Search

In the last couple of decades, Attribute-Based Encryption (ABE) has been a promising encryption technique to realize fine-grained access control over encrypted data. ABE has appealing functionalities such as (i) access control through encryption and (ii) encrypting a message to a group of recipients without knowing their actual identities. However, the existing state-of-the-art ABEs are based on number-theoretic hardness assumptions. These designs are not secure against attacks by quantum algorithms such as Shor algorithm. Moreover, existing Post-Quantum Cryptography (PQC)-based ABEs fail to provide long-term security. Therefore, there is a need for quantum secure ABE that can withstand quantum attacks and provides long-term security. In this work, for the first time, we introduce the notion of a quantum-secure ABE (qABE) framework that preserves the classical ABE's functionalities and resists quantum attacks. Next, we provide a generic construction of qABE which is able to transform any existing ABE into qABE scheme. Thereafter, we illustrate a concrete construction of a quantum ABE based on our generic transformation qABE and the Waters' ciphertext-policy ABE scheme. [ABSTRACT FROM AUTHOR]

The Internet of Things (IoT) is a heterogeneous network composed of numerous dynamically connected devices. While it brings convenience, the IoT also faces serious challenges in data security. Ciphertext-policy attribute-based encryption (CP-ABE) is a promising cryptography method that supports fine-grained access control, offering a solution to the IoT's security issues. However, existing CP-ABE schemes are inefficient and unsuitable for IoT devices with limited computing resources. To address this problem, this paper proposes an efficient pairing-free CP-ABE scheme for the IoT. The scheme is based on lightweight elliptic curve scalar multiplication and supports multi-authority and verifiable outsourced decryption. The proposed scheme satisfies indistinguishability against chosen-plaintext attacks (CPA) under the elliptic curve decisional Diffie–Hellman (ECDDH) problem. Performance analysis shows that our proposed scheme is more efficient and better suited to the IoT environment compared to existing schemes. [ABSTRACT FROM AUTHOR]

As the number of Internet of things (IoT) devices increases, traditional centralized access control solutions are inadequate for the current large-scale IoT environment. Existing distributed access control schemes suffer from high monetary costs and low throughput in processing access requests. To address these issues, a blockchain smart contract combined with ciphertext policy attribute based encryption (CP-ABE) was proposed to implement access control for IoT resources. Using Hyperledger Fabric as the underlying network, attribute-based encryption was applied to functional tokens, and token ciphertexts were stored using the interplanetary file system (IPFS). Through smart contracts, token retrieval addresses were publicly exposed to achieve 1-to-N authorization. Furthermore, contracts were designed to be deployed on the blockchain for decentralized permission evaluation of token requests, maintaining the allowed operations for subjects on specific resource objects, realizing more fine-grained attribute-based access control. Simulation experiments and performance analysis demonstrate that compared to existing solutions, this approach enables data owners to securely authorize access for a large number of requesting subjects in a shorter time frame. Stress tests show that the chaincode performs well.

With the rapid advancement of cloud computing technology, reversible data hiding algorithms in encrypted images (RDH-EI) have developed into an important field of study concentrated on safeguarding privacy in distributed cloud environments. However, existing algorithms often suffer from low embedding capacities and are inadequate for complex data access scenarios. To address these challenges, this paper proposes a novel reversible data hiding algorithm in encrypted images based on adaptive median edge detection (AMED) and ciphertext-policy attribute-based encryption (CP-ABE). This proposed algorithm enhances the conventional median edge detection (MED) by incorporating dynamic variables to improve pixel prediction accuracy. The carrier image is subsequently reconstructed using the Huffman coding technique. Encrypted image generation is then achieved by encrypting the image based on system user attributes and data access rights, with the hierarchical embedding of the group’s secret data seamlessly integrated during the encryption process using the CP-ABE scheme. Ultimately, the encrypted image is transmitted to the data hider, enabling independent embedding of the secret data and resulting in the creation of the marked encrypted image. This approach allows only the receiver to extract the authorized group’s secret data, thereby enabling fine-grained, controlled access. Test results indicate that, in contrast to current algorithms, the method introduced here considerably improves the embedding rate while preserving lossless image recovery. Specifically, the average maximum embedding rates for the (3, 4)-threshold and (6, 6)-threshold schemes reach 5.7853 bits per pixel (bpp) and 7.7781 bpp, respectively, across the BOSSbase, BOW-2, and USD databases. Furthermore, the algorithm facilitates permission-granting and joint-decryption capabilities. Additionally, this paper conducts a comprehensive examination of the algorithm’s robustness using metrics such as image correlation, information entropy, and number of pixel change rate (NPCR), confirming its high level of security. Overall, the algorithm can be applied in a multi-user and multi-level cloud service environment to realize the secure storage of carrier images and secret data. [ABSTRACT FROM AUTHOR]

Copyright of Telecommunications Science is the property of Beijing Xintong Media Co., Ltd. and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Satellite service systems transfer data from satellite providers to the big data industry, which includes data traders and data analytics companies. This system needs to provide access to numerous users whose specific identities are unknown. Ciphertext-Policy Attribute-Based Encryption (CP-ABE) allows unidentified users with the proper attributes to decrypt data, providing fine-grained access control of data. However, traditional CP-ABE does not protect access policies. Access policies are uploaded to the cloud, stored, and downloaded in plain text, making them vulnerable to privacy breaches. When the access policy is completely hidden, users need to use their own attributes to try matching one by one, which is an inefficient process. In order to efficiently hide the access policy fully, this paper introduces a new efficient and expressive Fully Policy-Hidden Ciphertext-Policy Attribute-Based Encryption scheme (CP-ABE-FPH), which integrates the 2-way handshake O-PSI method with the ROBDD method. The integration offers advantages: (1) High efficiency and high expressiveness. The access policy using ROBDD is highly expressive but computationally intensive due to its recursive nature. This shortcoming is overcome in CP-ABE-FPH using the proposed O-PSI method, and the access policy is matched quickly and secretly. (2) High flexibility. The decryption process does not require the owner or the Key Generation Center (KGC) to be online, and system attributes can be added at any time. Security analysis shows that the access policy is fully hidden. Efficiency analysis and simulation results show that the proposed scheme is highly efficient in decryption compared with existing schemes. [ABSTRACT FROM AUTHOR]

With the rapid growth of wireless sensor networks, secure data transmission, storage, and distribution in such networks has become an urgent demand. To defend against security risks such as data leakage, key compromise, and unauthorized misuse of data simultaneously, we propose a novel obfuscatable ciphertext-policy attribute-based re-encryption scheme with a specially designed obfuscator. The proposed scheme leverages program obfuscation to transform the re-encryption program codes into an unintelligible form and embed the private keys into the obfuscated implementation. Consequently, the proposed scheme protects data confidentiality and keeps the secrecy of the private key while providing fine-grained access control. Formal proofs for the security of the proposed re-encryption scheme and the obfuscator are provided. Extensive experiments have been conducted on representative platforms, including cloud servers, workstations, and embedded devices, to evaluate the computational efficiency and energy consumption of the scheme. Experimental results indicate that the scheme achieves high efficiency on various platforms and economical energy consumption on typical embedded devices with constrained resources. [ABSTRACT FROM AUTHOR]

Copyright of Automobile Technology is the property of Automobile Technology Editorial Office and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

The Internet of Things (IoT) is a heterogeneous network composed of numerous dynamically connected devices. While it brings convenience, the IoT also faces serious challenges in data security. Ciphertext-policy attribute-based encryption (CP-ABE) is a promising cryptography method that supports fine-grained access control, offering a solution to the IoT’s security issues. However, existing CP-ABE schemes are inefficient and unsuitable for IoT devices with limited computing resources. To address this problem, this paper proposes an efficient pairing-free CP-ABE scheme for the IoT. The scheme is based on lightweight elliptic curve scalar multiplication and supports multi-authority and verifiable outsourced decryption. The proposed scheme satisfies indistinguishability against chosen-plaintext attacks (CPA) under the elliptic curve decisional Diffie–Hellman (ECDDH) problem. Performance analysis shows that our proposed scheme is more efficient and better suited to the IoT environment compared to existing schemes.

Satellite service systems transfer data from satellite providers to the big data industry, which includes data traders and data analytics companies. This system needs to provide access to numerous users whose specific identities are unknown. Ciphertext-Policy Attribute-Based Encryption (CP-ABE) allows unidentified users with the proper attributes to decrypt data, providing fine-grained access control of data. However, traditional CP-ABE does not protect access policies. Access policies are uploaded to the cloud, stored, and downloaded in plain text, making them vulnerable to privacy breaches. When the access policy is completely hidden, users need to use their own attributes to try matching one by one, which is an inefficient process. In order to efficiently hide the access policy fully, this paper introduces a new efficient and expressive Fully Policy-Hidden Ciphertext-Policy Attribute-Based Encryption scheme (CP-ABE-FPH), which integrates the 2-way handshake O-PSI method with the ROBDD method. The integration offers advantages: (1) High efficiency and high expressiveness. The access policy using ROBDD is highly expressive but computationally intensive due to its recursive nature. This shortcoming is overcome in CP-ABE-FPH using the proposed O-PSI method, and the access policy is matched quickly and secretly. (2) High flexibility. The decryption process does not require the owner or the Key Generation Center (KGC) to be online, and system attributes can be added at any time. Security analysis shows that the access policy is fully hidden. Efficiency analysis and simulation results show that the proposed scheme is highly efficient in decryption compared with existing schemes.

In ciphertext-policy attribute-based encryption, there might be different levels of overlapping in the access policies of different data objects outsourced by the same data owner. This paper proposes a soft set decision-making method and cluster percolation method-based policy clustering by using policy similarity for CP-ABE, aiming to merge the duplicated access policy pieces to reduce repeated computations during the encryption process of corresponding data objects. Firstly, the access policies are clustered using either the soft set decision-making or the cluster percolation method. Secondly, the access policies within the same cluster are integrated for further encryption of corresponding data objects as a whole, thereby preventing redundant computations during the encryption process and thus reducing computational overhead. Theoretical analysis and experimental results demonstrate the feasibility and effectiveness of the proposed approach in this paper. [ABSTRACT FROM AUTHOR]

With the rapid deployment of storage services, secure and efficient user authorization and revocation data shared through the cloud have become a grand challenge hindering cloud data applications. When previous direct and indirect user revocation schemes implemented large-scale user revocation, they faced heavy communication and computational costs. To address these challenges, this study presents a new encryption scheme that combines ciphertext-policy attribute-based encryption (CP-ABE) with puncturable encryption to achieve efficient and flexible user revocation. We design a proxy server to reduce the computational overhead in the decryption phase. Because the puncture process is performed on a semi-honest cloud, we use the digital signature method to verify the correctness of its operation. Furthermore, we prove the security of our scheme under the chosen-plaintext attack (CPA), and compare it with other schemes to highlight its advantages. Numerical analysis and experimental simulation results reveal that our scheme is more suitable than other schemes for use in a cloud environment for user revocation. [ABSTRACT FROM AUTHOR]

Ciphertext-policy attribute-based encryption(CP-ABE) can be used to realize secure data sharing in cloud computing environments.However,user attribute change(attribute revocation and addition) in CP-ABE is a tricky problem.Generally,attribute change is realized via the proxy server’s secondary encryption of ciphertext and key update.However,when enforcing an attribute change,all ciphertexts related to this attribute should be updated.This paper proposes a user attribute change approach based on lazy-mode ciphertext-update.It analyzes the user’s access ability(before attribute revocation or after attribute addition) to the ciphertexts involved in attribute change and determines if these ciphertexts need to be updated,minimizing the scope of the ciphertexts that need to be updated and reducing the number of updates.This approach improves its efficiency by avoiding unnece-ssary ciphertext updates and shortening the ciphertext while preserving the original security features of the CP-ABE.Finally,a small-size test is conducted to verify the correctness of the proposed approach.

Agricultural product supply chain and blockchain are closely integrated with the continuous acceleration of agricultural modernization. The clustered supply chain has gradually developed from a single supply chain in recent years. There is heat competition among peer enterprises in the clustered agricultural product supply chain blockchain. Among them, the data on the blockchain is publicly available to all participants. The private data on the chain has been adopted as an encrypted storage model, in order to protect users' privacy. The existing single-department supervision scheme is unsuitable for the complex cluster agricultural supply chain. The multi-sector supervision can be expected to serve as a promising way in the current reality. However, multi-department supervision is still challenging to ensure the sharing of encrypted data on the chain without redundant information for irrelevant departments. It is a high demand to improve supervision efficiency and credibility. Fortunately, the ciphertext-policy attribute-based encryption (CP-ABE) can be a one-to-numerous encryption, essentially a public key encryption system. The CP-ABE can realize the sharing of data for the users with specified attributes suitable for the application environment of multi-department supervision of the blockchain in the clustered agricultural supply chain. In this research, a multi-department supervision scheme was proposed in the verifiable blockchain ciphertext policy for the cluster agricultural supply chains using CP-ABE. A chain of custody was set up outside the business chain, including the supervisors from various departments to facilitate the management of supervisors. The chain of custody managed data on the business chain through “cross-chain governance.” Different supervision strategies were set for the data on the chain, according to the data type. The administrator of the supervision department was set as the department's supervisor to supervise the specific data of the specific chain. According to the supervision strategy on the chain, the enterprise users encrypted the data using CP-ABE to realize the disclosure of data for privacy. A CP-ABE-based access tree verification scheme was designed to combine the smart contracts and supervision strategies, and then to verify the CP-ABE access tree before the data was uploaded to the chain, in order to ensure that the data was available to the designated supervisor. The direct use of CP-ABE was inefficient for data encryption. Therefore, hybrid encryption was used to encrypt and share the data. The specific implementation was to encrypt the original data with symmetric encryption and then use the CP-ABE to encrypt the symmetric encryption key. A supervision prototype system was constructed under the blockchain ciphertext of the clustered agricultural supply chain using Hyperledger Fabric. The system was tested in two aspects of function and performance. The functional test showed that the system fully met the needs of essential multi-department supervision. The performance test showed that each time the number of supervisors in the supervision strategy increased by 10, while the average on-chain time was extended by about 500 ms, and the average throughput was 438 (number of transactions/s, transactions/s). When the number of supervisors for a single data type of a single enterprise was within a reasonable range, the clustered system was adept to the multi-department supervision under the condition of the primary clustered agricultural supply chain blockchain ciphertext-application requirements. Security analysis indicated the high-security system. As such, this scheme can be expected suitable for the multi-departmental, specialized, and fine-grained supervision of data on the blockchain under data encryption. The pressure of regulators can be inspired by the development of blockchain supervision of cluster agricultural supply chains. [ABSTRACT FROM AUTHOR]

In ciphertext-policy attribute-based encryption, there might be different levels of overlapping in the access policies of different data objects outsourced by the same data owner. This paper proposes a soft set decision-making method and cluster percolation method-based policy clustering by using policy similarity for CP-ABE, aiming to merge the duplicated access policy pieces to reduce repeated computations during the encryption process of corresponding data objects. Firstly, the access policies are clustered using either the soft set decision-making or the cluster percolation method. Secondly, the access policies within the same cluster are integrated for further encryption of corresponding data objects as a whole, thereby preventing redundant computations during the encryption process and thus reducing computational overhead. Theoretical analysis and experimental results demonstrate the feasibility and effectiveness of the proposed approach in this paper.

In order to improve the expressivity of the access structure in attribute-based encryption, and avoid the interference of irrelevant attributes in the access structure, a ciphertext-policy attributebased encryption (CP-ABE) scheme based on reduced ordered binary decision diagram (ROBDD) access structure is proposed. The ROBDD access structure in this scheme can effectively express the access policy with complex access logic and prevent the interference of irrelevant attributes, which improves the encryption speed. RSA attribute authentication mechanism is introduced to achieve attribute authentication in non-leaf nodes of ROBDD, which realizes anti-collusion attack and protection of user attribute set. The effective path eigenvalues and encryption parameters in ROBDD are used to create polynomials, and any effective path eigenvalue can get encryption parameters through polynomial calculation, which reduces the cost of ciphertext storage overhead. The scheme implements user revocation, user attribute revocation, and system attribute revocation. Performance analysis and experimental simulation show that the proposed scheme has higher encryption and decryption efficiency, and lower ciphertext storage overhead. [ABSTRACT FROM AUTHOR]

With the rapid development of cloud computing, a large number of web services have been emerging quickly, which brings a heavy burden for users to choose the services they preferred. In order to suggest web services for users, recommendation algorithms are needed and many of them have been investigated recently. However, most of the existing recommendation schemes are based on centralized historical data, which may lead to single point of failure. Generally, the data contains a lot of sensitive information that cloud may expose the privacy of users, which makes most cloud platforms reluctant to share their own data. In order to solve the above issues, the secure data sharing among cloud platforms is necessary for better recommendation, which can maximize the profits. In this paper, we propose a blockchain-assisted collaborative service recommendation scheme ( $BC - SRDS$ ). Specifically, we adopt the ciphertext-policy attribute-based encryption (CP-ABE) algorithm to encrypt the data, which ensures the data confidentiality and realizes secure data sharing. Then, we utilize the blockchain to share data, such that the DoS attack, DDoS attack and single point of failure can be avoided. Meanwhile, the data integrity, tampering-proof of data are guaranteed through the blockchain. And we use locality-sensitive hashing algorithm to recommend the services for users. Finally, it is proved through the security analysis that $BC - SRDS$ is capable of achieving data confidentiality, data integrity and tampering-proof. A series of experiments show that $BC - SRDS$ achieves better recommendation accuracy compared with the existing schemes.

Securing information dissemination is extremely important for various vehicular ad hoc networks (VANETs) applications. However, most of the applications require disseminating the critical information only to the authorized vehicles through V2I (Vehicle to Infrastructure) communications. Moreover, V2I communications usually suffer from incomplete information to vehicles in one RSU’s transmission range. Therefore, it is an even challenging task that how to ensure reliable dissemination of encrypted data to the recipient vehicles in multi-RSU settings. We propose a security-aware information dissemination scheme with fine-grained access control in cooperative multi-RSU of VANETs. Our proposed scheme uses ciphertext-policy attribute-based encryption (CP-ABE) to ensure confidential communication in a broadcasting way, which ensures that only the vehicles that satisfy the access control policy can have the ability to access the information; and we employ proxy re-encryption in the communication protocol to make sure the moving vehicles in high-speed can get the whole encrypted information. Performance analysis shows that our scheme can enable fine-grained access control for the broadcasted information, and make sure the vehicles receive reliable information in the whole disseminating process. And our scheme is applicable and efficient in various scenarios of information dissemination, especially in cooperative multi-RSU of VANETs. [ABSTRACT FROM AUTHOR]

In this article, we propose a revocable lattice-based CP-ABE (Ciphertext-Policy Attribute-Based Encryption) scheme (RL-ABE), which is suitable to be applied in the cloud storage. The RL-ABE scheme can resist quantum algorithm attack and ensure fine-grained access control to the users’ rights in achieving shared data. In addition, our scheme can realize attribute revocation, which can expediently renew users’ attributes to grant or revoke their access rights. Then, we formally prove the security of our scheme based on the hardness of Ring Learning with Error problem(R-LWE) to resist quantum algorithm attack, and prove our scheme can solve security threatens to withstand collusion attacks. Finally, the performance analysis shows the high efficiency of our scheme compared with other related schemes. [ABSTRACT FROM AUTHOR]

Cloud-assisted smart grid has been broadly deployed to improve the economics, efficiency, sustainability, and reliability of electricity services. The new revolution of technology will also bring new challenges to data security, particularly data confidentiality. As a promising encryption method for supporting fine-grained access control, attribute-based encryption (ABE) is widely given attention by the academia and industry. However, most existing schemes suffer from the efficiency problem limiting its deployment for the cloud-assisted smart grid, especially for resource-limited users. To address this problem, this paper proposes two efficient pairing-free ciphertext-policy attribute-based schemes that eliminate the computation-intensive bilinear pairing operation. The basic scheme only uses some simple scalar multiplications based on elliptic curves, and the enhanced scheme provides an important usability feature, namely the users and attributes revocation. The security of the proposed schemes is reduced to the elliptic curve decisional Diffie-Hellman problem. Finally, the performance analysis and extensive experiments demonstrate that our proposed schemes are suitable for the cloud-assisted smart grid.

It is the most important and challenging problem to share the data safely in cloud computing. Some so-called trusted third parties may also infringe users' data privacy. It is an urgent problem for data owners to share data safely with the designated users rather than the third party or other users. Traditional encryption schemes utilize different keys to produce multiple encrypted copies of the same data for users. It is no longer applicable for cloud data sharing security. Attribute-based encryption can solve above problems, but it needs to rely on trusted third parties to protect the users' privacy. In this article, in order to address the above problems, we propose a blockchain-based ciphertext-policy attribute-based encryption scheme for cloud data secure sharing without relying on any trusted third parties. Blockchain-based ciphertext-policy attribute-based encryption scheme can protect the rights and security of data owner. Compared with existing cloud security schemes, the proposed scheme has more advantages in terms of the six aspects: (1) data owners have the authority to decide who can decrypt the data; (2) the operations of users are retained permanently, and all records are tamper-proof; (3) our proposed scheme has the characteristic of "one-to-many" encryption, and data is encrypted only once; (4) our scheme does not rely on any trusted third party; (5) in terms of the discrete logarithm problem and decisional q parallel-bilinear Diffie–Hellman exponent problem, we prove that our proposed scheme is secure; and (6) experiment shows that our proposed scheme is more efficient than the comparative scheme. [ABSTRACT FROM AUTHOR]

As an emerging and efficient paradigm for multimedia systems, fog networking has attracted widespread attention over the last few years. However, an increasing number of attacks in the current virtualized environments underlines the importance of secure data sharing. Unfortunately, existing multimedia data sharing schemes are not suitable for the networking systems because of the heavy computational operations, latency-sensitive service, and resource-limited devices. Additionally, authenticated and secure communications are crucial issues related to privacy and trust. In this paper, we propose a secure and efficient data sharing scheme with the computation outsourcing capability in a fog networking system by employing ciphertext-policy attribute-based encryption. The scheme supports dynamic policy updating and delegates attribute revocation processes to the cloud and fog by proxy re-encryption. In particular, we build a secure communication protocol for the revocation parameter transmission. We adopt a chaotic map to generate a one-time key, by which the revocation parameters are encrypted. Then, to ensure legal user accessing to the system, we establish a privacy-preserving communication architecture between the user and cloud, which provides authentication. In addition, our scheme provides a verifiable auditing service for the decryption key and shared file, thus ensuring its correctness. Finally, we analyze the security of the scheme, evaluate its performance, and compare it with related works. [ABSTRACT FROM AUTHOR]

In a ciphertext-policy attribute-based encryption (CP-ABE) system, the decryption keys are only related to attributes shared by multiple users and do not contain any identity information of their original holders. Hence, if a decryption key is leaked, there is no feasible method to trace the suspicious user. The user tracing problem has become an obstacle to the adoption of CP-ABE in practice. In order to address it, some traceable/accountable CP-ABE schemes have been established. However, considering the user tracing problem in multi-domain environment will face new challenges. Multi-domain environments usually have a two-layer structure, domains and intradomain users. When tracing a user, we should first trace the domain where the user is located, and then trace the user in the domain. Unfortunately, the existing traceable CP-ABE schemes only focus on one level of users tracing, and are not suitable for the two-layer structure of multi-domain environments. Therefore, a white-box traceable CP-ABE scheme in multi-domain environment is proposed in this paper. The proposed scheme obtains a so-called two-layer tracing. At the domain level, a short signature technique is used to prevent an attacker from forging the tracing parameter and realize the traceability for domains. Linkable ring signature technology is introduced at the user level to provide a tracing method for users by utilizing the linkability of the signature. The two signature structures are reasonably embedded in a user private key to support two-layer white-box tracing at both domains and intradomain users. The proposed scheme supports any monotone access structures and has full security against chosen plaintext attack in the standard model. Compared with related schemes, the asymptotic communication cost and the asymptotic computation cost of the proposed scheme are relatively low. These advantages make the proposed scheme more practical for solving the user tracing problem in multi-domain environment.

s: At present, the main drawbacks of existing k-times attribute-based authentication (abbreviated to k-TABA) schemes and related attribute-based authentication schemes are that the computation cost of the authentication process depends on the size of the access formula and none of these schemes considers the problems of member revocation and attribute update. A new k-TABA scheme was constructed based on the building blocks of direct anonymous attestation, set membership proof and ciphertext-policy attribute-based encryption. Moreover, in order to reduce user's calculation as much as possible, the underlying attribute-based encryption scheme was modified, and then the main decryption operations were outsourced by using the key binding technique of Green et al. The new scheme can be deployed on a trusted platform and support expressive authentication policies. In addition, it also satisfies several ideal properties, such as registration process verifiability, member revocation, attribute update, and so on. The significant performance advantage of the new scheme is that the computation overhead of the user in the authentication phase is constant.

Searchable encryption (SE) has been a promising technology which allows users to perform search queries over encrypted data. However, the most of existing SE schemes cannot deal with the shared records that have hierarchical structures. In this paper, we devise a basic cryptographic primitive called as attribute-based keyword search over hierarchical data (ABKS-HD) scheme by using the ciphertext-policy attribute-based encryption (CP-ABE) technique, but this basic scheme cannot satisfy all the desirable requirements of cloud systems. The facts that the single keyword search will yield many irrelevant search results and the revoked users can access the unauthorized data with the old or outdated secret keys make this basic scheme not scale well in practice. To this end, we also propose two improved schemes (ABKS-HD-I, ABKS-HD-II) for the sake of supporting multi-keyword search and user revocation, respectively. In contrast with the state-of-the-art attribute-based keyword search (ABKS) schemes, the computation overhead of our schemes almost linearly increases with the number of users’ attributes rather than the number of attributes in systems. Formal security analysis proves that our schemes are secure against both chosen-plaintext attack (CPA) and chosen-keyword attack (CKA) in the random oracle model. Furthermore, empirical study using a real-world dataset shows that our schemes are feasible and efficient in practical applications. [ABSTRACT FROM AUTHOR]

ABKS has drawn much attention from research and industry in recent years, an ABKS scheme is an encryption scheme that supports keyword search and access control. Attribute-Based Encryption is a public key encryption that enables users to encrypt and decrypt message based on attributes. In a typical implementation, the size of the ciphertext is proportional to the number of attributes associated with it and the decryption time is proportional to the number of attributes used during decryption. Inherit from ABE technology, the computation cost and ciphertext size in most ABKS schemes grow with the complexity of the access policy. On the other hand, we found that the traditional ABKS schemes cannot resist our secret-key-recovery attack. To deal with the above problems, we present new ciphertext policy attribute based encryption with fast keyword search constructions. Our constructions preserve the fine-grained access control inherited from the ABE system while supporting hidden policy and fast keyword search. Our constructions feature multi-value-independent compared with the existing attribute based searchable encryption schemes. The performance analysis demonstrates the efficiency of our constructions. We offer rigorous security proof of our second scheme, which is IND-CKA and IND-CPA secure. [ABSTRACT FROM AUTHOR]

• We design a scalable access control system. • We propose flexible key-delegation and user revocation mechanisms. • We provide lightweight decryption mechanism using an outsourcing technique. • We prove the semantic security of the proposed scheme in the standard model. With the development of cloud computing, many enterprises have been interested in outsourcing their data to cloud servers to decrease IT costs and rise capabilities of provided services. To afford confidentiality and fine-grained data access control, attribute-based encryption (ABE) was proposed and used in several cloud storage systems. However, scalability and flexibility in key delegation and user revocation mechanisms are primary issues in ABE systems. In this paper, we introduce the concept of a fully distributed revocable ciphertext-policy hierarchical ABE (FDR-CP-HABE) and design the first FDR-CP-HABE scheme. Our scheme offers a high level of flexibility and scalability in the key delegation and user revocation phases. Moreover, our scheme is efficient and provides lightweight computation in the decryption phase. Indeed, by exploiting a computation outsourcing technique, most of the operations are executed by the powerful cloud server, and very few computations are left to the users. Also, the storage cost on the user side is significantly decreased as compared to similar schemes. Furthermore, using the hardness assumption of DBDH problem, we prove that our scheme is adaptively secure in the standard model. Our security analyses and implementation results indicate that our scheme is efficient, secure, and scalable. [ABSTRACT FROM AUTHOR]

Ciphertext-policy attribute-based encryption (CP-ABE) is a promising cryptographic solution to the problem for enforcing fine-grained access control over encrypted data in the cloud. However, when applying CP-ABE to data outsourcing scenarios, we have to address the challenging issue of policy updates because access control elements, such as users, attributes, and access rules may change frequently. In this paper, we propose a notion of access policy updatable ciphertext-policy attribute-based encryption (APU-CP-ABE) by combining the idea of ciphertext-policy attribute-based key encapsulation and symmetric proxy re-encryption. When an access policy update occurs, data owner is no longer required to download any data for re-encryption from the cloud, all he needs to do is generate a re-encryption key and produce a new encapsulated symmetric key, and then upload them to the cloud. The cloud server executes re-encryption without decryption. Because the re-encrypted ciphertext is encrypted under a completely new key, users cannot decrypt data even if they keep the old symmetric keys or parts of the previous ciphertext. We present an APU-CP-ABE construction based on Syalim et al.’s [Syalim, Nishide and Sakurai (2017)] improved symmetric proxy re-encryption scheme and Agrawal et al.’s [Agrawal and Chase (2017)] attribute-based message encryption scheme. It requires only 6 bilinear pairing operations for decryption, regardless of the number of attributes involved. This makes our construction particularly attractive when decryption is time-critical. [ABSTRACT FROM AUTHOR]

In emergency care, fast and efficient treatment is vital. The availability of Electronic Medical Records (EMR) allows healthcare professionals to access a patient's data promptly, which facilitates the decision-making process and saves time by not repeating medical procedures. Unfortunately, the complete EMR of a patient is often not available during an emergency situation to all treatment teams. Cloud services emerge as a promising solution to this problem by allowing ubiquitous access to information. However, EMR storage and sharing through clouds raise several concerns about security and privacy. To this end, we propose a protocol through which all treatment teams involved in the emergency care can securely decrypt relevant data from the patient's EMR and add new information about the patient's status. Furthermore, our protocol ensures that treatment teams will only access the patient's EMR for the period during which the patient is under their care. Finally, we present a formal security analysis of our protocol and some initial experimental results. [ABSTRACT FROM AUTHOR]

With the development of cloud computing, more and more video services are moving to the cloud. How to realize fine-grained access control of those data on cloud becomes an urgent problem. Attribute-based encryption provides a solution. However, heavy computation is still a bottleneck restricting the wider application of attribute-based encryption in cloud computing. In addition, we find that expression of the access control structure on media cloud can be further improved. To solve these problems, we propose an enhanced media ciphertext-policy attribute-based encryption algorithm and introduce its two key components, the multiple access tree and the key chain. To increase the scalability of the proposed algorithm, we discussed the issues of multi-authorization, user revocation, and 1 − n multiple access tree. Security analysis shows that enhanced media ciphertext-policy attribute-based encryption can successfully resist chosen-plaintext attacks under the decisional bilinear Diffie–Hellman assumption. Performance analysis proves both theoretically and practically that the proposed algorithm incurs less computational cost than the traditional ciphertext-policy attribute-based encryption, multi-message ciphertext-policy attribute-based encryption, and scalable ciphertext-policy attribute-based encryption by optimizing the access control structure. Our proposed algorithm has strong practical significance in media cloud. [ABSTRACT FROM AUTHOR]

The rapid development of smart wearable devices makes personal health management feasible, which also stimulates the evolution of personal health records (PHRs). However, PHRs face many security challenges ever since it has been created. Besides, the complicated policy adjusting operation makes the PHRs stored in the cloud not so easy to use. In this paper, we propose a lightweight PHRs system on the basis of attribute-based encryption with policy updating. To update an outsourced ciphertext PHRs in the cloud, PHRs owners only need to generate an updating key, then upload it to the cloud server instead of retrieving the entire ciphertexts. We proved the security of our scheme, and the experiment result indicates that our system is much more efficient than the brute force way of ciphertext updating.