Identity-based Broadcast Encryption Research Articles

Privacy preserving data sharing method for social media platforms.

Digital security as a service is a crucial aspect as it deals with user privacy provision and secure content delivery to legitimate users. Most social media platforms utilize end-to-end encryption as a significant security feature. However, multimedia data transmission in group communication is not encrypted. One of the most important objectives for a service provider is to send the desired multimedia data/service to only legitimate subscriber. Broadcast encryption is the most appropriate cryptographic primitive solution for this problem. Therefore, this study devised a construction called anonymous revocable identity-based broadcast encryption that preserves the privacy of messages broadcasted and the identity of legitimate users, where even revoked users cannot extract information about the user's identity and sent data. The update key is broadcast periodically to non-revoked users, who can obtain the message using the update and decryption keys. A third-party can also revoke the users. It is proven that the proposed construction is semantically secure against IND-ID-CPA attacks and efficient in terms of computational cost and communication bandwidth.

A multivariate identity-based broadcast encryption with applications to the internet of things

<p style='text-indent:20px;'>When Kevin Ashton proposed the catchword 'Internet of Things' in 1999, little did he know that technology will become an indispensable part of human lives in just two decades. In short, the Internet of Things (IoT), is a catch-all terminology used to describe devices connected to the internet. These devices can share and receive data as well as provide instructions over a network. By design itself, the IoT system requires multicasting data and information to a set of designated devices, securely. Taking everything into account, Broadcast Encryption (BE) seems to be the natural choice to address the problem. BE allows an originator to broadcast ciphertexts to a big group of receivers in a well-organized and competent way, while ensuring that only designated people can decrypt the data. In this work, we put forward the first Identity-Based Broadcast Encryption scheme based on multivariate polynomials that achieves post-quantum security. Multivariate public key cryptosystems (MPKC), touted as one of the most promising post-quantum cryptography candidates, forms the foundation on which our scheme relies upon, which allows it to be very cost-effective and faster when implemented. In addition, it also provides resistance to collusion attack, and as a consequence our scheme can be utilized to form an efficient and robust IoT system.</p>

Identity-Based and Leakage-Resilient Broadcast Encryption Scheme for Cloud Storage Service

Cloud storage services are an important application of cloud computing. An increasing number of data owners store their data on cloud platforms. Since cloud platforms are far away from users, data security and privacy protection are very important issues that need to be addressed. Identity-based broadcast encryption (IBBE) is an important method to provide security and privacy protection for cloud storage services. Because the side channel attacks may lead to the disclosure of the key information of the cryptographic system, which will damage the security of the system, this paper provides an identity-based broadcast encryption with leakage resilience by state partition (LR-SP-IBBE). By using a binary extractor to compensate for the loss in entropy of the symmetric key caused by side-channel attacks, the proposed scheme randomizes the encapsulated symmetric key. Furthermore, using a state partition technique, we split the private key into two parts, and the corresponding decryption was divided into two stages. Through the double-system encryption skill, the security and leakage-resilience were proved in the composite order group model.

A Hybrid Multi-Cloud Framework Using the IBBE Key Management System for Securing Data Storage

Information storage and access in multi-cloud environments have become quite prevalent. In this paper, a multi-cloud framework is presented that secures users’ data. The primary goal of this framework is to secure users’ data from untrusted Cloud Service Providers (CSPs). They can collude with other malicious users and can hand over users’ data to these malicious users for their beneficial interests. In order to achieve this goal, the data are split into parts, and then each part is encrypted and uploaded to a different cloud. Therefore, client-side cryptography is used in this framework. For encrypting users’ data, the BDNA encryption technique is used. This framework presents a hybrid cryptographic approach that uses Identity-based Broadcast Encryption (IBBE) for managing the keys of the symmetric key algorithm (BDNA) by encrypting them with the particular version of IBBE. The work presented in this research paper is the first practical implementation of IBBE for securing encryption keys. Earlier, IBBE was only used for securely broadcasting data across many users over a network. The security of this hybrid scheme was proved through Indistinguishable Chosen-Ciphertext Attacks. This double encryption process makes the framework secure against all insiders and malicious users’ attacks. The proposed framework was implemented as a web application, and real-time storage clouds were used for storing the data. The workflow of the proposed framework is presented through screenshots of different working modules.

Cloud assisted semi-static secure accountable authority identity-based broadcast encryption featuring public traceability without random oracles

Cloud assisted semi-static secure accountable authority identity-based broadcast encryption featuring public traceability without random oracles

Anonymous Identity Based Broadcast Encryption against Continual Side Channel Attacks in the State Partition Model

In the past 10 years, many side-channel attacks have been discovered and exploited one after another by attackers, which have greatly damaged the security of cryptographic systems. Since no existing anonymous broadcast encryption scheme can resist the side-channel attack, the paper presents an anonymous identity-based broadcast encryption against continual side-channel attacks in the state partition model (CLR-SS-AIBBE). Based on split-state technology, the proposed scheme divides the private key into two states, and the decryption operations are correspondingly divided into two steps. Based on the three static hypotheses for a bilinear group with composite order, the proposed scheme can be proved to be fully secure by the dual system encryption technology in the standard model. The leakage ratio about the private key can reach 1/3.

Policy-Based Broadcast Access Authorization for Flexible Data Sharing in Clouds

Cloud storage services allow data owners to outsource their potentially sensitive data (e.g., private genome data) to remote cloud servers in a ciphertext form. To enable data owners to further share the data encrypted in ciphertexts, many proxy re-encryption (PRE) schemes are proposed. However, most schemes only support single-recipient or coarse-grained re-encryption, which may limit the flexibility for data sharing. To address this issue, we propose a Policy-based Broadcast Access Authorization (PBAA) scheme by introducing the well-established identity-based broadcast encryption (IBBE) and key-policy attribute-based encryption into PRE. In our PBAA scheme, a data owner can apply IBBE to encrypt his data to a group of recipients. More importantly, the data owner can generate a delegation key with an access policy, and send this key to the cloud such that it can convert any initial ciphertext satisfying the access policy into a new ciphertext for a new group of recipients. With these features, cloud users can share their remote data in a secure and flexible way. Security analysis and performance evaluation show that the PBAA scheme is secure and efficient, respectively.

Lightweight ID-based broadcast signcryption for cloud–fog-assisted IoT

Balancing the security and efficiency of the internet of things (IoT) is difficult due to its numerous heterogeneous devices, different trust levels of stakeholders, and asymmetric resource distribution among layers. Identity-based broadcast encryption (IBBE) is a promising technique to ensure data confidentiality, simplify the certification management issue, and achieve one-to-many data sharing while reducing overheads simultaneously. However, broadcast encryption (BE) schemes without source authentication are not applicable in the real world as they cannot prevent invalid messages from malicious users. Meanwhile, the computation cost of IBBE is heavy and not suitable for constrained devices. This paper proposes a lightweight ID-based broadcast signcryption scheme (LIBBSC), which takes advantage of fog nodes to temporarily store ciphertext and to partially designcrypt for end users. A fog node transforms the ciphertext based on the specific user’s public identity key and then sends the outdesigncrypted ciphertext to the end-user (this step transforms the broadcast to the one-to-one communication). Finally, only the designated end-user with the associated secret key can rapidly designcrypt with minimal computational cost. Our scheme is selective-ID secure against chosen-ciphertext attacks in the random oracle model. And the implementation and evaluation of the proposed scheme show that it is efficient and suitable for IoT devices.

Efficient Data Sharing With Privacy Preservation Over Lattices for Secure Cloud Storage

Data sharing is a basic data processing mechanism in the cloud storage. Data confidentiality and the receiver privacy are two important requirements of data-sharing systems. Because the data owner does not wish anyone who is not authorized to access the shared data and the authenticated data receiver also does not wish anyone else to know that he/she has accessed the shared data from the data owner. Broadcast encryption gives a possible solution to these requirements of data-sharing systems. This article constructs a data-sharing system over lattice by designing an efficient identity-based broadcast encryption (IBBE) scheme which achieves the data confidentiality and the identity privacy simultaneously. Besides the data owner, no one knows the identities of the authenticated data receivers in the proposed data-sharing system. Data confidentiality is achieved by the indistinguishability under the selective identity and the chosen ciphertext attacks (IND-sID-CCA) of the proposed IBBE scheme. It is proven in the random oracle model that the IND-sID-CCA security is based on the hardness of the learning with errors problem which can resist the quantum attacks. Inherited from the proposed IBBE scheme, the proposed data-sharing system also has several other characters which are suitable to the practical application. The most important feature is that all the public parameters size, private key size, and the ciphertext length are constant for any data receivers set in the proposed system. Hence, the proposed system adapts to the situation of large receiver group. Moreover, the proposed data-sharing system supports efficient member joining. When a new user asks to access the uploaded data, the existing receiver does not need to update his/her private key. The decryption cost of the existing receiver will remain unchanged when the outsourced data have been updated. Detailed performance analysis and a simulated experiment of the designed core algorithm are given by using Java program on a personal computer Intel Core i7-8700 K (3.7 GHz), 32 G RAM which verifies the design results in this article.

Broadcast Encryption Scheme for V2I Communication in VANETs

Information dissemination in vehicular ad hoc networks (VANETs) is inseparable from the interaction between vehicles and infrastructure. The trust authority (TA) often plays a pivotal role in VANETs and requires interaction with multiple vehicles. However, when the TA sends the same message to multiple vehicles, there are many redundancies, as it needs to negotiate with each vehicle and send them different ciphertexts. This greatly reduces the work efficiency of the TA. To the best of our knowledge, there is no research on the problem of redundancy that occurs when the same message is sent to multiple vehicles in VANETs. The proposed scheme adopts identity-based broadcast encryption (IBBE) technology, which is a secure data-sharing scheme suitable for the vehicle-to-infrastructure communication mode, in VANETs for the first time. Thus, with only one encryption, the TA can generate a fixed-length ciphertext for a group of vehicles. When there are new vehicles that subsequently request a service, the TA can assign encryption tasks to the proxy server. In terms of security, our scheme meets the particular requirements of VANETs. The encryption overhead of the sender and the length of the ciphertext were comparatively analyzed. The results demonstrated that the performance of the scheme improved significantly. Thus, our scheme can prevent redundancies and effectively improve the work efficiency of TA.

Shielded Identity Based Data and Contour Sharing for Mobile Healthcare Through Cloud Computing

Abstract: Cloud computing and social networks are changing the way healthcare provides by providing real-time data sharing in a cost-effective way. However, the issue of data security is one of the key barriers to the widespread use of social networking services (MHSN), as health information is considered extremely sensitive. In this paper, we introduce a secure data sharing and MHSN profile matching scheme on a cloud computer. Patients can extract their encrypted health records from cloud storage via identity-based broadcast encryption (IBBE), and share them with a team of physicians in a safe and effective manner. Then we introduce a conditional data-based encryption component, which allows physicians who satisfy the pre-defined conditions in ciphertext to authorize cloud platform to convert ciphertext into a new ciphertext-based encryption system. without disclosing any sensitive information. The paper will also provide insight into data security policies that may authorize certain administrators to have read-only capabilities for all device parameters and read / write specific set of commands. Each administrator may have a different access profile introduction.

Efficient Identity-Based Broadcast Encryption Scheme on Lattices for the Internet of Things

In an identity-based broadcast encryption (IBBE) scheme, the ciphertext is usually appended with a set of user identities to specify intended recipients. However, as IBBE is adopted in extensive industries, the demand of anonymity for specific scenarios such as military applications is urgent and ought no more to be ignored. On the contrary, how to optimize computation and communication is an unavoidable challenge in the IBBE scheme construction, especially in the large-scaled resource-limited wireless networks such as the Internet of Things (IoT), where the cost of computation and communication should be mitigated as much as possible since other functions including connectivity and privacy should be given the top priority. Thus, we present an IBBE scheme from the lattice, in which we employ the Chinese remainder theorem and lattice basis delegation in fixed dimensions to obtain several desirable characteristics, such as constant-size public parameter, private key, and ciphertext. In addition, our encryption and decryption algorithms are more efficient than broadcast encryption (BE) schemes based on number-theoretic problems. To be noticed, our scheme can simultaneously achieve confidentiality and outsider anonymity against the chosen-plaintext attack under the hardness of the learning with error (LWE) problem.

An ID-based Broadcast Encryption Scheme for Cloud-network Integration in Smart Grid

An ID-based Broadcast Encryption Scheme for Cloud-network Integration in Smart Grid

Blockchain enabled Security Framework for handling Security and privacy challenges in Smart cities

One of the intriguing secure applications with regards to the keen city is communicating data to authentic clients, alluringly with client protection. Broadcast encryption has been considered as a helpful device to ensure the information security and give information access control. Most works in broadcast encryption are about the information security, while less consideration is paid to the information access control and the character protection. In this paper, in view of transmission encryption, we present a plan called Fully Privacy-Preserving and Revocable Identity-Based Broadcast Encryption, which protects the information security and the personality security of the collector just as the denied client. The information can be safely ensured and just the approved client can get to the information. The repudiation cycle doesn't uncover any data about the information substance and the collector personality. The general population adapts nothing about the recipient character and the repudiated client personality. These properties lead to pleasant applications in the shrewd city where character protection is attractive. The security of our plan is end up being semantically secure in the arbitrary prophet model

Dual Encryption based secured data maintenance using Fog Computing

Many people and organizations are accessing data in the cloud due to the rapid growth of cloud computing .Fog computing interface used between cloud and the end devices to reduce the overhead of the cloud computing and better network services, with secure data transmission requirement. In this paper, Identity Based Broadcast Encryption with Decrypting Time Interval (IBBE-DTI) scheme is proposed for protecting the data securely. This facilitates the data to be encrypted with authentication token which is the combination of private key and identities of users who wants the data. To increasing the security, data owner additionally set decrypting time interval along with the data to be encrypted which leads to additional key namely Time Secret Key (TSK) for decryption. This paper proposed a dual verification process for efficient user authentication based on authorization token, which will be defined by the data owner, and a Unique Signature, which will generate by the fog processor at the time of encryption. This proposed work supports both security of data and verifies the user authentication for efficient data transmission with low computation overhead.

KeyD: Secure Key-Deduplication with Identity-Based Broadcast Encryption

Deduplication, which can save storage cost by enabling us to store only one copy of identical data, becomes unprecedentedly significant with the dramatic increase in data stored in the cloud. For the purpose of ensuring data confidentiality, they are usually encrypted before outsourced. Traditional encryption will inevitably result in multiple different ciphertexts produced from the same plaintext by different users' secret keys, which hinders data deduplication. Convergent encryption makes deduplication possible since it naturally encrypts the same plaintexts into the same ciphertexts. One attendant problem is how to reliably and effectively manage a huge number of convergent keys. Several deduplication schemes have been proposed to deal with the convergent key management problem. However, they either need to introduce key management servers or require interaction between data owners. In this paper, we design a novel client-side deduplication protocol named KeyD without such an independent key management server by utilizing the identity-based broadcast encryption (IBBE) technique. Users only interact with the cloud service provider (CSP) during the process of data upload and download. Security analysis demonstrates that KeyD ensures data confidentiality and convergent key security, and well protects the ownership privacy simultaneously. A thorough and detailed performance comparison shows that our scheme makes a better tradeoff among the storage cost, communication and computation overhead.

Identity Based Broadcast Encryption Scheme with Shorter Decryption Keys for Open Networks

In Broadcast Encryption schemes, a sender can broadcast the encrypted message securely in a threatening network to a set of legitimate system users only. In IBE scheme any sender can encrypt the desired message using his/her identity without attaining the public key certificate. Here, we have presented an efficient ID-based broadcast encryption scheme (IBBE) for open networks. In this scheme, desired messages can be broadcasted to any subset of the users by any sender but only authorized receivers are capable in retrieving the encrypted messages. This scheme has shorter decryption keys in comparison with other primitive of IBBE scheme for open networks. Moreover, the proposed scheme intends to achieve the lower cost for computation as well as transmission in comparison to earlier existing IBBE schemes.

Revocable identity-based encryption with server-aided ciphertext evolution

The utmost important problem in identity-based cryptosystems is the issue of user revocation. One of the existing solutions in the literature is to issue extra time keys periodically for every non-revoked user over public channels. Unfortunately, this solution is inefficient and very impractical when applying to the cloud. Because the scheme requires different time keys to allow data decryption for different time periods, and therefore the user has to keep a long list of time keys, which grows linearly with time. Furthermore, it is worth noting that ciphertexts produced prior to the revocation will remain available to the revoked users, which is undesirable for most application scenarios. To the best of our knowledge, there is no existing work that can solve both the aforementioned problems simultaneously in a practical manner. In this paper, we present an efficient solution called ciphertext evolution. The ciphertexts evolve to new ones with cloud's aid and the old ones are deleted. At any time, the data user has to utilize its current decryption key to decrypt ciphertexts in the cloud. So, all the past time keys become invalid and the user only needs to keep the current one. If the user is revoked, it cannot decrypt any ciphertext in the cloud because it does not have the current time key. We present generic and concrete constructions of revocable identity-based encryption with ciphertext evolution (RIBE-CE), which are proven based on the IND-CPA security model. Subsequently, we also extend RIBE-CE to the broadcast setting by giving generic and concrete constructions of revocable identity-based broadcast encryption with ciphertext evolution, which are secure under the IND-sID-CPA security model. Our schemes can be applied to the (group) data sharing, which is very practical and applicable to the cloud setting.

Secure auditing and deduplication for encrypted cloud data supporting ownership modification

Storing only one unique copy of the same cloud data and guaranteeing its integrity are two main goals for cloud storage auditing and deduplication schemes. In such schemes, data owners can firmly believe the data integrity by periodically auditing and the cloud server can save lots of storage space by exploiting the duplication techniques. However, when a data owner deletes or modifies his outsourced data, he should lose the ownership for the original data and should not be able to successfully retrieve this data any more. For all we know, existing cloud storage auditing and deduplication literatures fail to support the modifications of ownership, which actually occur quite often in actual cloud storage scenarios. In this paper, we propose the first deduplicated data integrity auditing scheme supporting the ownership modification. It guarantees the integrity of the outsourced data and supports the dynamic access control over the outsourced data. We employ a re-encryption algorithm and the secure identity-based broadcast encryption technology, which prevent data from being disclosed to the revoked owners, even if they previously had prior ownership of these data. The security and efficiency of our proposed scheme have been validated by detailed analysis and experiments.

Identity-Based Encryption Transformation for Flexible Sharing of Encrypted Data in Public Cloud

With the rapid development of cloud computing, an increasing number of individuals and organizations are sharing data in the public cloud. To protect the privacy of data stored in the cloud, a data owner usually encrypts his data in such a way that certain designated data users can decrypt the data. This raises a serious problem when the encrypted data needs to be shared to more people beyond those initially designated by the data owner. To address this problem, we introduce and formalize an identity-based encryption transformation (IBET) model by seamlessly integrating two well-established encryption mechanisms, namely identity-based encryption (IBE) and identity-based broadcast encryption (IBBE). In IBET, data users are identified and authorized for data access based on their recognizable identities, which avoids complicated certificate management in usual secure distributed systems. More importantly, IBET provides a transformation mechanism that converts an IBE ciphertext into an IBBE ciphertext so that a new group of users not specified during the IBE encryption can access the underlying data. We design a concrete IBET scheme based on bilinear groups and prove its security against powerful attacks. Thorough theoretical and experimental analyses demonstrate the high efficiency and practicability of the proposed scheme.