Broadcast Encryption Research Articles

Reinventing BrED: A Practical Construction

Broadcast Encryption (BE) allows a sender to send an encrypted message to multiple receivers. In a typical broadcast encryption scenario, the broadcaster decides the set of users who can decrypt a particular ciphertext (denoted as the privileged set). Gritti et al. (IJIS'16) introduced a new primitive called Broadcast Encryption with Dealership (BrED), where the dealer decides the privileged set. A BrED scheme allows a dealer to buy content from the broadcaster and sell it to users. It provides better flexibility in managing a large user base. To date, quite a few different constructions of BrED schemes have been proposed by the research community. We find that all existing BrED schemes are insecure under the existing security definitions. We demonstrate a concrete attack on all the existing schemes in the purview of the existing security definition. We also find that the security definitions proposed in the state-of-the-art BrED schemes do not capture the real world. We argue about the inadequacy of existing definitions and propose a new security definition that models the real world more closely. Finally, we propose a new BrED construction and prove it to be secure in our newly proposed security model.

Ad Hoc Broadcast, Trace, and Revoke

Traitor tracing schemes [Chor–Fiat–Naor, Crypto ’94] help content distributors fight against piracy and are defined with the content distributor as a trusted authority having access to the secret keys of all users. While the traditional model caters well to its original motivation, its centralized nature makes it unsuitable for many scenarios. For usage among mutually untrusted parties, a notion of *ad hoc* traitor tracing (naturally with the capability of broadcast and revocation) is proposed and studied in this work. Such a scheme allows users in the system to generate their own public/secret key pairs, without trusting any other entity. To encrypt, a list of public keys is used to identify the set of recipients, and decryption is possible with a secret key for any of the public keys in the list. In addition, there is a tracing algorithm that given a list of recipients’ public keys and a pirate decoder capable of decrypting ciphertexts encrypted to them, identifies at least one recipient whose secret key must have been used to construct the said decoder. Two constructions are presented. The first is based on functional encryption for circuits (conceptually, obfuscation) and has constant-size ciphertext, yet its decryption time is linear in the number of recipients. The second is a generic transformation that reduces decryption time at the cost of increased ciphertext size. A matching lower bound on the trade-off between ciphertext size and decryption time is shown, indicating that the two constructions achieve all possible optimal trade-offs, i.e., they fully demonstrate the Pareto front of efficiency. The lower bound also applies to broadcast encryption (hence all mildly expressive attribute-based encryption schemes) and is of independent interest.

A revocable and comparable attribute-based signature scheme from lattices for IoMT

The Internet of Medical Things (IoMT) refers to the utilization of the Internet of Things (IoT) technology in the healthcare industry. Access control is particularly important for IoMT due to the sensitive nature of patient data, such as electronic health records (EHR). Although fine-grained access control can be achieved by attribute-based signature (ABS), existing ABS schemes lacks the ability to provide range comparison access policy in which patients can check whether the attribute value is within a certain range. In addition, the dynamic change of doctors’ permissions and the development of quantum technology also require that ABS can provide user revocation and resist quantum attacks. In order to solve these problems and make ABS schemes for IoMT more useful and more secure, we come up with a novel revocable and comparable ABS (RC-ABS) from lattices for IoMT, enabling fine-grained access control, attribute range comparison, and user revocation. First of all, we provide a proof of the unforgeability of our scheme in the standard model (SM) under the selective user revocation list semi-adaptive attribute adaptive message attack, which can resist attacks by semi-honest adversaries and prevent adversaries from attacking the weaknesses of hash functions in IoMT. Furthermore, our ABS scheme leverages the small integer solution problem (SIS) to effectively defends against quantum algorithm attacks. Finally, detailed performance analysis demonstrates that our solution not only possesses enhanced security features and functionalities, such as revocability, comparability, and resistance against quantum attacks, but also maintains a constant computation cost of user revocation, making it more efficient compared to other revocation schemes.

Broadcast Encryption using Sum-Product decomposition of Boolean functions

The problem of Broadcast Encryption (BE) consists in broadcasting an encrypted message to a large number of users or receiving devices in such a way that the emitter of the message can control which of the users can or cannot decrypt it. Since the early 1990s, the design of BE schemes has received significant interest and many different concepts were proposed. A major breakthrough was achieved by Naor, Naor and Lotspiech (CRYPTO 2001) by partitioning cleverly the set of authorized users and associating a symmetric key to each subset. Since then, while there have been many advances in public-key based BE schemes, mostly based on bilinear maps, little was made on symmetric cryptography. In this paper, we design a new symmetric-based BE scheme, named Σ Π BE, that relies on logic optimization and consensual security assumptions. It is competitive with the work of Naor et al. and provides a different tradeoff: the bandwidth requirement is significantly lowered at the cost of an increase in the key storage.

Anonymous attribute-based broadcast encryption with hidden multiple access structures

Due to the high demands of data communication, the broadcasting system streams the data daily. This service not only sends out the message to the correct participant but also respects the security of the identity user. In addition, when delivered, all the information must be protected for the party who employs the broadcasting service. Currently, Attribute-Based Broadcast Encryption (ABBE) is useful to apply for the broadcasting service. (ABBE) is a combination of Attribute-Based Encryption (ABE) and Broadcast Encryption (BE), which allows a broadcaster (or encrypter) to broadcast an encrypted message, including a predefined user set and specified access policy to install the authorization mechanism. It is desirable to hide all the information when producing in the ciphertext, which has not been considered in the previous works of ABBE. Motivated by the above issue, we devise a solution to achieve anonymity for the ABBE scheme, which not only hides the access structures but also anonymizes the user’s identity. In this work, we propose two schemes as Anonymous Key Policy (AKP)-ABBE and Anonymous Ciphertext Policy (ACP)-ABBE with supporting multiple access structures by using OR/AND\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\ extsf {OR}/\ extsf {AND}$$\\end{document} gates. Specifically, we present the generic constructions of AKP/ACP-ABBE on the building block of the Inner Product Encryption (IPE\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\ extsf {IPE}$$\\end{document}), which enables the hidden user’s identity and complex OR/AND\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\ extsf {OR}/\ extsf {AND}$$\\end{document}-Gate access structure. We show that our proposed schemes are secured under the standard models.

Reinforcing privacy in cloud computing via adaptively secure non-zero inner product encryption and anonymous identity-based revocation in unbounded setting

Cloud computing serves as an advanced computing technology to support Internet services and has numerous applications, including medical fields, online data storage, social network, big data analysis, and e-learning platforms. Inner product encryption (IPE) is a promising cryptographic primitive that facilitates access control over outsourced encrypted data by restricting decryption capability via an inner product relation. Most of the existing IPEs are built assuming a priori bound on the length of attribute vectors associated with the plane data. A situation may occur when adding new attributes is essential due to upgradation. Thus it is desirable to construct IPE with variable length attribute vectors instead of fixing the length at the setup phase. Such IPEs are more flexible while encrypting data and consequently have more real-life applications. In the following, we make our contributions:–We design the first efficient adaptively payload-hiding secure unbounded non-zero IPE (UNIPE) scheme from the standard symmetric external Diffie-Hellman (SXDH) assumption and prove security in the standard model.–We propose a generic construction of an adaptively weak attribute-hidingUNIPE from an unbounded inner product functional encryption (UIPFE) scheme. We also instantiate UNIPE from the SXDH assumption and prove security in the standard model.–Finally, we present the first unbounded anonymous identity-based revocation (UAnon-IBRV) scheme using our generic UNIPE as the building block. The anonymity feature ensures that the ciphertext reveals no information about the revoking sets of the system.

A traceable and revocable broadcast encryption scheme for preventing malicious encryptors in Medical IoT

Medical data sharing is essential for the advancement of medical research, but the existence of malicious encryptors and malicious users poses a major challenge to the seamless sharing of information among healthcare providers. We proposed a traceable and revocable broadcast encryption scheme for preventing malicious encryptors in the Medical Internet of Things (MIoT). In 2023, Wang et al. first proposed the concept of malicious encryptor for broadcast encryption and trator tracing, and they constructed a scheme for preventing this attack. The malicious encryptor is reasonable in real broadcast encryption systems because the encryptor is not always the same as the digital content provider. When digital content providers for medical institutions want to share sensitive medical data, the employees may implement encryption. Then the employees may plant some trapdoors and sell to the black market, which can be used to construct pirated boxes. To resist malicious encryptor attacks, we rely on the uniform distribution of the output of the secure cryptographic hash function to generate the randomness needed for encryption. To prevent malicious users from selling their private keys to attackers, we set up public tracing and revocation mechanisms. Meanwhile, we enable digital content providers to share common encrypted data to different groups of authorized users protected by privacy, while also sharing individual data to designated consumers of those groups. Under the decision q-parallel BDHE assumption without random oracles, our construction is demonstrated to be adaptive IND-CPA secure. Since we have a compact communication bandwidth, a constant user secret key size, and only three bilinear operations are needed for decryption to recover the encrypted broadcast message, our scheme does not add much overhead and is therefore practical.

TRE-DSP: A traceable and revocable CP-ABE based data sharing scheme for IoV with partially hidden policy

With the popularity of the Internet of Vehicles (IoV), a large amount of data is being generated every day. How to securely share data between the IoV operator and various value-added service providers becomes one of the critical issues. Due to its flexible and efficient fine-grained access control feature, Ciphertext-Policy Attribute-Based Encryption (CP-ABE) is suitable for data sharing in IoV. However, there are many flaws in most existing CP-ABE schemes, such as attribute privacy leakage and key misuse. This paper proposes a traceable and revocable CP-ABE-based data sharing with partially hidden policy for IoV (TRE-DSP). A partially hidden access structure is adopted to hide sensitive user attribute values, and attribute categories are sent along with the ciphertext to effectively avoid privacy exposure. In addition, key tracking and malicious user revocation are introduced with broadcast encryption to prevent key misuse. Since the main computation task is outsourced to the cloud, the burden of the user side is relatively low. Analysis of security and performance demonstrates that TRE-DSP is more secure and practical for data sharing in IoV.

Fully anonymous identity-based broadcast signcryption with public verification

In the multicast communication scenario, compared with broadcast encryption, broadcast signcryption or multi-receiver signcryption has additional ability to authenticate the source of the message. With the enhanced awareness of privacy preservation, ordinary users pay more attention to the identity leakage in the communication process. The primitive of anonymous broadcast signcryption has been proposed to solve this problem, which provides additional anonymity compared with the existing broadcast signcryption. However, most anonymous broadcast signcryption schemes only ensure the sender's identity concealment but ignore the anonymity of the receiver set. In this paper, we present a fully anonymous identity-based broadcast signcryption scheme, which meets insider unforgeability, outsider confidentiality, identity concealment of sender and full anonymity of the receiver set. In addition, our scheme has two further desirable characteristics. One is public verifiability which means any third party can verify the validity of the message source without knowing the private key provided by the receiver. The other is statelessness which means the user does not need to update the private key due to the join or revocation of other users. Moreover, our scheme has constant-size public parameters and private key as well as constant decryption complexity, which makes the scheme more suitable for deployment in devices with limited storage or low computing power such as IoT devices.

MRLWE-CP-ABE: A revocable CP-ABE for post-quantum cryptography

Abstract We address the problem of user fast revocation in the lattice-based Ciphertext Policy Attribute-Based Encryption (CP-ABE) by extending the scheme originally introduced by Zhang and Zhang [Zhang J, Zhang Z. A ciphertext policy attribute-based encryption scheme without pairings. In: International Conference on Information Security and Cryptology. Springer; 2011. p. 324–40. doi: https://doi.org/10.1007/978-3-642-34704-7_23.]. While a lot of work exists on the construction of revocable schemes for CP-ABE based on pairings, works based on lattices are not so common, and – to the best of our knowledge – we introduce the first server-aided revocation scheme in a lattice-based CP-ABE scheme, hence being embedded in a post-quantum secure environment. In particular, we rely on semi-trusted “mediators” to provide a multi-step decryption capable of handling mediation without re-encryption. We comment on the scheme and its application, and we provide performance experiments on a prototype implementation in the Attribute-Based Encryption spin-off library of Palisade to evaluate the overhead compared with the original scheme.

MBP: Multi-channel broadcast proxy re-encryption for cloud-based IoT devices

The broadcast proxy re-encryption methods extend traditional proxy re-encryption mechanisms, where a single user shares the cloud data with multiple receivers. When the sender has different data to share with different sets of users, the existing broadcast proxy re-encryption schemes allow him/her to calculate distinct re-encryption keys for different groups in terms of additional computation time and overhead. To overcome these issues, we propose a scheme, named MBP, in IoT application scenario that allows the sender to calculate a single re-encryption key for all the groups of users, i.e., IoT devices. We use the multi-channel broadcast encryption concept in the broadcast proxy re-encryption method, so as single re-encryption key calculation and single re-encryption are done for different groups of IoT devices. It reduces the size of the security elements. However, it increases the computation time of the receiver IoT devices at the time of decryption of both the ciphertexts. To address this issue, we use the Rubinstein-Ståhl bargaining game approach. MBP is secure under a selective group chosen-ciphertext attack using the random oracle model. The implementation of MBP shows that it reduces the communication overhead from the data owner to the cloud server and from the cloud server to the receiver than existing algorithms.

Generic Construction of Fully Anonymous Broadcast Authenticated Encryption with Keyword Search with Adaptive Corruptions

As a multireceiver variant of public key authenticated encryption with keyword search (PAEKS), broadcast authenticated encryption with keyword search (BAEKS) was proposed by Liu et al. (ACISP 2021). BAEKS focuses on receiver anonymity, where no information about the receiver is leaked from ciphertexts, which is reminiscent of the anonymous broadcast encryption. Here, there are rooms for improving their security definitions, e.g., two challenge sets of receivers are selected before the setup phase, and an adversary is not allowed to corrupt any receiver. In this paper, we propose a generic construction of BAEKS derived from PAEKS that provides ciphertext anonymity and consistency in a multireceiver setting. The proposed construction is an extension of the generic construction proposed by Libert et al. (PKC 2012) for the fully anonymous broadcast encryption and provides adaptive corruptions. We also demonstrate that the Qin et al. PAEKS scheme (ProvSec 2021) provides ciphertext anonymity and consistency in a multireceiver setting and can be employed as a building block of the proposed generic construction.

AC-SDVN: An Access Control Protocol for Video Multicast in Software Defined Vehicular Networks

The way to use limited bandwidth resources to achieve high-quality video services in vehicular networks is an important research topic. A large number of studies have shown that the fast-growing field of software defined networking (SDN) can provide solutions to the problems encountered by traditional IP networks when implementing video multicasting. However, there is no research addressing the security issues for this scenario. In this paper, we explore the application scenarios of video multicast in software defined vehicular networks (SDVN), and propose a secure and effective access control protocol to solve multicast security issues. This protocol realizes the authentication of multicast video requesting vehicles and RSUs. According to the authentication results, the SDN controller constructs multicast paths that only reach legitimate RSUs and vehicles, and only the vehicle passing the authentication can obtain video decryption keys. The protocol resists common attacks and satisfies the security requirements in vehicular networks. In addition, the scheme supports batch verification, which reduces the time cost of authentication, and adopts broadcast encryption technology to effectively reduce the communication load. Compared with related schemes, our protocol performs better in terms of computation and communication cost, packet loss rate, and time delay.

NDN-RBE: An Accountable Privacy Aware Access Control Framework For NDN

Abstract Named Data Networking (NDN) is an emerging network architecture. An important characteristic of NDN is its in-network cache, which enables Data packets to be available from multiple locations on the Internet. Hence the enforcement of access control mechanisms becomes even more critical in the NDN. This paper proposes a novel access control scheme referred to as Role-Based Encryption for NDN (NDN-RBE), which uses a broadcast encryption mechanism to achieve secure data access control. Our scheme uses the role inheritance property of the traditional Role-Based Access Control (RBAC) model to achieve efficient data access control over hierarchical content. This makes our scheme particularly suitable for large-scale real-world content-centric services like Netflix. Our scheme also supports additional design features such as anonymous signature-based authentication, batch signature verification and two types of privilege revocations. In addition, our formal security analysis demonstrates that our scheme is provably secure against Chosen Plaintext Attacks. Our performance and functionality comparison show that our scheme outperforms other notable existing works in terms of security, functionality, computation, communication and storage overhead. Furthermore, our experimental results show an improvement in content delivery time of the order of 15 percent compared with the other closely related works.

ROMSS: a rational optional multi-secret sharing scheme based on reputation mechanism

The traditional threshold secret sharing scheme only allows the participants’ sub-secret shares to be used once in the reconstruction process. Several multi-secret sharing schemes have been proposed that are related to cloud computing, aiming to improve reconstruction efficiency. Rational secret sharing is a technique that combines secret sharing with game theory. In traditional rational multi-secret sharing, participants must reconstruct all secrets, resulting in unnecessary overhead. Rational participants will act dishonestly to maximize their own interests, leading to a prisoner’s dilemma and incomplete secret reconstruction. Additionally, when sharing multiple secrets, the Dealer must distribute the sub-secret shares of all secrets to the participants, increasing overhead. In this paper, we propose a rational optional multi-secret sharing scheme based on a reputation mechanism that selectively reconstructs secrets according to participants’ needs in the context of cloud computing. Our scheme introduces a reputation mechanism to evaluate participants’ reputation values to avoid their dishonest behaviors. Furthermore, we adopt a broadcast encryption matrix so that participants only need to receive a single sub-secret share to participate in multi-secret reconstruction. Our security analysis shows that the proposed scheme can effectively constrain the self-interested behavior of rational participants and reduce the overhead in the process, thus multi-secret sharing scheme can provide more efficient and secure solutions for secret sharing in key management and distributive storage for the cloud scenarios.

Privacy-Preserving and Reliable Decentralized Federated Learning

Conventional federated learning (FL) approaches generally rely on a centralized server, and there has been a trend of designing asynchronous FL approaches for distributed applications partly to mitigate limitations associated with conventional (synchronous) FL approaches (e.g., single point of failure / attack). In this paper, we first introduce two new tools, namely: a quality-based aggregation method and an extended dynamic contribution broadcast encryption (DConBE). Building on these two new tools and local differential privacy, we then propose a privacy-preserving and reliable decentralized FL scheme, designed to support batch joining/leaving of clients while incurring minimal delay and achieving high model accuracy. In other words, our scheme seeks to ensure an optimal trade-off between model accuracy and data privacy, which is also demonstrated in our simulation results. For example, the results show that our aggregation method can effectively avoid low-quality updates in the sense that the scheme guarantees high model accuracy even in the presence of bad clients who may submit low-quality updates. In addition, our scheme incurs a lower loss and the extended DConBE only slightly affects the efficiency of our scheme. With the extended dynamic contribution broadcast encryption, our scheme can efficiently support batch joining/leaving of clients.

Constructions of broadcast encryption with personalized messages from bilinear map

Broadcast encryption (BE) is a one to many encryption protocol which sends a message to desired set of users securely and efficiently. Broadcast encryption with personalized messages (BEPMsg) is a cryptographic primitive that sends a common broadcast message together with user-specific personalized messages to a group of users. This work contains the transformation of broadcast encryption from the bilinear map to broadcast encryption with personalized messages. The transformation of BE from bilinear map to BEPMsg helps to design BEPMsg with different flavors. We have also proposed two BEPMsg constructions and discussed their security. Our first construction is an adaptive secure BEPMsg scheme. It also supports inclusive–exclusive property in encryption algorithm as the broadcaster can select the set of subscribed or revoked users to decrease the encryption cost depending on the size of the set of subscribed and revoked users. More positively, it has a constant header size. Our second construction provides outsider anonymity in BEPMsg by performing the decryption without using the set of subscribed or revoked users.

Adaptively secure multi-authority attribute-based broadcast encryption in fog computing

Fog computing is considered an important development in cloud computing, with shorter response times, less data transfer load and a more secure distributed service architecture that can be accessed by a wide range of end devices. As with cloud computing, it also faces the challenge of how to securely distribute sensitive data. Ciphertext-Policy Attribute-based Broadcast Encryption (CP-ABBE) can protect sensitive data and provide fine-grained access control with user revocation. However, existing CP-ABBE schemes suffer many limitations when implemented in a fog computing environment: a single authority performs poorly in handling requests or data from many IoT devices, leading to system delays or limited functionality; expensive decryption costs make the computation and storage overheads unfriendly to devices with limited resources; these schemes are only proven selectively secure, meaning that security was proven in a weaker model. In this paper, using threshold secret sharing and decryption delegation, we propose an adaptively secure attribute-based multi-authority broadcast encryption (MA-ABBE) scheme that breaks through these limitations. The comparison and analysis results show that our scheme is practical and achieves adaptive security, enables user-side fast decryption and low storage overhead, and provides a secure and efficient option for protecting sensitive data in fog computing environments.

Post-quantum secure recipient revocable broadcast encryption supporting anonymity

Post-quantum secure recipient revocable broadcast encryption supporting anonymity

Secure Cloud Storage Privacy-Preserving In Public Auditing

Cloud computing is a technology that is both efficient and cost-effective, thanks to its low maintenance requirements. This paper implemented a approach is used to share group resources across cloud users. Regrettably, as a result of the frequent differences in participation, the issue of sharing information in a multi-owner manner while also preserving privacy and information from a trusted cloud continues to be a challenging one. During the course we put into place a safe method of data sharing among multiple owners using the Diffe- Hellman algorithm that are cloud-based and applicable to rotating groups. By leveraging techniques like as group signature and dynamic broadcast encryption, any user of the cloud has the ability to anonymously share data with other users. In the meanwhile, the number of users whose access has been revoked does not have any impact on the storage overhead or encryption computation costs associated with our system. In addition, employ rigorous proofs to investigate the scheme's level of safety, and conduct tests to verify the scheme's usefulness.