Inner Product Functional Encryption Research Articles

Unbounded non-zero inner product encryption

In a non-zero inner product encryption (NIPE) scheme, ciphertexts and keys are associated with vectors from an inner-product space. Decryption of a ciphertext for x→ is allowed by a key for y→ if and only if the inner product 〈x→,y→〉≠0. Existing constructions of NIPE assume the length of the vectors are fixed apriori. We present the first constructions of unbounded non-zero inner product encryption (UNIPE) with constant sized keys. Unbounded here refers to the size of vectors not being pre-fixed during setup. Both constructions, based on bilinear maps, are proven selectively secure under the decisional bilinear Diffie-Hellman (DBDH) assumption.Our constructions are obtained by transforming the unbounded inner product functional encryption (IPFE) schemes of Dufour-Sans and Pointcheval (ACNS 2019), one in the strict domain setting and the other in the permissive domain setting. Interestingly, in the latter case, we prove security from DBDH, a static assumption while the original IPFE scheme relied on an interactive parameterised assumption. In terms of efficiency, features of the IPFE constructions are retained after transformation to NIPE. Notably, the public key and decryption keys have constant size.

Fully collusion resistant trace-and-revoke functional encryption for arbitrary identities

Functional Encryption (FE) has been extensively studied in the recent years, mainly focusing on the feasibility of constructing FE for general functionalities, as well as some realizations for restricted functionalities of practical interest, such as inner-product. However, little consideration has been given to the issue of key leakage on FE. The property of FE that allows multiple users to obtain the same functional keys from the holder of the master secret key raises an important problem: if some users leak their keys or collude to create a pirate decoder, how can we identify at least one of those users, given some information about the compromised keys or the pirate decoder? Moreover, how do we disable the decryption capabilities of those users (i.e. traitors)?Two recent works have offered potential solutions to the above traitor scenario. However, the two solutions satisfy weaker notions of security and traceability, can only tolerate bounded collusions (i.e., there is an a priori bound on the number of keys the pirate decoder obtains), or can only handle a polynomially large universe of possible identities. In this paper, we study trace-and-revoke mechanism on FE and provide the first construction of trace-and-revoke FE that supports arbitrary identities, is both fully collusion resistant and fully anonymous. Our construction relies on a generic transformation from revocable predicate functional encryption with broadcast (RPFE with broadcast, which is an extension of revocable predicate encryption with broadcast proposed by Kim and J. Wu at ASIACRYPT'2020) to trace-and-revoke FE. Since this construction admits a generic construction of trace-and-revoke inner-product FE (IPFE), we instantiate the trace-and-revoke IPFE from the well-studied Learning with Errors (LWE). This is achieved by proposing a new LWE-based attribute-based IPFE (ABIPFE) scheme to instantiate RPFE with broadcast.

(Inner-Product) Functional Encryption with Updatable Ciphertexts

We propose a novel variant of functional encryption which supports ciphertext updates, dubbed ciphertext-updatable functional encryption. Such a feature further broadens the practical applicability of the functional encryption paradigm and allows for fine-grained access control even after a ciphertext is generated. Updating ciphertexts is carried out via so-called update tokens which a dedicated party can use to convert ciphertexts. However, allowing update tokens requires some care for the security definition. Our contribution is threefold: We define our new primitive with a security notion in the indistinguishability setting. Within CUFE, functional decryption keys and ciphertexts are labeled with tags such that only if the tags of the decryption key and the ciphertext match, then decryption succeeds. Furthermore, we allow ciphertexts to switch their tags to any other tag via update tokens. Such tokens are generated by the holder of the main secret key and can only be used in the desired direction.We present a generic construction of CUFE for any functionality as well as predicates different from equality testing on tags which relies on the existence of indistinguishability obfuscation (iO).We present a practical construction of CUFE for the inner-product functionality from standard assumptions (i.e., LWE) in the random-oracle model. On the technical level, we build on the recent functional encryption schemes with fine-grained access control and linear operations on encrypted data (Abdalla et al., AC’20) and introduce an additional ciphertext updatability feature. Proving security for such a construction turned out to be non-trivial, particularly when revealing keys for the updated challenge ciphertext is allowed. Overall, such construction enriches the set of known inner-product functional encryption schemes with the additional updatability feature of ciphertexts.

Privacy-Preserving and Communication-Efficient Energy Prediction Scheme Based on Federated Learning for Smart Grids

Energy forecasting is important because it enables infrastructure planning and power dispatching while reducing power outages and equipment failures. It is well-known that federated learning (FL) can be used to build a global energy predictor for smart grids without revealing the customers’ raw data to preserve privacy. However, it still reveals local models’ parameters during the training process, which may still leak customers’ data privacy. In addition, for the global model to converge, it requires multiple training rounds, which must be done in a communication-efficient way. Moreover, most existing works only focus on load forecasting while neglecting energy forecasting in net-metering systems. To address these limitations, in this paper, we propose a privacy-preserving and communication-efficient FL-based energy predictor for net-metering systems. Based on a dataset for real power consumption/generation readings, we first propose a multi-data-source hybrid deep learning (DL)-based predictor to accurately predict future readings. Then, we repurpose an efficient inner-product functional encryption (IPFE) scheme for implementing secure data aggregation to preserve the customers’ privacy by encrypting their models’ parameters during the FL training. To address communication efficiency, we use a change and transmit (CAT) approach to update local model’s parameters, where only the parameters with sufficient changes are updated. Our extensive studies demonstrate that our approach accurately predicts future readings while providing privacy protection and high communication efficiency.

Bounded-collusion decentralized ABE with sublinear parameters

In this paper, we propose a decentralized ABE scheme against bounded collusion which means the number of users in the system is a-prior bounded. The scheme enjoys public key and ciphertext of sublinear sizes in the number of users in the system while all prior constructions require linear sizes. Besides, our scheme achieves semi-adaptive security under bilateral k-Lin assumption and SXDH assumption in a pairing group. Keep the same as the previous constructions, the scheme supports monotone span program as a policy and does not rely on the random oracle.Technically, we follow Wang et al.'s “linear secret sharing scheme (LSSS) + inner-product functional encryption (IPFE)” paradigm [PKC'19] and use (an extended variant of) functional encryption for quadratic functions (QFE) in the place of IPFE. By this, we encrypt with sublinear-size random coins and later expand them to linear-size entropy for security proof. Roughly, the use of QFE requires bilateral k-Lin assumption while the entropy expansion relies on SXDH.

Privacy-enhanced and non-interactive linear regression with dropout-resilience

Linear regression, the most basic and widely used machine learning algorithm, has played an essential role in many areas such as healthcare, economics, and weather prediction. However, in practice, regression training requires a large dataset, usually stored in a distributed form from multiple data owners. Moreover, it is difficult to federate data among users to train a global model because of privacy issues and communication limitations. To address these challenges, we propose a non-interactive privacy-enhanced training scheme for linear regression based on functional encryption - FELR. In particular, based on the secure aggregation scheme and Paillier inner-product functional encryption, two cloud servers can train the model on the ciphertext. The solution does not require any interaction between the cloud servers and data owners. Throughout the training period, the cloud servers do not know any local private data. A detailed security analysis demonstrates that FELR can provide high security for data owners. The experimental conclusions also demonstrate that the performance of the training scheme on the data owners' side is approximately 25% higher than that of the existing solution, which significantly decreases the computational costs.

Practical reusable garbled circuits with parallel updates

The central contribution of the current paper is to establish a practical and effective reusable garbled circuit scheme with parallel updates, where each update is applied to the circuit in parallel. First of all, we present a strengthened notion of inner product functional encryption (IPE) called simulation-based security (SIM-security) for multi-instance and show that a secret-key IPE scheme is multi-instance SIM-secure. Then we put forward a reusable garbled circuit scheme based on the IPE scheme. The idea is a reduction from re-randomizable garbled circuits in which the distribution of the original garbled circuit is computationally indistinguishable from the re-randomized garbled circuit. Finally, we implemented reusable garbled circuits and validate the practicality of our reusable garbled circuit scheme. Experimental results demonstrate that our reusable garbled circuit scheme is suitable for a wide range of real-world scenarios.

PriSign, A Privacy-Preserving Single Sign-On System for Cloud Environments

Anonymous single sign-on systems allow users to use a single credential to access multiple services protected by verifiers without revealing their personal information, which is especially important due to privacy regulations such as GDPR. In this paper, we introduce a new strong privacy-preserving single sign-on scheme, dubbed PriSign, based on our proposed attribute-based credential with traceability (ABCT), attribute-based credential with blindness (ABCB), and threshold inner-product functional encryption (TIPFE). Compared with the existing state-of-the-art solutions, PriSign presents three improvements: (1) users can obtain different types of tickets according to the attribute disclosure policies enforced by the ticket issuer to support fine-grained access control; (2) users can hide access tokens and designate a verifier for tokens according to a verifier’s policy jointly issued by multiple policymakers, meaning that non-designated verifiers cannot obtain any information about the tokens; (3) we innovatively use a threshold approach to issue policy keys online in order for verifiers to achieve proxy re-verification services in an unstable cloud environment. We implement PriSign and compare the performance with other ASSO systems in the personal laptop, and the results prove its practicability.

Generic Construction of Black-Box Traceable Attribute-Based Encryption

Attribute-based encryption (ABE) has been widely used to provide fine-grained access control to encrypted data in cloud computing. However, in practice, since the attributes are shared by multiple users in the ABE system, it is difficult to identify malicious users which intentionally but implicitly reveal their own ABE secret keys for some purpose. In recent years, a substantial amount of work focused on designing efficient tracing mechanisms to identify such misbehaving users on ABE. In this paper, we propose an efficient generic construction of black-box traceable ABE to identify the traitors. Our construction supports (public) adaptive black-box traceability and has short keys and short ciphertexts that are independent of the number of users. Technically, our construction relies on a generic transformation from any attribute-based inner-product functional encryption (ABIPFE) scheme to black-box traceable ABE system. Furthermore, to instantiate our generic construction from standard lattices, we propose the first lattice-based ABIPFE scheme, which is proven weakly selective secure in the standard model.

PPNNP: A privacy-preserving neural network prediction with separated data providers using multi-client inner-product encryption

In a neural network of deep learning, it needs a series of algorithms that endeavor to recognize underlying relationships in a set of data. In order to protect the privacy of user’s datasets, traditional schemes can perform the prediction task by setting only a single data provider in the system. However, the data may come from multiple separated data providers rather than single data source in real world since each data provider might hold partial features of a complete prediction sample. It requires that multiple data providers cooperate to perform the prediction for the neural networks by sending their own local data to a well-trained prediction model deployed on a remote cloud server to obtain a predictive label. However, the data owned by multiple data providers usually contain a large amount of private information, which can lead to serious security problems once leaked. To resolve the security and privacy issues of the data owned by multiple data providers, in this paper, we propose a Privacy-Preserving Neural Network Prediction model (PPNNP) that deploys multi-client inner-product functional encryption to the first layer of prediction model. Multiple data providers encrypt their data and upload it to a well-trained model deployed on cloud server, and the server makes predictions by calculating inner-products related to them. It can provide sufficient privacy and security for the data while deploying different neural network architectures with activation functions that are even non-linear on the remote server. We evaluate our scheme based on the real datasets and provide a comparison with the related schemes. Experimental results demonstrate that our scheme can reduce the computational cost of the whole process while significantly reducing the encryption time. It can obtain an accuracy of over 90% in different network architectures with even non-linear activation functions. Meanwhile, our solution can reduce communication overhead in the whole protocol.

A tighter proof for CCA secure inner product functional encryption: Genericity meets efficiency

Inner product functional encryption (IPFE) is a primitive which produces, from a master secret key, decryption keys skk associated to vectors k over some specified base ring. Decrypting an encryption of vector m with skk only reveals 〈k,m〉. Benhamouda et al. [7] provided a generic construction for CCA-secure IPFE from projective hash functions (PHFs), unfortunately their security reduction suffers an exponential loss. Their only instantiation capable of decrypting inner products of large sizes, which relies on the decisional composite residuosity (DCR) assumption, is impractical due to the large size of ciphertexts, decryption keys, and the prohibitive speed of the scheme. Our core contribution is a new approach to proving CCA security. Our constructions maintain the genericity of [7], while our security proof relaxes the requirements on the underlying PHFs and gains in reduction tightness. We instantiate these constructions from the DCR assumption, an assumption in class groups (HSMCL) and the decision Diffie Hellman (DDH) assumption. Our CCA-secure constructions from DCR and HSMCL are the first such schemes to efficiently decrypt inner products of large size, improving by multiple orders of magnitude upon the work of [7]. A single-core C implementation of these schemes shows that, for a 112 bit security, and 100-dimensional vectors, their DCR-based scheme takes 1 h 20 min to encrypt, and over 5 min to decrypt, whereas our slowest scheme takes 5.2 s to encrypt and 0.5 s to decrypt. Similarly a ciphertext for their scheme is of 283 MB; those of our HSMCL-based scheme are of 30 kB.

Tightly CCA-secure inner product functional encryption scheme

Inner product functional encryption (IPFE) is a modern public key paradigm where the master key can derive a secret key sky for a vector y, which can then be used to decrypt a ciphertext of x to get the inner product 〈x,y〉 as output. In ASIACRYPT 2019, Tomida proposed the first tightly secure IPFE scheme in the multi-user and multi-challenge setting based on the matrix decisional Diffie-Hellman (MDDH) assumption. However, the construction achieves CPA security only. Up to now, there is no IPFE scheme with tight CCA security available.In this paper, we construct the first tightly CCA-secure IPFE scheme in the multi-user and multi-challenge setting. The security reduction to the MDDH assumption (including SXDH, k-LIN, etc.) loses only a factor O(log⁡λ) with λ the security parameter. Moreover, our scheme enjoys full compactness. To support inner product function of dimension m, our SXDH-based IPFE has (m2+8m+14) and (3m+14) group elements in the master public key and ciphertext respectively. This is comparable to the tightly CPA-secure IPFE proposed by Tomida based on the DDH assumption, whose master public key and ciphertext contain (m2+2) and 3m group elements, respectively.Furthermore, we construct the first IPFE with both tight CCA-security and function-hiding property, based on our CCA-secure IPFE. The tight function-hiding CCA security is obtained by adapting the techniques in Lin (CRYPTO 2017) and Gay (PKC 2020) to the multi-user and multi-challenge setting.

Hierarchical identity-based inner product functional encryption

Inner product functional encryption (IPFE), as a novel cryptographic primitive, can be classified into public-key IPFE (PK-IPFE) and secret-key IPFE (SK-IPFE). PK-IPFE has the following functions: an encryptor generates the ciphertext by encrypting a vector x→, and a decryptor decrypts the ciphertext and obtains the inner product 〈x→,y→〉 if it holds the secret key related to vector y→. The general IPFE cannot describe the hierarchical structure. The superior cannot use the general IPFE to issue the delegating keys for the subordinates, which complicates key management. We first propose a new primitive, hierarchical identity-based PK-IPFE (HID-PK-IPFE). HID-PK-IPFE has the following features. First, the identity of the decryptor can be specified when encrypting. Second, the identity of the recipient has a hierarchical structure. In the hierarchical tree, the upper-level users can generate the private key of the lower-level users; that is, our scheme has a delegation function. We formalize the selective chosen plaintext attack model of HID-PK-IPFE, propose the scheme in the standard model, and prove the security of the scheme on the basis of d-DBDHE assumption. We conducted two sets of simulations. We set the maximum depth of the identity hierarchy to 10, and increased the vector length from 10 to 15. We then listed the time spent by each algorithm in these two ranges. The simulation results show that the running time of each algorithm of our HID-PK-IPFE is completely acceptable in actual application scenarios.

Verifiable inner product computation on outsourced database for authenticated multi-user data sharing

With the rapid development of cloud computing, the practical applications such as the machine learning based on the outsourced data have been investigated in the data sharing setting. In machine learning, the inner product is a necessary primitive to analyze the description statistics. However, the inner product computation in selective data sharing setting has not been fully considered. For this fact, we propose a verifiable inner product computation scheme based on Inner Product Functional Encryption (IPFE). IPFE is employed to preserve the outsourced data privacy and restrict the computation on the outsourced data to be inner product. To achieve the key privacy and result privacy, we transform the secret key into blinded form, which in turn results in a blinded result. With the aim of implementing access control over the data user and outsourced data, we design to let cloud server perform the authentication procedures before computing inner product. This can also eliminate most computational overhead resulting from the unauthorized data user and undesired data. As a result, only the authorized data user can obtain the inner product computed on the designated outsourced data. The proposed scheme is proved to be secure under the authentication model and the result unforgeability model. The performance evaluation shows that the proposed scheme is feasible. To achieve a better security level, the proposed scheme is extended to be secure against the corrupted cloud server.

Tightly secure inner product functional encryption: Multi-input and function-hiding constructions

Tightly secure cryptographic schemes have been extensively studied in the fields of chosen-ciphertext secure public-key encryption (CCA-secure PKE), identity-based encryption (IBE), signatures and more. We extend tightly secure cryptography to inner product functional encryption (IPFE) and present the first tightly secure schemes related to IPFE. We first construct a new IPFE schemes that are tightly secure in the multi-user and multi-challenge setting. In other words, the security of our schemes do not degrade even if an adversary obtains many ciphertexts generated by many users. Our schemes are constructible on a pairing-free group and secure under the matrix decisional Diffie-Hellman (MDDH) assumption, which is the generalization of the decisional Diffie-Hellman (DDH) assumption. Applying the known conversions by Lin (CRYPTO 2017) and Abdalla et al. (CRYPTO 2018) to our schemes, we can obtain the first tightly secure function-hiding IPFE schemes and multi-input IPFE (MIPFE) schemes respectively. Our second main contribution is the proposal of a new generic conversion from function-hiding IPFE to function-hiding MIPFE, which was left as an open problem by Abdalla et al. (CRYPTO 2018). We can obtain the first tightly secure function-hiding MIPFE schemes by applying our conversion to the tightly secure function-hiding IPFE schemes described above.

Unbounded inner product functional encryption from bilinear maps

Inner product functional encryption (IPFE) is one class of functional encryption supporting only inner product functionality. All previous IPFE schemes are bounded schemes, meaning that the vector length that can be handled in the scheme is fixed in the setup phase. In this paper, we propose the first unbounded IPFE schemes, in which we do not have to fix the lengths of vectors in the setup phase and can handle (a priori) unbounded polynomial lengths of vectors. Our first scheme is private-key based and fully function hiding. That is, secret keys hide the information of the associated function. Our second scheme is public-key based and provides adaptive security in the indistinguishability based security definition. Both our schemes are based on SXDH, which is a well-studied standard assumption, and secure in the standard model. Furthermore, our schemes are quite efficient, incurring an efficiency loss by only a small constant factor from previous bounded function hiding schemes.

Privacy-Preserving Outsourced Inner Product Computation on Encrypted Database

We consider an outsourced computation model in the selective data sharing setting. Specifically, one of the data owners outsources the encrypted data to an untrusted cloud server, and wants to share the specific function of these data with a group of data users. A data user can perform the specific computation on the data that it is authorized to access. We propose a construction under this model for the inner product computation by using the Inner Product Functional Encryption (IPFE) as a building block. A standard IPFE used on this model has two privacy weaknesses regarding the master secret key and the encrypted vector. We propose a strengthened IPFE that revises these weaknesses. We construct a new IPFE scheme and use it to construct an efficient outsourced inner product computation scheme. In our outsourced computation scheme, the storage overhead and the computation cost for a data user are independent of the vector size. The result privacy and the outsourced data privacy are well preserved against the untrusted cloud server. The experimental results show that our schemes are efficient and practical.