Partial Decryption Research Articles

Study on Data Security Sharing Model Based on Attribute Encryption

In view of the problems of key management and access control in traditional encryption technology, this paper proposes a data security sharing model based on attribute encryption. Firstly, we studied the property encryption and data sharing model. Secondly, proposed an attribute encryption algorithm. The user’s private key is generated by the addition homomorphic encryption algorithm, which solves the key hosting problem. This paper proposed the data security sharing algorithm supporting partial decryption, which can reduce the calculation cost of user decryption. An efficient scheme of real-time attribute key cancellation is designed, which not only reduces the communication key, but also protects the forward and backward security of the data. Compared with the other two methods, the proposed method has lower computational and decryption costs.

Dual Authentication-Based Encryption with a Delegation System to Protect Medical Data in Cloud Computing

The increasing use of cloud computing, especially in commercial, government and healthcare institutions, started with the use of computerized clouds. Clouds store important data, which reduces the cost of management and ensures easy access. To protect this data, cryptographic methods are used to ensure confidentiality of the data, as well as to secure access to user data and increase trust in cloud technology. In our paper, we suggest a new scheme to support an attribute-based encryption system (ABE) that involves multiple parties such as data owners, data users, cloud servers and authority. A verified and authenticated decryption process for the cloud environment is the imperative feature of our proposed architecture. The data owner encrypts their data and sends it to the cloud. The cloud server performs partial decryption and the final decrypted data are shared for users as per their privileges. Thus, the data owner reduces complexity of productivity by delegating the decryption process to the cloud server. Analysis of the experimental results confirms that data access in the electronic cloud atmosphere is safer due to a controlled multiple-users-rights scheme. Our performance evaluation results show that the proposed model condensed the communication overhead and made Digital Imaging and Communications in Medicine (DICOM) more secure.

Fine-grained multi-authority access control in IoT-enabled mHealth

With the popularity of Internet of Things (IoT) and cloud computing technologies, mobile healthcare (mHealth) can offer remote, accurate, and effective medical services for patients according to their personal health records (PHRs). However, data security and efficient access of the PHR should be addressed. Attribute-based encryption (ABE) is regarded as a well-received cryptographic mechanism to simultaneously realize fine-grained access control and data confidentiality in mHealth. Nevertheless, existing works are either constructed in the single-authority setting which may be a performance bottleneck, or lack of efficient user decryption. In this paper, we propose SEMAAC, a secure and efficient multi-authority access control system for IoT-enabled mHealth. In SEMAAC, there are multiple independently worked attribute authorities (AAs). A new entity could be an AA without re-building the system. To reduce the user decryption overhead, most decryption is executed in cloud server, which whereafter returns a partial decryption ciphertext (PDC). The AAs can help the user to check if the PDC is correctly computed. Additionally, a restricted user can delegate his/her key to someone to outsource the decryption and check the returned result, without exposing the plaintext PHR file. The proposed SEMAAC is proved to be adaptively secure in the standard model. The numerical analysis and extensive experiments illustrate the efficiency and advantage of our scheme.

HOMOMORPHIC ENCRYPTION OF CLOUD DATA BY THE MATRIX POLYNOMIAL METHOD

The subject matter of the study is the encryption of information in cloud data computation and storage. Cloud technologies enable reducing the cost of IT infrastructure significantly and responding to changes in computing needs flexibly. In this case, the possibilities to perform calculations on the encrypted data without decrypting should be provided. Fully homomorphic encryption has this feature. The goal of this article is to increase the efficiency of fully homomorphic encryption (FHE) on the basis of matrix polynomials using the method of batch encryption to one ciphertext of several plaintexts with the subsequent complex processing of encrypted data. Batch encryption comes down to the fact that while conducting the operation on two ciphertexts, operations are simultaneously conducted coordinatewise on all the data contained in these ciphertexts in the form of plaintexts (SIMD). The task is the construction of algorithms of fully homomorphic data encryption using matrix polynomials. The following encryption methods are used in the article: the use of the Chinese remainder theorem; recording several different eigenvalues with different eigenvectors to the same matrix; the interpolation of matrix polynomials. The following results were obtained: possible approaches to constructing a batch EHE on the basis of matrix polynomials were described and analyzed, a set of algorithms that implement the FHE crypto scheme with interpolation of matrix polynomials was presented. The above algorithms and crypto schemes enable transmitting information in messages and data in queries as a plain text because an unlimited number of complex algebraic operations can be performed on the encrypted data, which makes it difficult to decrypt and read data without the knowledge of the entire algorithm. The constructed crypto schemes were shown as more efficient than analogues developed by IBM researchers. The following conclusion can be made: a batch fully homomorphic encryption using matrix polynomials can eliminate the need for at least partial decryption of data to carry out unauthorized computation on encrypted cloud data arrays.

Blowfish Hybridized Weighted Attribute-Based Encryption for Secure and Efficient Data Collaboration in Cloud Computing

Cloud computing plays a major role in sharing data and resources to other devices through data outsourcing. During sharing resources, it is a challenging task to provide access control and secure write operations. The main issue is to provide secure read and write operations collaboratively and to reduce computational overload by effective key management. In this paper, a secure and an efficient data collaboration scheme blowfish hybridized weighted attribute-based Encryption (BH-WABE ) for secure data writing and proficient access control has been proposed. Here, weight is assigned to each attribute based on its importance and data are encrypted using access control policies. The cloud service provider stores the outsourced data and an attribute authority revokes or updates the attributes by assigning different attributes based on the weight. The receiver can access the data file corresponding to its weight in order to reduce the computational overload. The proposed BH-WABE provides collusion resistance, multiauthority security and fine-grained access control in terms of security, reliability, and efficiency. The performance is compared with the conventional hybrid attribute-based encryption (HABE) scheme in terms of data confidentiality, flexible access control, data collaboration, full delegation, partial decryption, verification, and partial signing.

Multiple color image encryption and authentication based on phase retrieval and partial decryption in quaternion gyrator domain

In this paper, a multiple color image encryption and authentication scheme by using phase retrieval in quaternion gyrator domain and partial decryption is introduced. The quaternion representation is firstly employed to combine three color channels into a single-channel architecture. Then each color image is respectively encoded into a phase-only function according to quaternion gyrator transform based double phase encoding through phase retrieval technique. Subsequently, all phase-only functions are modulated to obtain the final ciphertext. To remain the content of secret images under cover, only a small part of the encrypted data that is selected by multiplying the random binary amplitude mask is preserved for decryption, where nonlinear quaternion correlation is developed to further perform authentication. Since the proposed encryption algorithm is asymmetric, such interest can significantly enhance security of the cryptosystem. The numerical simulations have demonstrated the feasibility and validity of the proposed scheme as well as its better performance compared with other schemes.

Multi-Authority Attribute Based Data Access Control in Fog Computing

The fog computing carries the cloud properties to the edge of the network. The cloud provides a substantial storage and communication to resource constrained edge or Internet of Things(IoT) devices. Without fog computing, these devices would have to store data on data centers and communicate with the cloud using the internet. The fog due to its inherited properties from cloud also inherits its security concerns. One of the primary security concern is data sharing and data storageas the illegitimate users could breach security while data is being shared or get access to stored data. Also, saved data on an untrusted cloud server is also a matter of concern. So, there is a requirement of an access control and data encryption scheme. Various Attribute-based Encryption (ABE) schemes have been proved to be beneficial. But due to the massive amount of data being shared and different types of users, the single authority approach is not favorable. The efficiency of the solution could be improved using offline-online encryption along with partial decryption method. As the data has to pass through untrusted cloud server so it is crucial to maintain verifiability. In this paper, we propose a scheme that uses Decentralized Attribute-based Encryption with offline-online encryption and partial decryption using a proxy server in fog communication. The scheme would help to secure fog communication with untrusted devices on the network. To prove its efficiency and effectiveness in fog environment, we implement the scheme on fog environment and also compare our scheme with a centralized scheme.

KSF-OABE: Outsourced Attribute-Based Encryption with Keyword Search Function for Cloud Storage

Cloud computing becomes increasingly popular for data owners to outsource their data to public cloud servers while allowing intended data users to retrieve these data stored in cloud. This kind of computing model brings challenges to the security and privacy of data stored in cloud. Attribute-based encryption (ABE) technology has been used to design fine-grained access control system, which provides one good method to solve the security issues in cloud setting. However, the computation cost and ciphertext size in most ABE schemes grow with the complexity of the access policy. Outsourced ABE (OABE) with fine-grained access control system can largely reduce the computation cost for users who want to access encrypted data stored in cloud by outsourcing the heavy computation to cloud service provider (CSP). However, as the amount of encrypted files stored in cloud is becoming very huge, which will hinder efficient query processing. To deal with above problem, we present a new cryptographic primitive called attribute-based encryption scheme with outsourcing key-issuing and outsourcing decryption, which can implement keyword search function (KSF-OABE). The proposed KSF-OABE scheme is proved secure against chosen-plaintext attack (CPA). CSP performs partial decryption task delegated by data user without knowing anything about the plaintext. Moreover, the CSP can perform encrypted keyword search without knowing anything about the keywords embedded in trapdoor.

A lattice-based changeable threshold multi-secret sharing scheme and its application to threshold cryptography

In this paper, we propose a threshold increasing algorithm for a (t; n) latticebased Threshold Multi-Stage Secret Sharing (TMSSS) scheme. To realize the changeability feature, we use the zero addition protocol to construct a new (t0; n) TMSSS scheme. Therefore, the new scheme enjoys the signi cant feature of threshold changeability along with the inherited features of being multi-stage, multi-use, and veri able derived fromour previously proposed lattice-based TMSSS scheme. Furthermore, we use the improved TMSSS scheme to propose a threshold decryption algorithm for the Learning With Error (LWE) based public key encryption scheme based on the study of Lindner and Peikert. For threshold decryption, each authorized subset of participants decrypts the ciphertext partially and sends the result to the combiner. The combiner can decrypt the ciphertext using the partial decryptions. The security of both schemes is based on hardness of lattice problems, i.e. LWE and Inhomogeneous Small Integer Solution (ISIS) problems, which are believed to resist against the quantum algorithms. The proposed schemes are eficient, especially on the participants' side, making them suitable for the applications in which the participants have limited processing capacities.

Efficient certificate‐based encryption schemes without pairing

AbstractRecently, a lot of researches focused on identity‐based encryption (IBE). The advantage of this scheme is that it can reduce the cost of the public key infrastructure by simplifying certificate management. Although IBE has its own innovations, one of its weaknesses is the key escrow problem. That is, the private key generator in IBE knows decryption keys for all identities and consequently can decrypt any ciphertexts. The certificate‐based encryption (CBE) scheme proposed in EUROCRYPT 2003 provides a solution for the key escrow problem by allowing the certification authority to possess a partial decryption key that comprises the full decryption key together with the user‐generated private key. In this paper, we propose new CBE schemes without pairing and prove them to be Indistinguishability under Chosen Ciphertext Attack secure in the random oracle model based on the hardness of the computational Diffie–Hellman problem. When compared with other CBE schemes, our schemes are significantly efficient in terms of performance, which makes our schemes suitable for computation‐limited node (e.g., sensor, wearable device) networks. Copyright © 2016 John Wiley & Sons, Ltd.

Secure and efficient data collaboration with hierarchical attribute-based encryption in cloud computing

With the increasing trend of outsourcing data to the cloud for efficient data storage, secure data collaboration service including data read and write in cloud computing is urgently required. However, it introduces many new challenges toward data security. The key issue is how to afford secure write operation on ciphertext collaboratively, and the other issues include difficulty in key management and heavy computation overhead on user since cooperative users may read and write data using any device. In this paper, we propose a secure and efficient data collaboration scheme, in which fine-grained access control of ciphertext and secure data writing operation can be afforded based on attribute-based encryption (ABE) and attribute-based signature (ABS) respectively. In order to relieve the attribute authority from heavy key management burden, our scheme employs a full delegation mechanism based on hierarchical attribute-based encryption (HABE). Further, we also propose a partial decryption and signing construction by delegating most of the computation overhead on user to cloud service provider. The security and performance analysis show that our scheme is secure and efficient.

부분 암호화를 위한 해쉬 트리 체인 기반 키 생성 및 관리 알고리즘

본 논문에서는 부분 암호화를 위한 키 생성 및 관리 알고리즘의 연구한다. 제안하는 알고리즘에서는 해쉬 트리 구조를 이용하여 적은 양의 해쉬키로부터 다양한 암호화 키를 생성하는 기능을 제공하고 있다. 본 논문에서는 새로운 키 생성 알고리즘을 이용하여 부분 암호화 및 부분 복호화하는 방법을 제시하고 시뮬레이션을 통하여 그 성능을 분석한다. A new key generation scheme is proposed to support partial encryption and partial decryption of data in cloud computing environment with a minimal key-related traffic overhead. Our proposed scheme employs a concept of hash tree chain to reduce the number of keys that need to be delivered to the decryption node. The performance of the proposed scheme is evaluated through simulation.

Constructing and verifying a robust Mix Net using CSP

A Mix Net is a cryptographic protocol that unlinks the correspondence between its inputs and its outputs. In this paper, we formally analyse a Mix Net using the process algebra CSP and its associated model checker FDR. The protocol that we verify removes the reliance on a Web Bulletin Board: rather than communicating via a Web Bulletin Board, the protocol allows the mix servers to communicate directly, exchanging signed messages and maintaining their own records of the messages they have received. Mix Net analyses in the literature are invariably focused on safety properties; important liveness properties, such as deadlock freedom, are wholly neglected. This is an unhappy omission, however, since a Mix Net that produces no results is of little use. In contrast, we verify here that the Mix Net is guaranteed to terminate, with each honest mix server outputting the decrypted vector of plaintexts alongside a chain proving that each re-encryption/permutation and partial decryption operation was performed correctly, under the assumption that there is an honest majority of them acting according to the protocol.

Secure personal data sharing in cloud computing using attribute-based broadcast encryption

The ciphertext-policy (CP) attribute-based encryption (ABE) (CP-ABE) emergings as a promising technology for allowing users to conveniently access data in cloud computing. Unfortunately, it suffers from several drawbacks such as decryption overhead, user revocation and privacy preserving. The authors proposed a new efficient and privacy-preserving attribute-based broadcast encryption (BE) (ABBE) named EP-ABBE, that can reduce the decryption computation overhead by partial decryption, and protect user privacy by obfuscating access policy of ciphertext and user's attributes. Based on EP-ABBE, a secure and flexible personal data sharing scheme in cloud computing was presented, in which the data owner can enjoy the flexibly of encrypting personal data using a specified access policy together with an implicit user index set. With the proposed scheme, efficient user revocation is achieved by dropping revoked user's index from the user index set, which is with very low computation cost. Moreover, the privacy of user can well be protected in the scheme. The security and performance analysis show that the scheme is secure, efficient and privacy-preserving.

An Efficient Certificateless Encryption for Secure Data Sharing in Public Clouds

We propose a mediated certificateless encryption scheme without pairing operations for securely sharing sensitive information in public clouds. Mediated certificateless public key encryption (mCL-PKE) solves the key escrow problem in identity based encryption and certificate revocation problem in public key cryptography. However, existing mCL-PKE schemes are either inefficient because of the use of expensive pairing operations or vulnerable against partial decryption attacks. In order to address the performance and security issues, in this paper, we first propose a mCL-PKE scheme without using pairing operations. We apply our mCL-PKE scheme to construct a practical solution to the problem of sharing sensitive information in public clouds. The cloud is employed as a secure storage as well as a key generation center. In our system, the data owner encrypts the sensitive data using the cloud generated users' public keys based on its access control policies and uploads the encrypted data to the cloud. Upon successful authorization, the cloud partially decrypts the encrypted data for the users. The users subsequently fully decrypt the partially decrypted data using their private keys. The confidentiality of the content and the keys is preserved with respect to the cloud, because the cloud cannot fully decrypt the information. We also propose an extension to the above approach to improve the efficiency of encryption at the data owner. We implement our mCL-PKE scheme and the overall cloud based system, and evaluate its security and performance. Our results show that our schemes are efficient and practical.

Improving security and efciency for encrypted data sharing in online social networks

Despite that existing data sharing systems in online social networks (OSNs) propose to encrypt data before sharing, the multiparty access control of encrypted data has become a challenging issue. In this paper, we propose a secure data sharing scheme in OSNs based on ciphertext-policy attribute-based proxy re-encryption and secret sharing. In order to protect users' sensitive data, our scheme allows users to customize access policies of their data and then outsource encrypted data to the OSNs service provider. Our scheme presents a multiparty access control model, which enables the disseminator to update the access policy of ciphertext if their attributes satisfy the existing access policy. Further, we present a partial decryption construction in which the computation overhead of user is largely reduced by delegating most of the decryption operations to the OSNs service provider. We also provide checkability on the results returned from the OSNs service provider to guarantee the correctness of partial decrypted ciphertext. Moreover, our scheme presents an efficient attribute revocation method that achieves both forward and backward secrecy. The security and performance analysis results indicate that the proposed scheme is secure and effcient in OSNs.

Spam Control Mechanism using Identity based Message Admission

Spammers have a tremendous financial incentive to compromise user Email accounts. Email spoofing is a way to exploit user trust. In the traditional DKIM signature approach no Certificate Authority is use wherein the keys and certificates are stored in the DNS Repositories itself. Survey tells that most of the DNS and Mail servers are exploited to DNS cache poisoning attack. If an attacker/ spammer will able to create a malware to obtain this stored information then using the principles of Wiener attack on RSA he can get the key exponents. Using them for a given user ID a spammer would be able to generate message with signed spoofs of other signer's userID. He can act as an eavesdropper in place of normal sender and send spam Mails to other recipients making the genuine sender look like a spammer. Therefore this paper addresses the issues by allowing sender to indicate that their emails are signed and encrypted using ID based mediated RSAA technique based on user identity. This system use Certificate Authority and a key Mediator. Using the concept of PKCS#1 the public key generated from the hash value of the private key for encryption. During decryption the private key is split between key mediator and a user for partial decryption and full decryption of message respectively If original message is recovered and verified the sender message is accepted else rejected or blocked as spam message. Using this system attacker can never read the original message sent nor modify during transit. 

Joint fingerprinting and decryption content security protection method for remote sensing images based on neighborhood similarity

The joint fingerprinting and decryption (JFD) framework has high efficiency and can provide comprehensive, effective content security protection for remote sensing images. However, the fingerprint is generated by random partial decryption in JFD, which will lead to obvious degradation of image quality after embedding fingerprints and will severely impact the precision and further application of remote sensing images. In order to solve this problem, an improved JFD scheme based on neighborhood similarity is proposed in this paper, where the image is partitioned into different regions, and the regions that affect future application most are excluded from the fingerprint embedding area. Moreover, neighborhood similarity is defined in order to evaluate the change of pixel correlation, and areas with good neighborhood similarity after encryption are chosen to embed fingerprints. The experimental results prove that the fingerprinted image has a good image quality, and it will not affect the following application such as edge extraction and unsupervised classification, etc. Therefore, it is a suitable content security protection method for remote sensing image.

Content security protection for remote sensing images integrating selective content encryption and digital fingerprint

Content security protection methods should be adopted to guarantee the security of highly sensitive remote sensing images during their transmission and usage. The joint fingerprinting and decryption (JFD) framework, which integrates encryption and fingerprinting, can provide comprehensive, effective content security protection for remote sensing information. However, several challenges need to be overcome. In order to solve the contradictory relationship between encryption security and fingerprinted image quality in JFD, a selective content encryption strategy is proposed to enhance encryption security and a new method for choosing fingerprint embedding area is proposed to reduce partial decryption's influence on image quality. Furthermore, a new method for generating and controlling fingerprints is introduced to JFD to eliminate its vulnerability to collusion attacks. The experiment results show that the proposed techniques are highly effective. Because of its high security, good fingerprinted image quality and high data processing and transmission speed, the new JFD scheme is an effective content security protection approach for remote sensing images, especially suitable for massive remote sensing images.

Partial decryption attacks in security-mediated certificateless encryption

Certificateless encryption refers to public key encryption with implicit certification. Security-mediated certificateless (SMC) encryption takes one-step further, such that every decryption requires a security-mediator (SEM) to partially decrypt the ciphertext. One major benefit is that instant revocation can be done by simply instructing the SEM to reject any further decryption request. Similar to the conventional chosen-ciphertext attack, it is reasonable to assume that an adversary can obtain the partial decryption of many ciphertexts. The authors show that the schemes proposed by Yang-Wang-Wang in AINAW 2007, Lo-Hwang-Li in IET Information Security, 1(3) and Yang-Xiong-Su in Computer Applications, 28(11) are insecure against partial decryption attacks, and hence cannot be classified as SMC encryption according to the original Chow-Boyd-Gonza-lez Nieto-s formulation in PKC 2006.