Outsourced Decryption Research Articles

A lightweight verifiable outsourced decryption of attribute-based encryption scheme for blockchain-enabled wireless body area network in fog computing

Wireless body area network includes some tiny wearable sensors for monitoring the physiological data of user, which has been a promising method of promoting the quality and efficiency greatly in healthcare. The collected physical signs are aggregated into the medical documents and uploaded to cloud server for utilizing by the remote user. As these files are highly sensitive privacy data, there is a vital challenge that constructs a secure and efficient communication architecture in this application scenario. Based on this standpoint, we present a lightweight verifiability ciphertext-policy attribute-based encryption protocol with outsourced decryption in this article. Specifically, our construction enjoys the following six features: (1) Although the outsourced decryption enables to save the computation overhead of the data user sharply in an attribute-based encryption scheme, the ciphertext is out of control and the correctness cannot be guaranteed by the data owner. The proposal provides the verifiability of ciphertext that ensures the user to check the correctness efficiently. (2) The size of the ciphertext is constant that is not increased with the complexity of attribute and access structure. (3) For Internet of Things devices, it introduces the fog computing into our protocol for the purpose of low latency and relation interactions, which has virtually saved the bandwidth. (4) With the help of blockchain technique, we encapsulate the hash value of public parameter, original and transformed ciphertext and transformed key into a block, so that the tamper-resistance is facilitated against an adversary from inside and outside the system. (5) In the standard model, we prove that it is selectively chosen-plaintext attack-secure and verifiable provided that the computational bilinear Diffie–Hellman assumption holds. (6) It implements this protocol and shows the result of performance measurement, which indicates a significant reduction on communication and computation costs burden on every entity in wireless body area network.

Practical traceable multi-authority CP-ABE with outsourcing decryption and access policy updation

Multi-authority ciphertext policy attribute-based encryption (CP-ABE) is one of the promising approaches where multiple authorities issue and manage various attributes to achieve fine-grained access control on stored data in cloud platforms. However, the practical use of multi-authority CP-ABE (MCP-ABE) requires satisfaction of different features. Firstly, in MCP-ABE, users having the same set of attributes must share the same decryption privileges. This may potentially lead to exposure of decryption keys by some malicious users. Thus, there is a need of designing MCP-ABE with traceability to overcome this problem. Secondly, as the cost of decryption increases with the complexity of access policy, it is preferred to provide the functionality of outsourcing decryption to reduce the computational burden on the user. Finally, the data owners must have flexibility to change the access policy. Hence, policy updation must be an integral part of MCP-ABE scheme. In this paper, we construct a new multi-authority CP-ABE scheme over large attribute universe with decentralization of authorities that supports white-box traceability along with policy updation and outsourcing decryption. Our proposed cryptosystem is built on prime order groups and supports monotonic access structures. These features improve efficiency and expressiveness of our system. We implemented our proposed cryptosystem in Charm cryptographic framework and analyzed its performance with a diverse set of test cases.

Cost-Efficient Outsourced Decryption of Attribute-Based Encryption Schemes for Both Users and Cloud Server in Green Cloud Computing

To reduce a user’s decryption cost and protect the private information from being leaked, Green et al. proposed an approach oursourcing the decryption of the attribute based encryption (ABE) scheme to the cloud server. Later, almost all ABE schemes with outsourced decryption (ABE-OD) used their model or approach. However, the cloud server needs to repeat the outsourced decryption service of the same ciphertext for distinct users satisfying the same access policy in these schemes. Green computing is the atmosphere conscientious and recyclable utilization of resources. The green cloud networks can reduce their cost or energy requirements by adapting its performance, optimizing resources management and services. The method is not efficient for the cloud server in the green cloud networks. In this article, to take into account recyclable utilization of resources for the cloud server, we put forward a new and secure approach to reduce total overhead of the cloud server when many users satisfying an access policy require the outsourced decryptions for the same ciphertext besides decreasing the decryption computation cost for users. Compared with the existing ABE-OD schemes, our total overhead of the cloud server is independent of the number of the users who satisfy an access policy and request the outsourcing decryption service. Finally, we extend our approach to a RCCA-secure ABE-OD scheme.

Pay as You Decrypt: Decryption Outsourcing for Functional Encryption Using Blockchain

The concept of functional encryption (FE) has been introduced to address the shortcomings of public-key encryption (PKE) in many emerging applications which require both data storage and data sharing (e.g., cloud storage service). One of the major issues existing in most FE schemes is the efficiency, as they are built from bilinear pairings of which the computation is very expensive. A widely accepted solution to this problem is outsourcing the heavy workloads to a powerful third party and leaving the user with the light computation. Nevertheless, it is impractical to assume that the third party (e.g., the cloud) will provide free services. To our knowledge, no attention has been paid to the payment procedure between the user and the third party in an FE with outsourced decryption (FEOD) scheme under the assumption that neither of them should be trusted. Leveraging the transactions on cryptocurrencies supported by the blockchain technology, in this paper, we aim to design FE with payable outsourced decryption (FEPOD) schemes. The payment in an FEPOD scheme is achieved through a blockchain-based cryptocurrency, which enables the user to pay a third party when it correctly completes the outsourced decryption. We define the adversarial model for FEPOD schemes, and then present a generic construction of FEPOD schemes. Also, we evaluate the performance of the proposed generic construction by implementing a concrete FEPOD scheme over a blockchain platform.

Efficient Decentralized Attribute Based Access Control for Mobile Clouds

Fine grained access control is a requirement for data stored in untrusted servers like clouds. Owing to the large volume of data, decentralized key management schemes are preferred over centralized ones. Often encryption and decryption are quite expensive and not practical when users access data from resource constrained devices. We propose a decentralized attribute based encryption (ABE) scheme with fast encryption, outsourced decryption and user revocation. Our scheme is very specific to the context of mobile cloud as the storage of encrypted data and the partial decryption of ciphertexts are dependent on the cloud and users with mobile devices can upload data to the cloud or access data from it by incurring very little cost for encryption and decryption respectively. The main idea is to divide the encryption into two phases, offline preprocessing phase which is done when the device is otherwise not in use and an online phase when the data is actually encrypted with the policy. This makes encryption faster and more efficient than existing decentralized ABE schemes. For decryption outsourcing, data users need to generate a transformed version of the decryption key allowing an untrusted proxy server to partially decrypt the ciphertext without gaining any information about the plaintext. Data users can then fully decrypt the partially decrypted ciphertext without performing any costly pairing operations. We also introduce user revocation in this scheme without incurring too much additional cost in the online phase. Comparison with other ABE schemes shows that our scheme significantly reduces computation times for both data owners and data users and highly suitable for use in mobile devices.

A verifiable hidden policy CP‐ABE with decryption testing scheme and its application in VANET

AbstractAs a new kind of cryptographic primitive, attribute‐based encryption (ABE) is widely used in various complex scenarios because it has the characteristic of access control while encrypting messages. However, the existing ciphertext policy ABE (CP‐ABE) encryption schemes have some inherent defects, such as the lack of privacy‐preserving and inefficient decryption. These weak points make them difficult to play a role in scenarios with high real‐time and high data confidentiality requirements, for example, vehicle ad hoc network (VANET). Therefore, we proposed a verifiable hidden policy CP‐ABE with decryption testing scheme (or VHPDT, for short). It has the following features: hidden policy to privacy‐preserving and outsourced decryption testing can verify the correctness of the decrypted result. Furthermore, we apply it into VANET.

Secure Online/Offline Data Sharing Framework for Cloud-Assisted Industrial Internet of Things

Ciphertext-policy attribute-based keyword search (CP-ABKS) schemes facilitate the fine-grained keyword search over encrypted data, such as those sensed/collected from Industrial Internet of Things (IIoT) devices and stored in the cloud. However, existing CP-ABKS schemes generally have significant computation and storage requirements, which are beyond those of resource-constrained IIoT devices. Therefore, in this paper, we design a secure online/offline data sharing framework (DSF), which supports online/offline encryption and outsourced decryption. Using the healthcare setting as a case study, we demonstrate how DSF can be deployed in the cloud-assisted Healthcare IIoT (HealthIIoT) system. We not only prove that the DSF is selectively secure in the chosen access structure security model but also demonstrate its efficiency and feasibility in practical scenarios using experiments.

One-to-many image encryption with privacy-preserving homomorphic outsourced decryption based on compressed sensing

As a classical framework for signal compression and reconstruction, compressed sensing (CS) has dramatically improved the state-of-the-art in many fields such as image processing, wireless communication, medical imaging and optics. Since CS integrates data compression and encryption, CS-based cryptographic primitives have attracted great attention in recent years. Note that almost all the existing CS-based encryption schemes are one-to-one symmetric cryptosystems. Unlike traditional permutation-diffusion based symmetric cryptosystems (e.g., DES and AES), CS-based encryption schemes do not have the characteristic of high efficiency because decryption procedures require to perform complex and time-consuming reconstruction algorithms. In this paper, we break the traditional one-to-one encryption framework of CS-based cryptosystems, and present an efficient one-to-many encryption model for flexible application scenarios. Specifically, the information sender first encrypts several plaintext images simultaneously for different users according to our proposed attribute-based key distribution mechanism, and then sends the ciphertext to the cloud storage server. Any user who has one of attributes can efficiently obtain the corresponding plaintext by using an outsourced decryption server (ODS). To prevent the ODS from stealing the plaintexts for illegal activities, we employ a homomorphic transformation algorithm which can transform the original reconstruction problem into a variant one. The experimental results and the comparison with similar works demonstrate the feasibility and the superiority of the proposed scheme.

Attribute-Based Privacy-Preserving Data Sharing for Dynamic Groups in Cloud Computing

The sharing of personal data with multiple users from different domains has been benefited considerably from the rapid advances of cloud computing, and it is highly desirable to ensure the sharing file should not be exposed to the unauthorized users or cloud providers. Unfortunately, issues such as achieving the flexible access control of the sharing file, preserving the privacy of the receivers, forming the receiver groups dynamically, and high efficiency in encryption/decryption still remain challenging. To deal with these challenges, we provide a novel anonymous attribute-based broadcast encryption (A <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> B <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> E) which features the property of hidden access policy and enables the data owner to share his/her data with multiple participants who are inside a predefined receiver set and fulfill the access policy. We first suggest a concrete A <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> B <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> E scheme together with the rigorous and formal security proof without the support of the random oracle model. Then, we design an efficient and secure data sharing system by incorporating the A <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> B <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> E scheme, verifiable outsourcing decryption technique for attribute-based encryption, and the idea of online/offline attribute-based encryption. Extensive security analysis and performance evaluation demonstrate that our data sharing system is secure and practical.

Multi-authority Attribute-Based Encryption with User Revocation and Outsourcing Decryption

Attribute based encryption scheme is widely used to share sensitive data in cloud storage environment because it can realize fine-grained access control. Aiming at the problem of user revocation and high cost of decryption in cloud storage environment, a multi-authority attribute based encryption scheme with efficient user revocation and outsourcing decryption was proposed. It supports large universe. Each authority manages a specific set of attributes and distributes attribute keys to users with corresponding attributes, avoiding the problem that a single authority may easily become a system bottleneck. The user revocation algorithm of the scheme can realize the efficient revocation of the authorized users, ensuring the forward security of ciphertext. It’s proved to be statically-secure under random oracle and the efficiency analysis shows that it reduces user decryption cost greatly

Improvement of an outsourced attribute-based encryption scheme

Attribute-based encryption (ABE) scheme has become an important technology in cryptography. However, the considerable overhead of encryption and decryption restricts its application on the devices with limited resource. Fortunately, as the development of cloud computing, someone presents that outsourcing decryption and encryption can be used to deal with the problem. This idea has drawn a lot of attention after being proposed. Recently, Li et al. put forward an efficient verifiable outsourced ABE scheme which outsources the encryption and decryption to the cloud server and enables its valid receivers to verify the correctness of the message after decrypting. However, in this paper, we prove that their scheme is not secure under chosen plaintext attack which is the basic security requirement of ABE scheme. Then, we improve their scheme and illustrate that the improved scheme is adaptive chosen ciphertext attack (CCA2) secure in the random oracle model. The final comparison shows that we do not add extra computational burden to improve the security.

Efficient and privacy preserving access control scheme for fog-enabled IoT

Abstract The fog-to-things paradigm is introduced to mitigate the heavy burden on the edge of cloud-based network due to the centralized processing and storing of the massive volume of IoT data. Fog-enabled IoT architectures ensure small latency and enough computing resource that enables real time devices and applications. However, there still exist security and privacy challenges on data access control for fog-enabled IoT. Ciphertext-policy attribute-based encryption (CP-ABE) can be adopted to realize data access control in cloud-fog computing systems. In this paper, we propose an efficient and privacy preserving outsourced multi-authority access control scheme, named PPO-MACS. All attributes of users are transformed to be anonymous and authenticable to realize privacy preserving. And the verifiable outsourced decryption is introduced to reduce computation overheads on the end user side. Meanwhile, an efficient user revocation method is proposed. Security and performance analysis show that our scheme is secure and highly efficient.

Partially policy-hidden attribute-based broadcast encryption with secure delegation in edge computing

The rapid growth of data has successfully promoted the development of edge computing, which is used for processing the data at the edge of network. The emergence of edge computing compensates for the network delay caused by massive data uploads to the cloud. However, the issues of data security and privacy protection still need to be resolved. In this paper, we propose an efficient ciphertext-policy attribute-based encryption (CP-ABE) scheme that for the first time simultaneously achieves partially hidden policy, direct revocation, and verifiable outsourced decryption. Specifically, in our scheme, the concept of partially hidden policy is introduced to protect private information in an access policy. In addition, after a revocation is successfully executed, the revoked users will not be able to access the message without affecting any other non-revoked users. Our new scheme leverages the outsourcing technique to minimize the overhead required of the user. We demonstrate that our scheme is secure under the Decisional (q−1) Diffie–Hellman assumption and the Decisional Bilinear Diffie–Hellman assumption, as well as evaluating its performance using simulations.

Privacy-preserving task recommendation with win-win incentives for mobile crowdsourcing

Mobile crowdsourcing enables mobile requesters to publish tasks, which can be accomplished by workers with awards. However, existing task allocation schemes face tradeoff between effectiveness and privacy preservation, and most of them lack consideration of win-win incentives for both requesters and workers participation. In this paper, we propose a privacy-preserving task recommendation scheme with win-win incentives in crowdsourcing through developing advanced attribute-based encryption with preparation/online encryption and outsourced decryption technologies. Specifically, we design bipartite matching between published tasks and participant workers, to recommend tasks for eligible workers with interests and provide valuable task accomplishment for requesters in a win-win manner. Furthermore, our scheme reduces encryption cost for requesters by splitting encryption into preparation and online phases, as well as shifts most of the decryption overhead from the worker side to the service platform. Privacy analysis demonstrates requester and worker privacy preservation under chosen-keyword attack and chosen-plaintext attack. Performance evaluation shows cost-efficient computation overhead for requesters and workers.

Generic Approach to Outsource the Decryption of Attribute-Based Encryption in Cloud Computing

The notion of attribute-based encryption with outsourced decryption (OD-ABE) was proposed by Green, Hohenberger, and Waters. In OD-ABE, the ABE ciphertext is converted to a partially-decrypted ciphertext that has a shorter bit length and a faster decryption time than that of the ABE ciphertext. In particular, the transformation can be performed by a powerful third party with a public transformation key. In this paper, we propose a generic approach for constructing ABE with outsourced decryption from standard ABE, as long as the later satisfies some additional properties. Its security can be reduced to the underlying standard ABE in the selective security model by a black-box way. To avoid the drawback of selective security in practice, we further propose a modified decryption outsourcing mode so that our generic construction can be adapted to satisfying adaptive security. This partially solves the open problem of constructing an OD-ABE scheme, and its adaptive security can be reduced to the underlying ABE scheme in a black-box way. Then, we present some concrete constructions that not only encompass existing ABE outsourcing schemes of Green et al., but also result in new selectively/adaptively-secure OD-ABE schemes with more efficient transformation key generation algorithm. Finally, we use the PBC library to test the efficiency of our schemes and compare the results with some previous ones, which shows that our schemes are more efficient in terms of decryption outsourcing and transformation key generation.

An Efficient ABE Scheme With Verifiable Outsourced Encryption and Decryption

Attribute-based encryption (ABE) is a promising cryptographic tool for data owner (DO) to realize fine-grained date sharing in the cloud computing. In the encryption of most existing ABE schemes, a substantial number of modular exponentiations are often required; the computational cost of it is growing linearly with the complexity of the access policy. Besides, in the most existing ABE with outsourced decryption, the computation cost of generating transformation key is growing linearly with the number of attributes associated with user private key; these computations are prohibitively high for mobile device users, which becomes a bottleneck limiting its application. To address the above issues, we propose a secure outsourcing algorithm for modular exponentiation in one single untrusted server model and a new method to generate the transformation key. Based on these techniques and Brent Waters's ciphertext-policy ABE scheme, we propose an ABE scheme with verifiable outsourced both encryption and decryption, which can securely outsource encryption and decryption to untrusted encryption service provider (ESP) and decryption service provider (DSP), respectively, leaving only a constant number of simple operations for the DO and eligible users to perform locally. In addition, both DO and the eligible users can check the correctness of results returned from the ESP and the DSP with a probability, respectively. Finally, we provide the experimental evaluation and security analysis of our scheme, which indicates that our construction is suitable for the mobile environment.

Efficient Privacy-Preserving Access Control of Mobile Multimedia Data in Cloud Computing

With the nature of allowing the encryptor to define the access policy before encrypting a message, Ciphertext-policy attribute-based encryption (CP-ABE) has been widely adopted as a primitive to design cloud-assisted mobile multimedia data sharing system. However, in most previous works, the access policy sent along with ciphertext remains in the palintext form, which would expose the user's privacy to anyone who can get the ciphertext even if he is not authorized to decrypt. In addition, the resource-constrained mobile devices can not carry out frequent encryption and decryption task caused by CP-ABE. Such drawbacks may reduce the enthusiasm of consumers to share the multimedia data via their mobile devices. In this paper, we proposed PPCMM, a privacy-preserving cloud-assisted mobile multimedia data sharing scheme, where each attribute is described by an attribute name and an attribute value. The attribute values are embedded in the ciphertext and only the attribute names are revealed in the access policy. The encryption is divided to two phase: online and offline. In the offline stage, the data owner can prepare the intermediate ciphertext components. Once receiving the encryption requirement of a specific access policy and the multimedia data, the data owner can quickly form the final legal ciphertext in the online stage. By employing the decryption outsourcing technique, most computation overhead of matching test and decryption is offload to the cloud server. The security proof showed that PPCMM is adaptively secure in the standard model. The performance analysis indicated that PPCMM greatly reduces the computation cost in both online encryption and user decryption.

Secure and flexible keyword search over encrypted data with outsourced decryption in Internet of things

The development of Internet of things (IoT) makes data exchange more frequently, and the cloud computing can provide stable storage and efficient computation for data users. To ensure the security and functionality of data, the efficiency of decryption and keyword search should be taken into consideration in resource-constrained IoT scenarios. In order to solve the above problems, a flexible keyword search scheme in IoT is proposed over encrypted data with outsourced decryption. First, the attribute-based encryption technology is applied, by which only users whose attributes meet the access control structure can access the sharing data. Second, the reciprocal mapping of Lagrange polynomials technology is employed to implement keyword search in a large number of ciphertext data. Third, the decryption of ciphertext is outsourced to improve the efficiency of decryption on the client side. The security and performance analysis indicates that the proposed scheme is secure and efficient.

An efficient and revocable storage CP-ABE scheme in the cloud computing

As a special kind of public-key encryption, attribute-based encryption (ABE) is able to achieve fine-grained access control mechanism by offering one-to-many encryption. Due to such unique characteristic, this primitive is widely employed in the cloud computing environment to provide flexible and secure data sharing. However, how to revoke the access privilege of a user to access encrypted data stored in cloud servers is challenging. Furthermore, the complex operation of ABE may cause a huge computational cost and is usually considered to be a heavy burden for system users. Motivated by the practical needs, an ABE scheme called efficient and revocable storage CP-ABE scheme with outsourced decryption and constant-size ciphertexts and secret keys is proposed in this paper. Our scheme offers the following features: In addition, the scheme is provably secure against selectively chosen-ciphertext attack. At the end, we describe how to deploy the scheme in cloud computing environment.

Practical attribute-based encryption: Outsourcing decryption, attribute revocation and policy updating

Attribute-Based Encryption (ABE) offers fine-grained access control policy over encrypted data, and thus applicable in cloud storage to provide authorized data privacy. However, there are some issues that should be solved before deploying ABE in practice. Firstly, as the heavy decryption cost grows with the complexity of access policy, an ABE with outsourcing decryption is preferred to relieve user's computation cost. Secondly, when user's attributes are altered, it is required for ABE supporting attribute revocation to change user's access privilege timely and effectively. Thirdly, in the case of access control policy changed by data owner, policy updating requirement must be met in designing ABE. Therefore, a practical ABE scheme is proposed which can solve aforementioned issues simultaneously. In order to support flexible number of attributes, our scheme also achieves large universe and multiple attribute authorities. The security and performance of the proposed scheme are discussed, followed by extensive experiments to demonstrate its effectiveness and practicability.