Indistinguishability Security Research Articles

Polar code-based secure transmission with higher message rate combining channel entropy and computational entropy

The existing physical layer security schemes, which are based on the key generation model and the wire-tap channel model, achieve security by utilizing channel reciprocity entropy and noise entropy, respectively. In contrast, we propose a novel secure transmission framework that combines noise entropy with reciprocity entropy, achieved by inserting reciprocity entropy into the frozen bits of polar codes. Note that in real-world scenarios, when eavesdroppers employ polynomial-time attacks, the bit error rate (BER) increases due to the introduction of computational entropy. To achieve indistinguishability security, we convert the practical physical layer security metric, BER, into the average min-entropy, a widely accepted concept in cryptography. The simulation results demonstrate that the eavesdropper’s BER can be significantly increased without compromising the communication performance of the legitimate receiver. Under concrete parameters we selected, when compared to the joint scheme of physical layer key generation and one time pad, the modular semantically-secure scheme based on the wire-tap channel model, and the simple channel entropy combination scheme, our scheme achieves a message rate approximately 1.2 times, 3.8 times, and 1.4 times better, respectively. Experimental testing validates the feasibility of our scheme.

Biometric identification on the cloud: A more secure and faster construction

Cloud-assisted biometric identification can benefit data owners with limited resources by offloading their storage and identification tasks to cloud servers with abundant resources. However, the adoption of this computing paradigm is hindered by security and privacy concerns. To solve the dilemma, several privacy-preserving cloud-assisted biometric identification protocols have been proposed. Nevertheless, the existing designs suffer from one or more of the following restrictions: (1) support only for data owner-online query, (2) low security level, and (3) inefficiency. Motivated by these challenges, this paper aims to explore a more secure and efficient construction. Concretely, we initialize the error weighted hashing (EWH)-based data packing technique to replace the time-consuming linear scan search during the identification process. Additionally, to ensure compatibility with the EWH-based search algorithm, we formulate an identity (id)-based scoring strategy and introduce a random split-based data encryption algorithm, which circumvents the costly homomorphic encryption scheme. Within the framework of the two non-colluding servers model, the random split-based one-time pad encryption guarantees provably indistinguishable security against chosen-plaintext attacks. Finally, since only simple hash and xor operations are involved, our novel construction exhibits significantly improved performance compared to prior designs, both in theory and in practice. This superiority is validated through rigorous theoretical analysis and extensive experimental evaluation.

Blockchain-Based Anonymous Data Sharing With Accountability for Internet of Things

Blockchain has been a promising infrastructure for enabling secure data sharing for the Internet of Things (IoT). With the widespread of IoT applications, security issues, such as data privacy, anonymity, and accountability become critical concerns for the users, which are essential principles for secure communication in those applications. However, the existing blockchain-based data-sharing schemes mainly consider data privacy. Only a few works can support anonymity with strong, trusted assumptions. Thus, there is a research gap on the anonymity of blockchain-based data sharing for IoT, which does not rely on any trusted party. In this article, we propose a blockchain-based anonymous data-sharing scheme (BA-DS) by adopting a novel public key encryption derived from a ring signature. In BA-DS, we remove the trusted party and ensure anonymity by using an unconditional linkable ring signature and Signature of Knowledge (SoK). During the revocation, we apply blockchain infrastructure to record the valid revocation list and generate a tag for data stored on the cloud, providing solid accountability. The formal security analysis shows that BA-DS is selective indistinguishable secure in the random oracle model. Additionally, we also prove that BA-DS holds anonymity, data privacy, accountability, and authenticity. The extensive experiments indicate that our proposed BA-DS achieves reasonable efficiency in terms of computational complexity, communication overhead, and consumption on the blockchain.

A Generic Construction of CCA-Secure Identity-Based Encryption with Equality Test against Insider Attacks

Identity-based encryption with equality test (IBEET) is a generalization of the traditional identity-based encryption (IBE) and public key searchable encryption, where trapdoors enable users to check whether two ciphertexts of distinct identities are encryptions of the same plaintext. By definition, IBEET cannot achieve indistinguishability security against insiders, i.e., users who have trapdoors. To address this issue, IBEET against insider attacks (IBEETIA) was later introduced as a dual primitive. While all users of IBEETIA are able to check whether two ciphertexts are encryptions of the same plaintext, only users who have tokens are able to encrypt plaintexts. Hence, IBEETIA is able to achieve indistinguishability security. On the other hand, the definition of IBEETIA weakens the notion of IBE due to its encryption inability. Nevertheless, known schemes of IBEETIA made use of rich algebraic structures such as bilinear groups and lattices. In this paper, we propose a generic construction of IBEETIA without resorting to rich algebraic structures. In particular, the only building blocks of the proposed construction are symmetric key encryption and pseudo-random permutations in the standard model. If a symmetric key encryption scheme satisfies CCA security, our proposed IBEETIA scheme also satisfies CCA security.

Blockchain-Based Multiple Authorities Attribute-Based Encryption for EHR Access Control Scheme

The Internet of Medical Things (IOMT) is critical in improving electronic device precision, dependability, and productivity. Researchers are driving the development of digital healthcare systems by connecting available medical resources and healthcare services. However, there are concerns about the security of sharing patients’ electronic health records. In response to the prevailing problems such as difficulties in sharing medical records between different hospitals and patients’ inability to grasp the usage of their medical records, we propose a patient-controlled and cloud-chain collaborative multi-authority attribute-based encryption for EHR sharing with verifiable outsourcing decryption and hiding access policies (VO-PH-MAABE). This scheme uses blockchain to store the validation parameters by utilizing its immutable, which data users use to verify the correctness of third-party outsourcing decryption results. In addition, we use policy-hiding technology to protect data privacy so that data security is guaranteed. Moreover, we use blockchain technology to establish trust among multiple authorities and utilize Shamir secret sharing and smart contracts to compute keys or tokens for attributes managed across multiple administrative domains, which avoids a single point of failure and reduces communication and computation overhead on the data user side. Finally, the ciphertext indistinguishability security under the chosen plaintext attack is demonstrated under the stochastic prediction model and compared with other schemes in terms of functionality, communication overhead, and computation overhead. The experimental results show the effectiveness of this scheme.

A Lightweight Authenticated Searchable Encryption without Bilinear Pairing for Cloud Computing

Outsourcing data to cloud services is a good solution for users with limited computing resources. Privacy and confidentiality of data is jeopardized when data is transferred and shared in the cloud. The development of searchable cryptography offers the possibility to solve these problems. Symmetric searchable encryption (SSE) is popular among researchers because it is efficient and secure. SSE often requires the data sender and data receiver to use the same key to generate key ciphertext and trapdoor, which will obviously cause the problem of key management. Searchable encryption based on public key can simplify the key management problem. A public key encryption scheme with keyword search (PEKS) allows multiple senders to encrypt keywords under the receiver’s public key. It is vulnerable to keyword guessing attacks (KGA) due to the small size of the keywords. The proposal of public key authenticated encryption with keyword search (PAEKS) is mainly to resist inside keyword guessing attacks. The previous security models do not involve the indistinguishability of the same keywords ( w 0 × × = w 1 ), which brings the user’s search pattern easy to leak. The essential reason is that the trapdoor generation algorithm is deterministic. At the same time, most of the existing schemes use bilinear pair design, which greatly reduces the efficiency of the scheme. To address these problems, the paper introduces an improved PAEKS model. We design a lightweight public key authentication encryption scheme based on the Diffie-Hellman protocol. Then, we prove the ciphertext indistinguishability security and trapdoor indistinguishability security of the scheme in the improved security model. Finally, the paper demonstrates its comparable security and computational efficiency by comparing it with previous PAEKS schemes. Meanwhile, we conduct an experimental evaluation based on the cryptographic library. Experimental results show that the computational overhead of our scheme compared with the ciphertext generation algorithm, trapdoor generation algorithm and test algorithm of other schemes Our scheme reduces 274, 158 and 60 times, respectively.

Enabling privacy and leakage resistance for dynamic blockchain-based access control systems

With rise of 5G/6G network, low-storage devices usually outsource data for higher rate and less latency. Non-controlled outsourcing and complex communications incur security issues for IoT applications. Specially, user privacy and access reliability pose technical challenges for sensitive data outsourcing and sharing. In this paper, we harmonize functional encryption and blockchain to propose a reliable and privacy-aware access control system named R-PAC. It allows a result-form access without learning raw information and fair interaction against malicious users. With a combination of all-or-nothing encapsulation technology, R-PAC supports users’ dynamic joining and key leakage resistance. We design R-PAC from Boneh–Franklin identity-based encryption, with forward-coverable encryption and reverse-discoverable decryption, and formally prove its indistinguishability security. We implement a R-PAC prototype and deploy it to a simulated Ethereum network to evaluate its performance. Experiments from both data access and transaction overhead show that R-PAC is with reasonable cost and has a trade-off between efficiency and strong security/functionality.

Data Security Protocol with Blind Factor in Cloud Environment

Compared with the traditional system, cloud storage users have no direct control over their data, so users are most concerned about security for their data stored in the cloud. One security requirement is to resolve any threats from semi-trusted key third party managers. The proposed data security for cloud environment with semi-trusted third party (DaSCE) protocol has solved the security threat of key managers to some extent but has not achieved positive results. Based on this, this paper proposes a semi-trusted third-party data security protocol (ADSS), which can effectively remove this security threat by adding time stamp and blind factor to prevent key managers and intermediaries from intercepting and decrypting user data. Moreover, the ADSS protocol is proved to provide indistinguishable security under a chosen ciphertext attack. Finally, the performance evaluation and simulation of the protocol show that the ADSS security is greater than DaSCE, and the amount of time needed is lower than DaSCE.

Public-key encryption with bidirectional keyword search and its application to encrypted emails

A traditional Public-key Encryption scheme with Keyword Search (PEKS) allows multiple senders to encrypt keywords under the public key of a receiver such that the receiver can search on these encrypted keywords using his/her searching secret key. In encrypted email systems, an email user not only needs to search on encrypted emails received from other users, but also needs to search on encrypted emails sent to other users. Motivated by this, the paper proposes a cryptographic method to allow these two types of user (i.e., senders and receivers) to search on encrypted keywords, which is called Public-key Encryption with Bidirectional Keyword Search (PEBKS). We give formal definitions of a PEBKS scheme and its indistinguishable security model to capture the scenario that no adversary can efficiently distinguish two ciphertexts of keywords from each other, even if the adversary can adaptively obtain search trapdoors of many keywords. Specifically, we propose a concrete PEBKS scheme, whose security relies on a standard hard problem, i.e., bilinear Diffie–Hellman problem, in the random oracle model. Finally, we simulate the proposed PEBKS scheme to assess its practicability and convinces that its feasibility to be applied to encrypted email systems.

A partially hidden policy CP-ABE scheme against attribute values guessing attacks with online privacy-protective decryption testing in IoT assisted cloud computing

In recent years, to address the security defect that the explicit attribute values in access policies may reveal the privacy, a new variant of ciphertext-policy attribute-based encryption(CP-ABE)——hidden policy CP-ABE (HP-CP-ABE) is proposed in some recent works. But there are two tremendous flaws in most existing HP-CP-ABE schemes. The one issue is that an attacker can launch the attribute values guessing attacks (AVGA) to detect the attribute values in access policies of many HP-CP-ABE schemes. And another issue is that, if the HP-CP-ABE schemes are using the “Linear Secret Sharing Schemes (LSSS)” as their access structures, as the rows of the LSSS matrix grows, the time complexity of the decryption testing algorithm will boost rapidly which will greatly aggravate the computing burden of the user. So in this paper, we propose a partially HP-CP-ABE (PHP-CP-ABE) scheme which can perfectly withstand the attribute values guessing attacks (AVGA). As our access structure is using the LSSS, to alleviate the computing burden of the user, we design a online privacy-protective decryption testing algorithm for the users to privately and securely outsource the decryption testing phase to the cloud server. Our online testing algorithm is privacy-protective which means during running the privacy-protective decryption testing algorithm, the cloud server has no chance to know anything about the attribute values in the access policy and the attribute values of the user. This will prevent the privacy from leaking out to the third party cloud server. Then we rigorously prove that our scheme is selectively indistinguishable secure under chosen plaintext attacks (IND-CPA). Next, by reduction to the computational q-PBDHE assumption which is firstly proposed in our paper, we prove that our HP-CP-ABE scheme is indistinguishable secure under the attribute values guessing attacks (IND-AVGA). Finally through the comparison with the state-of-art HP-CP-ABE schemes from the perspective of functionality and efficiency, it is easily to observe that our scheme has high-security and high-efficiency. In appendix, we give a straightaway analysis to some relevant works to point out the security vulnerabilities in their schemes.

Constructing provable secure broadcast encryption scheme with dealership

Broadcast encryption with dealership (BED) introduced by Gritti et al. (2015) is a proficient cryptographic primitive which involves a third party called as a dealer and creates a business opportunity for the dealer in broadcast services. Designing a BED is a tough task due to its various security requirements. Existing BED of Gritti et al. (2015). requires to get the user’s response to detect a dishonest dealer which is not practical in many cases. Acharya and Dutta solved the problem and proposed a BED scheme using random oracles. This brings up the question of whether it is possible to generate a secure BED without using the random oracle. Fortunately, we have found positive results. We have proposed two constructions in the standard model. Our first scheme is semi-static secure whereas the second one is the first adaptive secure construction in the standard model. All of our constructions provide group privacy by hiding the group of users and provide the maximum number of accountability by restricting the dealer from generating a group token involving a set of users having cardinality greater than a threshold value. We have provided concrete security proof of both of our constructions under key indistinguishability security game. Moreover, we have implemented our schemes and compared with existing schemes.

PHAS-HEKR-CP-ABE: partially policy-hidden CP-ABE with highly efficient key revocation in cloud data sharing system

In recent years, attribute-based encryption (ABE) provides a new idea to help researchers solving the problem of data privacy protection in cloud. But there are two issues in traditional ABE, the first issue is that the attributes in the access structures will be sent to users in cleartext together with the ciphertext. So a attacker has the opportunity to obtain some of the private information from the plaintext access structure. And the other issue is the traditional ABE scheme cannot revoke the users' illegal keys in an efficient way. To handle both of the above challenges, we come up with a large universe ciphertext-policy ABE (CP-ABE) scheme which supports partially hidden access structures (PHAS) and highly efficient key revocation at the same time in this paper. What's more, unlike most previous schemes, first our access structure is based on the expressive linear secret sharing scheme (LSSS) which supports both AND and OR gates in access formulas and second our scheme is built from the prime-order bilinear pairing groups. The comparison with other relevant works presents that our scheme is more comprehensive and efficient. Finally we rigorously prove and analyze that our scheme is selectively indistinguishable secure under chosen plaintext attacks (IND-CPA) in the random oracle model (ROM) and our access structure is really anonymous against off-line dictionary attacks.

Multi-user Fuzzy Keyword Searchable Encryption Scheme Based on Certificateless Cryptosystem

Nowadays, the application prospect of cloud storage is more and more extensive, and the security problem of cloud storage has become one of the hotspots of research. Searchable encryption can make full use of the huge computing resources of cloud servers and solve the problem of secure search after data encryption and upload. However, the existing searchable encryption schemes have the problems of high computational cost, low security, and insufficient flexibility in the way of searching keywords. In order to solve these problems, we propose a new certificateless multi-user fuzzy keyword searchable encryption scheme, which introduces the key distribution center, effectively reduces the computational cost, solves the problem of certificate management and key escrow, and uses the optimized wildcard technology to realize the fuzzy search of multiple users, which is not only brings convenience to users, but also realizes flexible search methods. Finally, the analysis results show that our scheme has indistinguishable security under keyword guessing attacks. Simulation experiments and performance analysis results show that our scheme has higher computational efficiency.

Verifiable Identity-Based Encryption with Keyword Search for IoT from Lattice

Internet of Things (IoT), which provides the solution of connecting things and devices, has increasingly developed as vital tools to realize intelligent life. Generally, source-limited IoT sensors outsource their data to the cloud, which arises the concerns that the transmission of IoT data is happening without appropriate consideration of the profound security challenges involved. Though encryption technology can guarantee the confidentiality of private data, it hinders the usability of data. Searchable encryption (SE) has been proposed to achieve secure data sharing and searching. However, most of existing SE schemes are designed under conventional hardness assumptions and may be vulnerable to the adversary with quantum computers. Moreover, the untrusted cloud server may perform an unfaithful search execution. To address these problems, in this paper, we propose the first verifiable identity-based keyword search (VIBKS) scheme from lattice. In particular, a lattice-based delegation algorithm is adopted to help the data user to verify both the correctness and the integrity of the search results. Besides, in order to reduce the communication overhead, we refer to the identity-based mechanism. We conduct rigorous proof to demonstrate that the proposed VIBKS scheme is ciphertext indistinguishable secure against the semi-honest-but-curious adversary. In addition, we give the detailed computation and communication complexity of our VIBKS and conduct a series of experiments to validate its efficiency performance.

A Higher-Level Security Scheme for Key Access on Cloud Computing

In this work, we construct a key access management scheme that seamlessly transitions any hierarchical-like access policy to the digital medium. The proposed scheme allows any public cloud system to be used as a private cloud. We consider the data owner an entity consisting of several organization units. We provide a secure method for each user of this entity to access the public cloud from both inside and outside the company's network. The idea of our key access control scheme, which is based on Shamir's secret sharing algorithm and polynomial interpolation method, is suitable especially for hierarchical organizational structures. It offers a secure, flexible, and hierarchical key access mechanism for organizations utilizing mission-critical data. It also minimizes concerns about moving mission-critical data to the public cloud and ensures that only users with sufficient approvals from the same or higher privileged users can access the key by making use of the topological ordering of a directed graph, including self-loop. Main overheads such as public and private storage needs are reduced to a tolerable level, and the key derivation is computationally efficient. From a security perspective, our scheme is both resistant to collaboration attacks and provides key indistinguishability security. Since the key does not need to be held anywhere, the problem of a data breach based on key disclosure risk is also eliminated.

Privacy-Preserving and Efficient Public Key Encryption with Keyword Search Based on CP-ABE in Cloud

In the area of searchable encryption, public key encryption with keyword search (PEKS) has been a critically important and promising technique which provides secure search over encrypted data in cloud computing. PEKS can protect user data privacy without affecting the usage of the data stored in the untrusted cloud server environment. However, most of the existing PEKS schemes concentrate on data users’ rich search functionalities, regardless of their search permission. Attribute-based encryption technology is a good method to solve the security issues, which provides fine-grained access control to the encrypted data. In this paper, we propose a privacy-preserving and efficient public key encryption with keyword search scheme by using the ciphertext-policy attribute-based encryption (CP-ABE) technique to support both fine-grained access control and keyword search over encrypted data simultaneously. We formalize the security definition, and prove that our scheme achieves selective indistinguishability security against an adaptive chosen keyword attack. Finally, we present the performance analysis in terms of theoretical analysis and experimental analysis, and demonstrate the efficiency of our scheme.

An automatic analysis approach toward indistinguishability of sampling on the LWE problem

Learning With Errors (LWE) is one of the Non-Polynomial (NP)-hard problems applied in cryptographic primitives against quantum attacks. However, the security and efficiency of schemes based on LWE are closely affected by the error sampling algorithms. The existing pseudo-random sampling methods potentially have security leaks that can fundamentally influence the security levels of previous cryptographic primitives. Given that these primitives are proved semantically secure, directly deducing the influences caused by leaks of sampling algorithms may be difficult. Thus, we attempt to use the attack model based on automatic learning system to identify and evaluate the practical security level of a cryptographic primitive that is semantically proved secure in indistinguishable security models. In this paper, we first analyzed the existing major sampling algorithms in terms of their security and efficiency. Then, concentrating on the Indistinguishability under Chosen-Plaintext Attack (IND-CPA) security model, we realized the new attack model based on the automatic learning system. The experimental data demonstrates that the sampling algorithms perform a key role in LWE-based schemes with significant disturbance of the attack advantages, which may potentially compromise security considerably. Moreover, our attack model is achievable with acceptable time and memory costs.

Cryptanalysis of RNZ, an identity-based fully anonymous broadcast encryption

Abstract An identity-based fully anonymous broadcast encryption ( IB-FAnoBE ) is a novel concept for transmitting confidential data to a group of users in which subscribed users’ outsider and insider anonymity are at primary concern. In this paper, we review one of the most efficient IB-FAnoBE , proposed by Ren, Niu and Zhang (RNZ), and show that their construction does not provide the main message indistinguishability security requirement of broadcast encryption. For this purpose, we exhibit that an unauthorized user can decrypt the encrypted content without having legitimate decryption privilege. Furthermore, we suggest some modifications to improve this scheme and construct a secure IB-FAnoBE .

An Indistinguishably Secure Function Encryption Scheme

In this work, we first design a function encryption scheme by using key encapsulation. We combine public key encryption with symmetric encryption to implement the idea of key encapsulation. In the key encapsulation, we use a key to turn a message (plaintext) into a ciphertext by symmetric encryption, and then we use public key encryption to turn this key into another ciphertext. In the design of function encryption scheme, we use the public key encryption system, symmetric encryption system, noninteractive proof system, indistinguishable obfuscator, and commitment scheme. Finally, we prove the indistinguishable security of our function encryption scheme.

A Secure Data Sharing Scheme with Designated Server

The cloud-assisted Internet of Things (CIoT) is booming, which utilizes powerful data processing capabilities of the cloud platform to solve massive Internet of Things (IoT) data. However, the CIoT faces new security challenges, such as the confidentiality of the outsourced data. Data encryption is a fundamental technique that can guarantee the confidentiality of outsourced data, but it limits target encrypted data retrieval from cloud platform. Public key encryption with keyword search (PEKS) provides a promising solution to address this problem. In PEKS, a cloud server can be authorized to search the keyword in encrypted documents and retrieve associated encrypted documents for the receiver. However, most existing PEKS schemes merely focus on keyword search function while ignoring the associated documents encryption/decryption function. Thus, in practice, a PEKS scheme must cooperate with another separated public key encryption (PKE) scheme to fulfill a completely secure data sharing scheme. To address this problem, in this paper, we propose a secure data sharing scheme with designated server that combines PKE scheme with PEKS scheme, which provides both keyword search and documents encryption/decryption functions. Furthermore, only the designated server can search the keyword via encrypted documents for enhanced security in our work. Moreover, our scheme also satisfies the public verifiability of search results, which includes both keywords and documents ciphertexts’ correctness and integrity. As to the security, our scheme provides stronger indistinguishability security of document and keyword in the proposed security model.