Search

Modern healthcare has a sharp focus on data aggregation and processing technologies. Consequently, from a data perspective, a patient may be regarded as a timestamped list of medical conditions and their corresponding corrective interventions. Technologies to securely aggregate and access data for individual patients in the quest for precision medicine have led to the adoption of Digital Twins in healthcare. Digital Twins are used in manufacturing and engineering to produce digital models of physical objects that capture the essence of device operation to enable and drive optimization. Thus, a patient's Digital Twin can significantly improve health data sharing. However, creating the Digital Twin from multiple data sources, such as the patient's electronic medical records (EMR) and personal health records (PHR) from wearable devices, presents some risks to the security of the model and the patient. The constituent data for the Digital Twin should be accessible only with permission from relevant entities and thus requires authentication, privacy, and provable provenance. This paper proposes a blockchain-secure patient Digital Twin that relies on smart contracts to automate the updating and communication processes that maintain the Digital Twin. The smart contracts govern the response the Digital Twin provides when queried, based on policies created for each patient. We highlight four research points: access control, interaction, privacy, and security of the Digital Twin and we evaluate the Digital Twin in terms of latency in the network, smart contract execution times, and data storage costs. [ABSTRACT FROM AUTHOR]

The emerging cloud storage technology has significantly improved efficiency and productivity in the traditional electronic healthcare field. However, it has also brought about many security concerns. Ciphertext policy attribute-based encryption (CP-ABE) holds immense potential in achieving fine-grained access control, providing robust security for electronic healthcare data in the cloud. However, current CP-ABE schemes still face issues such as inflexible attribute revocation, relatively lower computational capabilities, and key management. To address these issues, this paper introduces a revocable and traceable undeniable ciphertext policy attribute-based encryption scheme (MA-RUABE). MA-RUABE not only enables fast and accurate data traceability, effectively preventing malicious user key leakage, but also includes a direct revocation feature, significantly enhancing computational efficiency. Furthermore, the introduction of a multi-permission mechanism resolves the issue of centralization of power caused by single-attribute permissions. Furthermore, a security analysis demonstrates that our system ensures resilience against chosen plaintext attacks. Experimental results demonstrate that MA-RUABE incurs lower computational overhead, effectively enhancing system performance and ensuring data-sharing security in cloud-based electronic healthcare systems. [ABSTRACT FROM AUTHOR]

In application scenarios such as cloud storage, a symmetric algorithm can be used to encrypt massive data. However, using the symmetric operation and keys in encryption and decryption, it is very difficult to realize an efficient access control system. The asymmetric encryption algorithm ciphertext-policy attribute-based encryption (CP-ABE), as a versatile one-to-many encryption algorithm, is considered an ideal access control tool to solve the user's distrust of the service provider of cloud storage. However, in a traditional CP-ABE system, the malicious users may deliberately leak their attribute keys to others or build a decryption black box (DB) to provide illegal decryption services for benefits, while no one can determine their identities. To deal with the problems, especially the problem of tracing the DB builder, CP-ABE schemes with black-box traceability have been proposed in the past few years. But in this paper, we point out that for now, the tracing algorithms in all existing schemes actually work on an impractical assumption. That is, whenever a DB receives a decryption request, it always performs the decryption algorithm honestlycorrectly. We argue that if a DB finds the decryption request comes from the tracing algorithm, it may intentionally output incorrect decryption results to counter the tracing. Thus, we present the structural defect of the tracing algorithm applied to all known traceable CP-ABE schemes. We describe the construction of an alert decryption black box (ADB) that is capable of distinguishing a tracing ciphertext from a normal one. We also show how an ADB frustrates the tracing algorithm, and furthermore, malicious users can even apply an ADB to frame innocent users. [ABSTRACT FROM AUTHOR]

Cloud storage is the ideal solution for outsourcing big data since the cloud can store a large amount of data. Cloud storage, on the other hand, raises additional problems about data duplication, fine-grained access control, and privacy, all of these factors are crucial for cloud large data storage. Data duplication approaches based on encrypted data schemes now available do not provide for fine-grained access control. This paper proposes a secure framework for managing data using rapid asymmetric maximum based dynamic size chunking and fuzzy logic for deduplication. Chunking, fingerprinting, hashing, and writing are the four main process of the proposed method. Initially, chunking is done to split the files into chunks. Rapid Asymmetric Maximum (RAM) based Dynamic Size Chunking (DSC) is used in the proposed method. These chunked files are then fingerprinted using hashing process for ensuring data authentication. Then B-tree indexing approach is used in the proposed method in order to keep the fingerprinted in an organized state. General Type2-Fuzzy logic is using Ant Lion Optimization (ALO) is used for detecting duplicate files in the documents. In the cloud storage platform, only non-duplicate documents are safely kept. The Triple Data Encryption Standard is used to do a security study before outsourcing non-duplicate data to a third-party cloud server. The total computation time of the proposed technique is 0.4 s in the inline phase and 0.04 s in the offline phase, and the deduplication ratio is 95% in the inline phase and 90% in the offline phase. This proposed deduplication approach requires less storage, which reduces memory use and processing time. [ABSTRACT FROM AUTHOR]

Cloud computing offers abundant computing resources and scalable storage, but data leakage in the cloud storage environment is a common and critical concern due to inadequate protection measures. Revocable-attribute-based encryption (RABE) is introduced as an advanced form of identity-based encryption (IBE), which encrypts sensitive data while providing fine-grained access control and an effective user revocation mechanism. However, most existing RABE schemes are not resistant to quantum attacks and are limited in their application scenarios due to the revocation model. In this paper, we propose a RABE scheme constructed from lattices. Our scheme has several advantages, including a near-zero periodic workload for the key generation center (KGC), ensuring scalability as the number of users increases. Additionally, the encryptor is relieved from managing a revocation list. Moreover, our scheme guarantees the confidentiality and privacy of other ciphertexts even if the decryption key for a specific period is compromised. We validated the correctness of our scheme and demonstrated its security under the assumption of learning with errors (LWE), which is widely believed to be resistant to quantum attacks. Finally, we provide an application example of our RABE scheme in the electronic healthcare scenario. [ABSTRACT FROM AUTHOR]

Cloud-based electronic medical record (EMR) management system is an emerging paradigm that enables EMR owners to store and share their EMRs with intended group of healthcare personnel. And, it allows EMR users to retrieve desired records from the cloud when require. However, authentic EMR sharing and searching with security has been a challenging problem. In this paper, for the first time, we propose a searchable attribute-based signcryption for EMR storage and retrieval in cloud computing environment, termed as MediCare, that supports simultaneously the functionalities: fine-grained access control over encrypted EMRs, EMR owner authenticity and anonymity, Boolean formula-based keyword search over encrypted EMRs, keyword privacy, constant decryption cost for EMR users, non-interactive search results verification, and provably secure. We employ attribute-based framework in designing MediCare. Only authorized EMR owners can anonymously upload EMRs to the cloud, and an EMR user can search over encrypted EMRs using Boolean formula keyword policy. MediCare enables an EMR user to verify the correctness of the search results efficiently without interacting with any authority. We define more general security definitions of MediCare and provide rigorous security analysis. We also conduct experiments to evaluate MediCare's performance. [ABSTRACT FROM AUTHOR]

Currently, cloud storage servers are controlled by a third-party administrator. This semi-trusted approach gives rise to security concerns. Therefore, in cloud computing, some protocols use a key manager to encrypt the user's private data before uploading the data to the cloud. However, the security concerns that arise from the use of a key manager are not yet solved. In this respect, in this paper, a provably secure user cloud data access control protocol (DAC) is proposed based on existing cloud storage. Empirical tests confirm that the proposed approach is highly secure against adaptive selective ciphertext attacks and has excellent resistance to message attacks. A comprehensive performance evaluation, including time measurements, is conducted and the protocol is compared to other protocols, revealing the efficient file upload and download processes of the proposed approach. The results demonstrate the protocol's strong security, practicality, and operational efficiency. [ABSTRACT FROM AUTHOR]

In recent years, searchable encryption technology and attribute encryption technology have been widely used in cloud storage environments, and attribute-based searchable encryption schemes can both achieve the retrieval of encrypted data and effectively solve the access control problem. Considering that existing attribute-based searchable encryption schemes for cloud storage only support keyword search and do not support attribute revocation, most of the schemes that support attribute revocation only consider the computational overhead of users and ignore the large amount of computational resources consumed by attribute authorization centers when updating keys. In addition, keyword search may lead to partial errors in the returned search results, leading to the wastage of computational and broadband resources. To solve these issues, this paper proposes an attribute-based searchable encryption scheme that supports attribute revocation and is verifiable. To realize fine-grained ciphertext search of encrypted data, support scenarios of dynamic changes of user attributes, and ensure that third-party servers perform the search process reliably and honestly while minimizing computation and storage costs, first, this paper implements attribute revocation with the attribute authorization center by creating a user revocation list and an attribute key revocation list. At the same time, the system updates the attribute key at the time of user search request, which effectively reduces the computational overhead. Second, a third-party auditor is introduced to ensure the correctness of the search results. Finally, the security of this paper is verified by theoretical analysis, and the efficiency and practicality of this paper are verified by comparing it to other schemes through simulation experiments. [ABSTRACT FROM AUTHOR]

For mobile applications, mobile cloud computing (MCC) presents a revolutionary paradigm that allows mobile users to compute and store data on resource-rich cloud servers. However, this poses some problems for fine-grained access control, secure data storage, and user anonymity. On encrypted data, attribute-based encryption (ABE) provides, a fine-grained access control policy, and therefore applicable to provide authorized data privacy in the cloud storage. Nevertheless, in ABE, attributes assigned to a user are static, which presents the main problem. Therefore, as part of the encryption scheme it is advised to use the location. When the attributes of user are changed, attribute revocation supporting ABE is required to change user's access privilege in a timely and efficient manner. In this paper, we propose an access control system based on multi-authority attributes supplied anonymity of users, protect user's identity from malicious authorities and support the coexistence of authorities. Our scheme employs as policy some location range constraints with ABE and then users whose dynamic locations and time satisfying these access policies are authorized. Scyther tool is used to verify the security and analyze the correctness of the proposal followed by experiments to demonstrate its effectiveness. Our evaluation is based, in terms of computation time, on Java realization for CP-ABE (ciphertext policy-ABE) toolkit and it uses JPBC (Java pairing-based cryptography) library. [ABSTRACT FROM AUTHOR]

Data deduplication has become a promising technique that significantly reduces space utilization of cloud storage servers and optimizes the network bandwidth. A variety of deduplication techniques have been proposed to enhance the cloud server's storage efficiency. Most of the deduplication schemes do not address global indexing and user privacy issues. This paper elucidates a novel three-tier secure data deduplication architecture (referred to as SEEDDUP) for data storage and retrieval in the cloud. SEEDDUP provides data deduplication with proper indexing and user privacy. In this work, the optimal chunk size, for a given file size and format, is calculated using Cuckoo Search Algorithm. The chunk existence in the cloud is verified by the hash value generated via SHA3-512. To improve data deduplication speed, Merkle Hash Tree based MapReduce (MHTMR) is used for fast index lookup, which improves the performance at data storage and retrieval. In addition, data are encrypted based on its sensitivity level (low and high) using Niederreiter Public Key Cryptosystem. With this new SEEDDUP architecture, only legitimate users can request data successfully for limited times (k) and spurious data requests cannot be processed or handled in the cloud. Experimental results show that the proposed SEEDDUP can reduce latency, achieved good throughput and deduplication efficiency (chunk size variance and security measures) in data deduplication. [ABSTRACT FROM AUTHOR]

In the cloud, uploading encrypted data is the most effective way to ensure that the data are not leaked. However, data access control is still an open problem in cloud storage systems. To provide an authorization mechanism to limit the comparison of a user's ciphertexts with those of another, public key encryption supporting the equality test with four flexible authorizations (PKEET-FA) is presented. Subsequently, more functional identity-based encryption supporting the equality test (IBEET-FA) further combines identity-based encryption with flexible authorization. The bilinear pairing has always been intended to be replaced due to the high computational cost. Hence, in this paper, we use general trapdoor discrete log groups to construct a new and secure IBEET-FA scheme, which is more efficient. The computational cost for the encryption algorithm in our scheme was reduced to 43% of that of the scheme of Li et al. In Type 2 and 3 authorization algorithms, the computational cost of both was reduced to 40% of that of the scheme of Li et al. Furthermore, we give proof that our scheme is secure against one-wayness under the chosen identity and chosen ciphertext attacks (OW-ID-CCA), and indistinguishable against chosen identity and chosen ciphertext attacks (IND-ID-CCA). [ABSTRACT FROM AUTHOR]

In the existing ciphertext policy attribute encryption schemes of cloud storage（CP-ABE）, most of them only consider the computing cost of users, but ignore the large amount of computing resources consumed by the attribute authorization center when updating the key. So for this problem, this paper proposed a key update method based on CPABE to support fine-grained attribute revocation. First, the attribute authorization center creates the user revocation list and the attribute key revocation list, and then stores the data such as the revocation list using the relevant features of blockchain such as public security and verifiability. Finally, according to these data, the system updates the attribute key when the user requests the ciphertext, that is, turn frequent key changes into single-change on demand to reduce the amount of computation required by the attribute authorization center over a period of time. At the same time, by introducing a verifiable outsourcing method to ensure the correctness of the user interface and low overhead. The theoretical analysis verifies the security of the scheme and the high efficiency of ciphertext encryption and decryption, and the simulation experiment verifies that the scheme also has high efficiency in the aspect of single system attribute revocation. [ABSTRACT FROM AUTHOR]

Cloud storage is a cloud implementation that facilitates agencies to set up in-house information storage installations. Cloud storage actually creates security problems. When the information is communicated by groups; both cloud-specific and standard insider threats are visible. A key research problem is the secure sharing among group members, which confronts the internal threats of legitimate and malevolent users. In this paper, in this paper, an effective structured data sharing mechanism for user revocation in the multi-owner cloud system is proposed. The proposed method is based on the following five entities: data owner, cloud storage, central authority, and cryptographic server, and data users. The data owner will submit to cryptographic servers' data, user list and parameters capable of generating an Access Control List (ACL). A trusted third party is a cryptographic server that provides the symmetric key that triggers the encrypted data. The cryptographic server then divides the key into three sections for each user within the group. Quantitative findings indicate the sustainability of the mechanism proposed in contrast with conventional schemes. [ABSTRACT FROM AUTHOR]

Cloud computing provides a ubiquitous data storage and access mechanism for organizations, industries, and smart grids to facilitate their operations. However, the concern in cloud storage systems is to secure data access control toward authentication for sensitive data, such as the electric vehicles (EVs) requesting information for attending a charging service. Consequently, denying an authentic user's request will result in delaying the requested service, thereby leading to service inefficiency. The role-based access control (RBAC) plays a crucial role in securing and authenticating such time-sensitive data. The design mechanism of roles is based on skills, authority, and responsibilities for organizations. For EVs, the roles are based on the type of membership, such as permanent, occasional, or one-time. In this paper, we propose a new RBAC access control and privacy-preserving information access method toward the coarse-grained measure control and privacy protection in the cloud storage system for EVs. The data can be encrypted and decrypted based on the types of users who possess appropriate access permission toward authorized and unauthorized users according to their roles specified by role-based access control policies. The proposed approach has been simulated with various role-based scenarios, and the efficiency was evaluated against state-of-the-art role-based access-control techniques. [ABSTRACT FROM AUTHOR]

With the continuous development of cloud storage technology, cloud storage has become a new way of storage for both enterprises and individuals. The cloud environment can support users to share data, but it can lead to some malicious users accessing or modifying data by illegal means, so access control is an important way to protect user data. In this paper, we propose a traceable attribute encryption scheme based on signature authentication and based on the information efficient inverse model of an asymmetric random matrix, which can trace the user who leaks information. A user attribute revocation scheme based on improved attribute encryption is also proposed, which enables data owners to reduce computational overhead. In cloud storage access control, the workload of the data owner increases exponentially when facing a high number of user attribute revocation problems, which are jointly decided by the data owner and the authorization center. An error proportional allocation (EPA) calculation method is developed to achieve an optimal estimation of system parameters in the lattice cipher scheme; experimental results show that the scheme has the advantages of shorter parameters, efficient computation, and lower storage load, proving that the scheme is resistant to IND-SAS-CPA under the standard model-based assumption of determining LWE semantic security against IND-SAS-CPA attacks; and it is used in a cloud file sharing (CFS) service framework, which can make sensitive cloud data free from the risk of privacy leakage. [ABSTRACT FROM AUTHOR]

Due to the characteristics of distribution and virtualization, cloud storage is providing almost limitless storage services. Many users choose to upload data to the cloud to reduce storage burden, but the confidentiality of data is also at risk. When the cloud data must be deleted, the assured deletion of the data becomes a crucial problem. Assured deletion can preserve the confidentiality of the users data, and it is also an essential component of cloud storage services. In this paper, a secure and effective assured deletion scheme with orderly overwriting (SEAD-OO) is proposed. The scheme uses ciphertext-policy attribute-based encryption to achieve fine-grained access control and data sharing. To solve the problem of ciphertext left in the cloud after deleting the keys, we introduce physical deletion and logical deletion. Blockchain is introduced to ensure the validity and traceability of deletion. By comparing with related schemes, the proposed SEAD-OO is proved to be versatile. Theoretical analysis and experiments show that the scheme is safe and effective, and it provides a practical method for the assured deletion of cloud data. [ABSTRACT FROM AUTHOR]

Attribute-based encryption(ABE) can enable user-centered data sharing in untrusted cloud scenario where users usually lack control on their outsourced data. However, existing ABE schemes have intrinsic limitations on scalability and revocation efficiency due to the bottleneck of a central authority and heavy re-encryption overhead on revocations. In this paper, we present a revocable decentralized attribute-based encryption scheme for data access control in cloud storage. In particular, by integrating decentralized attribute-based encryption, key regression technique, all-or-nothing transform, revocation list for involved attributes, and blacklist in a novel way, we provide a revocable ABE scheme with practical dynamic group membership and identity privacy protection, and meanwhile, it enhances the re-encryption efficiency caused by revocations without sacrificing security. We analyzed the security of our scheme. The experimental evaluation demonstrates that the cryptographic overhead on key derivation, encryption(decryption), and ABE ciphertext update are reasonable, and for the throughput of accessing encrypted data from the cloud, our scheme outperforms other schemes. [ABSTRACT FROM AUTHOR]

In smart wards, data generated by wearables and monitoring devices are periodically transferred to the cloud server for long-term logging and subsequent access. Remote cloud storage inevitably raises security and access control challenges. Encryption can secure data but may severely impact the value generated by sharing data. More importantly, the privacy leakage caused by keyword searches is unacceptable for medical data. The designated-server public-key encryption with keyword search (dPEKS) can realize ciphertext-based search. However, existing dPEKS face an efficiency bottleneck as they only achieve one-to-one data sharing. In addition, cloud-controlled access control creates over-centralized power. In contrast, using blockchain to control who can search has the extra benefit that the blockchain can record access behavior for subsequent tracking. Therefore, this paper proposes a blockchain-assisted dPEKS (BC-dPEKS) scheme, which exploits a permissioned blockchain to perform trapdoor generation on behalf of data users and record data uploading and access for tracing. To the best of our knowledge, this is the first scheme to tightly integrate blockchain to change PEKS primitive to achieve one-to-many search. Formal security models, the corresponding security proofs, and comprehensive performance analysis are presented. [ABSTRACT FROM AUTHOR]

In the application of industrial Internet, due to the differences in computing and storage capabilities of heterogeneous nodes, cloud solutions are generally used to provide data storage and data access services. Access control in cloud storage, such as an extended data access control scheme for multi-authority cloud storage (NEDAC-MACS), is the cornerstone to ensure the security and privacy of data in cloud storage. This paper gave an attack method to demonstrate that a revoked user could still decrypt new ciphertexts in NEDAC-MACS and proposed a scheme to enhance the security of NEDAC-MACS, which could resist the collusion attack between cloud server and users. Finally, formal cryptanalysis and performance analysis show that the scheme can resist collusion attacks between unauthorized users and between cloud servers and users, and ensure forward security, backward security and data confidentiality. [ABSTRACT FROM AUTHOR]

Dispatching and Control Cloud (DCC) is a cloud platform constructed by State Grid Corporation with the technology of cloud computing. DCC has improved the overall operation and monitoring capabilities, the smart level and many other advantages of power grid. However, the development of DCC has been hampered by security and privacy issues. Secure unified identity authentication, access control and authorisation management are significant topics in DCC. To find out a solution for the topics above, we have employed some encryption schemes using the attribute-based encryption(ABE), as ABE can preserve users' privacy and achieve access control with fine grain over the encrypted information. SM9 is a kind of Chinese official standard in the field of cryptography, which contains the SM9 encryption algorithm (SM9-IBE). In this paper, an ABE scheme based on SM9-IBE is proposed, making SM9 support fine-grained access control which would be better applied in DCC. Our proposed scheme (SM9-ABE) has been proven to be of great security in the selective CPA model under DBDH assumption. Furthermore, we implement SM9-ABE and evaluate its practical performance. The implementation indicates our scheme performs well in the matter of security and functionality, at an additional time cost which is acceptable. [ABSTRACT FROM AUTHOR]

As the security of cloud storage cannot be effectively guaranteed, many users are reluctant to upload their key data to the cloud for storage, which seriously hinders the development of cloud storage. Since ensuring the confidentiality of user data and avoiding unauthorized access is the key to solving the security problems of cloud storage, there has been much cryptographic research proposing the use of the combination of cryptography technologies and access control model to guarantee the data security on untrusted cloud providers. However, the vast majority of existing access control schemes for ciphertext in cloud storage do not support the dynamic update of access control policies, and the computational overhead is also very large. This is contrary to the needs of most practical applications, which leverage dynamic data and need low computation cost. To solve this problem, combined with identity-based cryptosystem (IBC) and role-based access control (RBAC) model, we propose an RBAC (In this paper we use RBAC1 model which is richer access control model)) scheme for ciphertext in cloud storage. We also give the formal definitions of our scheme, a detailed description of four tuple used to represent access control strategy, the hybrid encryption strategy and write-time re-encryption strategy, which are designed for improving the system efficiency. The detailed construction processes of our scheme which. Include system initialization, add and delete users, add and delete permissions, add and delete roles, add and delete role inheritance, assign and remove user, assign and remove permission, read and write file algorithm are also given. Finally, we analyze the scheme and prove that it is correct, access control preserving (AC- preserving) and secure. [ABSTRACT FROM AUTHOR]

Because of the importance of digital images and their extensive application to digital watermarking, block chain, access control, identity authentication, distributive storage in the cloud and so on, image secret sharing (ISS) is attracting ever-increasing attention. Share authentication is an important issue in its practical application. However, most ISS schemes with share authentication ability require a dealer to participate in the authentication (namely, dealer participatory authentication). In this paper, we design an ISS for a $(k,n)$ -threshold with separate share authentication abilities of both dealer participatory authentication and dealer nonparticipatory authentication. The advantages of polynomial-based ISS and visual secret sharing (VSS) are skillfully fused to achieve these two authentication abilities without sending a share by using a screening operation. In addition, the designed scheme has the characteristics of low decryption (authentication) complexity, lossless decryption and no pixel expansion. Experiments and theoretical analyses are performed to show the effectiveness of the designed scheme. [ABSTRACT FROM AUTHOR]

• Fast access revocation is a major challenge in cloud storage service. • The encryption key is embedded into a set of coefficients of a polynomial so-called access polynomial. • The scheme supports fast revocation by means of updating the access polynomial coefficients. • Blockchain is utilized to implement access control as a smart contract between data owner and users. • Attribute-based encryption (ABE) is used in response transactions to impose the access policy to the file as well as preserving user anonymity. This paper presents a novel collaboration scheme for secure cloud file sharing using blockchain and attribute-based encryption(ABE). Blockchain enables us to implement access control as a smart contract between data owner and users. Each data owner creates its own smart contract where in a data user can request to access a specific file by registering a transaction. In response transaction, the data owner sends the required credential to the user thereby enabling her/him to decrypt the intended file on the cloud storage. This scheme is decentralized, fault tolerant and secured against DoS attacks. The cipher-key , which is used for file encryption, is embedded into a set of coefficients of a polynomial so-called access polynomial. It is attached to the encrypted file on the cloud storage as a metadata. The data user can restore the cipher-key by means of the credential receiving in response transaction and access polynomial. The data owner uses ABE scheme in response transaction to impose her/him access policy to the file as well as preserving user anonymity. This scheme supports fast revocation of the user access by means of updating the access polynomial coefficients and without any communication overhead to non-revoked users. Through formal verification, we show that the scheme is secure in terms of secrecy of credential information and authentication of participants. Finally, the evaluation results show that our scheme is scalable with acceptable performance up to 20,000 users. [ABSTRACT FROM AUTHOR]

Cloud-based data sharing has become a significant technology trend thanks for its convenience and economy. Data owners are suggested to encrypt data before outsourcing for data security and users' privacy. This approach makes it a challenging problem to implement the retrieval of encrypted data while enforcing fine-grained access control over the ciphertext. In this paper, we propose a blockchain-assisted multi-keyword fuzzy search encryption (BCFSE) scheme for secure data sharing which supports fine-grained access control and attribute revocation. The BCFSE scheme maps the attributes in the ciphertext policy attribute-based encryption (CP-ABE) to attribute tokens on the blockchain, which provides lightweight, secure and trusted attribute management. Moreover, we construct a keyword search scheme based on CP-ABE by using searchable symmetric encryption algorithm in the keyword encryption and retrieval phases, effectively reducing computational cost. BCFSE combines the advantages of CP-ABE and searchable encryption based on blockchain, which implements authorization and search with the assistance of smart contracts to ensure the reliability of the search process. In addition, the BCFSE scheme supports multi-keyword fuzzy search with both AND and OR semantics. Extensive experiments have been performed on real datasets to validate the effectiveness and efficiency of our BCFSE scheme. [ABSTRACT FROM AUTHOR]

With emerging of cloud and edge computing, it is popular to store Electronic Medical Records (EMRs) on a remote cloud. Furthermore, to share the EMRs stored in the cloud, attribute-based encryption (ABE) can provide a fine-grained access control strategy. However, in ABE, the finer the access control is, the bigger the number of required attributes is. Accordingly, it requires the higher computation costs. In this paper, to reduce the burden of patients, we first present a verifiable outsourced ABE scheme with the help of edge servers and fog nodes, in which edge servers are fully responsible for the encryption of ABE while fog nodes assist data users to perform the corresponding decryption. Furthermore, to protect the privacy of data owner, we introduced the proxy re-encryption algorithms, which still can achieve dual access control for EMRs. What's more, to detect the honesty of edge servers and the cloud, we adopt an aggregated digital signature to guarantee the correctness of the EMRs initially encrypted by data owner. The experimental results and security proofs show that our scheme has higher computational efficiency and achieves more fine-grained access control. [ABSTRACT FROM AUTHOR]

Ciphertext-Policy Attribute-Based Keyword Search (CP-ABKS) provides data privacy and achieves fine-grained access control over encrypted data in the cloud. However, authorized users may misuse the secret key for financial benefits in a multi-user scenario. Thus, tracing those malicious users and revoking them from the system is essential. Alongside this, most existing schemes have only a single authority to generate the secret key, which may lead to misuse of the secret key. To address these problems, this paper proposes a traceable and revocable multi-authority attribute-based keyword search in the cloud. The scheme involves two authorities generating the user secret key to restrict any individual authority's unauthorized access to cloud data. The scheme also traces malicious users and revokes them from the system. Further, we prove that the scheme is secure against chosen keyword attacks, chosen plaintext attacks, and traceability. And also verify the security against malicious authorities. The performance analysis shows that the proposed scheme is efficient in computation cost compared to the state-of-the-art schemes. [ABSTRACT FROM AUTHOR]

• We present a new privacy-preserving data sharing model based on blockchain, which not only realizes a secure but also trusted and flexible data sharing. • We propose a concrete privacy-preserving data sharing scheme, in which multi-keyword searchable encryption is employed to achieve more accurate retrieval, and any trusted third party is not involved in the proposed scheme. • We give the formal definition of keyword privacy and prove that the proposed scheme in this paper satisfies the definition. All theoretical and experimental results display that the proposed scheme is effective and more efficient with respect to storage and computation overhead. Along with the progress of cloud service, a growing quantity of data owners store their data on cloud databases, which can not only reduce data owners' storage cost but also provide a quick search function. However, while cloud storage brings some conveniences to users, new privacy problems may emerge, such as the leakage of data privacy and user's query privacy. The best way of protecting data privacy is to encrypt the data. So how to efficiently retrieve the ciphertext to make it available becomes a hot issue in recent years. In this paper, new searchable encryption with multiple keywords is described, it can improve the accuracy of retrieval results, and we present a secure and trusted data sharing framework based on attribute-based encryption (ABE), searchable encryption, and blockchain. Unlike the previous studies, we realize flexible data sharing by using ABE. Furthermore, we transfer the related calculation of ciphertext retrieval to blockchain for credible execution without relying on any trusted third party. The security analysis proves that our method meets the proposed security requirements of data, keyword index, trapdoor, and query. Finally, the experimental results indicate that our scheme suggested has certain practicability and efficiency. [ABSTRACT FROM AUTHOR]

With the rapid development of computer technology and medical imaging technology, medical images present an explosive growth. To save storage and computation overhead, hospitals often choose to outsource digital medical images to cloud server. Since medical images are a major auxiliary means for doctors' diagnosis or medical researchers' study, the secure retrieval of outsourced medical images is especially important. To address this problem, we propose a Faster outsourced Medical Image Retrieval scheme with privacy preservation (FMIR) in this paper. FMIR first makes a simple classification to outsourced medical images, which narrows the retrieval range and improves the retrieval efficiency compared with the existing unclassified retrieval schemes. Second, FMIR implements a lightweight access control for each class using polynomial-based access control strategy, which provides the fine-grained access control for better privacy protection of medical images. Third, FMIR reduces the interference of random numbers on relevant score to 0, which further improves the accuracy of the retrieval. Finally, the security and performance analysis show that FMIR is secure, accurate and efficient. [ABSTRACT FROM AUTHOR]

Cloud computing offers a huge resource pool by centralizing various resources with the rapid growth of digital data. Data storage is the most acceptable service in cloud computing. As one of the key technologies of cloud storage service, data deduplication technology allows cloud servers to save storage space by deleting redundant data. In order to protect data privacy, data holders generally encrypt their data first, and then upload the encrypted data to the cloud server, which clearly brings a new challenge for cloud data deduplication, as traditional deduplication technology cannot deduplicate encrypted data. Existing solutions have various security issues. They cannot flexibly support data access control, and also require data users to remain online. In this paper, we propose an identity-based proxy re-encryption data deduplication scheme using identity-based proxy re-encryption (IB-PRE) and identity-based proof of ownership (IB-PoW). The proposed scheme integrates cloud data deduplication with access control. By detailed security analysis and performance evaluation, we show that the proposed scheme is security, efficient and effective. [ABSTRACT FROM AUTHOR]

• Taxonomy based review of related work including various cloud deployment models. • Formal identification of the adversarial attacks in outsourcing system architecture of healthcare data in hybrid cloud. • Proposed a privacy-preserving access control model (PPX-AC) for EHRs in hybrid cloud with fine-grained access control and robust privacy preservation through data anonymization technique. • Formal modelling,analysis and verification of (PPX-AC) model is performed with prototype implementation that compiles XACML policy to verify its effectiveness. An increasing trend in healthcare organizations to outsource EHRs' data to the cloud highlights new challenges regarding the privacy of given individuals. Healthcare organizations outsource their EHRs data in a hybrid cloud that elevates the problem of security and privacy in terms of EHRs' access to an unlimited number of recipients in a hybrid cloud environment. In this paper, we investigated the need for a privacy-preserving access control model for the hybrid cloud. A comprehensive and exploratory analysis of privacy-preserving solutions with the help of taxonomy for cloud-based EHRs is described in this work. We have formally identified the existence of internal access control and external privacy disclosures in outsourcing system architecture for hybrid cloud. Then, we proposed a privacy-preserving XACML based access control model (PPX-AC) that supports fine-grained access control with the multipurpose utilization of EHRs alongside state-of-the-art privacy mechanism. Our proposed approach invalidates the identified security and privacy attacks. We have formally verified the proposed privacy-preserving XACML based access control model (PPX-AC) with the invalidation of identified privacy attacks using High-Level Petri Nets (HLPN). Moreover, property verification of the proposed model in SMT-lib and Z3 solver and implementation of the model proves its effectiveness in terms of privacy-aware EHRs access and multipurpose usage. [ABSTRACT FROM AUTHOR]

Due to increasing volume of stored data in organizations, data owners upload their data to cloud servers. Sensitive data has to be encrypted prior to uploading to the cloud server because of security requirements. Therefore, capable of searching over the encrypted cloud data is a very important issue. One of the most important challenges that must be addressed is to search whole documents to find related documents to a query. In this paper, a scheme is suggested to eliminate the need of searching for whole documents. A secure multi-keyword ranked search method over the encrypted cloud data is introduced that provides dynamic operation on the document collection. Also, access control mechanism is considered in the proposed scheme. The vector space model is employed to B+tree index and query creating. Due to generation of a B+tree-based index structure, search time is getting sub-linear. First, the cloud server is assumed to be "Honest-but-Curious". Second, it is considered that the data are stored on an untrusted cloud server. The Merkle B-tree (MB-tree) is utilized to verify search results in the presence of access control rules when the cloud server is untrusted. Experiments are conducted using the real world dataset to confirm efficiency and precision of the offered scheme. [ABSTRACT FROM AUTHOR]