Search

With the development of LiDAR technology, 3D point cloud data have a rich information-carrying capacity and environmental perception capabilities, have been widely applied in fields such as the Internet of Vehicles(IoV) and smart homes. However, the privacy and sensitive content contained within them faces significant security risks. To address these challenges, we propose a selective encryption scheme for 3D point cloud based on hybrid key with spatial maintenance. Firstly, a new SH-CCM map is introduced, which exhibits excellent sensitivity to initial conditions, randomness, and unpredictability. Secondly, a hybrid key generation scheme is designed, where the hybrid key is composed of an agreement session key and a user's private key. Then, a spatial maintenance encryption method is designed using the proposed chaotic map to maintain the spatial stability of the selected regions during encryption, preventing data confusion and loss that could arise from overlap with adjacent point clouds in the encrypted domain. Finally, the security and robustness of this method are verified through simulation experiments and numerical analysis, demonstrating high encryption efficiency and effective resistance against known plaintext/chosen plaintext attacks, differential attacks, brute force attacks, and other statistical analysis attacks. [ABSTRACT FROM AUTHOR]

Linux clouds have become an attractive target for cyber-attacks. However, existing detection solutions for Linux clouds have variety of limitations. Some of the solutions are untrusted, incapable of detecting unknown malware, or rely on a human expert to define the features. Other solutions are trusted but require a large amount of computational resources or have a limited ability to detect rootkits, fileless malware, or malware on a different server. In this study, we propose MinCloud, a trusted and transferable MinHash-based framework for unknown malware detection in Linux virtual servers that overcomes the limitations of existing solutions. In the first stage, we acquired volatile memory dumps from virtual servers by querying the hypervisor in a trusted manner and then analyzed them using the MinHash method. Finally, the MinHash characteristics are harnessed by applying machine learning classifiers to achieve precise malware detection. MinCloud was evaluated on widely used Linux virtual servers, various benign and malicious applications, and 23,000 volatile memory dumps, each representing different behaviors of the examined servers and the executed applications over time. MinCloud's evaluation shows it can (1) detect unknown malware, (2) classify unknown malware according to its malware category, (3) detect fileless attacks and rootkit malware, and (4) provide accurately transfer detection between different Linux servers. MinCloud outperformed state-of-the-art trusted detection methods and commonly used antiviruses. [ABSTRACT FROM AUTHOR]

Digital signatures are widely used in a variety of applications necessitating authentication. However, the amount of data is steadily increasing in domains like IoT, blockchain, e-commerce, etc. In such scenarios, the number of signatures could become extensive, resulting in considerable overhead in signature verification. Consequently, this bottleneck can hamper the responsiveness of transactions. Batch verification can verify numerous signatures simultaneously, effectively solving the challenge posed by the excessive overhead of verifying signatures. However, current state-of-the-art batch verification algorithms still require improvement when handling a large volume of signatures. In this paper, we propose an efficient algorithm for batch verification of discrete-logarithm-based signatures. Specifically, we propose an accelerated Multi-scalar Multiplication algorithm, which accounts for 99% cent of overheads in the batch verification process. When verifying a large number of signatures simultaneously, our algorithm significantly improves efficiency. For instance, when processing 10,000 signatures, our algorithm achieves a 3.6 × speedup compared to the common algorithm. We applied our scheme to ECDSA, SM2 signature algorithm, and Schnorr signature algorithm, and simulation results show a significant improvement with our approach. [ABSTRACT FROM AUTHOR]

The Internet of Things (IoT) paradigm has widespread applications across many fields in which private and sensitive user or environmental data are sensed and shared. Most present-day IoT applications depend on centralized cloud servers for authentication and access control. Validating the identity of a user and determining the legitimacy of his/her access requests require multiple rounds of data communications over the untrusted Internet, exposing sensitive data to potential attacks. Thus, protecting these data from security and privacy attacks and ensuring legitimate access is imperative. To address this challenge, we adopt an emerging technology called blockchain to propose a decentralized security framework called BloAC. It ensures secure access control in IoT networks without the intervention of the back-end cloud. We have used the Hyperledger Fabric , an open-source, permissioned blockchain platform, for implementing a prototype system using customized attribute-based access control (ABAC) policies. We have performed simulated and real test bed-based experiments to illustrate that BloAC outperforms the cloud–server-based access control in latency and scalability, significantly reducing latency by up to 42.45% compared to cloud-based solutions. Finally, we conduct a security analysis to formally verify the ABAC policies used in BloAC and establish its robustness against attacks theoretically and using the AVISPA tool. [ABSTRACT FROM AUTHOR]

This study proposes a novel technique for reversibly embedding data within encrypted images, specifically utilizing a Pixel Shifting Approach (PSA). Traditional data hiding methods commonly employ the modification of the least significant bits (LSBs) of pixels in the original image. In contrast, methods using encrypted cover images offer a wider range of data hiding techniques that are not constrained by LSB modifications. The proposed data hiding method embeds data into an encrypted cover image by dividing it into non-overlapping blocks and then permuting pixels within each block according to a defined rule, rather than modifying the LSBs of pixels. The entropy of the image remains preserved after data embedding, making it difficult to detect the location of hidden data. To extract the hidden data, the encrypted image is decrypted, and the smoothness of each block is measured. The block with the lowest smoothness is identified as the one containing the hidden data, which is also the original block. This is because the pixels within each block have different statistical properties compared to other blocks, allowing for data recovery. The proposed method offers the advantage of embedding 4 bits of data per block, surpassing the performance of the existing Modified Pixel Shifting Approach (MPSA). Moreover, the entropy preservation of the stego-image is comparable to MPSA, while the algorithm's execution time is more efficient. The simpler data hiding rule compared to MPSA enables faster encoding and decoding. Reversibility is guaranteed by preserving the correlation among pixels within each block when extracting data from the stego-image and restoring the original image. Experimental results demonstrate that the proposed method significantly outperforms existing techniques in terms of data hiding efficiency and security. [ABSTRACT FROM AUTHOR]

Modern robust steganography-based cyber attacks often bypass intrinsic cloud security measures, and contemporary steganalysis methods struggle to address these covert threats due to recent advancements in deep learning (DL)-based steganography techniques. Existing steganography removal methods are constrained by trade-offs involving high processing times, poor quality of sanitized images, and insufficient removal of steganographic content. This paper introduces SteriCNN, a lightweight deep residual neural network model designed for steganography removal. SteriCNN effectively eliminates embedded steganographic information while preserving the visual integrity of the sanitized images. We employ a series of convolutional blocks with three residual connections for feature extraction, feature learning, feature attention, and image reconstruction from the residue. The proposed model utilizes the correlation of channel features to achieve a faster learning rate, and by varying the dilation rate in convolutional blocks, the model achieves wider receptive fields, enabling it to cover larger areas of the input image at each layer. SteriCNN is targeted for blind image sterilization for real-time use cases due to its low training and prediction time costs. Our study shows impressive results for both traditional and deep learning-based stego vulnerabilities, with approximately 90% of steganograms eliminated while maintaining an average PSNR value of 46 dB and an SSIM of 0.99 when tested with popular steganography methods. • Proposes a low-cost framework for image steganography removal using deep residual networks. • Introduces an efficient stego-scrubber effective for traditional and DL-based steganography. • Addresses the shortcomings of commercial cloud services in mitigating steganography-related security risks. [ABSTRACT FROM AUTHOR]

The interval test problem is a variant of Yao's millionaires' problem to check whether a value x belongs to an interval R. Existing solutions to the interval test problem prioritize generic protocols but encounter efficiency challenges. There is a growing interest in developing efficient and secure multi-party computation protocols tailored to specific applications. In this paper, we propose a secure and simplified protocol for solving the interval test problem. This protocol exhibits high generality, as it only requires invocations of the private set intersection cardinality (PSI-CA) subprotocol. Furthermore, we modify it to construct a more efficient protocol for small integers by introducing oblivious transfer (OT) to reduce the times of homomorphic encryption. Our protocols provide privacy protection for both clients and servers in the semi-honest security model. We evaluate the computational and communication overhead of our protocols. Our OT-based secure interval test (OT-SIT) protocol is seven times faster than existing protocols for 18-bit integers. When the bit length is 4, it reduces communication overhead by approximately 97%. The upstream overhead is as low as 500 B. However, it uses binary tree structures, so the advantages in computation and communication quickly diminish as the bit length increase. [ABSTRACT FROM AUTHOR]

Attribute-based methods such as attribute-based access control make decisions based on attributes possessed by a subject rather than the subject's identity. This allows for anonymous authorization but does not guarantee anonymity. If a policy can be composed that few subjects possess attributes to satisfy and is used for access control, the system can guess with high probability the requesting subject's identity. Other approaches to achieving anonymity in attribute-based authorization do not address this attribute distribution problem. Suppose polices contain conjunctions of at most t attributes and the system must not be able to guess with probability greater than 1 r the identity of a subject using a policy for authorization. The anonymity guarantee is r for maximum credential size t. An anonymizing array is a combinatorial array proposed as an abstraction to address the distribution problem by ensuring that any assignment of values to t attributes appearing in the array appears at least r times. Anonymizing arrays are related to covering arrays with higher coverage, but have an additional property, homogeneity, due to their application domain. We discuss the application of anonymizing arrays to guarantee anonymous authorization in attribute-based methods. Additionally, we develop metrics to compare arrays with the same parameters. [ABSTRACT FROM AUTHOR]

The demand for processing vast volumes of data has surged dramatically due to the advancement of machine learning technology. Large-scale data processing necessitates substantial computational resources, prompting individuals and enterprises to turn to cloud services. Accompanying this trend is a growing concern regarding data leakage and misuse. Homomorphic encryption (HE) is one solution for safeguarding data privacy, enabling encrypted data to be processed securely in the cloud. However, the encryption and decryption routines of some HE schemes require considerable computational resources, presenting non-trivial work for clients. In this paper, we propose an outsourced decryption protocol for the prevailing RLWE-based fully homomorphic encryption schemes. The protocol splits the original decryption into two routines, with the computationally intensive part executed remotely by the cloud. Its security relies on an invariant of the NTRU-search problem with a newly designed blinding key distribution. Cryptographic analyses are conducted to configure protocol parameters across varying security levels. Our experiments demonstrate that the proposed protocol achieves up to a 67% acceleration in the client-side computation, accompanied by a 50% reduction in space usage. [ABSTRACT FROM AUTHOR]

Encrypted data aggregation can effectively achieve the preservation of users' privacy by aggregating electricity consumption data from multiple-source smart meters, and simultaneously reduce the transmission communication overhead in smart grids. Although encryption operations ensure data confidentiality, as smart meters are resource-constrained devices, compromised private key leakage could likewise threaten users' privacy. In this paper, we devise the fine-grained encrypted data aggregation mechanism with fault tolerance by modifying the Lifted EC-ElGamal encryption and symmetric homomorphic encryption, which could guarantee data confidentiality, even if corresponding private key is leaked. In the mechanism, edge server is integrated in smart grids to receive encrypted multidimensional electricity consumption data sent by smart meters, execute integrity checking, generate and forward corresponding verified aggregated data reports to the control center. To ensure the robustness of smart grids due to network interruption or data packet loss from smart meters to the edge server, we exploit the Shamir secret sharing technique to achieve transmission fault tolerance. Besides, dynamic subset adjustment could be utilized in the mechanism, enabling the control center to dynamically adjust users' multidimensional electricity consumption data collection strategy according to the actual situation. We conduct security analysis and performance evaluation demonstrating the feasibility of the mechanism in the secure deployment of edge-assisted smart grids. [ABSTRACT FROM AUTHOR]

In the field of artificial intelligence and data engineering, the effective utilization of data is critical for improving productivity across various sectors. As machine learning increasingly relies on sensitive data, balancing privacy with computational efficiency has become a major challenge. Homomorphic encryption provides a promising solution by enabling computation on encrypted data while preserving privacy in machine learning. However, its integration with neural networks is hindered by high computational demands and limitations in performing complex nonlinear operations. To address these challenges, we propose a novel approach that incorporates a "Self-Learnable Activation Function" (SLAF) and refines the structure of neural network linear layers. These enhancements are designed to accommodate the constraints of homomorphic encryption, allowing for deeper network architectures without significant computational overhead. Our optimized neural network model, tailored for biometric authentication tasks, outperforms traditional methods that use simple polynomial activation functions. Using the UTKFace dataset, which includes facial features under diverse scenarios, we validated the effectiveness of our solution in real-world applications. Experimental results demonstrate accuracy improvements of 0.88% to 3.15% over traditional models and 4.87% to 9.67% over the CryptoNets model, underscoring the capability of our approach to meet stringent privacy-preserving biometric authentication requirements. [ABSTRACT FROM AUTHOR]

In the Internet of Things, access control and identity management rely on centralized platforms. However, centralized platforms will compromise user privacy with identity leakage. Self-sovereign identity (SSI) is a novel model for identity management that does not require third-party centralized authority. Thus, SSI is a potential solution to the identity management problem in IoT access control. This paper's motivation is to address the problems of lack of identity sovereignty, centralized authorization, and high computational overhead for IoT access control. We propose a novel access control scheme for IoT that decentralizes identity management and tackles single-point-of-failure issues. This scheme leverages ciphertext policy attribute-based encryption (CP-ABE) and SSI to achieve the overall goal. Specifically, Our scheme eliminates the central authority and empowers users to manage their identity, allowing users to decide what attributes they disclose. Regarding the distribution of roles in the architecture, this paper follows the generic SSI model (ISSUER–HOLDER—VERIFIER) that allows a user to access a service from a service provider. To enable real-world deployment of our scheme, we establish an attribute authorization authority(such as the government) as a trusted identity point of entry. Users generate decentralized identifiers to enjoy services of interest in a privacy-preserving manner. The analysis demonstrates the practicality and superiority of our scheme. Our scheme requires less computation and is suitable for resource-constrained IoT scenarios. [ABSTRACT FROM AUTHOR]

Cancelable Biometrics (CB) stands for a range of biometric transformation schemes combining biometrics with user specific tokens to generate secure templates. Required properties are the irreversibility, unlikability and recognition accuracy of templates while making their revocation possible. In biometrics, a key-binding scheme is used for protecting a cryptographic key using a biometric data. The key can be recomputed only if a correct biometric data is acquired during authentication. Applications of key-binding schemes are typically disk encryption, where the cryptographic key is used to encrypt and decrypt the disk. In this paper, we cryptanalyze a recent key-binding scheme, called Cancelable Biometrics Vault (CBV) based on cancelable biometrics. More precisely, the introduced cancelable transformation, called BioEncoding scheme, for instantiating the CBV framework is attacked in terms of reversibility and linkability of templates. Subsequently, our linkability attack enables to recover the key in the vault without additional assumptions. Our cryptanalysis introduces a new perspective by uncovering the CBV scheme's revocability and linkability vulnerabilities, which were not previously identified in comparable biometric-based key-binding schemes. [ABSTRACT FROM AUTHOR]

Understanding the attributes of critical data and implementing suitable security measures help organisations bolster their data-protection strategies and diminish the potential impacts of ransomware incidents. Unauthorised extraction and acquisition of data are the principal objectives of most cyber invasions. We underscore the severity of this issue using a recent attack by the Clop ransomware group, which exploited the MOVEit Transfer vulnerability and bypassed network-detection mechanisms to exfiltrate data via a Command and Control server. As a countermeasure, we propose a method called Buffer-Based Signature Verification (BBSV). This approach involves embedding 32-byte tags into files prior to their storage in the cloud, thus offering enhanced data protection. The BBSV method can be integrated into software like MOVEit Secure Managed File Transfer, thereby thwarting attempts by ransomware to exfiltrate data. Empirically tested using a BBSV prototype, our approach was able to successfully halt the encryption process for 80 ransomware instances from 70 ransomware families. BBSV not only stops the encryption but also prevents data exfiltration when data are moved or written from the original location by adversaries. We further develop a hypothetical exploit scenario in which an adversary manages to bypass the BBSV, illicitly transmits data to a Command and Control server, and then removes files from the original location. We construct an extended state space, in which each state represents a tuple that integrates user authentication and system components at the filesystem level. [ABSTRACT FROM AUTHOR]

In the distribution of digital content, users may collude and utilize their secret keys to create pirate decoders which enable illegally users to receive the same service. As a useful countermeasure, the notion of identity-based traitor tracing (IBTT) scheme was introduced for the data owner to trace down pirates and simplify certificate management process. As far as we know, various IBTT schemes have been proposed in the literature and all of them are designed on classical hardness assumptions, which are believed to become broken in the coming post-quantum era. To address this issue, we propose the first post-quantum IBTT scheme in this work. The new IBTT scheme is proved to be secure in the quantum security model, assuming the quantum-resistant hardness of the underlying learning with errors problem. Notably, compared with other IBTT schemes, our construction has the minimal size increasing to make the underlying encryption scheme traitor tracing. [ABSTRACT FROM AUTHOR]

Homomorphic encryption is an effective way to address the privacy and security issues of Networked Control Systems (NCSs). Since the control function needs to be redesigned according to the homomorphism to complete encrypted computing, the practical implementation of a perfectly secure and highly efficient NCS is challenging. Previously proposed NCSs based on homomorphic encryption are still subject to the risk of eavesdropping attacks. In this paper, a combined homomorphic encryption scheme is designed to build a secure environment for NCSs. This scheme comprehensively enhances the security of NCSs by eliminating potential security hazards. The risk of eavesdropping attacks on information in the controller and communication channel is avoided. More specifically, the entire control scheme is encrypted and privacy computing within the controller is performed on this basis. Data protection is provided for all transmission channels, including the transmission of the intermediate result and controller state. In particular, the computational efficiency of the encrypted control system is fast and feasible for real-time control. The performance and stability of the closed-loop system are maintained. [ABSTRACT FROM AUTHOR]

Patient-centric precision medicine requires the analysis of large volumes of genomic data to tailor treatments and medications based on individual-level characteristics. Because the amount of data held by a single institution is limited, researchers may want access to genomic data held by other institutions. Owing to the inherent privacy implications of genomic data, performing comparisons on encrypted data is preferable in certain settings. The Similar patient query (SPQ) is an application that enables a secure search across genomic databases for patients with similar genetic makeup. Query results can be used to draw meaningful conclusions regarding suitable therapies. However, existing protocols either reveal intermediate computations, such as similarity scores, which can lead to membership-inference attacks, or they realize the ideal Boolean output (similar/not similar) through multiple protocol rounds, requiring the database owners to stay online throughout. This paper introduces a two-party privacy-preserving approach to perform SPQs across encrypted genomic databases based on secure function extensions of additively homomorphic encryption. In contrast to related works, our scheme enables secure computation of genomic data similarity without an external party in a single round. This is achieved for more than 1000 positions of a genome in a single public key operation of 256-bit security level in the integer factorization setting. [ABSTRACT FROM AUTHOR]

Zero-knowledge range proofs (ZKRPs) are commonly used to prove the validation of a secret integer lies in an interval to some other party in a secret way. In many ZKRPs, the secret is represented in binary and then committed via a suitable commitment scheme or represented as an appropriate encryption scheme. This paper is an extended version of the conference paper presented at the 14th IEEE International Conference on Security of Information and Networks. To this end, after summarizing the conference paper, we first analyze the proof proposed by Mao in 1998 in the elliptic-curve setting. Mao's proof contains a bit commitment scheme with an OR construction as a sub-protocol. We have extended Mao's range proof to base- u with a modified OR-proof. We investigate and compare the efficiency of different base approaches on Mao's range proof with both Pedersen commitment and ElGamal encryption. Later, we analyze the range proof proposed by Bootle et al. in both finite fields and elliptic-curve settings. This proof contains polynomial commitment with matrix row operations. We take the number of computations in modulo exponentiation and the cost of the number of exchanged integers between parties. Then, we generalize these costs for u -based construction. We show that compared with the base-2 representation, different base approach provides efficiency in communication cost or computation cost, or both. [ABSTRACT FROM AUTHOR]

As an important transmission medium, color images can provide more information, but in the process of image encryption, few algorithms fully consider the relationship between three color planes. To achieve a more secure and effective color image encryption effect, we propose a novel scheme combining a 2D hyperchaotic Sin–Henon system (2D-SH) and the division algorithm. 2D-SH is designed based on Sin mapping and Henon mapping, which has a broader chaotic range, better ergodicity, and more complicated chaotic behavior. The division algorithm is applied to the chaotic sequences produced by 2D-SH to generate a position matrix and two pseudo-random matrices for cross-plane scrambling and diffusion. The main encryption process involves three steps. Firstly, a color plaintext image is dimensionally reduced and preprocessed into a 2D pixel matrix to improve the efficiency of scrambling and diffusion. Secondly, the position matrix is used to achieve cross-plane scrambling. Finally, the pseudo-random matrices and the position matrix are used to realize synchronous diffusion and scrambling. The algorithm is simple in structure and can complete the encryption with only one round of the process. Simulation experiments and security analyses demonstrate that the proposed algorithm can not only encrypt images securely and fast, but also successfully pass various tests, demonstrating robustness and effectiveness. In addition, SH-CIEA outperforms some latest algorithms in terms of variance, entropy, and other aspects. The calculation time is nearly 0.61 s, showing its efficiency for practical applications. [ABSTRACT FROM AUTHOR]

Electronic voting systems can support a key behavioral process in inter-organizational collaboration – collective decision-making – but typically face challenges related to single points of failure from centralized databases and trusted third parties to deal with privacy voting requirements. To address such issues, this work presents a decentralized voting system based on blockchain technology, Fully Homomorphic Encryption, tokenization, and Proof-of-Stake mechanisms to promote the system's sustainability while enhancing voting privacy and anonymization. Our solution introduces verifiability to voting processes without any trusted intermediaries. We use the inter-organizational collaboration use case since it introduces additional voting requirements in the private domain, such as promoting cooperative behavioral processes to develop trustworthy relationships between organizations. Our proof-of-concept implementation and evaluation results show that the proposed solution provides voting privacy with adequate computational costs. • An on-chain voting system for collective decision-making among organizations. • Smart contract and fully homomorphic encryption for decentralized voting privacy. • Mechanisms to ensure voter eligibility, participation, reward, and accountability. [ABSTRACT FROM AUTHOR]

Malware often uses code obfuscation to evade detection, employing techniques such as packing, virtualization, and data encoding or encryption. Despite widespread application, the impact of combining these techniques in a particular order – so-called obfuscation layering – on code analysis remains poorly understood. This study advances previous research by examining the effects of obfuscation layering on the classification of obfuscation techniques contained in binary code, focusing on how different layering combinations alter structural code patterns. Utilizing a dataset of 85 C programs modified with various combinations of code obfuscation techniques, we analyze the impact of obfuscation layering on structural code metrics such as its control flow complexity. Our study demonstrates that obfuscation layering significantly affects the ability to classify obfuscated code and that the order of applied obfuscations is less significant for classification than previously assumed. Through explainability methodologies our work offers novel insights for malware analysts and researchers to improve their detection strategies. • We measure the effects of obfuscation layering on the structure of binary code. • We evaluate if individual obfuscations can cover the structural patterns of others. • We introduce a comprehensive research dataset released under a CC license. [ABSTRACT FROM AUTHOR]

Encryption technology provides the ability of confidential transmission to ensure the security of Industrial Internet communication, but it makes detecting malicious encrypted traffic very difficult. To resolve the conflict between the difficulty of malicious encrypted traffic detection and the requirements of traffic privacy protection, we propose a cloud-assisted Industrial Internet malicious encrypted traffic detection scheme with privacy protection. To accurately match the encrypted traffic and the detection rules, a privacy set intersection protocol based on the oblivious pseudorandom function and random garbled Bloom filter is constructed, which can detect malicious traffic without revealing data content. Meanwhile, our scheme can allow semi-trusted cloud servers to assist resource-constrained end devices to participate in private calculations. The key-homomorphic encryption is introduced to obfuscate the detection rules, making the detection rules always transparent to end users and semi-trusted cloud servers. We also design the random input verification to make the malicious end users do not have any opportunity to participate in the privacy set intersection calculation using arbitrary data. The scheme analysis and performance evaluation results show that our scheme can effectively guarantee the security of encrypted traffic detection with better detection performance and limited resource consumption. [ABSTRACT FROM AUTHOR]

Currently, the connectivity of vehicles using the latest communication and computing technologies has grown as the Internet of Vehicles (IoV). IoV has been utilized to foster an easy traffic flow by sharing safety-warning messages. However, authentication and confidentiality of shared information is a challenging issue. To solve the problem, various privacy-preserving authenticated data-aggregation schemes have been devised. However, existing schemes have shortcomings specifically concerning a heavy computational cost, and the need for a secure channel. Besides, static pseudonyms may increase the risk of a vehicle's privacy leakage. In response to these challenges, this study introduces a new pairing-less and secure privacy-preserving authenticated data aggregation (PLS-PPADA) scheme. Leveraging the pairing-less and certificate-based setting, the PLS-PPADA scheme emerges as a robust, efficient, and effective solution for safety-warning systems in IoV. Further, to resolve the risk of privacy leakage due to static pseudonyms, the paradigm of fuzzy identity has been utilized. Thus, it achieves efficiency and dynamic anonymity and also does not require a secure channel for key sharing. A comprehensive security analysis underscores its effective data protection capabilities and efficiency comparison presents it as a compelling alternative to existing state-of-the-art schemes. [ABSTRACT FROM AUTHOR]

Considering the existence of fast implementation methods for multiplication operations over ideal lattices, we constructed a selectively secure ciphertext policy attribute-based encryption scheme supporting Boolean circuits based non-monotonic linear secret sharing scheme. It uses the trapdoor generation algorithm TrapGen to generate the public parameters and the preimage sampling algorithm SamplePre to embed the public parameters and randomness into the user's secret key, which achieves the randomization of the secret key. The sharing and reconstruction of the secret in the encryption and decryption algorithm are achieved by a non-monotonic linear secret sharing scheme. Compared to the existing ciphertext policy attribute-based encryption schemes based on a similar sampling algorithm, the size of the ciphertext is significantly reduced. • Our scheme is a CPABE scheme over ideal lattices. • We use non-monotonic LSSS to complete the sharing and reconstruction of secrets. • Our scheme supports Boolean circuit access structures. [ABSTRACT FROM AUTHOR]

Nonlinear invariant attack applied to lightweight block ciphers relies on the existence of a nonlinear invariant g : F 2 n → F 2 for the round function. Whereas invariants of the entire S-box layer have been studied in terms of the corresponding cycle structure, a similar analysis for the linear layer has not been performed yet. In this article, we provide a theoretical analysis for specifying the minimal length of cycles for commonly used linear permutations in lightweight block ciphers. Namely, using a suitable matrix representation, we exactly specify the minimal cycle lengths for those linear layers that employ ShiftRows, Rotational-XOR and circular Boolean matrix operations which can be found in many well-known families of block ciphers. These results are practically useful for the purpose of finding nonlinear invariants of the entire encryption rounds since these can be specified using the intersection of cycles corresponding to the linear and S-box layer. We also apply our theoretical analysis practically and specify minimal cycle lengths of linear layers for certain families of block ciphers including some NIST candidates. [ABSTRACT FROM AUTHOR]

Cloud Service Providers (CSP s) allow data owners to migrate their data to resource-rich and powerful cloud servers and provide access to this data by individual users. Some of this data may be highly sensitive and important and CSP s cannot always be trusted to provide secure access. It is also important for end users to protect their identities against malicious authorities and providers, when they access services and data. Attribute-Based Encryption (ABE) is an end-to-end public key encryption mechanism, which provides secure and reliable fine-grained access control over encrypted data using defined policies and constraints. Since, in ABE , users are identified by their attributes and not by their identities, collecting and analyzing attributes may reveal their identities and violate their anonymity. Towards this end, we define a new anonymity model in the context of ABE. We analyze several existing anonymous ABE schemes and identify their vulnerabilities in user authorization and user anonymity protection. Subsequently, we propose a Privacy-Preserving Access Control Scheme (PACS) , which supports multi-authority, anonymizes user identity, and is immune against users collusion attacks, authorities collusion attacks and chosen plaintext attacks. We also propose an extension of PACS , called Statistical Privacy-Preserving Access Control Scheme (SPACS) , which supports statistical anonymity even if malicious authorities and providers statistically analyze the attributes. Lastly, we show that the efficiency of our scheme is comparable to other existing schemes. Our analysis show that SPACS can successfully protect against Collision Attacks and Chosen Plaintext Attacks. [ABSTRACT FROM AUTHOR]

In light of the escalating frequency of DNS attacks, it is imperative to bolster user security and privacy through the encryption of DNS queries. However, conventional methods for detecting DNS traffic are no longer effective in identifying encrypted traffic, particularly with the utilization of the DNS-over-HTTPS (DoH) protocol, which employs secure HTTPS for DNS resolution. To confront this challenge, we propose a novel model for detecting malicious DoH traffic, named DoH-TriCGAN, which distinguishes between non-DoH, benign DoH, and malicious DoH traffic. DoH-TriCGAN employs a conditional generative adversarial network comprising three network components, for which we only provide additional information to the generator. We extracted different small sample datasets and large sample dataset from the CIRA-CIC-DoHBrw-2020 dataset, to evaluate the efficiency and effectiveness of the proposed DoH-TriCGAN model, and compared the quality of the generated synthetic data. To establish a benchmark, we utilized the six metrics – accuracy, precision, recall, F1-score, ROC_AUC, and PR_AUC – to assess the performance of our model. The results demonstrate our proposed model outperforms the other five models (RF, XGBoost, BiGRU, Autoencoder, Transformer), showing the best performance particularly in scenarios with limited training samples, while also demonstrating data expansion capabilities by generating high-quality synthetic data to address the issue of insufficient network traffic. [ABSTRACT FROM AUTHOR]

The Internet of Things (IoT) generates a significant volume of geo-tagged images via surveillance sensors in edge–cloud computing environments. Image search is essential to facilitate information sharing, data analysis, and strategic decision-making. However, outsourced images are typically encrypted for privacy protection, posing a challenge in simultaneously searching for visual and geographical relevance on encrypted images. To address this, this paper proposes an edge intelligence empowered privacy-preserving top- k geo-tagged image search scheme for IoT in edge–cloud computing. The scheme presents a novel single-to-multi searchable encryption method for geo-tagged images that enables multiple users to perform secure nearest neighbor queries on a data source. Additionally, an extended anchor-based position determination method and an inner product-based distance calculation method are designed to enable geo-tagged image similarity calculation on ciphertext. Finally, a secure pruning method is introduced to improve query performance. Experiments are conducted to verify the performance of the scheme in terms of high efficiency and accuracy of the search. • Single-to-multi searchable encryption model on geo-tagged images. • Secure nearest neighbor queries on geo-tagged images. • Secure pruning based on the extended locality-sensitive hashing. • Distance calculation from an encrypted data point to an encrypted space. • Extended anchor-based position determination. [ABSTRACT FROM AUTHOR]

Nowadays, many security service providers have their own vulnerability databases and consider them as corporate property. How to ensure the normal use of client while protecting the privacy of these assets has become a problem that needs to be solved. This paper mainly introduces a privacy comparison protocol based on BGN and a version number standardization method, which can be used in scenarios of vulnerability database privacy comparison. Our scheme PCPHE adds random offsets and special preprocessing to avoid common factor attacks that may occur in privacy comparison, while ensuring that client does not know the specific vulnerability database content of the security service provider in a limited number of queries. [ABSTRACT FROM AUTHOR]

Cloud file sharing (CFS) in cloud storage is one of the essential tools for enterprises to improve their core competitiveness. In the sharing process, user dynamic management and players/readers abuse has always been a problem that needs to be solved, but malicious encryptors are also a new challenge. Therefore, preventing malicious encryption is another way to protect copyright issues. This scheme proposes a traitor tracing scheme with puncturable-based broadcast encryption in cloud storage, which is an improved scheme proposed in Ref. Garg et al. (2010). Based on the original completely collusion resistant traitor tracing scheme, the uniform distribution of hash output is used to prevent malicious encryptors. In addition, users can perform authentication during the decryption phase to prevent replay attacks. At the same time, the puncture algorithm is introduced, so that normal users can dynamically revoke themselves without affecting the normal use of other users. We prove that the scheme is secure under chosen plaintext attack (CPA). Theoretical analysis also shows that our scheme can prevent malicious encryptors in cloud file sharing and allow normal users to dynamically revoke. After experimental verification, our scheme offers distinct advantages over the existing one. • Prevent malicious encryptors. We use the feature of uniform distribution of hash output to hash random numbers, which makes it impossible to embed the random trapdoor. • Dynamic management of users. We incorporate puncture encryption that allow legitimate recipients to update their private key by self-puncture, thereby revoking the private key's ability to decrypt message. Also, the ability of other recipients to decrypt messages is not affected. • User self-verification. During encryption, The user hashes the decrypted M and R , and then compares them with h = H (R ‖ M ‖ L) to see whether they suffer replay attacks. [ABSTRACT FROM AUTHOR]

In the current age of constrained local storage capacity, ensuring the security and privacy of user data against unauthorized third-party access has grown significantly more vital. Searchable Encryption (SE) has arisen as a promising method for preserving the confidentiality of user data while also enabling efficient search capabilities. Certificateless Searchable Encryption (CLSE) stands out among a range of SE cryptosystems by effectively addressing issues related to certification management and key escrow. Nevertheless, the majority of current CLSE approaches heavily depend on computationally intensive bilinear pairings and do not offer robust support for conjunctive keyword searches in multi-receiver scenarios. To address these limitations, we propose a Pairing-free Dynamic Multi-receiver Certificateless Authenticated Searchable Encryption (PDMCLASE) scheme. PDMCLASE focuses on three essential features: (1) Dynamic multi-receiver functionality, enabling new data receivers to access documents while revoking access for existing receivers; (2) Conjunctive subset keyword search, empowering data receivers to perform efficient conjunctive searches on subsets of keywords; and (3) Data sender authentication, ensuring the authenticity of keyword encryption by the data sender. Furthermore, PDMCLASE attains keyword privacy by leveraging elliptic curve hardness problems within the standard model. Through our performance analysis, we establish that PDMCLASE not only delivers improved functionality but also demonstrates reduced computational overhead when compared to alternative schemes. [ABSTRACT FROM AUTHOR]

NTRU is a lattice-based cryptosystem built on a convolutional ring of polynomials. There are many generalizations of NTRU in the literature; however, group ring NTRU, or GR-NTRU, is the most reasonable description of NTRU as a general framework to design its variants. Most versions are commutative and are obtained by changing the ring of coefficients while keeping the cyclic structure intact. In this work, we analyze the noncommutative version of GR-NTRU designed with the group ring of dihedral group over the ring of Eisenstein integers. We experimentally test the size of the keyspace of this new variant and find that it is comparable and even larger for certain parameters compared to the existing commutative counterpart. We observe that although it is slightly slow in terms of speed of encryption and decryption, it has higher lattice security. [ABSTRACT FROM AUTHOR]

The advent of quantum computing threatens the security of traditional public-key cryptography. Algorithms for quantum computing have the ability to solve the large prime factorization and the discrete logarithm problem in polynomial time. To deal with the threat, post-quantum cryptography (PQC) primitives and protocols were proposed. Lattice-based cryptography (LBC) is the promising post-quantum cryptography, both in traditional and emerging security scenarios such as public-key encryption, homomorphic encryption and oblivious transfer. Theoretically, the algebraic structure of the lattice provides a secure fundamental for LBC. In contrast, the implementation should consider the balance of time, space, and resources for realization on various programmable platforms. In the implementation of lattice-based cryptography, polynomial multiplication is the primary operation accounting for about 30% of the execution. To improve the performance of LBC schemes, various efficient algorithms have been proposed over decades. This work focuses on approaches to accelerate polynomial multiplication used in LBC schemes. First, we review and compare three polynomial multiplication algorithms, Number Theory Transform (NTT), Karatsuba algorithm and Toom–Cook algorithm. Then we present a comprehensive survey of implementation on programmable platforms such as Graphics Processing Unit (GPU) and Field-Programmable Gate Array (FPGA). At last, we summarize the future trend of implementing polynomial multiplication and provide recommendations. [ABSTRACT FROM AUTHOR]

E-Health Cloud can provide remote, accurate, real-time, intelligent information services for healthcare. Despite the benefits brought by data outsourcing, it may also cause data breaches and compromise user privacy. Searchable encryption can provide data security and search services in the encrypted data domain. However, in E-Health Cloud, users may have some other special needs, such as sharing their health information with doctors during the treatment period and updating the data access right when they transfer from one hospital to another. Some works introduced the primitive proxy re-encryption with public keyword search (Re-PEKS) to meet the above needs. However, the state-of-the-art solutions cannot support expressive boolean query, and its search cost time increases linearly with total number of outsourced documents, this is very impractical in huge E-Health Cloud system. An efficient Re-PEKS scheme termed PRTDs is proposed in this article to address this problem. PRTDs supports sub-linear boolean query, time controlled data sharing, and re-encryption to change data users simultaneously. To compare PRTDs with the most advanced time-enabled Re-PEKS scheme, we also implement exhaustive comparative experiments on HUAWEI Cloud with the Enron dataset, and the results show that PRTDs has a better performance on encryption and searching. [ABSTRACT FROM AUTHOR]

Encryption deduplication technology first encrypts the file or chunks of data, then detects and removes duplicate ciphertexts, storing only one copy on the cloud storage server (CSP). Although traditional encryption deduplication schemes have the function of ciphertext deduplication, they also have a serious problem. Since the key generation algorithm and the encryption algorithm are deterministic, the frequency of plaintext chunking will be leaked. It is possible for the attacker to infer the information of the plaintext. We propose a Randomized Encryption deduplication method against Frequency Attack (REFA) that provides high randomness in ciphertexts. The core idea of REFA is that after obtaining a convergence key generated with the aid of a key server, the user randomizes the convergence key with a random value of the same length. Then, REFA encrypts the plaintext chunk with a randomized key. Our scheme hides the random value in the ciphertext and encrypts the convergence key for user ownership verification. REFA perfectly masks the frequency of plaintext chunks and has high storage efficiency and data security. Furthermore, the CSP performs ciphertext updates with ciphertexts uploaded by subsequent users. REFA can effectively protect against frequency analysis attacks. [ABSTRACT FROM AUTHOR]

Visual cryptography encrypts the secret image into n shares (transparency) so that only stacking a qualified number of shares can recover the secret image by the human visual system while no information can be revealed without a large enough number of shares. This paper investigates the (k , n) -threshold Visual Secret Sharing (VSS) model, where one can decrypt the original image by stacking at least k shares and get nothing with less than k shares. There are two main approaches, which have been showed equivalent in some sense, in the literature: codebook-based schemes and random-grid-based schemes; the former is the case of this paper. In general, given any positive integers k and n , it is not easy to design a valid scheme for the (k , n) -threshold VSS model. In this paper, we propose a simple strategy to construct an efficient scheme for the (k , n) -threshold VSS model for any positive integers 2 ≤ k ≤ n. The crucial idea is to establish a seemingly unrelated connection between the (k , n) -threshold VSS scheme and a mathematical structure — the generalized Pascal's triangle. This paper improves and extends previous results in four aspects: • Our construction offers a unified viewpoint and covers several known results. • The resulting scheme has a progressive-viewing property that means the more shares being stacked together the clearer the secret image would be revealed. • The proposed scheme can be constructed explicitly and efficiently based on the generalized Pascal's triangle without a computer. • Performance of the proposed scheme is comparable with known results. [ABSTRACT FROM AUTHOR]

As a cryptographic primitive supporting finer and richer access control, attribute-based encryption can provide more efficient, concise, secure and highly adaptive access control policies for cloud data, which has attracted the attention of many researchers. However, in a standard ABE scheme, the key can only be generated and issued by a central authority. The single authorization center has a heavy load and is vulnerable to attack. Once the center is paralyzed, it will bring serious security consequences. Multi-authorization center attribute encryption (MA-ABE) allows multiple parties to play an authoritative role, which can solve this problem. In this paper, we propose a MA-ABE scheme, which combines a global ID model, a two-stage sampling technique on a lattice and a monotonous linear secret sharing schemes (M-LSSS) to achieve a static security against arbitrary collusion in the random oracle model, in which the access policy of the scheme is expressed by DNF formula. Technically, our scheme is an improvement on the work of Datta et al. (2021), through this improvement, we can get shorter ciphertext and smaller key size. [ABSTRACT FROM AUTHOR]

Malware signatures represent a powerful tool for malware detection and classification, widely used by security researchers and security solution providers. Yara rules describe malware based on string patterns that are evaluated on targeted files. Generally, the security provider sends signatures to the client endpoints and the rule evaluation is performed locally, such that the scanned files do not leave the client machines. However, if a zero-day vulnerability is discovered and the security provider exposes the corresponding signature, there is a considerable risk to also disclose the unpatched vulnerability. A solution is represented by homomorphic encrypted Yara rules, which can be evaluated on targeted files without being decrypted. In this article, we propose a homomorphic Yara rules evaluation method and do a comparative analysis with the HENFA method (Homomorphic Encryption for Finite Automata (Genise et al., 2019)). For our method, we propose a fully homomorphic exact string matching algorithm based on the TFHE scheme (Fully Homomorphic Encryption over the Torus (Chillotti et al., 2020)). In order to determine how suitable is the exact string matching approach in practice, we analyze a public Yara rules repository and generate various statistics about the patterns used in the Yara rules. For the two homomorphic Yara rules matching methods, both theoretical and experimental comparative evaluations are presented. Our proposed method implies ciphertexts with smaller sizes and has better efficiency in the average testing scenarios compared to the HENFA method. [ABSTRACT FROM AUTHOR]

It is analyzed that the important part of the fingerprint image is concentrated in one part of the image, and the gray image is the part with useful information in the whole image. Therefore, this paper combines a new fingerprint image encryption algorithm proposed by combining two new one-dimensional chaotic systems, nonlinear functions, and rules with a dynamic "X" model. We propose two new one-dimensional chaotic systems, one is Sin-Cos chaotic system (SCCS) and the other is Cos-Cos chaotic system (CCCS). Firstly, the fingerprint image is binarized and the contour is extracted to get the area of the fingerprint in the image. Then, for the fingerprint area, a round of encryption is carried out by using nonlinear rules and 24 rules of the dynamic X model. Then the whole image is separated into several parts according to the fingerprint position, read into a sequence at one time, and the whole fingerprint image is scrambled and diffused synchronously by using nonlinear rules and functions. The entropy, NPCR, and UACI of the algorithm are very close to the ideal value, and the performance in time efficiency is passable. The algorithm is extremely secure in a large number of test performance analysis results. [ABSTRACT FROM AUTHOR]

Recently, a JPEG encryption scheme with RS (run/size) pairs multi-permutation and block permutation has been proposed, which mainly improves security by extracting the expected number of RS pairs for global permutations that need overflow processing. However, it still has the risk of information leakage under the chosen plaintext attack. This is because the limited embedding capacity in overflow processing makes the overflow blocks (OBs) less. On the one hand, a few OBs make the sketch generated by non-zero coefficients count after RS pair multi-permutation visually indistinguishable from the original sketch. On the other hand, a few OBs limit the number of extracted RS pairs that can participate in global permutation, so there are many partially extracted blocks (PEBs) containing unextracted RS pairs. More PEBs make the accuracy of the estimated block permutation sequence high, because the unique plaintext block can be constructed as long as there is an unextracted RS pair in an encrypted block. Simulation results show that the correct ratio of block permutation sequence is not less than 60 %. The highest and average PSNRs between the attacked sketch and the original one reach up to 47.07 dB and 27.42 dB, respectively. [ABSTRACT FROM AUTHOR]

Accurate and secure string matching in record linkage is increasingly important in application domains such as bioinformatics, healthcare, and crime detection. Most existing privacy-preserving string matching techniques provide an overall similarity between a pair of strings. As a result, these techniques cannot identify the longest common sub-string between the strings in a pair leading to lower linkage quality, while existing techniques that can identify the longest common sub-string from a pair of strings have long runtimes. While blocking techniques that can be used in the record linkage pipeline improve the time complexity, each string is generally inserted into several blocks making it vulnerable to frequency based attacks. In this paper, we propose two encryption-based approaches to improve the effectiveness and efficiency of string matching in record linkage. Our approaches compare strings based on their lengths of sub-strings. In the first approach, we encrypt the sub-string lengths into individual ciphertexts and compare a pair of ciphertexts based on the corresponding sub-string. In the second approach, we encrypt multiple lengths of sub-strings into a single ciphertext that allows efficient comparison of ciphertexts. We evaluate our approaches on real-world datasets and validate the accuracy, complexity, and privacy compared to four baselines, showing that our approaches outperform all baselines in terms of complexity and privacy while providing higher linkage quality than a standard privacy-preserving record linkage technique. • Accurate and secure string matching based on longest common sub-string is increasingly important in application domains such as bioinformatics, healthcare, and crime detection. • We propose two privacy-preserving string matching approaches based on lengths of sub-strings that can identify common sub-strings between databases. • In our first approach we compare the lengths of sub-strings between databases using a list of hash values generated using a special 1- and 0-encoding, while in our second approach we use an efficient encryption technique to conduct the comparison between pairs of ciphertexts from two databases efficiently. • We empirically evaluate our approaches under the linkage quality, time complexity, and privacy guarantees against several state-of-the-art privacy-preserving string matching approaches using several real datasets. • Our evaluation shows that our approaches can achieve a high linkage quality and efficiency while providing stronger privacy compared to baselines. [ABSTRACT FROM AUTHOR]

Quantum image encryption technology employs the unique features of superposition, entanglement, and quantum state instability, offering advantages like high efficiency, parallelism, and robust resistance to decryption attempts. In this work, we propose a quantum image encryption algorithm via an optimized quantum circuit and parity bit-plane permutation named OCPBP. Our research commences with applying an optimization algorithm to BRQI image preparation. This optimization significantly reduces the number of auxiliary qubits from n +3 to 2 in the preparation of (n +5)-CNOT gate preparation. This reduction makes a significant simplification of the complexity and memory space required for BRQI image preparation. Moreover, we introduce an innovative operation based on parity pixel bit-planes for permutation, which provides a fresh perspective on quantum image encryption based on the BRQI model. Furthermore, we generate quantum key images for XOR operations using the improved logistic map, effectively tackling the challenge of non-random keys that can be a concern in conventional BRQI encryption techniques. We also perform a row-column-based permutation operation to enhance the algorithm's resilience against potential attacks. Through extensive theoretical analysis and comparative experiments, we confirm the heightened security and reduced complexity of the proposed OCPBP algorithm compared to BRQI-based and chaotic image encryption methods. It holds significant promise for improving quantum image communication and application. [ABSTRACT FROM AUTHOR]

With the continued evolution of three dimensional (3D) object presentation and usage, the security of such objects has become an increasingly desirable research area. Previous efforts mostly concentrated on the encryption of point clouds, solid models, meshes, and 3D textured models. The (texture map) part of meshed 3D objects was overlooked by previous encryption techniques of 3D meshed objects in spite of its importance because they require preprocessing to be extracted. Therefore, this paper provides a system for the full encryption of 3D textured objects with their texture maps. It provides an improved system based on an existing flexible cryptosystem named Flexible cryptosystem based on Cellular Automata (FcCA). The FcCA system has two drawbacks. One drawback is shuffling plain data without changing their values, which yields the same histogram and nonstandard encryption ratios. The other drawback is the need for many generations to make the keyspace very large, which is unsuitable for the large size of textured object data. This work overcomes these drawbacks of FcCA and fully encrypts 3D textured objects with their texture maps. The improvements to FcCA include making intersect start points change with every generation and encrypting the values of plain data while shuffling them using cellular automata. At first, the plain 3D object is extracted to vertices, faces, and texture, in addition to its texture map. After that, extracted data are encrypted using the proposed improved FcCA (iFcCA) cryptosystem. Implementation and analysis of this new system showed its preponderance as it can encrypt and decrypt 3D textured objects better than FcCA and other existing methods. Moreover, it reduces the need for many generations of cellular automata, and consequently, reduces execution time. In addition, iFcCA has a very robust key, and it can resist different types of attacks. [ABSTRACT FROM AUTHOR]

This paper proposes a reversible data hiding scheme for encrypted images with SHE (Somewhat Homomorphic Encryption) based on sorting block-level prediction-error expansion (SBPEE). The image provider divides the image into 2 × 2 image blocks and uses SHE to protect the content of the image. In encrypted images, the data hider embeds the secret data with the method of SBPEE, which is based on the pixel redundancy within each block. And the sorting technique shows a good performance at low embedding rate. With the watermarked encrypted image, if the receiver has only the data hiding key, he can extract the additional data. If the receiver has both the data hiding key and the encryption key, he can extract the additional data correctly and recover the original image without loss. The experimental results show that the performance of the method is better than that of the existing similar methods when the embedding rate is low and is consistent with the existing methods when the embedding rate is high. [ABSTRACT FROM AUTHOR]

Lightweight block ciphers based on symmetric cipher are tailored to addressing security issues for highly constrained Internet of things devices. In this article, we explore general software implementations of lightweight ciphers on GPU architectures, with a special focus on LED, Piccolo and PRESENT. First, we implement the lightweight block ciphers using lookup table based technique. Then we analyze the effect of different factors on the encryption performance, such as the size of lookup table, the parallelism level, the use of different type of memory and the idle state caused by data transmission. We evaluated the three lightweight block ciphers on Nvidia Tesla V100 and Nvidia GTX1060 GPUs. Finally, the experimental result shows a great improvement on all the investigated ciphers compared to the unoptimized implementations. [ABSTRACT FROM AUTHOR]

Conditional proxy re-encryption allows a semi-trusted third-party proxy to convert Alice's ciphertext that meets a certain condition into another set of ciphertext. Meanwhile, the proxy cannot obtain any valuable information in the process. Nevertheless, a single re-encryption condition is difficult to meet the needs of practical applications, and the existing conditional proxy re-encryption scheme cannot flexibly control the conversion conditions. To solve this problem, this paper proposes a multi-conditional proxy broadcast re-encryption (MC-PBRE) scheme for file sharing systems. In our scheme, a single user can delegate the decryption rights of the encrypted file to a group of users. At the same time, users can set any number of conditions to control the user group decryption permissions. This paper demonstrates the security of the scheme for chosen-ciphertext attacks in the standard model. Furthermore, the program can resist collusion attacks, which means that the agent cannot collude with the user group to get the private key of the principal. [ABSTRACT FROM AUTHOR]

Reversible data hiding in encrypted domain has been discussed for years. However, the performance of the existing algorithms is generally not satisfactory for the difficulty in signal processing in encrypted domain. In this paper, a high capacity reversible data hiding scheme for encrypted covers is proposed. The cover is first partitioned into non-overlapping blocks and encrypted effectively with homomorphism but without data expansion. Then a histogram shifting algorithm based on prediction error extension is introduced to achieve high embedding capacity of the scheme. The parameters in embedding process can not only adjust the embedding rate but also provide pretty good support for the security of the embedded data. The algorithm can achieve full reversibility at high embedding rate without extra data, and the embedding rate can reach to 2 bpp (bit per pixel). The experimental results verify the effectiveness of our solution, and show that the proposed scheme has outstanding performance in both capacity and quality compared with similar algorithms. [ABSTRACT FROM AUTHOR]

• Multi-secret image sharing schemes have high computational complexity in decoding. • Arithmetic modulo-based scheme has low computational complexity but is not secure. • To overcome these issues, arithmetic operation-based scheme is proposed. • Proposed scheme fulfills security criterion and reduces computational complexity. • Company organizer can utilize universal share for managing multiple secrets. Visual secret sharing (VSS) scheme is an encryption technique to hide secret message into two or more meaningless images, called as shares. Shares are stack together to decrypt the secret message using human visual system. To share many secrets, multi-secret image sharing schemes are often used. Diversity in sharing multiple secrets is using the universal share. Company organizer shares multiple secret images using this common share. Computation cost is the major drawback of such scheme. This study presents computationally efficient arithmetic-based multi-secret image sharing scheme using the universal share. Binary arithmetic-based scheme utilizes distinct value selecting function while encoding and decoding of secret images. Distinct value selecting function enhances randomness property of shares and fulfills threshold property. Thus, the proposed method provides computationally efficient method while satisfying threshold security criteria. [ABSTRACT FROM AUTHOR]

Personal health record (PHR) system has become an important platform for health information exchange, in which patients can effectively manage and share personal health information in cloud storage. In general, all health information will be encrypted before they are uploaded to the cloud server. However, the cloud server is unreliable and the sensitive information of users may be disclosed in this process. The general encryption algorithm cannot protect both confidentiality and privacy of the uploaded information. Attribute-based encryption (ABE) provides a solution to it. In this paper, we propose a privacy-preserving decentralized ABE scheme for secure sharing of PHR based on Lewko and Waters′s scheme, in which an anonymous secret key issuing protocol is used to hide GIDs. This protocol can make the authorities generate the correct decryption key for users without knowing their GIDs. In addition, the one-way anonymous key agreement is used to hide the attributes in the access policy. The presented scheme keeps the security of the Lewko and Waters′s scheme and removes the random oracle. Finally, we show that the security of the proposed scheme is reduced to static assumptions based on dual system encryption instead of other strong assumptions. [ABSTRACT FROM AUTHOR]