Identity-based Proxy Re-encryption Scheme Research Articles

A provably secure collusion-resistant identity-based proxy re-encryption scheme based on NTRU

Proxy re-encryption (PRE) technology realizes the transformation of decryption right from a delegator to a delegatee. In response to the rapid development of quantum attack technology, scholars have proposed the lattice-based PRE schemes, and the underlying encryption scheme of most lattice-based PRE schemes is the dual cryptosystem, which has the defects of large storage overhead, computational overhead and low efficiency. To address these deficiencies, we present a novel identity-based proxy re-encryption (IB-PRE) scheme based on NTRU. By means of the underlying efficient NTRU scheme, the proposed scheme reduces the storage overhead and computational overhead on key size and computational complexity, and improves efficiency. Our scheme possesses desired properties such as multi-hop property, unidirectionality and collusion-resistance. Meanwhile, based on the decisional Hermite normal form of ring learning with errors (D-RLWEHNF) hard problem, it is carefully designed and demonstrated to be secure under selective identity and chosen plaintext attacks in the standard model.

Multi-Keyword Searchable Identity-Based Proxy Re-Encryption from Lattices

To protect the privacy of cloud data, encryption before uploading provides a solution. However, searching for target data in ciphertext takes effort. Therefore, searchable encryption has become an important research topic. On the other hand, since the advancement of quantum computers will lead to the crisis of cracking traditional encryption algorithms, it is necessary to design encryption schemes that can resist quantum attacks. Therefore, we propose a multi-keyword searchable identity-based proxy re-encryption scheme from lattices. In addition to resisting quantum attacks, the proposed scheme uses several cryptographic techniques to improve encryption efficiency. First, identity-based encryption is used to reduce the computation and transmission costs caused by certificates. Second, the proposed scheme uses proxy re-encryption to achieve the purpose of outsourced computing, allowing the proxy server to reduce the computation and transmission costs of the users. Third, the proposed multi-keyword searchable encryption can provide AND and OR operators to increase the flexibility of searchability. Moreover, the access structure of the proposed scheme is not based on a linear secret sharing scheme (LSSS), avoiding the errors caused by an LSSS-based structure in decryption or search results. Finally, we also give formal security proof of the proposed scheme under the decisional learning with errors assumption.

Identity-Based Proxy Re-Encryption Scheme Using Fog Computing and Anonymous Key Generation

In the fog computing architecture, a fog is a node closer to clients and responsible for responding to users' requests as well as forwarding messages to clouds. In some medical applications such as the remote healthcare, a sensor of patients will first send encrypted data of sensed information to a nearby fog such that the fog acting as a re-encryption proxy could generate a re-encrypted ciphertext designated for requested data users in the cloud. Specifically, a data user can request access to cloud ciphertexts by sending a query to the fog node that will forward this query to the corresponding data owner who preserves the right to grant or deny the permission to access his/her data. When the access request is granted, the fog node will obtain a unique re-encryption key for carrying out the re-encryption process. Although some previous concepts have been proposed to fulfill these application requirements, they either have known security flaws or incur higher computational complexity. In this work, we present an identity-based proxy re-encryption scheme on the basis of the fog computing architecture. Our identity-based mechanism uses public channels for key distribution and avoids the troublesome problem of key escrow. We also formally prove that the proposed protocol is secure in the IND-PrID-CPA notion. Furthermore, we show that our work exhibits better performance in terms of computational complexity.

An Identity-Based Proxy Re-Encryption Scheme With Single-Hop Conditional Delegation and Multi-Hop Ciphertext Evolution for Secure Cloud Data Sharing

Proxy re-encryption (PRE) provides a promising solution for applications requiring efficient and secure ciphertext conversion, such as secure cloud data sharing. While the one with the function of ciphertext evolution is more desirable for some long-term schemes involving key update. Recently, Yao et al. constructed an identity-based conditional proxy re-encryption scheme simultaneously supporting authorization and ciphertext evolution. However, its delegated ciphertext can be re-authorized, which may cause the authorization to exceed the original delegator’s expectation. In contrast, the single-hop PRE authorization scheme may be more appropriate for systems requiring better control over authorization. In this paper, an identity-based proxy re-encryption scheme with single-hop conditional delegation and multi-hop ciphertext evolution (IBPRE-SHCD-MHCE) is proposed. Also, its description, construction, and security analysis are given. The analysis and experimental comparison results show that the proposed scheme has improved the computational efficiency and storage consumption compared with the two underlying schemes.

Backdoor-resistant identity-based proxy re-encryption for cloud-assisted wireless body area networks

The wireless body area network (WBAN) provides users with real-time medical services. Meanwhile, the cloud technology provides greater storage space and computing power for medical data. Both of them have contribute to the development of telemedicine. In a cloud-assisted WBAN, the open network environment and the semi-trust cloud service providers expose the user’s private medical data to backdoor adversaries who can make exfiltration attacks, such as the algorithm substitution attack (ASA) through the process of data sharing. Therefore, it is necessary to find a secure and efficient medical data sharing scheme for the huge amount of medical data. In this paper, we first design an identity-based proxy re-encryption scheme with cryptographic reverse firewall (IBPRE-CRF), then show the application in a multiple-access telemedicine data sharing scenario. Security analysis shows that the IBPRE-CRF scheme provides chosen plaintext attack security and resists exfiltration attacks. Performance analysis shows that the IBPRE-CRF scheme has a significant communication and computational cost advantage while being resistant to exfiltration attacks in clouds. Therefore, our IBPRE-CRF scheme is suitable for telemedicine data sharing in a cloud-assisted WBAN.

Identity-based threshold proxy re-encryption scheme from lattices and its applications

Identity-based threshold proxy re-encryption scheme from lattices and its applications

Efficient Identity-based Proxy Re-encryption Scheme in Blockchain-assisted Decentralized Storage System

Efficient Identity-based Proxy Re-encryption Scheme in Blockchain-assisted Decentralized Storage System

IB-VPRE: adaptively secure identity-based proxy re-encryption scheme from LWE with re-encryption verifiability

Identity-based proxy re-encryption (IB-PRE) can convert the ciphertext encrypted under Alice’s identity to Bob’s ciphertext of the same message by a semi-trusted proxy with the proper transformation key. The main purpose of our work is to enhance the security of IB-PRE. For outside attacks, all existing IB-PRE constructions from lattices have only achieved a limited or weak security model called IND-sID-CPA security. Therefore, by embedding re-encryption key generation and re-encryption algorithms appropriately in Agrawal et al.’s identity-based encryption scheme from lattices, we construct an IND-ID-CPA secure IB-PRE scheme over decisional learning with errors (LWE) under the standard model. For inside attacks, we propose a new primitive IB-VPRE by extending the basic IB-PRE scheme with a new functionality called re-encryption verifiability, meaning that a re-encrypted ciphertext receiver or a third party can verify whether the received ciphertext is correctly transformed from an original ciphertext or not, and thus can detect illegal activities of the proxy. We realize re-encryption verifiability using the homomorphic signature technique as a black box, making the resulting scheme non-interactive and quantum-immune after instanced by a lattice-based homomorphic signature scheme.

New identity based proxy re-encryption scheme from lattices

Identity-Based Proxy Re-Encryption (IB-PRE) allows a semi-trusted proxy to convert the ciphertext encrypted under Alice's identity into Bob's ciphertext of the same message without leaking plaintext. Lattice-based cryptography enjoys potential resistance to quantum analysis and low computational complexity. A multi-hop and unidirectional IB-PRE from lattices is presented. We split the functions of decryption and ciphertext transformation separately, and design the double private keys mechanism, where two keys are generated for each user, one key is used to decrypt the ciphertext by Pre-Image Sampling technique, and the other is used to generate the re-encryption key by Bonsai Trees technique. The generation of the re-encryption key is non-interactive and collusion resistant. Moreover, its IND-sID-CPA security over the decisional Learning With Errors (LWE) assumption under the standard model is proved. Compared with some previous IB-PRE schemes from Bilinear Pairings, the format of transformed ciphertext in our scheme remains unchanged, furthermore, it can also resist quantum analysis. Compared with some existing IB-PRE schemes from lattices with similar properties, the space of the message in our scheme is a vector of length l and the encryption process remains a lower encryption blowup factor. At last, a proof-of-concept implementation is provided.

Secure and efficient proxy re-encryption scheme based on key-homomorphic constrained PRFs in cloud computing

With the rapid development of cloud computing, its security and privacy are of great concern. Since the cloud service provider is not completely trustworthy, the security of the outsourced files has become serious issues. Identity-based proxy re-encryption (IBPRE) schemes have been proposed to achieve feasible access control of encrypted data under the condition of guaranteeing the confidentiality of data, which can transfer the original ciphertexts to the re-encrypted ciphertexts for a designated decryptor. However, most of the existing IBPRE schemes either do not support revocation or computational complexity is too high. In this paper, we combine the properties of constrained pseudorandom functions (PRFs) and key homomorphic PRFs to construct a secure and efficient proxy re-encryption scheme for cloud computing. In our proposed scheme, the data owner authenticates the requesters and distributes the decryption keys by using an identity-based key exchange method. Meanwhile, a proxy re-encryption scheme is used to achieve data sharing and ciphertext update. We present the security proof of our scheme. In addition, compared with other existing schemes, our scheme has low computational complexity and communication cost.

A Source Hiding Identity-Based Proxy Reencryption Scheme for Wireless Sensor Network

Wireless sensor network (WSN), which extends the typical Internet environment to Internet of Things, has been deployed in various environments such as safety monitoring, intelligent transportation, and smart home. In a WSN, encryption is typically used to protect data that are stored in wireless devices. However some features like data sharing can be affected if the traditional encryption is used. A secure mechanism should support a gateway of the network to directly convert a user’s encrypted data (encrypted pollution data) to a new user’s encryption without exposing the underlying plaintext data during the whole sharing phase. In this work, a new source hiding identity-based proxy reencryption scheme (SHIB-PRE) is proposed to deal with the issue. The proposed SHIB-PRE scheme supports a proxy (gateway or cloud server) to transform a user’s encrypted date to a new user’s ciphertext as long as the proxy has the proxy reencryption key. In SHIB-PRE, the encrypted pollution data is kept secure from the proxy and the relationship between a source ciphertext and a reencrypted ciphertext is concealed from the outside eavesdropper. In this paper, we give an introduction to the definition of a source hiding identity-based proxy reencryption and its chosen plaintext security model. Further, a concrete construction will be presented and proven chosen plaintext secure under the q-DDHE assumption in the standard model.

Identity-based re-encryption scheme with lightweight re-encryption key generation

Cryptographic proxy re-encryption is a very useful primitive which is capable of transforming a ciphertext under one public key PK1 into a new ciphertext under another public key PK2 without private information leakage, while the two ciphertexts are encryptions of the same message. Re-encryption schemes at first are constructed under the public-key encryption (PKE) scenario. While it is a powerful primitive naturally required in not only PKE but also other scenarios, various extensions from PKE to other advanced encryption schemes like identity-based encryption (IBE), attribute-based encryption (ABE) as well as functional encryption (FE) are needed as well. In this work we have concentrated on how to reduce the workloads in the user/client side at large. To this end, we have put forth a novel identity-based proxy re-encryption (IBPRE) scheme with the feature that the re-encryption key gen­eration for the users is highly lightweight - actually almost free. Although this will lead to possibly extra decryption workload due to the utilization of homomorphic encryption, it is the first scheme realizing such almost free RK generation. In addition, it can also avoid some other shortcomings like re-encryption key management.

Improved functional proxy re-encryption schemes for secure cloud data sharing

Recently Liang et al. propose an interesting privacy-preserving ciphertext multi-sharing control for big data storage mechanism, which is based on the cryptographic primitive of anonymous multi-hop identity based conditional proxy re-encryption scheme AMH-IBCPRE. They propose a concrete AMH-IBCPRE scheme and conclude their scheme can achieve IND-sCon-sID-CCA secure (indistinguishable secure under selectively conditional selectively identity chosen ciphertext attack). However, our research show their scheme can not be IND-sConsID- CCA secure for single-hop and multi-hop data sharing. Also in 2014, Liang et al. propose an interesting deterministic finite automata-based functional proxy reencryption scheme DFA-based FPRE for secure public cloud data sharing, they also conclude their scheme can achieve IND-CCA secure (indistinguishable secure under chosen ciphertext attack), we also show their scheme can not be IND-CCA secure either. For these two proposals, the main reason of insecurity is that part of the re-encryption key has the same structure as the valid ciphertext, thus the adversary can query on the decryption oracle with this part of the re-encryption key to get secret keys, which will break the CCA-security of their scheme.We give an improved AMH-IBCPRE scheme and an improved DFA-based FPRE scheme for cloud data sharing and show the new schemes can resist our attack and be CCA-secure.We also demonstrate our improved AMH-IBCPRE scheme?s efficiency compared with other related identity based proxy re-encryption schemes, the results show our scheme is almost the most efficient one.

Identity Based Proxy Re-encryption Scheme under LWE

The proxy re-encryption allows an intermediate proxy to convert a ciphertext for Alice into a ciphertext for Bob without seeing the original message and leaking out relevant information. Unlike many prior identity based proxy re-encryption schemes which are based on the number theoretic assumptions such as large integer factorization and discrete logarithm problem. In this paper, we first propose a novel identity based proxy re-encryption scheme which is based on the hardness of standard Learning With Error(LWE) problem and is CPA secure in the standard model. This scheme can be reduced to the worst-case lattice hard problem that is able to resist attacks from quantum algorithm. The key step in our construction is that the challenger how to answer the private query under a known trapdoor matrix. Our scheme enjoys properties of the non-interactivity, unidirectionality, anonymous and so on. In this paper, we utilize primitives include G-trapdoor for lattice and sample algorithms to realize simple and efficient re-encryption.

Cost-effective secure E-health cloud system using identity based cryptographic techniques

Nowadays E-health cloud systems are more and more widely employed. However the security of these systems needs more consideration for the sensitive health information of patients. Some protocols on how to secure the e-health cloud system have been proposed, but many of them use the traditional PKI infrastructure to implement cryptographic mechanisms, which is cumbersome for they require every user having and remembering its own public/private keys. Identity based encryption (IBE) is a cryptographic primitive which uses the identity information of the user (e.g., email address) as the public key. Hence the public key is implicitly authenticated and the certificate management is simplified. Proxy re-encryption is another cryptographic primitive which aims at transforming a ciphertext under the delegator A into another ciphertext which can be decrypted by the delegatee B. In this paper, we describe several identity related cryptographic techniques for securing E-health system, which include new IBE schemes, new identity based proxy re-encryption (IBPRE) schemes. We also prove these schemes’ security and give the performance analysis, the results show our IBPRE scheme is especially highly efficient for re-encryption, which can be used to achieve cost-effective cloud usage.

A Chosen-Ciphertext Secure Fuzzy Identity-Based Proxy Re-Encryption Scheme

Green and Ateniese introduced the notion of identity-based proxy re-encryption (IBPRE), whereby the proxy can covert a ciphertext encrypted under the delegator's identity to an encryption under the delegatee's identity of the same message. In some situations, biometric, such as dactylogram, was used as identities. However, these biometric identities will inherently have some noise when they are sampled each time. To make identity-based proxy re-encryption flexible on identities, we introduced a new primitive called fuzzy identity-based proxy re-encryption (FIB-PRE), in which an identity is viewed as a set of descriptive attributes. In a fuzzy identity-based proxy re-encryption scheme, an identity can decrypt a ciphertext re-encrypted under another identity , if and only if and are close to each other as measured by the “set overlap” distance metric. In this work, we first formulate the security model of a FIB-PRE scheme. Finally, we present a construction of FIB-PRE and prove its CCA security under the decisional bilinear Diffie-Hellman (DBDH) assumption in the random model.

Collusion-Resistant Identity-Based Proxy Re-Encryption Without Random Oracles

In an identity-based proxy re-encryption scheme, a semi-trusted proxy can convert a ciphertext under Alice’s public identity into a ciphertext for Bob. The proxy does not know the secret key of Alice or Bob, and also does not know the plaintext during the conversion. In identity-based proxy re-encryption, the collusion of the proxy and a delegatee may result in the decryption of ciphertext for delegator. In this paper, we present a new scheme which can avoid the collusion of proxy and delegatee. Our scheme improves the scheme of Chu and Tzeng while inheriting all useful properties such as unidirectionality and non-interactivity. In our scheme, we get the security by using added secret parameter and change the secret key and re-encryption key. Our sheme is secure against ChosenCiphertext Attack (CCA) and collusion attack in the standard model.

An Identity-Based Conditional Proxy Re-Encryption in Cloud Computing Environments

In this paper, an identity-based conditional proxy re-encryption (PRE) scheme is proposed, where a delegator provides a re-encryption key satisfying one condition to a semi-trusted proxy who can convert a ciphertext encrypted under the delegator’s public key into one that can be decrypted using the delegatee’s private key. We address the identity-based proxy re-encryption scheme, where the delegator and the delegatee request keys from a trusted party known as a key generator center (KGC), who generates private keys for delegator and delegatee based on their identities. Meanwhile, the identity-based conditional proxy re-encryption scheme satisfies the properties of PRE including unidirectionality, non-interactivity and multi-hop. Additionally, the identity-based conditional proxy re-encryption scheme is efficient in terms of both the communication cost and the computing cost, and can realize security secret sharing in cloud computing environments.

Identity-based data storage in cloud computing

Identity-based proxy re-encryption schemes have been proposed to shift the burden of managing numerous files from the owner to a proxy server. Nevertheless, the existing solutions suffer from sever...

On the security of two multi-use CCA-secure proxy re-encryption schemes

In proxy re-encryption PRE, a semi-trusted proxy can convert a ciphertext originally intended for Alice into one which can be decrypted by Bob, while the proxy cannot know the corresponding plaintext. PRE can be classified as single-use PRE and multi-use PRE according to the times the ciphertext can be transformed. In multi-use PRE schemes, the ciphertext can be transformed from A to B and to C and so on. In CCS'09 post session, Wang et al. proposed a multi-use unidirectional CCA-secure proxy re-encryption scheme. Unfortunately, we show their proposal is not CCA-secure in the corresponding security models by giving concrete attacks. In 2010, Ren et al. proposed a hierarchical identity-based proxy re-encryption scheme without random oracles, and claimed their scheme was also multi-use and CCA-secure, we also show their scheme is not secure.