Proxy Re-encryption Technique Research Articles

Efficient and Secure EMR Storage and Sharing Scheme Based on Hyperledger Fabric and IPFS

This study examines the issues of privacy protection, data security, and query efficiency in blockchain-based electronic medical record (EMR) sharing. It proposes a secure storage and sharing scheme for EMR based on Hyperledger Fabric and the InterPlanetary File System (IPFS). To mitigate the privacy risks of data mining that could reveal patient identities, we establish an attribution channel in Hyperledger Fabric to store EMR ownership information and a data channel to store the storage location, digest, and usage records of medical data. Encrypted medical data are stored in the IPFS. To improve query efficiency in the blockchain, we integrate queryable medical data attributes into a composite key for conditional queries, avoiding complex data filtering processes. Additionally, we use a zero-knowledge proof combined with smart contracts for decentralized identity verification, eliminating reliance on third-party centralized verification services and enhancing system security. We also integrate AES and proxy re-encryption techniques to ensure data security during sharing. This scheme provides a more secure, efficient, and privacy-preserving approach for EMR systems, with significant practical implications and broad application potential.

PIRB: Privacy-Preserving Identity-Based Redactable Blockchains with Accountability

In this paper, we propose a privacy-preserving identity-based redactable blockchain (PIRB), the first identity-based redactable blockchain that supports flexible policies while maintaining accountability. Based on digital identities, PIRB enables a knowledge owner to set one policy for a batch of users while preserving policy privacy. Furthermore, similar to state-of-the-art solutions, PIRB draws inspiration from the proxy re-encryption technique to enforce user accountability. The design of PIRB entails addressing two primary technical challenges: firstly, achieving a flexible policy while upholding policy privacy; secondly, establishing accountability measures. To tackle the former challenge, we propose an enhanced identity-based encryption scheme that integrates polynomial function techniques. To address the latter challenge, a distinct identifier is generated for each user and subsequently concealed within the user’s secret key. Specifically, following existing schemes, we present the first scheme PIRB-I to cater to one-way access control scenarios, empowering owners to define access policies for designated editors. Additionally, recognizing the needs on the editor side for owner selection, we enhance PIRB-I through the introduction of matchmaking encryption, thereby supporting bilateral access control in a framework denoted as the second scheme PIRB-II. Notably, PIRB-I and PIRB-II involve a trade-off between computational and communication complexities. Specifically, when contrasted with PIRB-I, PIRB-II facilitates editors in owner selection, thereby mitigating editors’ communication overheads at the cost of increased computational overheads during policy generation and matching. Theoretical analysis demonstrates the inherent trade-off complexity and the resilience exhibited by PIRB-I and PIRB-II against chosen-plaintext attacks. Extensive experimentation on the FISCO blockchain shows that, compared with the state-of-the-art works, PIRB-I and PIRB-II achieve 200 times and 100 times computational efficiency improvements and 50 times and 60 times communication efficiency improvements on average, respectively.

U-MEDCHAIN A Blockchain Based System for Medical Records Access and Permissions Management

In recent years, the interest in using wireless communication technologies and mobile devices in the healthcare environment has increased. However, despite increased attention to the security of electronic health records, patient privacy is still at risk for data breaches. Thus, it is quite a challenge to involve an access control system especially if the patient’s medical data are accessible by users who have diverse privileges in different situations. Blockchain is a new technology that can be adopted for decentralized access control management issues. In this work, blockchain based frame work Electronic Medical Records (EMR) is applied. The proposed frame work aims at providing interoperable, secure, and efficient access to EMRs by health providers, patients and third parties while maintaining the patient’s privacy. We propose a timed-based smart contracts whose design meet the demands of EMRs. These contracts are employed in the blockchain for governing the transactions, monitoring the computations performed on the EMRs through the enforcement of the acceptable usage policies and managing the use of data after transmission. This work employs the blockchain technology with a collection of encryption techniques and hash functions. Sensitive information that are placed on the blockchain are encrypted to decrease the possibility of being accessed by unauthorized entity. Advanced cryptographic techniques are also adopted by the proposed framework for providing further security. The use of proxy re-encryption technique is employed to solve the problem of transferring encrypted messages among nodes with no need to share symmetric key. This adopts the distributed ElGamal re-encryption schema with distributed blinding technique. Our proposed framework employs the hashing method SHA-256, to ensure data integrity. The proposed system employs a new incentive mechanism integrated with the Proof of Authority (PoA) consensus algorithm for crating, validation, and appending new block. Now security and access control are maintained by the adoption of advanced encryption and authentication techniques throughout the blockchain. Interoperability, auditability, and accessibility are provided by the use of comprehensive logs. Our proposal gives efficient security and accessibility for medical records in an effective manner.

2D2PS: A demand-driven privacy-preserving scheme for anonymous data sharing in smart grids

In smart grid services, electricity consumption data sharing may lead to privacy breaches and the potential for misuse of personal data. Existing data aggregation approaches mainly rely on homomorphic encryption techniques to achieve privacy protection in data sharing, however, lack consideration of controlled anonymity and fine-grained access control. This paper proposes a demand-driven privacy-preserving scheme for anonymous data sharing in smart grids to solve these problems. Specifically, an authenticable pseudonym assignment method is first proposed to achieve controlled anonymity. In addition, a proxy re-encryption technique and a data separation algorithm are implemented to achieve fine-grained access control. Finally, we strictly prove that our scheme achieves privacy protection and authentication, and demonstrate its feasibility and effectiveness through simulations.

Preserving Privacy of Classified Authentic Satellite Lane Imagery Using Proxy Re-Encryption and UAV Technologies

Privacy preservation of image data has been a top priority for many applications. The rapid growth of technology has increased the possibility of creating fake images using social media as a platform. However, many people, including researchers, rely on image data for various purposes. In rural areas, lane images have a high level of importance, as this data can be used for analyzing various lane conditions. However, this data is also being forged. To overcome this and to improve the privacy of lane image data, a real-time solution is proposed in this work. The proposed methodology assumes lane images as input, which are further classified as fake or bona fide images with the help of Error Level Analysis (ELA) and artificial neural network (ANN) algorithms. The U-Net model ensures lane detection for bona fide lane images, which helps in the easy identification of lanes in rural areas. The final images obtained are secured by using the proxy re-encryption technique which uses RSA and ECC algorithms. This helps in ensuring the privacy of lane images. The cipher images are maintained using fog computing and processed with integrity. The proposed methodology is necessary for protecting genuine satellite lane images in rural areas, which are further used by forecasters, and researchers for making interpretations and predictions on data.

Edge-Cloud-Assisted Multiuser Forward Secure Searchable Encryption (EMFSSE) Scheme in the P2P Networking Environment

P2P network enables users to share resources effectively. However, with the advent of the big data era, the sensitive data of users in P2P network are also increasing dramatically. In order to solve the contradiction between the huge amount of sensitive data and the limited local storage space, an increasing number of users choose to encrypt their sensitive data and store them in the cloud server. For the problem of the secure storage and flexible access of large amounts of user data in P2P networks, an edge-cloud-assisted multiuser forward secure searchable encryption scheme is proposed. The scheme uses the proxy reencryption technique to optimize the multiuser searchable encryption and prevent the decryption key from being directly transmitted between users. By introducing an edge-cloud architecture, the system achieves efficient communication and timely response capabilities. The security analysis proves that our scheme achieves the CPA (chosen-plaintext attack) security based on DBDH assumption and the forward privacy. Finally, the theoretical and experimental comparisons between this scheme and other schemes show that our scheme has high efficiency in the process of data update, search, and trapdoor generation. In addition, due to the use of edge-cloud architecture, our scheme reduces about 90% and 75% of the user’s consumption in the encryption and token generation process.

WITHDRAWN: Secure identity based proxy re-encryption techniques for healthcare system

Cloud computing revolutionises many environments with easy-to-use enterprise applications that are easy to connect, customised, streamlined and scalable. This change of opinion calls for a broad spectrum of security and privacy concerns to be taken into consideration. Online Medical Stuff (IoMT) technology has increased the potential to interconnect medical specialist sensors in e-health. However, there are various provisions to incorporate these two innovations. The most challenging is the safety of medical knowledge and hence the difficulty of the sensing element equipment from a small environment. With the implementation of an increasingly reliable and cost-effective cloud platform (IoMT), a health care system with a high degree of public verification can be given.

Traceable and Controllable Encrypted Cloud Image Search in Multi-User Settings

With the advent of cloud computing, explosively increasing images are gradually outsourced to the cloud server for costs saving and feasibility. For security and privacy concerns, images (e.g., medical diagnosis, personal photos) should be encrypted before being outsourced. However, traditional encrypted image retrieval techniques still suffer from costly access control and low search accuracy. To solve these challenging issues, in this article, we first propose a Controllable encrypted cloud image Search scheme in Multi-user settings (namely CSM) by using the polynomial-based access strategy and proxy re-encryption technique. CSM achieves efficient access control and avoids heavy communication overhead caused by key transmission. Then, we improve the basic CSM to achieve malicious search user Tracing (namely TCSM) by utilizing the watermark technique, which can further prevent search users from illegally redistributing retrieved images to unauthorized search users. Our formal security analysis proves that our CSM (or TCSM) can guarantee the privacy of images, indexes, and search queries. Our empirical experiments using real-world datasets demonstrate the efficiency and high accuracy of our CSM (or TCSM) in practice.

Secure multiparty learning from the aggregation of locally trained models

In many applications, multiple parties would benefit from a precise learning model trained from the aggregated dataset. However, the trivial method that all the data is aggregated into one datacenter and processed centrally is not appropriate when data privacy is a significant concern. In this paper, we propose a new framework for secure multi-party learning and construct a concrete scheme by incorporating aggregate signature and proxy re-encryption techniques. Unlike the previous solutions for multi-party privacy-preserving machine learning, we don't use encryption algorithm to encrypt the whole dataset or the intermediate values during the training process. In our scheme, secure verifiable computation delegation is utilized to privately label a public dataset from the aggregation of locally trained models. Using these newly generated labeled data items, the participants can update their learning models with great accuracy improvement. Further, we prove that the proposed scheme satisfies the desired security properties, and the experimental analysis on MNIST and HAM10000 shows that it is highly efficient.

A Secure and Privacy-Preserving Approach to Protect User Data across Cloud based Online Social Networks

The tremendous growth of social networking systems enables the active participation of a wide variety of users. This has led to an increased probability of security and privacy concerns. In order to solve the issue, the article defines a secure and privacy-preserving approach to protect user data across Cloud-based online social networks. The proposed approach models social networks as a directed graph, such that a user can share sensitive information with other users only if there exists a directed edge from one user to another. The connectivity between data users data is efficiently shared using an attribute-based encryption (ABE) with different data access levels. The proposed ABE technique makes use of a trapdoor function to re-encrypt the data without the use of proxy re-encryption techniques. Experimental evaluation states that the proposed approach provides comparatively better results than the existing techniques.

A Lightweight and Formally Secure Certificate Based Signcryption With Proxy Re-Encryption (CBSRE) for Internet of Things Enabled Smart Grid

A smart grid is a new ecosystem, which is made by combining a number of smart Internet of Things (IoT) devices that manage wide energy sources by increasing the efficiency and reliability of the smart energy systems. As the IoT devices in the smart grid ecosystem generate a gigantic amount of data that needs to be stored and managed in the cloud server. On the other hand, the stored data in the cloud server can be accessible to a number of data users, therefore the data need authenticity and secrecy. Here, to fulfill the security requirements of such type of communication, signcryption with proxy re-encryption technique is the most suitable option where a semi-trusted third party can alter a ciphertext that has been encrypted for one user into another ciphertext without seeing the original content of the message. However, the existing signcryption with proxy re-encryption schemes for the smart grid environment is suffering from more bandwidth space and greater computational time requirements. Thus, in this paper, we propose a lightweight certificate-based signcryption with a proxy re-encryption (CBSRE) scheme for smart grid based-IoT devices with the intention of reducing the computational and communicational costs. For the security and efficiency of the proposed CBSRE scheme, we used a hyperelliptic curve cryptosystem that uses small parameters with a key size of 80-bits. Furthermore, the proposed scheme provides the security requirements of confidentiality (IND-CBSRE-CCA2-I and IND-CBSRE-CCA2-II), unforgeability (EUF-CBSRE-CMA-I and EUF-CBSRE-CMA-II) and forward secrecy. Additionally, we compared our proposed CBSRE scheme with the existing proxy signcryption with re-encryption schemes and the final results show that the new scheme provides strong security with the expanse of minimal computational and communications resources.

Secure and Efficient Bi-Directional Proxy Re-Encyrption Technique

<p><span style="font-size: small;"><span>The low cost availability of smart devices and broadband connection has led to rapid growth of communication over Internet. As of today the internet based communication service is widely used in various application services such as in E-Mail transaction of sensitive data (medical data), online money transaction etc. all these services requires a strong security. There has been continuous ongoing research by various cryptanalyst to enhance security of cryptography especially in semi-untrusted server. However, performance, computation time and ease of use play a significant role in using the algorithm for implementation. Proxy re-encryption plays a significant role in protecting data that are stored in semi-untrusted server. Many existing Proxy re-encryption technique induces high computation overhead due to adoption of public key cryptography such RSA (Rivet Shamir Adleman), ECC (Elliptical Curve Cryptography) etc. and it suffer from quantum attack. To address this lattice based cryptography is adopted by various approaches which is based on Learning With Error which shows resilience against quantum attacks such Chosen Cipher data attack and Chosen Plain Text attack. The drawback with existing lattice cryptography based approach is that they are unidirectional and adopts bilinear pairing which compromise security and induces high computation cost. To address this work present a Bidirectional Proxy Re-encryption scheme by adopting lattice based cryptography technique. Experiment is conducted for computation overhead by varying key and data size which attained significant performance improvement over existing Proxy Re-encryption scheme.</span><br /></span></p>

Adaptive Secure Cross-Cloud Data Collaboration with Identity-Based Cryptography and Conditional Proxy Re-Encryption

Data collaboration in cloud computing is more and more popular nowadays, and proxy deployment schemes are employed to realize cross-cloud data collaboration. However, data security and privacy are the most serious issues that would raise great concerns from users when they adopt cloud systems to handle data collaboration. Different cryptographic techniques are deployed in different cloud service providers, which makes cross-cloud data collaboration to be a deeper challenge. In this paper, we propose an adaptive secure cross-cloud data collaboration scheme with identity-based cryptography (IBC) and proxy re-encryption (PRE) techniques. We first present a secure cross-cloud data collaboration framework, which protects data confidentiality with IBC technique and transfers the collaborated data in an encrypted form by deploying a proxy close to the clouds. We then provide an adaptive conditional PRE protocol with the designed full identity-based broadcast conditional PRE algorithm, which can achieve flexible and conditional data re-encryption among ciphertexts encrypted in identity-based encryption manner and ciphertexts encrypted in identity-based broadcast encryption manner. The extensive analysis and experimental evaluations demonstrate the well security and performance of our scheme, which meets the secure data collaboration requirements in cross-cloud scenarios.

RETRACTED ARTICLE: E-Health Cloud Security Using Timing Enabled Proxy Re-Encryption

In the present era of Information Technology, almost all big and small scale companies are moving towards cloud to store and manage the data. Cloud computing is a routine of deploying a structure of distant servers speed up on the Internet to store, oversee, and manage information, rather than a neighbourhood server or a PC. The purpose for cloud procurement is reduced cost, adaptability, regular access and refreshed programming. Nowadays, healthcare frameworks are adjusting computerized stages and ending up being more patient-centered and data driven. In this paper, we present a planning empowered intermediary re-encryption method to defeat the security issues. This Technique will allow only limited access rights to an authorized agent to access the records for a specific time period. This technique will use a searchable encryption and proxy Re-encryption technique.

CCA-Secure Revocable Identity-Based Encryption With Ciphertext Evolution in the Cloud

Identity-based encryption (IBE) is a very attractive cryptographic primitive due to its unnecessity of any certificate managements. Nevertheless, the user revocation problem in IBE remains an elusive research problem and hence, it is an important research topic. One possible approach in achieving revocations is to update user’s decryption keys. However, to avoid the need of secret channels, public time keys need to be issued to allow this update to occur. It is unfortunate that this method often suffers from two problems: 1) the user has to maintain linearly growing decryption keys; and 2) the revoked users can still access ciphertexts prior to revocation. At the first glance, proxy re-encryption technique may provide a solution to this problem, but the ciphertexts will become longer after each re-encryption, which makes it impractical. In this paper, we present a revocable identity-based encryption scheme with cloud-aided ciphertext evolution. Our construction solves the two aforementioned problems via ciphertext evolution implemented by the cloud. In addition, the size of ciphertexts in the cloud remains constant size regardless of evolutions. The scheme is provably secure against chosen ciphertext attacks based on the BDH problem. The comparisons with the existing related works show that our scheme enjoys better efficiency, and thus it is practical for the data sharing in cloud storage.

A privacy-preserving sensory data sharing scheme in Internet of Vehicles

Internet of Vehicles (IoV), which enables information gathering and disseminating among vehicles, roadside infrastructures and surrounding environments, has received considerable attention recently. However, the flourishing of IoV still faces several challenges in terms of location privacy preservation, vehicular sensory data collection and vehicular sensory data acquisition. Aiming at these challenges, in this paper, we propose a novel efficient and location privacy-preserving data sharing scheme with collusion resistance in IoV, which enables the collection and distribution of the data captured by vehicular sensors. During the vehicular sensory data collection phase, each vehicle structures the multi-dimensional sensory data captured at different locations and exploits the modified Paillier Cryptosystem to achieve the location privacy-preserving sensory data aggregation, while the data aggregation result of multiple vehicles can be recovered by the trusted central entity. During the vehicular sensory data acquisition phase, the proposed scheme exploits the proxy re-encryption technique to achieve the location privacy-preserving data querying at the network edge, i.e., the vehicles query the RSU instead of the trusted central entity. Numerical analysis are performed to validate the effectiveness of the proposed scheme, i.e., low data querying failure probability. Security analysis and performance evaluations are also carried out to validate the security properties and show the computation and communication efficiency of the proposed scheme.

SecRBAC: Secure data in the Clouds

Most current security solutions are based on perimeter security. However, Cloud computing breaks the organization perimeters. When data resides in the Cloud, they reside outside the organizational bounds. This leads users to a loos of control over their data and raises reasonable security concerns that slow down the adoption of Cloud computing. Is the Cloud service provider accessing the data? Is it legitimately applying the access control policy defined by the user? This paper presents a data-centric access control solution with enriched role-based expressiveness in which security is focused on protecting user data regardless the Cloud service provider that holds it. Novel identity-based and proxy re-encryption techniques are used to protect the authorization model. Data is encrypted and authorization rules are cryptographically protected to preserve user data against the service provider access or misbehavior. The authorization model provides high expressiveness with role hierarchy and resource hierarchy support. The solution takes advantage of the logic formalism provided by Semantic Web technologies, which enables advanced rule management like semantic conflict detection. A proof of concept implementation has been developed and a working prototypical deployment of the proposal has been integrated within Google services.

Scalable and secure access control policy update for outsourced big data

Ciphertext Policy Attribute-based Encryption (CP-ABE) is proven to be one of the most effective approaches to data access control in data outsourcing environment such as cloud computing since it provides efficient key management based on user attributes of multiple users in accessing shared data. However, dealing with policy update limits the efficiency of the CP-ABE. In CP-ABE scheme, the access policy is used as a core element for data encryption. Hence, if the policy is updated, the data owner needs to re-encrypt files and send them back to the cloud. This incurs overheads including computation, communication, and maintenance cost at the data owner side. The computation and communication cost are very expensive if the outsourcing environment is devoted to “big data”. In this paper, we extend the capability of our access control scheme: C-CP-ARBE to be capable of supporting secure and flexible policy updates in the big data outsourcing environment. We develop a secure policy updating algorithm and propose a very lightweight proxy re-encryption (VL-PRE) technique to enable the policy updating to be done in the cloud in an efficient and computationally cost effective manner. Finally, we demonstrate the efficiency and performance of our proposed scheme through the implementation.

Attribute-Based Secure Data Sharing with Efficient Revocation in Fog Computing

Fog computing is a concept that extends the paradigm of cloud computing to the network edge. The goal of fog computing is to situate resources in the vicinity of end users. As with cloud computing, fog computing provides storage services. The data owners can store their confidential data in many fog nodes, which could cause more challenges for data sharing security. In this paper, we present a novel architecture for data sharing in a fog environment. We explore the benefits of fog computing in addressing one-to-many data sharing applications. This architecture sought to outperform the cloud-based architecture and to ensure further enhancements to system performance, especially from the perspective of security. We will address the security challenges of data sharing, such as fine-grained access control, data confidentiality, collusion resistance, scalability, and the issue of user revocation. Keeping these issues in mind, we will secure data sharing in fog computing by combining attributebased encryption and proxy re-encryption techniques. Findings of this study indicate that our system has the response and processing time faster than classical cloud systems. Further, experimental results show that our system has an efficient user revocation mechanism, and that it provides high scalability and sharing of data in real time with low latency.

Dynamic access policy in cloud-based personal health record (PHR) systems

With the development of cloud computing, an increasing number of users are using cloud-based personal health record (PHR) systems. The PHR is closely tied to patient privacy, and thus existing studies suggest encrypting PHRs before outsourcing. Comparison-based encryption (CBE) was the first to implement time comparison in an attribute-based access policy by means of the forward and backward derivation functions. However, CBE cannot be directly applied to cloud-based PHR environments for the following reasons: First, the cost of encryption grows linearly with the number of attributes in the access policy. Second, policy updating incurs high communication and computation costs for the data owner. To efficiently implement a dynamic access policy for PHRs in clouds, we first propose a hierarchical comparison-based encryption (HCBE) scheme that incorporates an attribute hierarchy into CBE. The HCBE scheme encrypts a ciphertext with a small number of generalized attributes at a higher level rather than many specific attributes at a lower level, greatly improving the encryption performance. Using the HCBE scheme as a foundation, we then develop a dynamic policy updating (DPU) scheme by utilizing the proxy re-encryption (PRE) technique. The DPU scheme can avoid the transmission of ciphertexts and minimize the computation overhead on the data owner by delegating the policy updating operations to the cloud. Extensive experiments have been conducted using a synthetic data set to verify the efficiency of our proposed schemes.