Identity-based Proxy Re-encryption Research Articles

A provably secure collusion-resistant identity-based proxy re-encryption scheme based on NTRU

Proxy re-encryption (PRE) technology realizes the transformation of decryption right from a delegator to a delegatee. In response to the rapid development of quantum attack technology, scholars have proposed the lattice-based PRE schemes, and the underlying encryption scheme of most lattice-based PRE schemes is the dual cryptosystem, which has the defects of large storage overhead, computational overhead and low efficiency. To address these deficiencies, we present a novel identity-based proxy re-encryption (IB-PRE) scheme based on NTRU. By means of the underlying efficient NTRU scheme, the proposed scheme reduces the storage overhead and computational overhead on key size and computational complexity, and improves efficiency. Our scheme possesses desired properties such as multi-hop property, unidirectionality and collusion-resistance. Meanwhile, based on the decisional Hermite normal form of ring learning with errors (D-RLWEHNF) hard problem, it is carefully designed and demonstrated to be secure under selective identity and chosen plaintext attacks in the standard model.

Multi-Keyword Searchable Identity-Based Proxy Re-Encryption from Lattices

To protect the privacy of cloud data, encryption before uploading provides a solution. However, searching for target data in ciphertext takes effort. Therefore, searchable encryption has become an important research topic. On the other hand, since the advancement of quantum computers will lead to the crisis of cracking traditional encryption algorithms, it is necessary to design encryption schemes that can resist quantum attacks. Therefore, we propose a multi-keyword searchable identity-based proxy re-encryption scheme from lattices. In addition to resisting quantum attacks, the proposed scheme uses several cryptographic techniques to improve encryption efficiency. First, identity-based encryption is used to reduce the computation and transmission costs caused by certificates. Second, the proposed scheme uses proxy re-encryption to achieve the purpose of outsourced computing, allowing the proxy server to reduce the computation and transmission costs of the users. Third, the proposed multi-keyword searchable encryption can provide AND and OR operators to increase the flexibility of searchability. Moreover, the access structure of the proposed scheme is not based on a linear secret sharing scheme (LSSS), avoiding the errors caused by an LSSS-based structure in decryption or search results. Finally, we also give formal security proof of the proposed scheme under the decisional learning with errors assumption.

Identity-Based Proxy Re-Encryption Scheme Using Fog Computing and Anonymous Key Generation

In the fog computing architecture, a fog is a node closer to clients and responsible for responding to users' requests as well as forwarding messages to clouds. In some medical applications such as the remote healthcare, a sensor of patients will first send encrypted data of sensed information to a nearby fog such that the fog acting as a re-encryption proxy could generate a re-encrypted ciphertext designated for requested data users in the cloud. Specifically, a data user can request access to cloud ciphertexts by sending a query to the fog node that will forward this query to the corresponding data owner who preserves the right to grant or deny the permission to access his/her data. When the access request is granted, the fog node will obtain a unique re-encryption key for carrying out the re-encryption process. Although some previous concepts have been proposed to fulfill these application requirements, they either have known security flaws or incur higher computational complexity. In this work, we present an identity-based proxy re-encryption scheme on the basis of the fog computing architecture. Our identity-based mechanism uses public channels for key distribution and avoids the troublesome problem of key escrow. We also formally prove that the proposed protocol is secure in the IND-PrID-CPA notion. Furthermore, we show that our work exhibits better performance in terms of computational complexity.

Identity-Based Unidirectional Collusion-Resistant Proxy Re-Encryption from U-LWE

Identity-based proxy re-encryption (IB-PRE) converts the ciphertext encrypted under the delegator’s identity to the one encrypted under the delegatee’s identity through a semitrusted proxy without leaking delegator’s private key and the underlying plaintext. At present, the security of most IB-PRE schemes relies on the hardness of the discrete logarithm solution or large integer decomposition and cannot resist attacks of the quantum algorithms. The majority of the IB-PRE schemes over lattice are secure only in the random oracle model. Aiming at such problems, the paper constructs a secure IB-PRE scheme over lattice in the standard model. In the scheme, the underlying encryption scheme proposed by Gentry et al. in EUROCRYPT 2010 is adopted to reduce the storage space of ciphertext. The proposed scheme is unidirectional collusion-resistant multihop and anonymous, and it is semantically secure against selective identity and chosen plaintext attack based on Decisional Learning With Errors with uniformly distributed errors (D-U-LWE) hard problem in the standard model.

An Identity-Based Proxy Re-Encryption Scheme With Single-Hop Conditional Delegation and Multi-Hop Ciphertext Evolution for Secure Cloud Data Sharing

Proxy re-encryption (PRE) provides a promising solution for applications requiring efficient and secure ciphertext conversion, such as secure cloud data sharing. While the one with the function of ciphertext evolution is more desirable for some long-term schemes involving key update. Recently, Yao et al. constructed an identity-based conditional proxy re-encryption scheme simultaneously supporting authorization and ciphertext evolution. However, its delegated ciphertext can be re-authorized, which may cause the authorization to exceed the original delegator’s expectation. In contrast, the single-hop PRE authorization scheme may be more appropriate for systems requiring better control over authorization. In this paper, an identity-based proxy re-encryption scheme with single-hop conditional delegation and multi-hop ciphertext evolution (IBPRE-SHCD-MHCE) is proposed. Also, its description, construction, and security analysis are given. The analysis and experimental comparison results show that the proposed scheme has improved the computational efficiency and storage consumption compared with the two underlying schemes.

Backdoor-resistant identity-based proxy re-encryption for cloud-assisted wireless body area networks

The wireless body area network (WBAN) provides users with real-time medical services. Meanwhile, the cloud technology provides greater storage space and computing power for medical data. Both of them have contribute to the development of telemedicine. In a cloud-assisted WBAN, the open network environment and the semi-trust cloud service providers expose the user’s private medical data to backdoor adversaries who can make exfiltration attacks, such as the algorithm substitution attack (ASA) through the process of data sharing. Therefore, it is necessary to find a secure and efficient medical data sharing scheme for the huge amount of medical data. In this paper, we first design an identity-based proxy re-encryption scheme with cryptographic reverse firewall (IBPRE-CRF), then show the application in a multiple-access telemedicine data sharing scenario. Security analysis shows that the IBPRE-CRF scheme provides chosen plaintext attack security and resists exfiltration attacks. Performance analysis shows that the IBPRE-CRF scheme has a significant communication and computational cost advantage while being resistant to exfiltration attacks in clouds. Therefore, our IBPRE-CRF scheme is suitable for telemedicine data sharing in a cloud-assisted WBAN.

Sharing of encrypted lock keys in the blockchain-based renting house system from time- and identity-based proxy reencryption

Sharing of encrypted lock keys in the blockchain-based renting house system from time- and identity-based proxy reencryption

A Blockchain‐based Framework for Privacy Preservation of Electronic Health Records (EHRs)

AbstractHealthcare Records are becoming more valuable than ever due to the emergence of various new diseases and the current pandemic. These records are scattered throughout multiple healthcare providers in several places. Keeping them in physical form is time‐consuming; thus, they need to be kept in electronic form. Electronic Healthcare Records (EHRs) are mostly managed at the individual company level, creating a single point of failure and exposing users to various security risks, including amateur‐level attacks and data breaches by hackers. This article proposes a permissioned blockchain‐based framework to overcome the above issues for secured storage and sharing of EHRs over the network. For the overall implementation of the framework Hyperledger Fabric (HLF), InterPlanetary Distributed File System (IPFS), and Identity Based Proxy Re‐Encryption (IB‐PRE) algorithm are used. To create proposed blockchain network, HLF is used. To manage EHRs on the blockchain, IPFS is used where the actual encrypted massive data is stored off‐chain, and their corresponding hash values are stored on the blockchain. Further, IB‐PRE algorithm is used to share EHRs in a safe manner, where a proxy node retrieves requested data from IPFS, performs re‐encryption, and returns the re‐encrypted data to the requester thus, ensures user privacy and data integrity. Finally, the Hyperledger Caliper tool is used to run a performance test to check the system efficiency in terms of throughput and latency. Features and performance‐based comparisons of the proposed and existing related work are made to demonstrate the effectiveness.

Identity-based threshold proxy re-encryption scheme from lattices and its applications

Identity-based threshold proxy re-encryption scheme from lattices and its applications

An identity-based proxy re-encryption for data deduplication in cloud

Cloud computing offers a huge resource pool by centralizing various resources with the rapid growth of digital data. Data storage is the most acceptable service in cloud computing. As one of the key technologies of cloud storage service, data deduplication technology allows cloud servers to save storage space by deleting redundant data. In order to protect data privacy, data holders generally encrypt their data first, and then upload the encrypted data to the cloud server, which clearly brings a new challenge for cloud data deduplication, as traditional deduplication technology cannot deduplicate encrypted data. Existing solutions have various security issues. They cannot flexibly support data access control, and also require data users to remain online. In this paper, we propose an identity-based proxy re-encryption data deduplication scheme using identity-based proxy re-encryption (IB-PRE) and identity-based proof of ownership (IB-PoW). The proposed scheme integrates cloud data deduplication with access control. By detailed security analysis and performance evaluation, we show that the proposed scheme is security, efficient and effective.

Efficient Identity-based Proxy Re-encryption Scheme in Blockchain-assisted Decentralized Storage System

Efficient Identity-based Proxy Re-encryption Scheme in Blockchain-assisted Decentralized Storage System

Secure Content Distribution with Access Control Enforcement in Named Data Networking.

NDN is one of the new emerging future internet architectures which brings up new solutions over today’s internet architecture, facilitating content distribution, in-network caching, mobility support, and multicast forwarding. NDNs ubiquitous in-network caching allows consumers to access data directly from the intermediate router’s cache. However, it opens content privacy problems since data packets replicated in the router are always accessible by every consumer. Sensitive contents in the routers should be protected and accessed only by authorized consumers. Although the content protection problem can be solved by applying an encryption-based access control policy, it still needs an efficient content distribution scheme with lower computational overhead and content retrieval time. We propose an efficient and secure content distribution (ES_CD), by combining symmetric encryption and identity-based proxy re-encryption. The analysis shows that our proposed scheme achieves content retrieval time reduction up to 20% for the cached contents in our network simulation environment and a slight computational overhead of less than 19 ms at the content producer and 9 ms at the consumer for 2 KB content. ES_CD provides content confidentiality and ensures only legitimate consumers can access the contents during a predefined time without requiring a trusted third party and keeping the content producer always online.

Group Delegated ID-Based Proxy Reencryption for the Enterprise IoT-Cloud Storage Environment

In general, ID-based proxy reencryption (IBPRE) includes data transfer in a 1 : 1 manner between a sender and receiver. Therefore, only the data owner has the authority to decrypt or reencrypt the data that is encrypted with his/her public key. However, in an environment with data self-sovereignty, such as an enterprise IoT-cloud environment, the data are directly managed by cloud once data is uploaded from user-controlled IoT devices. In such a situation, there is no way of sharing data if the data owner has no access over the data due to being outside the workplace and other issues. In this study, to solve this problem, data can be shared even when the data cannot be accessed by delegating the authority of the data owner to generate the reencryption key to other users. In addition, by solving the security threats that may appear in this process, data sharing can be performed securely and efficiently in the corporate environment.

Identity Based Cryptography Using Matrices

A new method of identity (ID) based Elgamal type encryption/decryption is described. The technique uses rectangular integer matrices in finite field Zp, as the private keys. Adoption of modular arithmetic limits the size of the elements of the key matrices while maintaining reasonably high security levels. The principle of the method is extended to design a new ID based Proxy Re-Encryption (PRE) scheme that converts the cipher text (CT) intended for one user into a different CT which can be decrypted by another user. In present work, all mathematical operations like addition, subtraction, multiplication, and inversion of matrices are carried out using modular algebra. Further, ID based encryption/decryption as well as PRE has protection against chosen plain text and chosen CT attacks. Computational expensive techniques like, bilinear maps and modular exponentials are not used in the proposed scheme. Therefore, present technique is computationally less expensive compared to similar existing methods as confirmed by experimental results. Proposed PRE scheme is implemented within a cloud service system is well suited for secure data sharing among multiple end users.

Collusion-resistant identity-based Proxy Re-encryption: Lattice-based constructions in Standard Model

The concept of proxy re-encryption (PRE) dates back to the work of Blaze, Bleumer, and Strauss in 1998. PRE offers delegation of decryption rights, i.e., it securely enables the re-encryption of ciphertexts from one key to another, without relying on trusted parties. PRE allows a semi-trusted third party termed as a “proxy” to securely divert encrypted files of user A (delegator) to user B (delegatee) without revealing any information about the underlying files to the proxy. To eliminate the necessity of having a costly certificate verification process, Green and Ateniese introduced an identity-based PRE (IB-PRE). The potential applicability of IB-PRE sprung up a long line of intensive research from its first instantiation. Unfortunately, till today, there is no collusion-resistant unidirectional IB-PRE secure in the standard model, which can withstand quantum attack. In this paper, we present the first concrete constructions of collusion-resistant unidirectional IB-PRE, for both selective and adaptive identity, which are secure in standard model based on the hardness of learning with errors problem.

WITHDRAWN: Secure identity based proxy re-encryption techniques for healthcare system

Cloud computing revolutionises many environments with easy-to-use enterprise applications that are easy to connect, customised, streamlined and scalable. This change of opinion calls for a broad spectrum of security and privacy concerns to be taken into consideration. Online Medical Stuff (IoMT) technology has increased the potential to interconnect medical specialist sensors in e-health. However, there are various provisions to incorporate these two innovations. The most challenging is the safety of medical knowledge and hence the difficulty of the sensing element equipment from a small environment. With the implementation of an increasingly reliable and cost-effective cloud platform (IoMT), a health care system with a high degree of public verification can be given.

Design and Implementation of Secure and Efficient Cloud Centric Smart Health Care System

In modern healthcare environment provide more user-friendly services at less time and in cost -effective manner. However, it causes data security issues on Electronic Health Record (EHR) transactions. The most challenging issue while handling the medical data is unauthorized accessing by unknown person. In this paper, a secure medical data access is carried out using Identity based proxy re-encryption system. Initially, patient has to register and upload the data in the cloud using the identity based proxy re-encryption system. Then the doctor will access the document using their respective identity and request for it, to get the secret key. This provides data confidentiality, integrity, and reduce the computation cost, while handling the documents in cloud.

IB-VPRE: adaptively secure identity-based proxy re-encryption scheme from LWE with re-encryption verifiability

Identity-based proxy re-encryption (IB-PRE) can convert the ciphertext encrypted under Alice’s identity to Bob’s ciphertext of the same message by a semi-trusted proxy with the proper transformation key. The main purpose of our work is to enhance the security of IB-PRE. For outside attacks, all existing IB-PRE constructions from lattices have only achieved a limited or weak security model called IND-sID-CPA security. Therefore, by embedding re-encryption key generation and re-encryption algorithms appropriately in Agrawal et al.’s identity-based encryption scheme from lattices, we construct an IND-ID-CPA secure IB-PRE scheme over decisional learning with errors (LWE) under the standard model. For inside attacks, we propose a new primitive IB-VPRE by extending the basic IB-PRE scheme with a new functionality called re-encryption verifiability, meaning that a re-encrypted ciphertext receiver or a third party can verify whether the received ciphertext is correctly transformed from an original ciphertext or not, and thus can detect illegal activities of the proxy. We realize re-encryption verifiability using the homomorphic signature technique as a black box, making the resulting scheme non-interactive and quantum-immune after instanced by a lattice-based homomorphic signature scheme.

A lightweight privacy-preserving and sharing scheme with dual-blockchain for intelligent pricing system of smart grid

With the deepening of the application of information technology, the development trend of smart grid as the next generation grid has pointed the way for the development of energy internet in the power industry. To protect the privacy of participants, this paper proposes a lightweight dual-blockchain privacy protection and sharing solution for smart grid intelligent pricing systems. We design a lightweight distributed cloud storage architecture based on dual blockchains. The cloud storage architecture stores the encrypted data and returns the address, thereby protecting the privacy of the data. A private blockchain is used to map the association between real identity and pseudonym. At the same time, a new shared blockchain is created for nodes with access control to reduce cost, ensure security and access resource on-demand. Then, secure signature authentication and identity-based proxy re-encryption strategies are designed. Encryption and bilinear pair-based signature scheme is used to aggregate data to support low-cost and high-performance computing. The evaluation results show that the scheme has the advantages of low latency, low response time and small storage cost, and can meet the growing demand for secure communication of full-service data of the smart grid.

Identity-Based Proxy Re-encryption over NTRU Lattices for Cloud Computing

Identity-based proxy re-encryption (IB-PRE) is a kind of public key cryptography that allows a proxy to convert the ciphertext based on Alice’s identity into another ciphertext of the same message for Bob. It has important applications in cloud computing, distributed systems and secure e-mail forwarding. So far, the existing lattice-based IB-PRE schemes are designed on the general lattice and their security is based on the learning with errors (LWE) assumption. In this paper, we propose an IB-PRE scheme over NTRU lattices with the desirable properties of anonymity, unidirectionality, backward collusion safeness and multi-hop. Our IB-PRE scheme is provable secure under adaptive chosen-plaintext and adaptive chosen-identity attacks. And, in the random oracle model, the security of our scheme is based on the decisional Ring-LWE assumption. Besides, the key and ciphertext sizes of our IB-PRE scheme are short, only one or two ring elements, and our scheme could encrypt n bits in each encryption process.