Hierarchical Identity-based Encryption Research Articles

Efficient revocable identity‐based encryption from multilinear maps

AbstractIn Identity‐Based Encryption (IBE) systems, there is a widespread concern over the issue on how to provide an efficient revocation mechanism. We develop a new approach in constructing an efficient revocable IBE scheme. Our approach utilizes recent advances in multilinear maps and combines a two‐level hierarchical IBE scheme with a revocation encryption system. In our revocable IBE scheme, both the public parameters and the private key are constant‐size. Simultaneously, the size of the update key at some time is only proportional to the number of revoked users at the time. Our proposed scheme is proven secure in the selective revocation list model without relying on random oracles. Copyright © 2015 John Wiley & Sons, Ltd.

Practical chosen-ciphertext secure Hierarchical Identity-Based Broadcast Encryption

We focus on practical Hierarchical Identity-Based Broadcast Encryption (HIBBE) with semantic security against adaptively chosen-ciphertext attacks (CCA2) in the standard model. We achieve this goal in two steps. First, we propose a new HIBBE scheme that is secure against chosen-plaintext attacks (CPA). Compared with the existing HIBBE scheme that is built from composite-order bilinear groups, our construction is based on prime-order bilinear groups. The much better efficiency of group operations in prime-order bilinear groups makes our proposed HIBBE scheme more practical. Then, we convert it into a CCA2-secure scheme at the cost of a one-time signature. Instead of extending one user hierarchy in the Canetti---Halevi---Katz approach from CPA-secure ($$l+1$$l+1)-Hierarchical Identity-Based Encryption [($$l+1$$l+1)-HIBE] to CCA2-secure $$l$$l-HIBE, our construction merely adds one on-the-fly dummy user in the basic scheme. We formally prove the security of these two schemes in the standard model. Comprehensive theoretical analyses and experimental results demonstrate that the proposed HIBBE schemes achieve desirable performance.

SECO: Secure and scalable data collaboration services in cloud computing

Cloud storage services enable users to remotely store their data and eliminate excessive local installation of software and hardware. There is an increasing trend of outsourcing enterprise data to the cloud for efficient data storage and management. However, this introduces many new challenges toward data security. One critical issue is how to enable a secure data collaboration service including data access and update in cloud computing. A data collaboration service is to support the availability and consistency of the shared data among multi-users. In this paper, we propose a secure, efficient and scalable data collaboration scheme SECO. In SECO, we employ a multi-level hierarchical identity based encryption (HIBE) to guarantee data confidentiality against untrusted cloud. This paper is the first attempt to explore secure cloud data collaboration services that precludes information leakage and enables a one-to-many encryption paradigm, data writing operation and fine-grained access control simultaneously. Security analysis indicates that the SECO is semantically secure against adaptive chosen ciphertext attacks (IND-ID-CCA) in the random oracle model, and enforces fine-grained access control, collusion resistance and backward secrecy. Extensive performance analysis and experimental results show that SECO is highly efficient and has only low overhead on computation, communication and storage.

Anonymous hierarchical identity-based encryption without key delegation in decryption

Hierarchical identity-based encryption (HIBE) introduces the concept of hierarchical identity in identity-based encryption (IBE) which eases the burden of key generation centre. Anonymous identity-based encryption is another extension of IBE in which the ciphertext leaks no information about the target identity. In this paper, we propose a new anonymous hierarchical identity-based encryption system. Unlike previous anonymous HIBE system, our system needs no key delegation in decryption, i.e., the user can decrypt the ciphertext directly if his identity vector is the prefix of the target identity vector. So it is not necessary for the user to know the target identity vector, which enhances the practicality of anonymous HIBE systems. Our system is constructed in composite order groups and proven adaptive security and anonymity from four static assumptions by using the dual system encryption technique.

Multi-keyword ranked searchable public-key encryption

Most related works on Public-Key Encryption with Keyword Search scheme also called Searchable Public-key Encryption focus on single keyword search. Some works supporting multi-keyword search cannot provide search result ranking. In this paper, we study the problem of multi-keyword ranked search over encrypted data in public-key model. We propose the definition of Multi-Keyword Ranked Searchable Public-key Encryption/Public-Key Encryption with Multi-Keyword Ranked Search. In the definition, we allow the receiver to query any set of keywords. As the query result, the receiver can get the number of queried keywords appearing in the encrypted data, which can be used to evaluate the similarity ranking of the data keywords to the search query in 'as many matches as possible' principle. We put forward a generic construction for public-key encryption with multi-keyword ranked search scheme with sub-linear ciphertext based on any anonymous hierarchical identity-based encryption scheme and provide the security analysis. At last, we present a concrete scheme with sub-linear ciphertext.

MEASURABLE, SAFE AND SECURE DATA MANAGEMENT FOR SENSITIVE USERS IN CLOUD COMPUTING

Cloud Computing is most trustworthy internet paradigm for small scale business entrepreneurs. The increased use of cloud computing applications has grown the users access to the database. The increase usage of users access has created the privacy problems in cloud computing. The increased usage of data centers with different users has given rise to data leakage and privacy data issues. The data owner could not trust the users access as the data of other users is accessed and revealed to other users. There is an urgency to arrest the problem of privacy issues and data security. The proposed project is developed to support the delegation of private keys to the users. This private key is generated to subsumes Hierarchical Identity-Based Encryption. The proposed project is developed on the basis of attribute based access rights to the users from the data owner. The project is developed to convey the protected key through automatic mail as soon as the user is registered with the data owner for accessing the fine-grained data sharing.

Unbounded Anonymous Hierarchical Identity-Based Encryption in the Standard Model

In this work, we present a new anonymous HIBE scheme which is unbounded in the sense that the public parameters do not impose additional limitations on the functionality of the systems. In most of previous constructions of anonymous HIBE in the standard model, a maximum hierarchy depth had to be fixed at setup. Our constructions avoid these limitations. We use a nested dual system encryption argument to prove full security for our anonymous HIBE scheme, in the standard model and relying on static assumptions.

Hierarchical identity-based broadcast encryption scheme from LWE

A hierarchical identity-based broadcast encryption (H-IBBE) scheme is an identity-based broadcast encryption (IBBE) scheme in a hierarchical environment. In order to obtain secure H-IBBE schemes in the quantum era, we propose an H-IBBE scheme based on the learning with errors problem assumption. Our scheme achieves indistinguishability from random under adaptive chosen-plaintext and chosen-identity attacks in the random oracle model.

Compact hierarchical identity-based encryption based on a harder decisional problem

We generalize the decisional problem that was used to prove the security of a well-known hierarchical identity-based encryption scheme by Boneh, Boyen and Goh. We argue that our new problem is strictly harder than the original problem, and thus the security of the aforementioned cryptographic primitive is laid on even stronger foundations.

Hierarchical Certificate-Based Encryption: Definition and an Efficient Construction

Certificate-based encryption is a new paradigm which was introduced by Gentry to address the complex public key revocation problem in traditional public key cryptosystems. It represents an interesting and potentially useful balance between traditional public-key encryption and identity-based encryption. In this paper, we introduce the notion of hierarchical certificate-based encryption that preserves the advantages of certificate-based encryption such as implicit certificate and key-escrow free while inheriting the properties of hierarchical identity-based encryption. We formalize the definition of hierarchical certificate-based encryption and also propose a concrete hierarchical certificate-based encryption scheme that is chosen-ciphertext secure under the hardness of bilinear Diffie-Hellman problem in the random oracle model.

Revisits and Transformations Among Functional Encryption Systems

ABSTRACTFunctional encryption provides a general access control over the encrypted data, where only the receiver with attribute that satisfies control policy function of policy parameter (i.e. ) can decrypt its ciphertext. Special cases of functional encryption include (anonymous-) (hierarchical) identity-based encryption, fuzzy identity-based encryption, attribute-based encryption, public key encryption with keyword search, spatial encryption, inner-product encryption, hidden-vector encryption and predicate encryption. In general functional encryption systems, the control policy function can be set flexibly. The main gap among these functional encryption schemes lies in the policy functions that associates with the secret keys. In this work, we first investigate several functional encryption schemes, and then formalize and unify the functionality description of the control policies for these schemes. After giving a general definition and security model, we present the relationship and transformations among functional encryption schemes when the equivalence of these different policy functions is employed.

RHIBE: Constructing Revocable Hierarchical ID-Based Encryption from HIBE

Up to now, there was very little work on studying the revocation problem in existing hi- erarchical ID-based encryption (HIBE) systems. Certainly, all existing HIBE systems may inherit the revocation method suggested by Boneh and Franklin to revoke illegal or expired users, in which non-revoked users must periodically update their private keys using secure channels by contacting their ancestors in hierarchical structures. In this paper, we propose the first HIBE scheme with pub- lic revocation mechanism, called revocable HIBE (RHIBE), which is extended from Lewko and Waters's unbounded HIBE scheme presented in Eurocrypt 2011. We demonstrate that the proposed RHIBE scheme is fully secure while removing the requirement of secure channels for private key updating in Boneh and Franklin's revocation method. The public revocation mechanism is an excit- ing alternative to the existing revocation methods. Finally, we discuss the transformation technique from a HIBE scheme to a RHIBE scheme and employ it to another well-known HIBE scheme.

Efficient Hierarchical Identity-Based Encryption for Mobile Ad Hoc Networks

A Mobile Ad-hoc Network (MANET) is a collection of wireless nodes that can dynamically form a network to exchange information without using any pre-existing fixed network infrastructure. Such networks are more vulnerable to security attacks than conventional wired networks, and hence cryptographic schemes are usually used to ensure security for them. It is worth noting that the nodes in MANETs are with low computational power and communicate over relatively bandwidth constrained wireless links, and thus the deployed cryptographic schemes should usually be highly efficient in term of both computational cost and communication overhead. To ensure the data confidentiality for MANETs, in this paper, we present a new hierarchical identity-based encryption (HIBE) scheme, which enjoys the advantages of low computational cost and light communication overhead. We further propose a new hierarchical identity-based key encapsulation mechanism (HIBKEM) based on our HIBE scheme. The proposed HIBKEM scheme is fully secure against adaptive chosen-ciphertext attack, and has a tight security reduction in the standard model.

Timed-Release Hierarchical Identity-Based Encryption

We propose a notion of hierarchical identity-based encryption (HIBE) scheme with timed-release encryption (TRE) mechanism, timed-release hierarchical identity-based encryption (TRHIBE), and define its security models. We also show a generic construction of TRHIBE from HIBE and one-time signature, and discuss the security of the constructed scheme.

Efficient hierarchical identity-based encryption for Mobile Ad hoc Networks

A Mobile Ad-hoc Network (MANET) is a collection of wireless nodes that can dynamically form a network to exchange information without using any pre-existing fixed network infrastructure. Such networks are more vulnerable to security attacks than conventional wired networks, and hence cryptographic schemes are usually used to ensure security for them. It is worth noting that the nodes in MANETs are with low computational power and communicate over relatively bandwidth constrained wireless links, and thus the deployed cryptographic schemes should usually be highly efficient in term of both computational cost and communication overhead. To ensure the data confidentiality for MANETs, in this paper, we present a new hierarchical identity-based encryption (HIBE) scheme, which enjoys the advantages of low computational cost and light communication overhead. We further propose a new hierarchical identity-based key encapsulation mechanism (HIBKEM) based on our HIBE scheme. The proposed HIBKEM scheme is fully secure against adaptive chosen-ciphertext attack, and has a tight security reduction in the standard model.

Hierarchical identity-based encryption without key delegation in decryption

Hierarchical Identity-Based Encryption HIBE is a generalisation of Identity-Based Encryption IBE which mirrors an organisational hierarchy. However, when the user decrypts a ciphertext encrypted to a hierarchical identity, he/she should know the exact hierarchical identity in order to run the delegate algorithm to get the secret key corresponding to the target hierarchical identity if the hierarchical identity linked with his/her key is a prefix of the target hierarchical identity. In this paper, we consider a new concept called HIBE without key delegation in decryption. In such HIBE systems, the user can decrypt the ciphertext directly without running the delegate algorithm even if his hierarchical identity is only a prefix of the target hierarchical identity. We present two HIBE systems, which are proven secure in the standard model under the decision BDH and l-BDHE assumptions, respectively. Both systems have the same decryption efficiency in pairing, compared with BB

Scalable Hierarchical Identity-based Signature Scheme from Lattices

In the paper, we propose a novel adaptively secure hierarchical identity-based signature scheme from lattices. The size of signatures in our scheme is shortest among the existing hierarchical identity-based signature schemes from lattices. Our scheme is motivated by Gentry et al.s signature scheme and Agrawal et al.s hierarchical identity-based encryption scheme.

Lattice-based certificateless public-key encryption in the standard model

The notion of certificateless public-key encryption (CL-PKE) was introduced by Al-Riyami and Paterson in 2003 that avoids the drawbacks of both traditional PKI-based public-key encryption (i.e., establishing public-key infrastructure) and identity-based encryption (i.e., key escrow). So CL-PKE like identity-based encryption is certificate-free, and unlike identity-based encryption is key escrow-free. In this paper, we introduce simple and efficient CCA-secure CL-PKE based on (hierarchical) identity-based encryption. Our construction has both theoretical and practical interests. First, our generic transformation gives a new way of constructing CCA-secure CL-PKE. Second, instantiating our transformation using lattice-based primitives results in a more efficient CCA-secure CL-PKE than its counterpart introduced by Dent in 2008.

Security and privacy issues in electronic health network

Electronic health network (EHN) is an information system providing functions involved in e-health. In this paper, we devise mechanisms covering three important security and privacy issues of EHN including trust management, privacy preserving, and data sharing. First, we propose an authenticated key agreement scheme based on hierarchical identity-based signature (HIBS). We abstract a hierarchical architecture from the social network architecture of EHN. To support large-scale scenarios, we introduce a virtual signature generation phase into traditional HIBS, thus our scheme will be efficient even the depth is quite big. Second, we propose a fast data searching scheme based on symmetric searchable encryption (SSE). To improve the searching efficiency, we introduce a two-level cache structure into the traditional SSE. Third, we propose an access control scheme based on hierarchical identity-based encryption (HIBE). To make it a fine-grained scheme, we organize the data owner’s file in hierarchy and introduce a virtual key generation phase to traditional HIBE. Also, the scheme can provide delegation and revocation functions easily. Besides, our schemes guarantee known-key secrecy, forward secrecy, and antidirection secrecy and possess the resistance capability to collude-attack. Evaluation results show that our scheme indeed achieves the security and efficiency.

Unbounded anonymous hierarchical IBE with continual-key-leakage tolerance

Modern cryptographic schemes are constructed under the fundamental assumption that secret keys are perfectly hidden from all possible attackers. In practice, however, keys and internal states may partially be leaked. Recently, cryptographic construction with key-leakage resilience has been a crucial research topic. In this work, we proposed an anonymous hierarchical identity-based encryption that can tolerate partial leakage of secret keys. Our results were as follows. First, we provided a tolerance for continual key leakage that can capture both memory leakage and continual leakage. We extended a dual-system encryption mechanism in orthogonal subgroups to achieve key-leakage resilience and implicitly employed an update algorithm to guard against continual leakage. Second, the delegation depth is unbounded, which means that no predetermined depth was imposed in the setup algorithm, thus making the scheme very flexible in practice. We employed a secret-sharing approach to split the master key into multiple shares in key components corresponding to the elements. Third, we analyzed and discussed the performance of allowable leakage-tolerance bounds and the leakage rate of the proposed scheme and gave an evaluation that attains about 40-70% leakage rate under the Advanced Encryption Standard 112 security level. Copyright © 2013 John Wiley & Sons, Ltd.