Public Verifiability Research Articles

Merkle Tree and Blockchain-Based Cloud Data Auditing

Cloud computing is the fastest growing and most promising field in the service provisioning segment. It has become a challenging task to provide security in the cloud. The purpose of this article is to suggest a better and efficient integrity verification technique for data referred to as cloud audit. The deployment of cloud storage services has significant benefits in the management of data for users. However, this raises many security concerns, and one of them is data integrity. Though public verification techniques serve the purpose they are vulnerable to procrastinating auditors who may not perform verifications on time. In this article, a cloud data auditing system is proposed. The proposed cloud data auditing system integrates Merkle Tree-based Cloud audit and the blockchain-based audit recording system, thus the core idea is to record each verification result into a blockchain as a transaction. Utilizing the time-sensitive nature of blockchain, the verifications are time-stamped after the corresponding transaction is recorded into the blockchain, which enables users to check whether auditors have performed the verifications at the prescribed time. The proposed cloud data auditing system is experimentally validated. The investigations with varied dataset size revealed less time taken, on an average of 0.25 milliseconds with the use of Merkle Tree. Further results reveal consistency of the data integrity checking.

Towards an Efficient Certificateless Access Control Scheme for Wireless Body Area Networks

Wireless body area networks have become popular due to recent technological developments in sensor technology. A sensor can be used to collect data from different environments of interest, process and communicate the data to other nodes in a network. By its very nature, a sensor node is limited in resource usage. Due to these limitations, numerous security challenges have emerged in their applications, hence the need for more efficient and secure cryptosystems. In this paper, we give an efficient certificateless pairing-free signcryption scheme then design a secure access control scheme that can satisfy both the properties of ciphertext authentication and public verifiability using the signcryption scheme. A formal security proof of our scheme in random oracle model is provided. In addition, we compare the efficiency of our access control scheme with other existing schemes that are based on signcryption scheme. The analysis reveals that our scheme achieves better trade-off for computational and communication cost.

Threshold Multi-Keyword Search for Cloud-Based Group Data Sharing

Searchable Encryption (SE) is a popular cryptographic primitive for building ciphertexts retrieval systems with far-reaching applications. However, existing SE schemes generally do not support threshold access control (i.e., data users must collaboratively issue search and decryption operations over encrypted cloud data) in a group-oriented cloud data sharing setting, which is increasingly receiving much attention in the research community. Thus, in this article, we first propose a Threshold Multi-keyword Search (TMS) scheme for cloud-based group data sharing (referred to as basic TMS scheme) by utilizing Shamir’s secret sharing technique, to achieve threshold multi-keyword search, threshold decryption, and short record ciphertext size. Then, we extend this basic TMS to realize threshold result verification and threshold traceability (referred to as enhanced TMS). Furthermore, the enhanced TMS is extended to support public result verification and dynamic operations with the public verifier and improved hash tables, respectively. Our formal security analysis proves that both basic TMS and enhanced TMS are semi-adaptively secure and can resist Chosen-Keyword Attack (CKA). Our theoretical evaluation and empirical experiments demonstrate the potential utility of both schemes.

Cloud based security on outsourcing using blockchain in E-health systems

Recently, Electronic Health Records (EHR) plays a significant role in E-health care system that allows data exchange of patient's health records via a portal designated by healthcare professionals. In this, the lack of confidentiality and integrity factors leads to different security issues on sensitive health information and causes a serious impact on a patient's life. To accomplish the security of medical data, we propose a new scheme named Elliptical Curve Certificateless Aggregate Cryptography Signature scheme (EC-ACS) for the public verification and auditing in the Medical Cloud Server (MCS) to secure EHR using authorized blockchain technology. In this, we use Elliptic Curve Cryptography (ECC) to encrypt medical data and the Certificateless Aggregate Signature scheme (CAS) to generate the digital signature for sharing and storing data in the cloud storage. This proposed scheme ensures security, privacy and safeguards the confidential information from unauthorized access in the cloud health system. Furthermore, the blockchain technique guarantees the integrity, traceability and secure storage of medical records in the cloud environment.

LH-ABSC: A Lightweight Hybrid Attribute-Based Signcryption Scheme for Cloud-Fog-Assisted IoT

One of the best ways to deal with the massive data generated by the Internet of Things (IoT) is storing them in the cloud. However, outsourced storage raises some security and privacy issues, such as data leaking and illegal access. The attribute-based signcryption (ABSC) is one of the most promising approaches which can ensure the confidentiality and authenticity of data simultaneously. Nonetheless, it not only inherits the fine-grained access control but also the heavy computational cost which is intolerable for most resource-limited IoT devices. In this article, we propose lightweight hybrid-policy ABSC (LH-ABSC), a lightweight ABSC scheme which adopts ciphertext-policy encryption (CPABE) and key-policy attribute-based signature (KPABS). Ciphertext-policy attribute-based signature leads the decision making that who can decrypt to the data owners directly. Meanwhile, the signature is related with data owners' attribute set which can be used to testify the authenticity of data. In particular, LH-ABSC has constant signature size and satisfies public verification which is deeply important for IoT devices. Moreover, LH-ABSC outsources most computing overhead to fog nodes, including signature, verify, and decryption. Comprehensive theoretical analyses, such as confidentiality, unforgeability, and verifiability, are provided. Also, the selective chosen ciphertext security, the selective chosen message security, and signers anonymity are achieved.

A Lightweight Data Aggregation Protocol With Privacy-Preserving for Healthcare Wireless Sensor Networks

In recent years, healthcare wireless sensor networks (HWSNs) have received extensive attention. Due to the direct participation of patients' personal health data, privacy issues, and security are very sensitive in HWSNs. How to aggregate the sensitive patient information securely and efficiently is still a challenging task to the HWSNs communication scenario. In this article, a lightweight data aggregation protocol with privacy-preserving is proposed to achieve enhancing security in HWSNs. With the proposed protocol, patients' personal health data collected by the data collect client can be aggregated by data aggregator and efficiently obtained by the medical service provider in a privacy-preserving manner. In particular, we first propose an efficient certificateless aggregate signcryption scheme, and then, design a data aggregation protocol for patient condition monitoring with information confidentiality, integrity, mutual authenticity, and public verifiability. Performance comparisons show that our newly proposed protocol significantly reduces computing overhead compared to the latest protocols in the field.

Secure Verifiable Database Supporting Efficient Dynamic Operations in Cloud Computing

Storage is one of the main services that the cloud provides users. Utilizing the cloud to store large amounts of data can alleviate the cost of storage and the hardware investment on the local side, which is very important for resource-restricted clients. An emerging issue for clients is how to verify the database in the could after outsourcing their data to the cloud. Many verifiable database (VDB) schemes have been proposed by researchers that can solve this issue. However, some of the existing schemes cannot satisfy the practical requirements of database verifiability. In this paper, we propose a secure verifiable database scheme that is based on the polynomial commitment for cloud computing, which can realize the verifiability of database records in the cloud. Moreover, the proposed scheme can support public verifiability in that all clients in the system can verify the database. In addition, we use the BLS signature and the index-hash table to construct dynamic operations for the database. Security analysis shows that our scheme can achieve real-world security requirements. The simulation results show that our scheme is more efficient than similar schemes.

Secure Data Transfer and Deletion from Counting Bloom Filter in Cloud Computing

With the rapid development of cloud storage, an increasing number of data owners prefer to outsource their data to the cloud server, which can greatly reduce the local storage overhead. Because different cloud service providers offer distinct quality of data storage service, e.g., security, reliability, access speed and prices, cloud data transfer has become a fundamental requirement of the data owner to change the cloud service providers. Hence, how to securely migrate the data from one cloud to another and permanently delete the transferred data from the original cloud becomes a primary concern of data owners. To solve this problem, we construct a new counting Bloom filter-based scheme in this paper. The proposed scheme not only can achieve secure data transfer but also can realize permanent data deletion. Additionally, the proposed scheme can satisfy the public verifiability without requiring any trusted third party. Finally, we also develop a simulation implementation that demonstrates the practicality and efficiency of our proposal.

Comments on “Provably Secure Generalized Signcryption Scheme With Public Verifiability for Secure Data Transmission Between Resource-Constrained IoT Devices”

Very recently, Karati et al. presented a new generalized CLSC (gCLSC) to provide the functions of digital signature and encryption to fulfill the authenticity and confidentiality for the resource-constrained Internet-of-Things (IoT) devices. Karati et al. claimed that the newly proposed gCLSC supports the property of public verifiability and security of an ideal signcryption under the strong Diffie–Hellman and bilinear Diffie–Hellman inversion problems without the random oracle model. Unfortunately, their scheme is insecure with respect to unforgeability. It is demonstrated that any receiver or nonprivileged user can generate a valid signature or signcrypted ciphertext on any message. Finally, this article also points out the flaw in their unforgeability proof and gives some suggestions on the construction of a concrete scheme.

Secure and efficient publicly verifiable outsourcing of matrix multiplication in online mode

With the emergence of cloud computing paradigm in many scientific applications, outsourcing of computation has attracted a great amount of attention from the research community. Outsourcing of heavy computations such as multiplication of two large matrices has raised some security concerns. Data and the result of computation should be protected not only from attackers, but also from the cloud servers. Moreover, data owner should be able to verify the correctness of computation with complexity less than the original computation. The previous schemes either have expensive offline phase or do not support public verifiability. In this paper, first we find a security vulnerability in the Zhang-Lei’s scheme for outsourcing of matrix multiplication where the cloud server can forge the result and pass the verification phase. Then, we present a secure and efficient publicly verifiable outsourcing of matrix multiplication scheme which achieves privacy protection of outsourced data and result, unforgeability of result, public verifiability and high efficiency. Our analyses show that compared with the related work, the proposed scheme is superior in terms of functionality, computation, communication and storage overhead, especially in verification computation overhead.

Efficient Proofs of Retrievability with Public Verifiability for Dynamic Cloud Storage

Cloud service providers offer various facilities to their clients. The clients with limited resources opt for some of these facilities. They can outsource their bulk data to the cloud server. The cloud server maintains these data in lieu of monetary benefits. However, a malicious cloud server might delete some of these data to save some space and offer this extra amount of storage to another client. Therefore, the client might not retrieve her file (or some portions of it) as often as needed. Proofs of retrievability (POR) provide an assurance to the client that the server is actually storing all of her data appropriately and they can be retrieved at any point of time. In a dynamic POR scheme, the client can update her data after she uploads them to the cloud server. Moreover, in publicly verifiable POR schemes, the client can delegate her auditing task to some third party specialized for this purpose. In this work, we exploit the homomorphic hashing technique to design a publicly verifiable dynamic POR scheme that is more efficient (in terms of bandwidth required between the client and the server) than the “state-of-the-art” publicly verifiable dynamic POR scheme. We also analyze security and performance of our scheme.

A Ciphertext-Policy Attribute-based Encryption Scheme with Public Verification for an IoT-Fog-Cloud Architecture

Abstract In large scale Internet of Things (IoT) systems, IoT-Cloud is a scalable and practical method to achieve high-efficiency data management accommodation through delegating the data storage and management tasks to the cloud service providers (CSPs). To cope with the low-computability and limited-resource of IoT devices and the response-latency of CSPs, recent works introduce an IoT-Fog-Cloud architecture. Yet, the existing attribute-based data sharing solutions with high computation requirements are no longer suitable for this new architecture. In this paper, we propose a ciphertext-policy attribute-based encryption scheme for the architecture to address the above challenges. The expensive offline encryption is delegated to the fog by constructing an intermediate ciphertext pool with the help of a Chameleon hash function. A public verification is performed to filter the illegitimate ciphertexts before executing the decryption operation. We provide a formal proof of the security and extensive performance analyses. These demonstrate that the scheme is suitable for resource-constrained IoT devices.

An hyper elliptic curve based efficient signcryption scheme for user authentication

With ever growing popularity, wireless communication system also vulnerable to various security attacks. To provide high level security, many cryptographic solutions have been proposed. One such solution is signcryption, where authenticity and confidentiality provided by single logical step. Therefore, signcryption scheme helps to reduce computational cost, but it is not feasible for resource constraint environments. Because, most of the existing approaches were based on El-Gamal, bilinear pairing, Rivest-Shamir-Adleman (RSA), and Elliptic curve Cryptography (ECC). They consume more energy due to their increased key size. Hence, the new signcryption approach is proposed based on Hyper Elliptic Curve Cryptosystem (HECC) whose key size is much lesser than ECC. It significantly reduces the cost of computation and communication overhead by half the amount of ECC which suits well for resource constraint environments. Further, the proposed scheme attains necessary security features along with forward secrecy and public verifiability. On the other hand, the security of the approach is validated through an automated protocol validation tool – AVISPA.

A secure and efficient multi cloud-based data storage and retrieval using hash-based verifiable secret sharing scheme

As the availability of many smart devices rises, fast and easy access to data as well as sharing more information is felt. Cloud computing is a computational approach that shares configurable resources such as network, servers, storage space, applications and services on the internet. The confidentiality, integrity, and availability of the data, reducing computational cost and communication channel between the data owner and cloud service providers are essential parts of cloud computing. In the paper, we propose a new scheme to construct a secure cloud data storage based on the verifiable secret sharing scheme with public verifiability to protect data integrity. And the verification phase does not depend on any computational assumptions. The proposed scheme cannot only detect the cheating but also identify who are the cheaters. It is worth noting that the proposed scheme is more efficient compared with the other secret sharing-based cloud data storage since heavy and complex computation is not required.

A secure and efficient multi cloud-based data storage and retrieval using hash-based verifiable secret sharing scheme

As the availability of many smart devices rises, fast and easy access to data as well as sharing more information is felt. Cloud computing is a computational approach that shares configurable resources such as network, servers, storage space, applications and services on the internet. The confidentiality, integrity, and availability of the data, reducing computational cost and communication channel between the data owner and cloud service providers are essential parts of cloud computing. In the paper, we propose a new scheme to construct a secure cloud data storage based on the verifiable secret sharing scheme with public verifiability to protect data integrity. And the verification phase does not depend on any computational assumptions. The proposed scheme cannot only detect the cheating but also identify who are the cheaters. It is worth noting that the proposed scheme is more efficient compared with the other secret sharing-based cloud data storage since heavy and complex computation is not required.

Protecting data privacy in publicly verifiable delegation of matrix and polynomial functions

Outsourcing computation has gained significant attention in recent years in particular due to the prevalence of cloud computing. There are two main security concerns in outsourcing computation: guaranteeing that the server performs the computation correctly, and protecting the privacy of the client's data. The verifiable computation of Gennaro, Gentry and Parno addresses both concerns for outsourcing the computation of a function f on an input x to the cloud. The GGP scheme is privately delegatable, privately verifiable, and based on the expensive cryptographic primitives such as fully homomorphic encryption (FHE). In this paper we consider the problem of outsourcing matrix-vector multiplications of the form Fxwhere F is a matrix and xis a column vector, and construct publicly delegatable and publicly verifiable schemes. Our schemes are either input private or function private, highly efficient, and provably secure under the well-established assumptions such as the discrete-logarithm assumption. We decompose a polynomial computation, such as computing a univariate polynomial of arbitrary degree, a bivariate polynomial of arbitrary degree, a quadratic multivariate polynomial, and in general any multivariate polynomial, into a two-step computation in which the computaionally expensive step is a matrix-vector multiplication. We use the matrix schemes to outsource the computation of high-degree polynomials and obtain the first high-degree polynomial outsourcing schemes that simultaneously have public delegation, public verification and input privacy/function privacy.

Publicly verifiable and efficiency/security-adjustable outsourcing scheme for solving large-scale modular system of linear equations

Solving large-scale modular system of linear equations (mathcal {LMSLE}) is pervasive in modern computer and communication community, especially in the fields of coding theory and cryptography. However, it is computationally overloaded for lightweight devices arisen in quantity with the dawn of the things of internet (IoT) era. As an important form of cloud computing services, secure computation outsourcing has become a popular topic. In this paper, we design an efficient outsourcing scheme that enables the resource-constrained client to find a solution of the mathcal {LMSLE} with the assistance of a public cloud server. By utilizing affine transformation based on sparse unimodular matrices, our scheme has three merits compared with previous work: 1) Our scheme is efficiency/security-adjustable. Our encryption method is dynamic, and it can balance the security and efficiency to match different application scenarios by skillfully control the number of unimodular matrices. 2) Our scheme is versatile. It is suit for generic m-by-n coefficient matrix A, no matter it is square or not. 3) Our scheme satisfies public verifiability and achieves the optimal verification probability. It enables any verifier which is not necessarily the client to verify the correctness of the results returned from the cloud server with probability 1. Finally, theoretical analysis and comprehensive experimental results confirm our scheme’s security and high efficiency.

Provably Secure and Generalized Signcryption With Public Verifiability for Secure Data Transmission Between Resource-Constrained IoT Devices

The Internet of Things (IoT) is revolutionizing our modern lives by introducing active connection between smart devices. However, IoT devices are repeatedly exhibiting many security flaws, which will inevitably lead to eavesdropping and impersonation attacks. Thus, providing a proper security in IoT becomes a prime focus for the researchers. In cryptography, certificateless signcryption (CLSC) is one of the recent public key techniques for the security requirements of the authenticity and confidentiality of any message between the parties. In this article, a new generalized CLSC (gCLSC) is introduced to provide the functions of digital signature and encryption to fulfill the authenticity and confidentiality for the resource-constrained IoT devices. Besides, the gCLSC supports the property of public verifiability and security of an ideal signcryption under the strong Diffie–Hellman and bilinear Diffie–Hellman inversion problems without random oracle model. Performance assessment of the gCLSC gives satisfactory results after comparing with other competitive CLSC schemes in terms of its functionality. Therefore, the gCLSC can be adopted in the IoT networks where authenticity, confidentiality, and lightweight are the essential factors.

An identity-based online/offline secure cloud storage auditing scheme

Cloud storage has significantly reduced data management costs for data owners. However, loss of physical control over the data after outsourcing, triggers some security concerns such as data integrity. Provable Data Possession (PDP) protocols, enable data owners to audit the integrity of their outsourced data without the need to retrieve the file from cloud server. However, most existing PDP schemes require resource-constrained users to perform costly operations for generating metadata on file blocks. In online/offline PDP mechanisms introduced most recently, the user’s computation is divided into online/offline phases, where the costly operations are allowed to be carried out in the offline phase. The users only require to perform lightweight operations in the real-time online phase. In this paper, we propose an identity-based (ID-based) online/offline PDP protocol which not only has lightweight computations at the users side, but also removes the complex certificate management/verification costs caused by expensive Public Key Infrastructure. The proposed scheme is based on an ID-based online/offline signature designed in this paper. The protocol is proven to be secure against a malicious cloud server in the random oracle model. We also prove the privacy preserving property of the protocol in the sense that it leaks no information of the outsourced data to the public verifier during the protocol execution. Moreover, our mechanism supports batch verification of multiple auditing tasks and fully dynamic data operations, efficiently. Experimental results demonstrate fine efficiency of our scheme in comparison to the recent proposals.

Arbitrable blind quantum computation

Blind quantum computation (of a single-server case) is a two-party cryptographic protocol which involves a quantum computation server Bob and a client Alice who wants to delegate her quantum computation to Bob without revealing her quantum algorithms and her input to and output from the algorithms. Since Bob may be truant and pretend to execute some computation, Alice wants to verify Bob’s honesty on computation. To resolve this problem, the notion of the verifiability has been considered in the literature and several protocols of verifiable blind computation have been developed. Verifiable blind quantum computation enables Alice to check whether Bob is cheating or not. In addition to the above problem, another problem could arise. If Alice pretends to be a client and is actually a competitor against Bob, then she might slander Bob by fabricating his dishonesty. Therefore, if either Alice or Bob is cheating, then a “neutral” referee other than Alice and Bob should judge which is honest. The standard definition of the verifiability guarantees that only Alice can verify Bob’s computation, and thus, it should be called private verifiability. If Bob claims his innocence though he is actually cheating, then Alice cannot persuade any others that Bob is really cheating while Alice can recognize Bob’s cheating. In this paper, we incorporate arbitrators as the third party into blind quantum computation to resolve the above problems and give an arbitrable blind quantum computation scheme, which provides public verifiability in some sense.