Re-encryption Scheme Research Articles

Efficient Identity-based Proxy Re-encryption Scheme in Blockchain-assisted Decentralized Storage System

Efficient Identity-based Proxy Re-encryption Scheme in Blockchain-assisted Decentralized Storage System

Revocable Identity-Based Broadcast Proxy Re-Encryption for Data Sharing in Clouds

Cloud computing has become prevalent due to its nature of massive storage and vast computing capabilities. Ensuring a secure data sharing is critical to cloud applications. Recently, a number of identity-based broadcast proxy re-encryption (IB-BPRE) schemes have been proposed to resolve the problem. However, the IB-BPRE requires a cloud user (Alice) who wants to share data with a bunch of other users (e.g., colleagues) to participate the group shared key renewal process because Alice's private key is a prerequisite for shared key generation. This, however, does not leverage the benefit of cloud computing and causes the inconvenience for cloud users. Therefore, a novel security notion named revocable identity-based broadcast proxy re-encryption (RIB-BPRE) is presented to address the issue of key revocation in this work. In a RIB-BPRE scheme, a proxy can revoke a set of delegates, designated by the delegator, from the re-encryption key. The performance evaluation reveals that the proposed scheme is efficient and practical.

Identity Based Cryptography Using Matrices

A new method of identity (ID) based Elgamal type encryption/decryption is described. The technique uses rectangular integer matrices in finite field Zp, as the private keys. Adoption of modular arithmetic limits the size of the elements of the key matrices while maintaining reasonably high security levels. The principle of the method is extended to design a new ID based Proxy Re-Encryption (PRE) scheme that converts the cipher text (CT) intended for one user into a different CT which can be decrypted by another user. In present work, all mathematical operations like addition, subtraction, multiplication, and inversion of matrices are carried out using modular algebra. Further, ID based encryption/decryption as well as PRE has protection against chosen plain text and chosen CT attacks. Computational expensive techniques like, bilinear maps and modular exponentials are not used in the proposed scheme. Therefore, present technique is computationally less expensive compared to similar existing methods as confirmed by experimental results. Proposed PRE scheme is implemented within a cloud service system is well suited for secure data sharing among multiple end users.

SPChain: Blockchain-based medical data sharing and privacy-preserving eHealth system

The sharing of electronic medical records (EMRs) has great positive significance for research on disease and epidemic prevention. Recently, blockchain-based eHealth systems have achieved great success in terms of EMRs sharing and management, but there still remain some challenges. Permissioned blockchain-based solutions provide high throughput and scalability, but may suffer from rollback attacks and lead to privacy leakage. Designs based on the public blockchain, on the other hand, are more open and secure, but sacrifice scalability and have no incentives for medical institutions to join into the systems. Moreover, data retrieval in blockchain-based eHealth systems is inefficient because of the basic blockchain structure. To solve the above problems, we propose a blockchain-based medical data sharing and privacy-preserving eHealth system named SPChain. To achieve quick retrieval, we devise special keyblocks and microblocks for patients to store their EMRs. A reputation system is also constructed to motivate medical institutions to participate in SPChain. By using proxy re-encryption schemes, SPChain achieves medical data sharing for patients in a privacy-preserving manner. To evaluate SPChain, we leverage the distribution of miners in the real world to test the system’s performance and ability to resist mentioned attacks. The results show that SPChain can achieve high throughput (220 TPS) with low storage overhead. Compared with the existing schemes, SPChain achieves lower time complexity in terms of data retrieving, and can resist proposed blockchain attacks as well as SPChain attacks.

Fine-Grained Access Control Scheme Based on Improved Proxy Re-Encryption in Cloud

Cloud storage technology has attracted a considerable number of users owing to its exponential growth. Storing data in the cloud can save the resources of local storage configuration and reduce the cost of local hardware investment. However, the data stored in the cloud is out of the physical control (out of control) of the user. Based on the service characteristics of the cloud environment and the security requirements of user privacy data in the cloud environment, this paper proposes an improved identity proxy re-encryption algorithm based on the advanced encryption standard algorithm. The performance of the algorithm is optimized by reducing the number of bilinear mapping operations, whose calculation takes the longest time in the proxy re-encryption scheme. Only two bilinear mapping operations are required in this scheme. In addition, the encrypted data are tested to different degrees. The experimental results show that this scheme satisfies encryption and decryption performance requirements of the user.

Attribute-based proxy re-encryption from standard lattices

Attribute-based proxy re-encryption (ABPRE), which combines the notions of proxy re-encryption (PRE) and attribute-based encryption (ABE), allows a semi-trusted proxy to transform a ciphertext under a particular access-policy into a ciphertext under another access policy, without revealing any information about the underlying plaintext. This primitive is very useful in some applications, where encrypted data needs to be stored in untrusted environments, such as cloud storage. In its key-policy flavor, the secret key is associated with an access policy that specifies which type of ciphertexts can be decrypted by that key, where ciphertexts are marked with different sets of attributes. However, all existing key-policy attribute-based proxy re-encryption (KP-ABPRE) schemes are based on classical number-theoretic assumptions, which are vulnerable to quantum attacks. This paper proposes the first KP-ABPRE scheme based on the learning with errors (LWE) problem, which is widely believed to be quantum-resistant. Our scheme is multi-hop, supports polynomial-depth policy circuits and has short private keys, where the size of the keys is dependent only on the depth of the supported policy circuits. In addition, we prove that our scheme is CPA secure in the selective security model, based on the LWE assumption.

IB-VPRE: adaptively secure identity-based proxy re-encryption scheme from LWE with re-encryption verifiability

Identity-based proxy re-encryption (IB-PRE) can convert the ciphertext encrypted under Alice’s identity to Bob’s ciphertext of the same message by a semi-trusted proxy with the proper transformation key. The main purpose of our work is to enhance the security of IB-PRE. For outside attacks, all existing IB-PRE constructions from lattices have only achieved a limited or weak security model called IND-sID-CPA security. Therefore, by embedding re-encryption key generation and re-encryption algorithms appropriately in Agrawal et al.’s identity-based encryption scheme from lattices, we construct an IND-ID-CPA secure IB-PRE scheme over decisional learning with errors (LWE) under the standard model. For inside attacks, we propose a new primitive IB-VPRE by extending the basic IB-PRE scheme with a new functionality called re-encryption verifiability, meaning that a re-encrypted ciphertext receiver or a third party can verify whether the received ciphertext is correctly transformed from an original ciphertext or not, and thus can detect illegal activities of the proxy. We realize re-encryption verifiability using the homomorphic signature technique as a black box, making the resulting scheme non-interactive and quantum-immune after instanced by a lattice-based homomorphic signature scheme.

Blockchain-based Searchable Proxy Re-encryption Scheme for EHR Security Storage and Sharing

The sharing of electronic health records (EHR) has shown significant advantages in the accurate diagnosis of patients and the development of medical institutions. However, due to the privacy and sensitivity of medical data, it is easy to cause security issues such as difficulty in data sharing among different medical institutions and easy leakage of data privacy. Because the blockchain has the characteristics of non-tampering, anonymity, and decentralization. We propose a blockchain-based searchable proxy re-encryption scheme for EHR security storage and sharing. First, we use blockchain and cloud server to store encrypted EHR together to prevent EHR from being tampered with and leaked. Secondly, we use a certificateless encryption and proxy re-encryption based on identity and type scheme as a data sharing protocol. Meanwhile, searchable encryption technology is used to generate a keyword index. Moreover, the proxy node is selected by the delegated proof-of-stake (DPOS) consensus algorithm, which ensures the privacy, immutability and security. It realizes the safe access of third-party data users to medical health data. Finally, security analysis and evaluation show that our scheme can resist identity disguise and replay attacks. In addition, it has stronger security and higher efficiency.

CCA secure and efficient proxy re-encryption scheme without bilinear pairing

Proxy re-encryption enables the conversion of ciphertext of a message encrypted with one users public key into a ciphertext that could be decrypted by another users private key. Proxy re-encryption can be used as tool for delegation in wide variety of applications. Since proxy re-encryption is used as a primitive for delegation in varied applications, the primitive should be secure and efficient. Also, depending on application scenario, it should satisfy various properties. The proxy re-encryption scheme without bilinear pairing are preferred, as the bilinear pairing is costly operation. We propose an efficient proxy re-encryption scheme without bilinear pairing. The proposed scheme is unidirectional, key optimal, collusion safe, non-interactive, non-transitive, proxy visible, provides original access and satisfies temporary property. The scheme handles the temporary property elegantly compared to the existing schemes without affecting the signing capability of the delegator. Also, the proxy visible property allows the delegatee to prioritize his responses. The proposed scheme is proved to be secure against the chosen ciphertext attack under random oracle model. The proposed scheme is shown to be efficient than the existing schemes.

A Lattice-Based Homomorphic Proxy Re-Encryption Scheme with Strong Anti-Collusion for Cloud Computing.

The homomorphic proxy re-encryption scheme combines the characteristics of a homomorphic encryption scheme and proxy re-encryption scheme. The proxy can not only convert a ciphertext of the delegator into a ciphertext of the delegatee, but also can homomorphically calculate the original ciphertext and re-encryption ciphertext belonging to the same user, so it is especially suitable for cloud computing. Yin et al. put forward the concept of a strong collusion attack on a proxy re-encryption scheme, and carried out a strong collusion attack on the scheme through an example. The existing homomorphic proxy re-encryption schemes use key switching algorithms to generate re-encryption keys, so it can not resist strong collusion attack. In this paper, we construct the first lattice-based homomorphic proxy re-encryption scheme with strong anti-collusion (HPRE-SAC). Firstly, algorithm TrapGen is used to generate an encryption key and trapdoor, then trapdoor sampling is used to generate a decryption key and re-encryption key, respectively. Finally, in order to ensure the homomorphism of ciphertext, a key switching algorithm is only used to generate the evaluation key. Compared with the existing homomorphic proxy re-encryption schemes, our HPRE-SAC scheme not only can resist strong collusion attacks, but also has smaller parameters.

A Secure and Privacy-Preserving Machine Learning Model Sharing Scheme for Edge-Enabled IoT

With the popular use of IoT devices, edge computing has been widely applied in the Internet of things (IoT) and regarded as a promising solution for its wide distribution, decentralization, low latency. At the same time, in response to the massive computing data and intelligent requirements of various applications in the IoT, artificial intelligence (AI) technology has also achieved rapid development. As a result, edge intelligence (EI) for the Internet of Things has attracted widespread attention. Driven by the requirement that making full use of data, machine learning (ML) models trained in EI are usually shared. However, there may be some security and privacy issues due to the openness and heterogeneity of edge intelligence. How to ensure flexible data access and data security as well as the accountability for edge nodes and users in EI model sharing have become important issues. In this article, we propose a Ciphertext Policy Attribute Based Proxy Re-encryption (CP-ABPRE) scheme with accountability to address the security and privacy issues in EI model sharing. In our scheme, a user can delegate the access right to others to make model access more flexible. Furthermore, each entity that may need to be held accountable is embedded a unique ID to achieve traceability. Finally, security analysis and performance evaluation are given to prove that our scheme is CPA secure and does not lose much efficiency with more features.

A Novel Revocable and Identity-Based Conditional Proxy Re-Encryption Scheme With Ciphertext Evolution for Secure Cloud Data Sharing

Proxy re-encryption (PRE), with the unique ciphertext transformation ability, enables various ciphertext authorization applications to be implemented efficiently. However, most existing PRE schemes mainly focus on access authorization while ignoring the situation where the key needs to be changed and the ciphertext needs to be evolved, making the scheme's practicability and security inadequate. Moreover, the few schemes that simultaneously combine ciphertext authorization, key update, and ciphertext evolution are not satisfactory in terms of security. For solving this problem, based on Xiong et al.'s scheme, this paper proposes an improved revocable and identity-based conditional proxy re-encryption scheme with ciphertext evolution (RIB-CPRE-CE) for secure and efficient cloud data sharing. The proposed scheme inherits the characteristics of multi-use, constant ciphertext length, fine-grained authorization, collision-resistance security, and chosen ciphertext attack (CCA) security from the original method. Also, it supports updating ciphertext to adapt to the new key after changing the identity (key) or achieves authorization revocation by evolving ciphertext. Two new algorithms, URKeyGen and UpReEnc, have been integrated into the original delegation scheme to support ciphertext evolution. The formal definition, security model, concrete construction, and security analysis of RIB-CPRE-CE have been presented. The comparison and analysis show that the proposed scheme is practical and secure. Although it adds a ciphertext evolution function for supporting key update and delegation revocation, its efficiency and security are not reduced. The proposed scheme can also be used in other access authorization systems that need to change the key or revoke the authorization. It has certain practicability and security.

Proxy re-encryption enabled secure and anonymous IoT data sharing platform based on blockchain

Data is central to the Internet of Things (IoT) ecosystem. With billions of devices connected, most of the current IoT systems are using centralized cloud-based data sharing systems, which will be difficult to scale up to meet the demands of future IoT systems. The involvement of such a third-party service provider requires also trust from both the sensor owner and sensor data user. Moreover, fees need to be paid for their services.To tackle both the scalability and trust issues and to automatize the payments, this paper presents a blockchain-based marketplace for sharing of the IoT data. We also use a proxy re-encryption scheme for transferring the data securely and anonymously, from data producer to the consumer. The system stores the IoT data in cloud storage after encryption. To share the collected IoT data, the system establishes runtime dynamic smart contracts between the sensor and data consumer without the involvement of a trusted third-party. It also uses a very efficient proxy re-encryption scheme which allows that the data is only visible by the owner and the person present in the smart contract. This novel combination of smart contracts with proxy re-encryption provides an efficient, fast and secure platform for storing, trading and managing sensor data. The proposed system is implemented using off-the-shelf IoT sensors and computer devices. We also analyze the performance of our hybrid system by using the permission-less Ethereum blockchain and compare it to the IBM Hyperledger Fabric, a permissioned blockchain.

A New Searchable Encryption Scheme with Integrity Preservation Property

Searchable encryption schemes allow documents’ owners to store their encrypted documents on servers, search for the desired keyword and then download only the desired encrypted file and then decrypt. Storing files on remote servers can be further developed, which, in addition to allow access to files at any location and at any time, it also gives the data owners the confidence that their files are stored without any change in the servers. This property can be interpreted as the integrity preservation property of encrypted documents in the searchable encryption schemes. Recently, in Yang et al. (Concurr Comput Pract Exp 29:e4211, 2017), Yang et al. proposed a semantic keyword searchable proxy re-encryption scheme and claimed their scheme resists against collusion and provides data privacy. However, in this paper, we show that unfortunately, their searchable encryption scheme does not provide the perfect security and their scheme is vulnerable against integrity contradiction attack. Our proposed attack is implemented in three different scenarios, its success probability of each scenario is one and its complexity is only one run of the scheme. We also improve Yang et al. scheme and show informally and formally that the improved scheme is secure against the attacks presented in this paper and also other known active and passive attacks. Comparisons also showed that the proposed scheme, in addition to the complete security it provides, is acceptable in terms of communication, storage and computational costs.

Secure Key Storage and Access Delegation Through Cloud Storage

Cloud storage is gaining popularity to store and share files. To secure the files, cloud storage providers supply client interfaces with the facility to encrypt the files and upload them into the cloud. When client-side encryption is done, the onus of key management lies with the cloud user. Public key proxy re-encryption mechanisms can be used to distribute the key among stakeholders of the file. However, clients use low powered devices like mobile phones to share their files. Lightweight cryptography operations are needed to carry out the encryption operations. Ring-LWE-based encryption scheme meets this criterion. In this work, a proxy re-encryption scheme is proposed to distribute the file key. The scheme is proved CCA secure under Ring-LWE assumption in the random oracle model. The performance of the scheme is compared with the existing proxy re-encryption schemes which are observed to show better performance for re-encryption and re-key generation.

A Cloud-Assisted Proxy Re-Encryption Scheme for Efficient Data Sharing Across IoT Systems

In recent years, the growth of IoT applications is rapid in nature and widespread across several domains. This tremendous growth of IoT applications leads to various security and privacy concerns. The existing security algorithms fail to provide improved security features across IoT devices due to its resource constrained nature (inability to handle a huge amount of data). In this context, the authors propose a cloud-assisted proxy re-encryption scheme for efficient data sharing across IoT systems. The proposed approach solves the root extraction problem using near-ring. This improves the security measures of the system. The security analysis of the proposed approach states that it provides improved security with lesser computational overheads.

Constant-size CCA-secure multi-hop unidirectional proxy re-encryption from indistinguishability obfuscation

In ACM CCS 2007, Canetti and Hohenberger left an open problem of how to construct a multi-hop unidirectional proxy re-encryption scheme secure against chosen-ciphertext attacks (CCA). To resolve this problem, we utilize the recent advances in indistinguishability obfuscation, overcome several obstacles and propose a multi-hop unidirectional proxy re-encryption scheme. The proposed scheme is proved to be CCA-secure in the standard model (i.e., without using the random oracle heuristic), and its ciphertext remains constant-size regardless of how many times it has been transformed. It is worth noting that, our techniques proposed in this paper can also be used to construct an identity-based multi-hop unidirectional PRE scheme with constant-size ciphertexts and CCA-security in the standard model.

Survey of Data Confidentiality and Privacy in the Cloud Computing Environment

The objective of this research is to develop a scheme for improving cloud data confidentiality. A considerable number of people are sharing data through third-party applications in the cloud computing environment. According to reviewed literature, it has been realized that data security and privacy were the key challenges to the wider adoption of cloud services with insider threats being the most prevalent. Similarly, our online survey indicated that 53.3% of the respondents citing insider breaches as the main threat to their organizational data. The survey also confirmed that data security and privacy is one of the greatest barriers to the adoption of cloud services in their organization. Noting the flaws of Attribute-Based Encryption (ABE) and Identity-based encryption (IBE), and with the growth of computing power, applications are constantly being developed which makes them vulnerable to attacks. Since data confidentiality is essential in the provision of information security in the cloud, this paper suggested the development and the deployment of a hybrid attribute-based re-encryption scheme, which is a scheme that bridges the ABE and IBE, to secure data in the cloud computing environment. Keywords: Encryption, Cloud Computing, Data, confidentiality, Privacy DOI: 10.7176/CEIS/11-5-03 Publication date: September 30 th 2020

Certificateless Proxy Reencryption Scheme (CPRES) Based on Hyperelliptic Curve for Access Control in Content-Centric Network (CCN)

Information-centric networking is the developing model envisioned by an increasing body of the data communication research community, which shifts the current network paradigm from host centric to data centric, well-known to information-centric networking (ICN). Further, the ICN adopts different types of architectures to extend the growth of the Internet infrastructure, e.g., name-based routing and in-network caching. As a result, the data can be easily routed and accessed within the network. However, when the producer generates contents for authentic consumers, then it is necessary for him/her to have a technique for content confidentiality, privacy, and access control. To provide the previously mentioned services, this paper presents a certificateless proxy reencryption scheme (CPRES) based on the hyperelliptic curve for access control in the content-centric network (CCN). Using certificateless PRE, the power of the key generation center (KGC) is limited to only the generation of partial keys to secure the access to the content. With the help of these partial keys, the producer further calculates keys for encryption and reencryption process. The simulation results show that the proposed scheme provides secure access to content during end-to-end communication. Moreover, the proposed CPRES scheme outperforms in terms of low computational energy and efficient utilization of communication bandwidth.

P2B: Privacy Preserving Identity-Based Broadcast Proxy Re-Encryption

This paper proposes Privacy Preserving Identity-Based Broadcast Proxy Re-encryption (P2B) — a scheme to provide privacy preserving in identity-based broadcast proxy re-encryption. P2B uses Lagrange interpolation polynomial theorem to provide privacy to identities of the receiver group of broadcasted re-encrypted ciphertext. Proxy re-encryption is an efficient solution to securely share cloud data with receivers. For sharing data with a group of receivers, the sender needs to regenerate the re-encryption key for every receiver, which leads to an overhead on the sender side. To solve the issue, identity-based proxy re-encryption is extensible to identity-based broadcast proxy re-encryption. However, the later poses a privacy issue on the receiver side, as each receiver of the receiver group needs to know the other receiver's identity. We solve the problem using the Lagrange interpolation method. We prove that our scheme is secure against chosen plaintext attack using random oracle model and it successfully hides the identities of the receivers. Finally, we implement P2B and compare it with other existing systems. It is seen that P2B reduces the decryption time by $68\%$ than recent existing Broadcast proxy re-encryption schemes and $98\%$ than the existing privacy preserving schemes.