Oblivious Pseudorandom Function Research Articles

Efficient Maliciously Secure Oblivious Exponentiations

Oblivious Pseudorandom Functions (OPRFs) allow a client to evaluate a pseudorandom function (PRF) on her secret input based on a key that is held by a server. In the process, the client only learns the PRF output but not the key, while the server neither learns the input nor the output of the client. The arguably most popular OPRF is due to Naor, Pinkas and Reingold (Eurocrypt 2009). It is based on an Oblivious Exponentiation by the server, with passive security under the Decisional Diffie-Hellman assumption. In this work, we strengthen the security guarantees of the NPR OPRF by protecting it against active attacks of the server. We have implemented our solution and report on the performance. Our main result is a new batch OPRF protocol which is secure against maliciously corrupted servers, but is essentially as efficient as the semi-honest solution. More precisely, the computation (and communication) overhead is a multiplicative factor o ( 1 ) as the batch size increases. The obvious solution using zero-knowledge proofs would have a constant factor overhead at best, which can be too expensive for certain deployments. Our protocol relies on a novel version of the DDH problem, which we call the Oblivious Exponentiation Problem (OEP), and we give evidence for its hardness in the Generic Group model. We also present a variant of our maliciously secure protocol that does not rely on the OEP but nevertheless only has overhead o ( 1 ) over the known semi-honest protocol. Moreover, we show that our techniques can also be used to efficiently protect threshold blind BLS signing and threshold ElGamal decryption against malicious attackers.

Detecting malicious encrypted traffic with privacy set intersection in cloud-assisted industrial internet

Encryption technology provides the ability of confidential transmission to ensure the security of Industrial Internet communication, but it makes detecting malicious encrypted traffic very difficult. To resolve the conflict between the difficulty of malicious encrypted traffic detection and the requirements of traffic privacy protection, we propose a cloud-assisted Industrial Internet malicious encrypted traffic detection scheme with privacy protection. To accurately match the encrypted traffic and the detection rules, a privacy set intersection protocol based on the oblivious pseudorandom function and random garbled Bloom filter is constructed, which can detect malicious traffic without revealing data content. Meanwhile, our scheme can allow semi-trusted cloud servers to assist resource-constrained end devices to participate in private calculations. The key-homomorphic encryption is introduced to obfuscate the detection rules, making the detection rules always transparent to end users and semi-trusted cloud servers. We also design the random input verification to make the malicious end users do not have any opportunity to participate in the privacy set intersection calculation using arbitrary data. The scheme analysis and performance evaluation results show that our scheme can effectively guarantee the security of encrypted traffic detection with better detection performance and limited resource consumption.

Delegated Private Matching For Compute

Private matching for compute (PMC) establishes a match between two datasets owned by mutually distrusted parties (C and P) and allows the parties to input more data for the matched records for arbitrary downstream secure computation without rerunning the private matching component. The state-of-the-art PMC protocols only support two parties and assume that both parties can participate in computationally intensive secure computation. We observe that such operational overhead limits the adoption of these protocols to solely powerful entities as small data owners or devices with minimal computing power will not be able to participate. We introduce two protocols to delegate PMC from party P to untrusted cloud servers, called delegates, allowing multiple smaller P parties to provide inputs containing identifiers and associated values. Our Delegated Private Matching for Compute protocols, called DPMC and DsPMC, establish a join between the datasets of party C and multiple delegators P based on multiple identifiers and compute secret shares of associated values for the identifiers that the parties have in common. We introduce a rerandomizable encrypted oblivious pseudorandom function (OPRF) primitive, called EO, which allows two parties to encrypt, mask, and shuffle their data. Note that EO may be of independent interest. Our DsPMC protocol limits the leakages of DPMC by combining our EO scheme and secure three-party shuffling. Finally, our implementation demonstrates the efficiency of our constructions by outperforming related works by approximately 10x for the total protocol execution and by at least 20x for the computation on the delegators.

The key security management scheme of cloud storage based on blockchain and digital twins

As a secure distributed ledger technology, blockchain has attracted widespread attention from academia and industry for its decentralization, immutability, and traceability characteristics. This paper proposes a cloud storage key security management scheme based on blockchain. To resist brute-force attacks launched by adversaries on ciphertexts, the scheme uses an oblivious pseudo-random function (OPRF) to generate randomized convergent keys and improve data confidentiality. Second, the scheme enhances the reliability of concurrent key management through a secret sharing mechanism, where convergent keys are split into key fragments and distributed on blockchain for storage. Even if a certain number of key fragments are lost or damaged, users can still recover complete key information through block transaction records. In addition, the scheme effectively supports file-level and block-level data security deduplication. Security analysis and experimental performance evaluation indicate that this scheme can ensure the security of keys and the confidentiality of data, and it has a low computational overhead for generating file-level encryption keys under this scheme. Even for a 100 MB file, the computational overhead required for generating encryption keys is less than 2 s, which improves computational efficiency.

A Novel Edge Cache-Based Private Set Intersection Protocol via Lightweight Oblivious PRF.

With the rapid development of edge computing and the Internet of Things, the problem of information resource sharing can be effectively solved through multi-party collaboration, but the risk of data leakage is also increasing. To address the above issues, we propose an efficient multi-party private set intersection (MPSI) protocol via a multi-point oblivious pseudorandom function (OPRF). Then, we apply it to work on a specific commercial application: edge caching. The proposed MPSI uses oblivious transfer (OT) together with a probe-and-XOR of strings (PaXoS) as the main building blocks. It not only provides one-sided malicious security, but also achieves a better balance between communication and computational overhead. From the communication pattern perspective, the client only needs to perform OT with the leader and send a data structure PaXoS to the designated party, making the protocol extremely efficient. Moreover, in the setting of edge caching, many parties hold a set of items containing an identity and its associated value. All parties can identify a set of the most frequently accessed common items without revealing the underlying data.

A lightweight delegated private set intersection cardinality protocol

Secure multiparty computation (MPC) is an important means to realize privacy computing (PC). Private set intersection cardinality (PSI-CA) is a variant of an important problem in MPC research, that is private set intersection. PSI-CA allows multiple participants jointly compute the size of the common intersection of their private sets through interaction without revealing any other information about their respective sets. Delegated PSI-CA delegates a large number of computing in the protocol to some untrusted cloud servers, which makes the protocol efficient. Delegated PSI-CA is considered to be of great significance for the construction of privacy-preserving contact tracing systems recently. However, the existing work is still not ideal for the resource-limited mobile terminal of clients. In this paper, we propose a lightweight delegated PSI-CA protocol based on multi-point oblivious pseudorandom function and collision-resistant hash function. Our protocol does not need to do additional pre-operations, so the computation complexity and the communication complexity on the client side are further reduced compare to the existing works. In addition, we build a privacy-preserving contact tracing system by utilizing our protocol, which can be publicly checked if necessary, named PC-CONTrace. The experimental results show that our system is more practical and advantageous for densely populated areas.

VR-PEKS: A Verifiable and Resistant to Keyword Guess Attack Public Key Encryption with Keyword Search Scheme

Public key encryption with keyword search (PEKS) allows users to perform keyword searches of ciphertext on untrusted cloud storage servers, protecting data privacy while sharing data. However, it faces several security problems in practical applications. First, an attacker can launch a keyword guessing attack to obtain keywords of interest to users, causing the leakage of their sensitive information. Second, untrusted cloud servers may return incorrect or incomplete results. In addition, with the continuous development of quantum computers, existing PEKS schemes face the problem of quantum attacks. Since cloud servers are mostly untrusted, verifiable search has become a hot research topic among scholars. However, most of the current schemes are based on bilinear pairing constructions, which are vulnerable to quantum attacks. To solve these problems, we propose a new ciphertext retrieval scheme based on fully homomorphic encryption (FHE), called VR-PEKS. This scheme implements verifiable search and is able to solve the problems of keyword guessing attacks and quantum attacks. We propose to improve the security of the scheme by using the oblivious pseudorandom function to randomize keywords and then encrypt them using FHE. An encrypted verified index structure is constructed and exposed by the data owner, enabling the data recipient to achieve verification of the correctness and integrity of the retrieved results without relying on a trusted third party. We demonstrate the security of the proposed scheme in a stochastic prediction model, and prove that our scheme satisfies keyword ciphertext indistinguishability and keyword trapdoor indistinguishability under adaptive keyword selection attacks. The comparison shows that our scheme is secure and feasible.

Device capture resilient authentication and key agreement protocol for IoV

With the steady growth of car ownership and the saturation of road traffic, the Internet of vehicle (IoV) is regarded as one of the most effective technologies to improve traffic efficiency and driving experience. Authentication and key agreement protocol (AKA) is a key means to ensure secure interaction between the onboard unit (OBU) and the various information servers. Typically, the private key of AKA protocol is stored in the OBU. However, OBU theft occurs as vehicles are often left unattended. Therefore, it is a challenge to ensure the secure storage of private keys. To address the above problem, a capture-resistant AKA protocol based on oblivious pseudorandom functions (OPRF) and collaborative signature is proposed in this paper. The private key is divided into two parts, one is encrypted using the public key of the auxiliary device and another can only be recovered by running the OPRF protocol between the OBU and the auxiliary device. Since no secret information is stored in the OBU, the adversary cannot obtain the private key even if the OBU is stolen. The comprehensive security analysis and performance comparison of the proposed scheme is provided in this paper. The result demonstrates that the proposed scheme is resistant to various known attacks, especially key leakage caused by device capture. In addition, the proposed scheme can strike a balance between computational and communication overhead.

Blockchain-Enabled Efficient Dynamic Cross-Domain Deduplication in Edge Computing

As the rapid proliferation of Internet of Things (IoT) and edge computing, large amounts of data are needed to be stored and transmitted in the online storage system. Data deduplication can be adopted to improve communication efficiency and minimize storage space. However, in edge computing, data deduplication brings security and functionality requirements that are still unsatisfied. Most existing schemes are vulnerable to brute-force attacks and single-point attacks. Moreover, they impose a heavy burden on resource-constrained edge nodes and do not support cross-domain deduplication. Blockchain is a promising technology because the programmable smart contract can be utilized to perform cross-domain deduplication and guarantee the traceability of data. In this article, an efficient dynamic cross-domain deduplication scheme in blockchain-enabled edge computing is proposed to solve the above problems. Specifically, the smart contract is employed to assist cross-domain deduplication, which also can reduce the storage pressure of edge nodes. Meanwhile, a hash proof system-based oblivious pseudorandom function is created to reduce the time cost of key generation and achieve the security requirements of resistance to brute-force attacks and single-point attacks. The technology of accumulators is adopted to achieve Proofs of Ownership (PoO), which can prevent duplicate-faking attacks. The security analysis demonstrates that the proposed scheme has a higher security level. The performance evaluation shows that the proposed scheme significantly reduces computation cost and communication overhead, compared with other existing schemes. The smart contract is implemented in the Ethereum test network (i.e., Rinkeby), which shows acceptable gas cost even the functions are called frequently.

A NEW MULTI-PARTY PRIVATE SET INTERSECTION PROTOCOL BASED on OPRFs

In many crucial real-world applications, parties must jointly perform some secure multi-party computation (MPC) while keeping their inputs hidden from other parties. Private Set Intersection (PSI), the specific area of Multi-Party Computation, let the parties learn the intersection of their private data sets without sharing their secret data with others. For instance, a smartphone user downloads a messaging application, naturally, he wants to discover who are the other contacts that are using the same application. The naive and insecure solution is to send all contacts to the server to discover them. However, the user does not want to share his contacts with the application for privacy issues. To handle this, in recent years, companies and organizations start to use PSI to enhance privacy and security with a little cost of communication and computation. In this paper, we introduce a novel method to compute Private Set Intersection with multi parties where there are at least three or more parties participating in the protocol. By employing the Zero-Secret Sharing scheme and Oblivious Pseudo-Random Functions (OPRFs), parties securely calculate the intersection with computational and communication complexities which are both linear in the number of parties.

Decentralized, Privacy-Preserving, Single Sign-On

In current single sign-on authentication schemes on the web, users are required to interact with identity providers securely to set up authentication data during a registration phase and receive a token (credential) for future access to services and applications. This type of interaction can make authentication schemes challenging in terms of security and availability. From a security perspective, a main threat is theft of authentication reference data stored with identity providers. An adversary could easily abuse such data to mount an offline dictionary attack for obtaining the underlying password or biometric. From a privacy perspective, identity providers are able to track user activity and control sensitive user data. In terms of availability, users rely on trusted third-party servers that need to be available during authentication. We propose a novel decentralized privacy-preserving single sign-on scheme through the Decentralized Anonymous Multi-Factor Authentication (DAMFA), a new authentication scheme where identity providers no longer require sensitive user data and can no longer track individual user activity. Moreover, our protocol eliminates dependence on an always-on identity provider during user authentication, allowing service providers to authenticate users at any time without interacting with the identity provider. Our approach builds on threshold oblivious pseudorandom functions (TOPRF) to improve resistance against offline attacks and uses a distributed transaction ledger to improve availability. We prove the security of DAMFA in the universal composibility (UC) model by defining a UC definition (ideal functionality) for DAMFA and formally proving the security of our scheme via ideal-real simulation. Finally, we demonstrate the practicability of our proposed scheme through a prototype implementation.

Differentially Private Set Intersection for Asymmetrical ID Alignment

Private Set Intersection (PSI) is typically used to achieve ID alignment with protection of IDs in the preparation phase of Vertical Federated Learning (VFL). However, existing PSI approaches are limited to protecting IDs that are outside the intersection of participants, and most ignore the sensitivity of intersection for a weak party in an asymmetrical ID alignment. Since the set size of the strong party is much greater than the weak party’s in an asymmetrical federation, and the intersection usually accounts for a substantial part of the weak party set, the weak party’s sensitive sample IDs would be severely compromised through sharing the intersection. To address this issue, we propose Differentially private PSI Cardinality and PSI (DPSI-CA, DPSI) protocols, which protect the intersection cardinality and sensitive IDs inside the intersect ion for the weak party, respectively. First, DPSI-CA encodes IDs in binary notation, and combines them with the GM encryption, to perform the ID-matchmaking by executing bitwise plaintext XOR. Then, the encrypted matching results are independently perturbed using randomized responses to produce differentially private outputs for PSI-CA, and its unbiased estimate is added to remove the deviation brought by the randomization. Furthermore, DPSI fuses Pseudo-Random Function (PRF)-based zero sharing, garbled Bloom filter, and Oblivious PRF (OPRF)-based shares reconstruction, to successfully reconstruct the shares corresponding to sampled IDs in the intersection. Meanwhile, a randomized response is used to sample the inputs and perturb the outputs of the OPRF-based shares reconstruction, producing a randomly sampled intersection for the weak party and differentially private intersection for the strong party. Finally, the privacy analysis shows that our protocols provide differential privacy for the weak party’s sensitive sample IDs, and extensive experiment results illustrate the feasibility of the asymmetrical ID alignment involving millions of IDs.

Blockchain-based verifiable privacy-preserving data classification protocol for medical data

Massive IoT devices are used for data collection with the fast development of the Internet-of-things (IoT). For example, wearable devices are used to collect users’ health data and conduct health monitoring. However, many private information are involved in medical data. Privacy-preserving data classification scheme (PPDC) provided an effective approach to balance the utility and the privacy of data. In the PPDC schemes, a fully trusted auditor is employed to validate the result of data classification. To reduce trust on the auditor, we provide a simplified version of the PPDC scheme. We propose blockchain-based verifiable privacy-preserving data classification protocol (VeriDC) for medical data. It makes the data center check the classification result without involving an auditor. We provide the system model of the verifiable privacy-preserving data classification protocol in blockchain setting and formalize its security model. By using verifiable oblivious pseudorandom function(verifiable OPRF), we can generate a verifiable proof and post it on blockchain to guarantee the transparency of data classification. We present a concrete construction and prove its security. Finally, we compare VeriDC with the related schemes to evaluate the effectiveness of VeriDC.

Practical Threshold Multi-Factor Authentication

Multi-factor authentication (MFA) has been widely used to safeguard high-value assets. Unlike single-factor authentication (e.g., password-only login), $t$ -factor authentication ( $t$ FA) requires a user always to carry and present $t$ specified factors so as to strengthen the security of login. Nevertheless, this may restrict user experience in limiting the flexibility of factor usage, e.g., the user may prefer to choose any factors at hand for login authentication. To bring back usability and flexibility without loss of security, we introduce a new notion of authentication, called $(t,n)$ threshold MFA , that allows a user to actively choose $t$ factors out of $n$ based on preference. We further define the “most-rigorous” multi-factor security model for the new notion, allowing attackers to control public channels, launch active/passive attacks, and compromise/corrupt any subset of parties as well as factors. We state that the model can capture the most practical security needs in the literature. We design a threshold MFA key exchange (T-MFAKE) protocol built on the top of a threshold oblivious pseudorandom function and an authenticated key exchange protocol. Our protocol achieves the “highest-attainable” security against all attacking attempts in the context of parties/factors being compromised/corrupted. As for efficiency, our design only requires $4+t$ exponentiations, 2 multi-exponentiations and $\mathbf {2}$ communication rounds. Compared with existing $t$ FA schemes, even the degenerated $(t,t)$ version of our protocol achieves the strongest security (stronger than most schemes) and higher efficiency on computational and communication. We instantiate our design on real-world platform to highlight its practicability and efficiency.

Privacy-Preserving Publicly Verifiable Databases

Verifiable databases (VDB) enables the data owner to outsource a huge unencrypted database to the powerful but untrusted cloud such that any client could later retrieve the database and check whether the cloud returns valid records or not. To the best of our knowledge, there is no prior work considering privacy. Besides, they assume that the data owner and the client are fully trusted while they may be semi-honest in the real world. To address these problems, we propose a new primitive called privacy-preserving publicly verifiable database (PPVDB), which not only guarantees the integrity of the queried result but also leaks no information. At the end of this protocol, the client can check whether the cloud returns a valid result and learns the queried result but nothing else about the database. Besides, the cloud learns nothing about the database and the query, and the data owner does not know which item that the client has queried. Motivated by the comparison among some strawman solutions, we incorporate verifiable computation for the polynomial with oblivious pseudorandom function to construct a PPVDB scheme, which is the first VDB scheme providing stronger security against the malicious cloud and the semi-honest client and data owner.

Building Low-Interactivity Multifactor Authenticated Key Exchange for Industrial Internet of Things

Industrial Internet of Things (IIoT) brings together computers, devices, advanced analytics, and people in industries, such as transportation, oil plant, and power grid that leads to major efficiency and productivity gains for almost any industrial procedures. Due to the interconnection of devices in IIoT, communication security has become a critical issue to address in many emerging industry standards that require the authentication and key exchange procedure to be done to guarantee the authorized machine access (e.g., from users) and secure the data transmission between machines. To overcome the shortcoming (i.e., low entropy) of the memorable password in user authentication, it is rightfully recommended by industry standards (such as IEC-62443 family) to use multifactor authentication (MFA) for higher security levels. Notably, latency is one of the main sources of inefficiency when a device is communicating with other machines on IIoT. To mitigate latency, a smooth projective hash function (SPHF) built from well-studied standard assumptions is used to achieve a lowinteractivity multifactor authenticated key exchange protocol (MFAKE) because SPHF allows each party to prove to the others that he knows the right authentication factor(s). In this article, we are, therefore, motivated to build a new MFAKE named “secure remote multifactor (SRMF)” to achieve the humaninvolved “machine-to-machine” secure communication in IIoT. That is, SRMF leverages multiple user-centric authentication factors (such as password, biometric fingerprints, and PIN), and it can synergistically support multifactor registration (MFR), MFA, and multifactor key exchange (MFKE). Furthermore, to prevent authentication factors stored at the server exposing to attackers, the password-harden service (i.e., Pythia-PRF and USENIX'15) inspires us to develop a multifactor hardening service (MFHS) utilizing an oblivious pseudorandom function (OPRF). The balanced security of the proposed protocol is proved under the model of Bellare-Pointcheval-Rogaway (EUROCRYPTO'00) along with theoretical and experimental evaluations.

A key for John Doe: modeling and designing Anonymous Password-Authenticated Key Exchange protocols

Anonymous Password-Authenticated Key Exchange ( $\sf{ APAKE}$ APAKE ) can be seen as the hybrid offspring of standard key exchange and anonymous password authentication protocols. $\sf{ APAKE}$ APAKE allows a client holding a low-entropy password to establish a session key with a server, provided that the client’s password is in the server’s set. Moreover, no information about the password input by the client or the set of valid passwords held by the server should leak to the other party–beyond whether the client’s password lies or not in the server’s password database. To the best of our knowledge, all $\sf{ APAKE}$ APAKE proposals to date either assume client storage or force the client to remember the index assigned to its password in the server’s database. Furthermore, earlier works either provide only informal definitions or fail in some sense to properly model the primitive. In this paper, we provide a formal security model for $\sf{ APAKE}$ APAKE , capturing security and anonymity provisions for both clients and servers. In addition, we present two $\sf{ APAKE}$ APAKE protocols that only require clients to remember a password and that attain our sought key secrecy and anonymity guarantees. Our first protocol leverages oblivious pseudo-random functions, while the second one builds upon a special type of identity-based encryption scheme.

Privacy Pass: Bypassing Internet Challenges Anonymously

AbstractThe growth of content delivery networks (CDNs) has engendered centralized control over the serving of internet content. An unwanted by-product of this growth is that CDNs are fast becoming global arbiters for which content requests are allowed and which are blocked in an attempt to stanch malicious traffic. In particular, in some cases honest users-especially those behind shared IP addresses, including users of privacy tools such as Tor, VPNs, and I2P - can be unfairly targeted by attempted ‘catch-all solutions’ that assume these users are acting maliciously. In this work, we provide a solution to prevent users from being exposed to a disproportionate amount of internet challenges such as CAPTCHAs. These challenges are at the very least annoying and at their worst - when coupled with bad implementations - can completely block access from web resources. We detail a 1-RTT cryptographic protocol (based on an implementation of an oblivious pseudorandom function) that allows users to receive a significant amount of anonymous tokens for each challenge solution that they provide. These tokens can be exchanged in the future for access without having to interact with a challenge. We have implemented our initial solution in a browser extension named “Privacy Pass”, and have worked with the Cloudflare CDN to deploy compatible server-side components in their infrastructure. However, we envisage that our solution could be used more generally for many applications where anonymous and honest access can be granted (e.g., anonymous wiki editing). The anonymity guarantee of our solution makes it immediately appropriate for use by users of Tor/VPNs/ I2P. We also publish figures from Cloudflare indicating the potential impact from the global release of Privacy Pass.

Enabling Efficient and Privacy-Preserving Health Query Over Outsourced Cloud

With the pervasiveness of Body Sensor Network (BSN) and cloud computing, online health query service has attracted considerable attention and become a promising approach to improve our quality of healthcare service. However, it still faces many challenges on privacy of users’ sensitive personal information, confidentiality of health service provider’s diagnosis model, accuracy of the diagnosis result, and efficiency of the query result. In this paper, we propose an efficient and privacy-preserving health query scheme over outsourced cloud named HeOC. In the HeOC scheme, the authenticated users can send the encrypted physiological data to the cloud and query the specific disease level accurately on the encrypted medical data stored in the cloud. To reduce the query latency, we fist design a sensor anomaly detection technique to find the high risk disease according to the user’s sensor information. Then, with the oblivious pseudorandom function protocol, the user queries the diagnosis result accurately. Detailed security analysis shows that the HeOC scheme can achieve the diagnosis without disclosing the privacy of the user’s health information and confidentiality of the health service provider’s diagnosis model. In addition, the extensive experiments with an android app and two python programs demonstrate its efficiency in computations and communications.

Towards fair mutual private set intersection with linear complexity

AbstractIn this paper, we propose a two‐way oblivious pseudorandom function (mOPRF) secure in standard model against malicious parties under the decisional composite residuosity and decisional Diffie–Hellman assumptions. Using this two‐way OPRF, we construct an optimistic mutual private set intersection (PSI) protocol conserving fairness. In our PSI protocol, fairness is obtained by a semi‐trusted arbiter in the sense that it cannot get access to the private information of the two parties, but we believe that it will follow the protocol. To the best of our knowledge, our PSI protocol is the first fair PSI with linear communication and computation complexities and is proven to be secure in standard model against malicious adversaries under decisional q‐Diffie–Hellman inversion, decisional composite residuosity, and decisional Diffie–Hellman assumptions. Apart from that, we present a modified version of the OPRF that requires less number of communication rounds. Copyright © 2016 John Wiley & Sons, Ltd.