications over VANETs. By adopting fuzzy identity-based encryption, ABACS can select the emergency vehicles that can most appropriately deal with an emergency and securely delegate the authority to control traffic facilities to the assigned emergency vehicles. Using novel cryptographic preliminaries, ABACS realizes confidentiality of messages, prevention of collusion attacks, and fine-grained access control. As compared to the current PKI scheme, the computational delay and transmission overhead can be reduced by exploiting the advantages afforded by message broadcasting, which is heavily used in ABACS. The performance evaluation demonstrates that ABACS is a suitable candidate for realizing emergency services via VANETs.

A new biometric identity based encryption scheme secure against DoS attacks

AbstractRecently, Sarier 1 proposed an efficient biometric Identity Based Encryption (IBE) scheme called BIO‐IBE using the Sakai Kasahara Key Construction and proved its security in the Random Oracle Model (ROM) based on the well‐exploited k‐BDHI computational problem. Despite its efficiency compared to other fuzzy IBE systems implemented for biometric identities, BIO‐IBE is not secure against a new type of denial of service (DoS) attack that we present. In this context, we describe a new biometric IBE scheme and show that our scheme is immune against this attack due to the signature applied on the public value PAR of the user. This way, the sender can detect whether PAR of the receiver that is stored publicly is modified by an active adversary, thus the generation of a ciphertext based on a wrong identity is avoided. The main difference of the new scheme is the structure of the key generation algorithm, where a unique biometric identity string ID obtained from the biometric attributes is used instead of picking a different polynomial for each user as in other fuzzy IBE schemes. In addition to the well‐defined security model for current fuzzy IBE schemes, we describe a stronger security model and prove the security of our scheme in this framework achieving a better reduction cost compared to BIO‐IBE. Finally, our scheme provides security against DoS attacks and better efficiency in terms of the key generation and decryption algorithms compared to the existing fuzzy IBE schemes. Copyright © 2009 John Wiley & Sons, Ltd.