Proxy Re-encryption Scheme Research Articles

Secure and Efficient Bi-Directional Proxy Re-Encyrption Technique

<p><span style="font-size: small;"><span>The low cost availability of smart devices and broadband connection has led to rapid growth of communication over Internet. As of today the internet based communication service is widely used in various application services such as in E-Mail transaction of sensitive data (medical data), online money transaction etc. all these services requires a strong security. There has been continuous ongoing research by various cryptanalyst to enhance security of cryptography especially in semi-untrusted server. However, performance, computation time and ease of use play a significant role in using the algorithm for implementation. Proxy re-encryption plays a significant role in protecting data that are stored in semi-untrusted server. Many existing Proxy re-encryption technique induces high computation overhead due to adoption of public key cryptography such RSA (Rivet Shamir Adleman), ECC (Elliptical Curve Cryptography) etc. and it suffer from quantum attack. To address this lattice based cryptography is adopted by various approaches which is based on Learning With Error which shows resilience against quantum attacks such Chosen Cipher data attack and Chosen Plain Text attack. The drawback with existing lattice cryptography based approach is that they are unidirectional and adopts bilinear pairing which compromise security and induces high computation cost. To address this work present a Bidirectional Proxy Re-encryption scheme by adopting lattice based cryptography technique. Experiment is conducted for computation overhead by varying key and data size which attained significant performance improvement over existing Proxy Re-encryption scheme.</span><br /></span></p>

A certificateless signcryption with proxy re-encryption for practical access control in cloud-based reliable smart grid

Cloud computing has proven to be applicable in smart grid systems with the help of the cloud-based Internet of things (IoT) technology. In this concept, IoT is deployed as a front-end enabling the acquisition of smart grid-related data and its outsourcing to the cloud for data storage purposes. It is obvious that data storage is a pertinent service in cloud computing. However, its wide adoption is hindered by the concern of having a secure access to data without a breach on confidentiality and authentication. To address this problem, we propose a novel data access control scheme that simultaneously accomplishes confidentiality and authentication for cloud-based smart grid systems. Our scheme can enable the storing of encrypted smart grid-related data in the cloud. When a user prefers to access the data, the data owner issues a delegation command to the cloud for data re-encryption. The cloud is unable to acquire any plaintext information on the data. Only authorized users are capable of decrypting the data. Moreover, the integrity and authentication of data can only be verified by the authorized user. We obtain the data access control scheme by proposing a pairing free certificateless signcryption with proxy re-encryption (CLS-PRE) scheme. We prove that our CLS-PRE scheme has indistinguishability against adaptive chosen ciphertext attack under the gap Diffie–Hellman problem and existential unforgeability against adaptive chosen message attack under elliptic curve discrete logarithm problem in the random oracle model.

Secure and efficient proxy re-encryption scheme based on key-homomorphic constrained PRFs in cloud computing

With the rapid development of cloud computing, its security and privacy are of great concern. Since the cloud service provider is not completely trustworthy, the security of the outsourced files has become serious issues. Identity-based proxy re-encryption (IBPRE) schemes have been proposed to achieve feasible access control of encrypted data under the condition of guaranteeing the confidentiality of data, which can transfer the original ciphertexts to the re-encrypted ciphertexts for a designated decryptor. However, most of the existing IBPRE schemes either do not support revocation or computational complexity is too high. In this paper, we combine the properties of constrained pseudorandom functions (PRFs) and key homomorphic PRFs to construct a secure and efficient proxy re-encryption scheme for cloud computing. In our proposed scheme, the data owner authenticates the requesters and distributes the decryption keys by using an identity-based key exchange method. Meanwhile, a proxy re-encryption scheme is used to achieve data sharing and ciphertext update. We present the security proof of our scheme. In addition, compared with other existing schemes, our scheme has low computational complexity and communication cost.

Non-transferable Proxy Re-encryption

The traditional security notion of proxy re-encryption (PRE) focuses on preventing the proxy learning anything about the encrypted messages. However, such a basic security requirement is clearly not enough for scenarios where the proxy can collude with Bob. A desirable security goal is, therefore, to prevent a malicious proxy colluding with Bob to re-delegate Alice's decryption right. In 2005, Ateniese et al. first proposed this intriguing problem called non-transferability, in the sense that the only way for Bob to transfer Alice's decryption capability is to expose his own secret key. However, no solutions have achieved this property. In this paper, we positively resolve this open problem. In particular, we give the first construction of non-transferable PRE where the attacker is allowed to obtain one pair of keys consisting of Bob's secret key and the corresponding re-encryption key. Using indistinguishability obfuscation and k-unforgeable authentication as main tools, our scheme is provably secure in the standard model. The essential idea behind our approach is to allow Bob's secret key to be evoked in the process of decrypting Alice's ciphertext while hiding the fact that only Bob could decrypt it by the obfuscated program. In addition, we also show a negative result: a CPA secure PRE scheme with ‘error-freeness’ property cannot be non-transferable.

A Source Hiding Identity-Based Proxy Reencryption Scheme for Wireless Sensor Network

Wireless sensor network (WSN), which extends the typical Internet environment to Internet of Things, has been deployed in various environments such as safety monitoring, intelligent transportation, and smart home. In a WSN, encryption is typically used to protect data that are stored in wireless devices. However some features like data sharing can be affected if the traditional encryption is used. A secure mechanism should support a gateway of the network to directly convert a user’s encrypted data (encrypted pollution data) to a new user’s encryption without exposing the underlying plaintext data during the whole sharing phase. In this work, a new source hiding identity-based proxy reencryption scheme (SHIB-PRE) is proposed to deal with the issue. The proposed SHIB-PRE scheme supports a proxy (gateway or cloud server) to transform a user’s encrypted date to a new user’s ciphertext as long as the proxy has the proxy reencryption key. In SHIB-PRE, the encrypted pollution data is kept secure from the proxy and the relationship between a source ciphertext and a reencrypted ciphertext is concealed from the outside eavesdropper. In this paper, we give an introduction to the definition of a source hiding identity-based proxy reencryption and its chosen plaintext security model. Further, a concrete construction will be presented and proven chosen plaintext secure under the q-DDHE assumption in the standard model.

More Constructions of Re-Splittable Threshold Public Key Encryption

The concept of threshold public key encryption (TPKE) with the special property called key re-splittability (re-splittable TPKE, for short) was introduced by Hanaoka et al. (CT-RSA 2012), and used as one of the building blocks for constructing their proxy re-encryption scheme. In a re-splittable TPKE scheme, a secret key can be split into a set of secret key shares not only once, but also multiple times, and the security of the TPKE scheme is guaranteed as long as the number of corrupted secret key shares under the same splitting is smaller than the threshold. In this paper, we show several new constructions of re-splittable TPKE scheme by extending the previous (ordinary) TPKE schemes.

A Fine-Grained Attribute Based Data Retrieval with Proxy Re-Encryption Scheme for Data Outsourcing Systems

Attribute based encryption is suitable for data protection in data outsourcing systems such as cloud computing. However, the leveraging of encryption technique may retrain some routine operations over the encrypted data, particularly in the field of data retrieval. This paper presents an attribute based date retrieval with proxy re-encryption (ABDR-PRE) to provide both fine-grained access control and retrieval over the ciphertexts. The proposed scheme achieves fine-grained data access management by adopting KP-ABE mechanism, a delegator can generate the re-encryption key and search indexes for the ciphertexts to be shared over the target delegatee’s attributes. Throughout the process of data sharing, the data are transferred as ciphers thus the server and unauthorized users cannot acquire the sensitive information of the encrypted data so the privacy and confidentiality can be protected. By security analysis, the proposed scheme meets the security requirements confidentiality, keyword semantic security as well as collusion attack resistance.

Provably secure group key management scheme based on proxy re-encryption with constant public bulletin size and key derivation time

Users share a group key to decrypt encryptions for the group using a group key management scheme. In this paper, we propose a re-encryption-based group key management scheme, which uses a unidirectional proxy re-encryption scheme with special properties to enable group members share the updated group key with minimum storage and computation overhead. In particular, we propose a proxy re-encryption scheme that supports direct re-encryption key derivation using intermediate re-encryption keys. Unlike multi-hop re-encryption, the proposed proxy re-encryption scheme does not involve repeated re-encryption of the message. All the computations are done on the re-encryption key level and only one re-encryption is sufficient for making the group key available to the users. The proposed scheme is the first for group key management based on proxy re-encryption that is secure against collusion. The individual users store just one individual secret key with group key derivation requiring O\((\log N)\) computation steps for a group of N users. Size of the public bulletin maintained to facilitate access to the most recent group key for off-line members is O(N) and remains constant with respect to the number of group updates. The proposed group key management scheme confronts attacks by a non-member and even a collusion attack under standard cryptographic assumptions.

Secure Data Collection, Storage and Access in Cloud-Assisted IoT

Cloud-assisted Internet of Things (IoT) provides a promising solution to data booming problems for the ability constraints of individual objects. However, with the leverage of cloud, IoT faces new security challenges for data mutuality between two parties, which is introduced for the first time in this paper and not currently addressed by traditional approaches. We investigate a secure cloud-assisted IoT data managing method to keep data confidentiality when collecting, storing and accessing IoT data with the assistance of a cloud with the consideration of users increment. The proposed system novelly applies a proxy re-encryption scheme, which was proposed in [5]. Hence, a secure IoT under our proposed method could resist most attacks from both insiders and outsiders of IoT to break data confidentiality, and meanwhile with constant communication cost for re-encryption anti incremental scale of IoT. We further show the method is practical by numerical results.

Self-Controllable Secure Location Sharing for Trajectory-Based Message Delivery on Cloud-Assisted VANETs.

In vehicular ad hoc networks, trajectory-based message delivery is a message forwarding strategy that utilizes the vehicle’s preferred driving routes information to deliver messages to the moving vehicles with the help of roadside units. For the purpose of supporting trajectory-based message delivery to a moving vehicle, the driving locations of the vehicle need to be shared with message senders. However, from a security perspective, vehicle users do not want their driving locations to be exposed to others except their desired senders for location privacy preservation. Therefore, in this paper, we propose a secure location-sharing system to allow a vehicle user (or driver) to share his/her driving trajectory information with roadside units authorized by the user. To design the proposed system, we put a central service manager which maintains vehicle trajectory data and acts as a broker between vehicles and roadside units to share the trajectory data on the cloud. Nevertheless, we make the trajectory data be hidden from not only unauthorized entities but also the service manager by taking advantage of a proxy re-encryption scheme. Hence, a vehicle can control that only the roadside units designated by the vehicle can access the trajectory data of the vehicle.

A CCA-secure key-policy attribute-based proxy re-encryption in the adaptive corruption model for dropbox data sharing system

The notion of attribute-based proxy re-encryption extends the traditional proxy re-encryption to the attribute-based setting. In an attribute-based proxy re-encryption scheme, the proxy can convert a ciphertext under one access policy to another ciphertext under a new access policy without revealing the underlying plaintext. Attribute-based proxy re-encryption has been widely used in many applications, such as personal health record and cloud data sharing systems. In this work, we propose the notion of key-policy attribute-based proxy re-encryption, which supports any monotonic access structures on users’ keys. Furthermore, our scheme is proved against chosen-ciphertext attack secure in the adaptive model.

Cloud-assisted privacy-preserving profile-matching scheme under multiple keys in mobile social network

Making new friends by measuring the proximity of people’s profile is a crucial service in mobile social networks. With the rapid development of cloud computing, outsourcing computing and storage to the cloud is now an effective way to relieve the heavy burden on users for managing and processing data. To prevent privacy leakage, data owners tend to encrypt their private data before outsourcing. However, current solutions either have heavy interactions or require users to encrypt private data with a single key. In this paper, we propose a novel cloud-assisted privacy-preserving profile-matching scheme under multiple keys based on a proxy re-encryption scheme with additive homomorphism. Our scheme is secure under the honest-but-curious (HBC) model given two non-colluding cloud servers.

Identity-based re-encryption scheme with lightweight re-encryption key generation

Cryptographic proxy re-encryption is a very useful primitive which is capable of transforming a ciphertext under one public key PK1 into a new ciphertext under another public key PK2 without private information leakage, while the two ciphertexts are encryptions of the same message. Re-encryption schemes at first are constructed under the public-key encryption (PKE) scenario. While it is a powerful primitive naturally required in not only PKE but also other scenarios, various extensions from PKE to other advanced encryption schemes like identity-based encryption (IBE), attribute-based encryption (ABE) as well as functional encryption (FE) are needed as well. In this work we have concentrated on how to reduce the workloads in the user/client side at large. To this end, we have put forth a novel identity-based proxy re-encryption (IBPRE) scheme with the feature that the re-encryption key gen­eration for the users is highly lightweight - actually almost free. Although this will lead to possibly extra decryption workload due to the utilization of homomorphic encryption, it is the first scheme realizing such almost free RK generation. In addition, it can also avoid some other shortcomings like re-encryption key management.

Non-transferable proxy re-encryption for multiple groups

In proxy re-encryption (PRE) scheme, the message is sent by a delegator to a delegatee with help of the trusted third party proxy without knowing the existing plaintext. It is known that non-transferable PRE schemes solve some problems of the naive PRE schemes. Some non-transferable PRE scheme is extended to group-based schemes, where the proxy diverts a ciphertext for a group into another group, but the existing schemes have the proxy colluding problem. To resolve the proxy colluding problem for group-based PRE schemes, we propose a non-transferable PRE scheme for multiple groups. In our scheme, there are three sub-processes, which are based on a non-transferable PRE scheme and a group signature. We show that our scheme provides the security for a delegator Alice, a delegatee Bob in the same group with Alice, and another delegatee Charlie in a different group from Alice.

Improved functional proxy re-encryption schemes for secure cloud data sharing

Recently Liang et al. propose an interesting privacy-preserving ciphertext multi-sharing control for big data storage mechanism, which is based on the cryptographic primitive of anonymous multi-hop identity based conditional proxy re-encryption scheme AMH-IBCPRE. They propose a concrete AMH-IBCPRE scheme and conclude their scheme can achieve IND-sCon-sID-CCA secure (indistinguishable secure under selectively conditional selectively identity chosen ciphertext attack). However, our research show their scheme can not be IND-sConsID- CCA secure for single-hop and multi-hop data sharing. Also in 2014, Liang et al. propose an interesting deterministic finite automata-based functional proxy reencryption scheme DFA-based FPRE for secure public cloud data sharing, they also conclude their scheme can achieve IND-CCA secure (indistinguishable secure under chosen ciphertext attack), we also show their scheme can not be IND-CCA secure either. For these two proposals, the main reason of insecurity is that part of the re-encryption key has the same structure as the valid ciphertext, thus the adversary can query on the decryption oracle with this part of the re-encryption key to get secret keys, which will break the CCA-security of their scheme.We give an improved AMH-IBCPRE scheme and an improved DFA-based FPRE scheme for cloud data sharing and show the new schemes can resist our attack and be CCA-secure.We also demonstrate our improved AMH-IBCPRE scheme?s efficiency compared with other related identity based proxy re-encryption schemes, the results show our scheme is almost the most efficient one.

PRE+: Dual of Proxy Re-encryption for Secure Cloud Data Sharing Service

In this paper, aiming at providing secure cloud data sharing services in cloud storage, we propose a scalable and controllable cloud data sharing framework for cloud users: Scanf. Towards proposing this framework, we introduce a new cryptographic primitive: PRE+, which can be seen as the dual of traditional proxy re-encryption (PRE) primitive. All the traditional PRE schemes until now require the delegator (or the delegator and the delegatee cooperatively) to generate the re-encryption keys. We observe that the encrypter also has the ability to generate re-encryption keys. Based on this observation, we construct a new PRE+ scheme, which is almost the same as the traditional PRE except the re-encryption keys generated by the encrypter. Compared with PRE, PRE+ can easily achieve the non-transferable property and message-level-based fine-grained delegation. Our Scanf framework based on PRE+ can also achieve these two properties, which is very important for cloud storage sharing service.

PRE<SUP align="right">+</SUP>: dual of proxy re-encryption for secure cloud data sharing service

In this paper, aiming at providing secure cloud data sharing services in cloud storage, we propose a scalable and controllable cloud data sharing framework for cloud users: Scanf. Towards proposing this framework, we introduce a new cryptographic primitive: PRE+, which can be seen as the dual of traditional proxy re-encryption (PRE) primitive. All the traditional PRE schemes until now require the delegator (or the delegator and the delegatee cooperatively) to generate the re-encryption keys. We observe that the encrypter also has the ability to generate re-encryption keys. Based on this observation, we construct a new PRE+ scheme, which is almost the same as the traditional PRE except the re-encryption keys generated by the encrypter. Compared with PRE, PRE+ can easily achieve the non-transferable property and message-level-based fine-grained delegation. Our Scanf framework based on PRE+ can also achieve these two properties, which is very important for cloud storage sharing service.

A New Kind of Conditional Proxy Re-Encryption for Secure Cloud Storage

Secure cloud storage has important applications in our big data-driven society, and to achieve secure cloud storage, we need to enforce strong access control mechanism. Proxy re-encryption (PRE) has been shown to be an effective tool of constructing cryptographically enforced access control schemes. In a traditional PRE scheme, a semi-trusted proxy can convert all ciphertexts for a delegator to ciphertexts for a delegatee once the proxy obtains the relevant re-encryption key from the delegator. In many practical applications, however, a fine-grained delegation of decryption abilities may be demanded, and thus, the notion of conditional PRE (C-PRE) is introduced, which allows only the ciphertexts satisfying a concrete condition to be converted by the proxy. In this paper, we introduce a special kind of C-PRE, sender-specified PRE (SS-PRE), which enables the delegator to delegate the decryption right of the ciphertexts from a specified sender to his/her delegatee. We give a formal definition of SS-PRE and its security model. We also provide the concrete constructions of an IND-CPA secure SS-PRE scheme and an IND-CCA secure SS-PRE scheme with the properties of unidirectionality and single-use and prove the security of both schemes in the standard model. The detailed analysis shows that our new IND-CCA secure SS-PRE scheme achieves a higher efficiency in computation cost and ciphertext size than the conventional C-PRE schemes.

Identity Based Proxy Re-encryption Scheme under LWE

The proxy re-encryption allows an intermediate proxy to convert a ciphertext for Alice into a ciphertext for Bob without seeing the original message and leaking out relevant information. Unlike many prior identity based proxy re-encryption schemes which are based on the number theoretic assumptions such as large integer factorization and discrete logarithm problem. In this paper, we first propose a novel identity based proxy re-encryption scheme which is based on the hardness of standard Learning With Error(LWE) problem and is CPA secure in the standard model. This scheme can be reduced to the worst-case lattice hard problem that is able to resist attacks from quantum algorithm. The key step in our construction is that the challenger how to answer the private query under a known trapdoor matrix. Our scheme enjoys properties of the non-interactivity, unidirectionality, anonymous and so on. In this paper, we utilize primitives include G-trapdoor for lattice and sample algorithms to realize simple and efficient re-encryption.

Leakage resilient ID-based proxy re-encryption scheme for access control in fog computing

In fog computing, fog-devices are usually physically close to end-devices, and have a high speed connection with cloud servers. They provide good access control service for end-devices to cloud, if an ID-based proxy re-encryption scheme is deployed on them. Each file stored on a cloud server is encrypted using a symmetric key, and these keys are encrypted by a public master key which is stored in a fog-device. If an end-device want to access a file in cloud, then the fog-device re-encrypts these encapsulated symmetric keys from the master key to the key of the end-device. However, due to the geographic dispersion of fog-devices, they are apt to be attacked by side channel attacks. In this work, we propose a leakage resilient ID-based proxy re-encryption scheme in auxiliary input model. It can resist the continuous leakage of secret keys caused by side channel attacks. We implement our scheme over two platforms, and the results show that our scheme is feasible in practice.