Product Functional Encryption Research Articles

Computational Differential Privacy for Encrypted Databases Supporting Linear Queries

Differential privacy is a fundamental concept for protecting individual privacy in databases while enabling data analysis. Conceptually, it is assumed that the adversary has no direct access to the database, and therefore, encryption is not necessary. However, with the emergence of cloud computing and the << on-cloud >> storage of vast databases potentially contributed by multiple parties, it is becoming increasingly necessary to consider the possibility of the adversary having (at least partial) access to sensitive databases. A consequence is that, to protect the on-line database, it is now necessary to employ encryption. At PoPETs'19, it was the first time that the notion of differential privacy was considered for encrypted databases, but only for a limited type of query, namely histograms. Subsequently, a new type of query, summation, was considered at CODASPY'22. These works achieve statistical differential privacy, by still assuming that the adversary has no access to the encrypted database. In this paper, we take an essential step further by assuming that the adversary can eventually access the encrypted data, making it impossible to achieve statistical differential privacy because the security of encryption (beyond the one-time pad) relies on computational assumptions. Therefore, the appropriate privacy notion for encrypted databases that we target is computational differential privacy, which was introduced by Beimel et al. at CRYPTO '08. In our work, we focus on the case of functional encryption, which is an extensively studied primitive permitting some authorized computation over encrypted data. Technically, we show that any randomized functional encryption scheme that satisfies simulation-based security and differential privacy of the output can achieve computational differential privacy for multiple queries to one database. Our work also extends the summation query to a much broader range of queries, specifically linear queries, by utilizing inner-product functional encryption. Hence, we provide an instantiation for inner-product functionalities by proving its simulation soundness and present a concrete randomized inner-product functional encryption with computational differential privacy against multiple queries. In terms of efficiency, our protocol is almost as practical as the underlying inner product functional encryption scheme. As evidence, we provide a full benchmark, based on our concrete implementation for databases with up to 1 000 000 entries. Our work can be considered as a step towards achieving privacy-preserving encrypted databases for a wide range of query types and considering the involvement of multiple database owners.

Unbounded non-zero inner product encryption

In a non-zero inner product encryption (NIPE) scheme, ciphertexts and keys are associated with vectors from an inner-product space. Decryption of a ciphertext for x→ is allowed by a key for y→ if and only if the inner product 〈x→,y→〉≠0. Existing constructions of NIPE assume the length of the vectors are fixed apriori. We present the first constructions of unbounded non-zero inner product encryption (UNIPE) with constant sized keys. Unbounded here refers to the size of vectors not being pre-fixed during setup. Both constructions, based on bilinear maps, are proven selectively secure under the decisional bilinear Diffie-Hellman (DBDH) assumption.Our constructions are obtained by transforming the unbounded inner product functional encryption (IPFE) schemes of Dufour-Sans and Pointcheval (ACNS 2019), one in the strict domain setting and the other in the permissive domain setting. Interestingly, in the latter case, we prove security from DBDH, a static assumption while the original IPFE scheme relied on an interactive parameterised assumption. In terms of efficiency, features of the IPFE constructions are retained after transformation to NIPE. Notably, the public key and decryption keys have constant size.

Reinforcing privacy in cloud computing via adaptively secure non-zero inner product encryption and anonymous identity-based revocation in unbounded setting

Cloud computing serves as an advanced computing technology to support Internet services and has numerous applications, including medical fields, online data storage, social network, big data analysis, and e-learning platforms. Inner product encryption (IPE) is a promising cryptographic primitive that facilitates access control over outsourced encrypted data by restricting decryption capability via an inner product relation. Most of the existing IPEs are built assuming a priori bound on the length of attribute vectors associated with the plane data. A situation may occur when adding new attributes is essential due to upgradation. Thus it is desirable to construct IPE with variable length attribute vectors instead of fixing the length at the setup phase. Such IPEs are more flexible while encrypting data and consequently have more real-life applications. In the following, we make our contributions:–We design the first efficient adaptively payload-hiding secure unbounded non-zero IPE (UNIPE) scheme from the standard symmetric external Diffie-Hellman (SXDH) assumption and prove security in the standard model.–We propose a generic construction of an adaptively weak attribute-hidingUNIPE from an unbounded inner product functional encryption (UIPFE) scheme. We also instantiate UNIPE from the SXDH assumption and prove security in the standard model.–Finally, we present the first unbounded anonymous identity-based revocation (UAnon-IBRV) scheme using our generic UNIPE as the building block. The anonymity feature ensures that the ciphertext reveals no information about the revoking sets of the system.

CP-IPFE: Ciphertext-Policy Based Inner Product Functional Encryption

CP-IPFE: Ciphertext-Policy Based Inner Product Functional Encryption

Unbounded Predicate Inner Product Functional Encryption from Pairings

Predicate inner product functional encryption (P-IPFE) is essentially attribute-based IPFE (AB-IPFE) which additionally hides attributes associated to ciphertexts. In a P-IPFE, a message {textbf {x}} is encrypted under an attribute {textbf {w}} and a secret key is generated for a pair ({textbf {y}}, {textbf {v}}) such that recovery of langle {{textbf {x}}}, {{textbf {y}}}rangle requires the vectors {textbf {w}}, {textbf {v}} to satisfy a linear relation. We call a P-IPFE unbounded if it can encrypt unbounded length attributes and message vectors. bullet zero predicate IPFE. We construct the first unbounded zero predicate IPFE (UZP-IPFE) which recovers langle {{textbf {x}}}, {{textbf {y}}}rangle if langle {{textbf {w}}}, {{textbf {v}}}rangle =0. This construction is inspired by the unbounded IPFE of Tomida and Takashima (ASIACRYPT 2018) and the unbounded zero inner product encryption of Okamoto and Takashima (ASIACRYPT 2012). The UZP-IPFE stands secure against general attackers capable of decrypting the challenge ciphertext. Concretely, it provides full attribute-hiding security in the indistinguishability-based semi-adaptive model under the standard symmetric external Diffie–Hellman assumption. bullet non-zero predicate IPFE. We present the first unbounded non-zero predicate IPFE (UNP-IPFE) that successfully recovers langle {{textbf {x}}}, {{textbf {y}}}rangle if langle {{textbf {w}}}, {{textbf {v}}}rangle ne 0. We generically transform an unbounded quadratic FE (UQFE) scheme to weak attribute-hiding UNP-IPFE in both public and secret key setting. Interestingly, our secret key simulation secure UNP-IPFE has succinct secret keys and is constructed from a novel succinct UQFE that we build in the random oracle model. We leave the problem of constructing a succinct public key UNP-IPFE or UQFE in the standard model as an important open problem.

Multi random projection inner product encryption, applications to proximity searchable encryption for the iris biometric

Biometric databases collect people's information and perform proximity search (finding records within bounded distance of the query) with few cryptographic protections. This work studies proximity searchable encryption applied to the iris biometric.Prior work proposed to build proximity search from inner product functional encryption (Kim et al., SCN 2018). This work identifies and closes two gaps in this approach:1.Biometrics use long vectors, often with thousands of bits. Many inner product encryption schemes have to invert a matrix whose dimension scales with this size. Setup is then not feasible on commodity hardware. We introduce a technique that improves setup efficiency without harming accuracy.2.Prior approaches leak distance between queries and all stored records. We propose a construction from function hiding, predicate, inner product encryption (Shen et al., TCC 2009) that avoids this leakage.Finally, we show that our scheme can be instantiated using symmetric pairing groups, which improves search efficiency.

Efficient Lp Distance Computation Using Function-Hiding Inner Product Encryption for Privacy-Preserving Anomaly Detection.

In Internet of Things (IoT) systems in which a large number of IoT devices are connected to each other and to third-party servers, it is crucial to verify whether each device operates appropriately. Although anomaly detection can help with this verification, individual devices cannot afford this process because of resource constraints. Therefore, it is reasonable to outsource anomaly detection to servers; however, sharing device state information with outside servers may raise privacy concerns. In this paper, we propose a method to compute the Lp distance privately for even p>2 using inner product functional encryption and we use this method to compute an advanced metric, namely p-powered error, for anomaly detection in a privacy-preserving manner. We demonstrate implementations on both a desktop computer and Raspberry Pi device to confirm the feasibility of our method. The experimental results demonstrate that the proposed method is sufficiently efficient for use in real-world IoT devices. Finally, we suggest two possible applications of the proposed computation method for Lp distance for privacy-preserving anomaly detection, namely smart building management and remote device diagnosis.

Practical reusable garbled circuits with parallel updates

The central contribution of the current paper is to establish a practical and effective reusable garbled circuit scheme with parallel updates, where each update is applied to the circuit in parallel. First of all, we present a strengthened notion of inner product functional encryption (IPE) called simulation-based security (SIM-security) for multi-instance and show that a secret-key IPE scheme is multi-instance SIM-secure. Then we put forward a reusable garbled circuit scheme based on the IPE scheme. The idea is a reduction from re-randomizable garbled circuits in which the distribution of the original garbled circuit is computationally indistinguishable from the re-randomized garbled circuit. Finally, we implemented reusable garbled circuits and validate the practicality of our reusable garbled circuit scheme. Experimental results demonstrate that our reusable garbled circuit scheme is suitable for a wide range of real-world scenarios.

PPTA: Privacy-Preserving Task Assignment Based on Inner Product Functional Encryption in SAM

The explosions of mobile communications and the Internet of Things (IoT) have spawned a new distributed computing paradigm—spatial crowdsourcing, in which workers actively participate in spatiotemporal computing tasks for earning commissions, facilitating the development of urban sharing economic services. Furthermore, to reduce users’ storage space and computational overhead, the server assignment model (SAM) is widely used, which means that crowdsourcing platforms collect sensitive information about tasks and workers, e.g., locations and interests, to perform task assignments accurately. However, in the real world, crowdsourcing platforms are not fully trustworthy and may reveal sensitive information about workers and tasks, which can reduce users’ motivation to use crowdsourcing services. Therefore, how to assign tasks efficiently and securely is still an urgent problem to be solved. In this article, we propose a privacy-preserving task assignment scheme (PPTA), in which the crowdsourcing platform efficiently implements the nearest task assignments without revealing sensitive information about tasks and workers. In PPTA, we utilize inner product functional encryption to achieve circular range queries and multikeyword queries. Considering that workers usually prefer to query the nearest tasks for reducing travel costs, we use the grid location intersection to enable the nearest task assignment. In particular, we design a SAM algorithm, which can improve task assignment rates in multitask and multiworker scenarios. In addition, our scheme can implement user accountability and user revocation, which enhances the security and practicality of the scheme. Finally, we demonstrate the privacy preservation through security theoretical proofs and show the efficiency by constructing extensive comparative experiments, which respectively illustrate the security and the effectiveness of our scheme.

RPTD: Reliability-enhanced Privacy-preserving Truth Discovery for Mobile Crowdsensing

Mobile CrowdSensing (MCS) provides effective data collection through smart devices carried by users. However, the data sensed from various devices is privacy-sensitive and not always trustworthy so that the cloud server needs to extract truthful values while protecting the privacy of user personal data. Although some privacy-preserving truth discovery mechanisms have been proposed to address these issues, they ignore the fact that the reliability of truth discovery algorithms may be considerably degraded by outliers in sensing data, and still cannot guarantee strong privacy. In this article, we propose a Reliability-enhanced Privacy-preserving Truth Discovery scheme (RPTD) for MCS to overcome these shortcomings. First, we design a multi-client inner product functional encryption to fully protect the privacy of sensing data, user weights and inferred truths, while supporting dynamic users. Then a new filtering method is constructed to accurately identify outliers in encrypted sensing data submitted by users, which eliminates the disturbance of outliers on the reliability of truth discovery. Theoretical analysis shows that RPTD ensures practical efficiency in computing and communication overhead while ensuring strong privacy and outliers filtering. Experimental results validate feasibility and effectiveness of the proposed RPTD scheme.

A tighter proof for CCA secure inner product functional encryption: Genericity meets efficiency

Inner product functional encryption (IPFE) is a primitive which produces, from a master secret key, decryption keys skk associated to vectors k over some specified base ring. Decrypting an encryption of vector m with skk only reveals 〈k,m〉. Benhamouda et al. [7] provided a generic construction for CCA-secure IPFE from projective hash functions (PHFs), unfortunately their security reduction suffers an exponential loss. Their only instantiation capable of decrypting inner products of large sizes, which relies on the decisional composite residuosity (DCR) assumption, is impractical due to the large size of ciphertexts, decryption keys, and the prohibitive speed of the scheme. Our core contribution is a new approach to proving CCA security. Our constructions maintain the genericity of [7], while our security proof relaxes the requirements on the underlying PHFs and gains in reduction tightness. We instantiate these constructions from the DCR assumption, an assumption in class groups (HSMCL) and the decision Diffie Hellman (DDH) assumption. Our CCA-secure constructions from DCR and HSMCL are the first such schemes to efficiently decrypt inner products of large size, improving by multiple orders of magnitude upon the work of [7]. A single-core C implementation of these schemes shows that, for a 112 bit security, and 100-dimensional vectors, their DCR-based scheme takes 1 h 20 min to encrypt, and over 5 min to decrypt, whereas our slowest scheme takes 5.2 s to encrypt and 0.5 s to decrypt. Similarly a ciphertext for their scheme is of 283 MB; those of our HSMCL-based scheme are of 30 kB.

Tightly CCA-secure inner product functional encryption scheme

Inner product functional encryption (IPFE) is a modern public key paradigm where the master key can derive a secret key sky for a vector y, which can then be used to decrypt a ciphertext of x to get the inner product 〈x,y〉 as output. In ASIACRYPT 2019, Tomida proposed the first tightly secure IPFE scheme in the multi-user and multi-challenge setting based on the matrix decisional Diffie-Hellman (MDDH) assumption. However, the construction achieves CPA security only. Up to now, there is no IPFE scheme with tight CCA security available.In this paper, we construct the first tightly CCA-secure IPFE scheme in the multi-user and multi-challenge setting. The security reduction to the MDDH assumption (including SXDH, k-LIN, etc.) loses only a factor O(log⁡λ) with λ the security parameter. Moreover, our scheme enjoys full compactness. To support inner product function of dimension m, our SXDH-based IPFE has (m2+8m+14) and (3m+14) group elements in the master public key and ciphertext respectively. This is comparable to the tightly CPA-secure IPFE proposed by Tomida based on the DDH assumption, whose master public key and ciphertext contain (m2+2) and 3m group elements, respectively.Furthermore, we construct the first IPFE with both tight CCA-security and function-hiding property, based on our CCA-secure IPFE. The tight function-hiding CCA security is obtained by adapting the techniques in Lin (CRYPTO 2017) and Gay (PKC 2020) to the multi-user and multi-challenge setting.

Post-Quantum Secure Inner Product Functional Encryption Using Multivariate Public Key Cryptography

Post-Quantum Secure Inner Product Functional Encryption Using Multivariate Public Key Cryptography

Hierarchical identity-based inner product functional encryption

Inner product functional encryption (IPFE), as a novel cryptographic primitive, can be classified into public-key IPFE (PK-IPFE) and secret-key IPFE (SK-IPFE). PK-IPFE has the following functions: an encryptor generates the ciphertext by encrypting a vector x→, and a decryptor decrypts the ciphertext and obtains the inner product 〈x→,y→〉 if it holds the secret key related to vector y→. The general IPFE cannot describe the hierarchical structure. The superior cannot use the general IPFE to issue the delegating keys for the subordinates, which complicates key management. We first propose a new primitive, hierarchical identity-based PK-IPFE (HID-PK-IPFE). HID-PK-IPFE has the following features. First, the identity of the decryptor can be specified when encrypting. Second, the identity of the recipient has a hierarchical structure. In the hierarchical tree, the upper-level users can generate the private key of the lower-level users; that is, our scheme has a delegation function. We formalize the selective chosen plaintext attack model of HID-PK-IPFE, propose the scheme in the standard model, and prove the security of the scheme on the basis of d-DBDHE assumption. We conducted two sets of simulations. We set the maximum depth of the identity hierarchy to 10, and increased the vector length from 10 to 15. We then listed the time spent by each algorithm in these two ranges. The simulation results show that the running time of each algorithm of our HID-PK-IPFE is completely acceptable in actual application scenarios.

Verifiable inner product computation on outsourced database for authenticated multi-user data sharing

With the rapid development of cloud computing, the practical applications such as the machine learning based on the outsourced data have been investigated in the data sharing setting. In machine learning, the inner product is a necessary primitive to analyze the description statistics. However, the inner product computation in selective data sharing setting has not been fully considered. For this fact, we propose a verifiable inner product computation scheme based on Inner Product Functional Encryption (IPFE). IPFE is employed to preserve the outsourced data privacy and restrict the computation on the outsourced data to be inner product. To achieve the key privacy and result privacy, we transform the secret key into blinded form, which in turn results in a blinded result. With the aim of implementing access control over the data user and outsourced data, we design to let cloud server perform the authentication procedures before computing inner product. This can also eliminate most computational overhead resulting from the unauthorized data user and undesired data. As a result, only the authorized data user can obtain the inner product computed on the designated outsourced data. The proposed scheme is proved to be secure under the authentication model and the result unforgeability model. The performance evaluation shows that the proposed scheme is feasible. To achieve a better security level, the proposed scheme is extended to be secure against the corrupted cloud server.

Tightly secure inner product functional encryption: Multi-input and function-hiding constructions

Tightly secure cryptographic schemes have been extensively studied in the fields of chosen-ciphertext secure public-key encryption (CCA-secure PKE), identity-based encryption (IBE), signatures and more. We extend tightly secure cryptography to inner product functional encryption (IPFE) and present the first tightly secure schemes related to IPFE. We first construct a new IPFE schemes that are tightly secure in the multi-user and multi-challenge setting. In other words, the security of our schemes do not degrade even if an adversary obtains many ciphertexts generated by many users. Our schemes are constructible on a pairing-free group and secure under the matrix decisional Diffie-Hellman (MDDH) assumption, which is the generalization of the decisional Diffie-Hellman (DDH) assumption. Applying the known conversions by Lin (CRYPTO 2017) and Abdalla et al. (CRYPTO 2018) to our schemes, we can obtain the first tightly secure function-hiding IPFE schemes and multi-input IPFE (MIPFE) schemes respectively. Our second main contribution is the proposal of a new generic conversion from function-hiding IPFE to function-hiding MIPFE, which was left as an open problem by Abdalla et al. (CRYPTO 2018). We can obtain the first tightly secure function-hiding MIPFE schemes by applying our conversion to the tightly secure function-hiding IPFE schemes described above.

Unbounded inner product functional encryption from bilinear maps

Inner product functional encryption (IPFE) is one class of functional encryption supporting only inner product functionality. All previous IPFE schemes are bounded schemes, meaning that the vector length that can be handled in the scheme is fixed in the setup phase. In this paper, we propose the first unbounded IPFE schemes, in which we do not have to fix the lengths of vectors in the setup phase and can handle (a priori) unbounded polynomial lengths of vectors. Our first scheme is private-key based and fully function hiding. That is, secret keys hide the information of the associated function. Our second scheme is public-key based and provides adaptive security in the indistinguishability based security definition. Both our schemes are based on SXDH, which is a well-studied standard assumption, and secure in the standard model. Furthermore, our schemes are quite efficient, incurring an efficiency loss by only a small constant factor from previous bounded function hiding schemes.

Privacy-Preserving Outsourced Inner Product Computation on Encrypted Database

We consider an outsourced computation model in the selective data sharing setting. Specifically, one of the data owners outsources the encrypted data to an untrusted cloud server, and wants to share the specific function of these data with a group of data users. A data user can perform the specific computation on the data that it is authorized to access. We propose a construction under this model for the inner product computation by using the Inner Product Functional Encryption (IPFE) as a building block. A standard IPFE used on this model has two privacy weaknesses regarding the master secret key and the encrypted vector. We propose a strengthened IPFE that revises these weaknesses. We construct a new IPFE scheme and use it to construct an efficient outsourced inner product computation scheme. In our outsourced computation scheme, the storage overhead and the computation cost for a data user are independent of the vector size. The result privacy and the outsourced data privacy are well preserved against the untrusted cloud server. The experimental results show that our schemes are efficient and practical.

Efficient Inner Product Functional Encryption with Full-Hiding Security

Efficient Inner Product Functional Encryption with Full-Hiding Security

Improved Construction for Inner Product Functional Encryption

Functional encryption (FE) is a vast new paradigm for encryption scheme which allows tremendous flexibility in accessing encrypted data. In a FE scheme, a user can learn specific function of encrypted messages by restricted functional key and reveals nothing else about the messages. Besides the standard notion of data privacy in FE, it should protect the privacy of the function itself which is also crucial for practical applications. In this paper, we construct a secret key FE scheme for the inner product functionality using asymmetric bilinear pairing groups of prime order. Compared with the existing similar schemes, our construction reduces both necessary storage and computational complexity by a factor of 2 or more. It achieves simulation-based security, security strength which is higher than that of indistinguishability-based security, against adversaries who get hold of an unbounded number of ciphertext queries and adaptive secret key queries under the External Decisional Linear (XDLIN) assumption in the standard model. In addition, we implement the secret key inner product scheme and compare the performance with the similar schemes.