Secure data forwarding involves converting decrypted ciphertext, initially readable by one user, into a format that can be deciphered by another user. Proxy re-encryption is a commonly employed technique for secure data forwarding. However, this technique faces two inherent limitations. Firstly, only the data owner possesses the ability to control which data users can decrypt the ciphertext, resulting in receivers receiving irrelevant or uninterested information. Secondly, when data is forwarded through multiple nodes, it becomes vulnerable to various attacks such as impersonation and forgery. A solution called bilateral access control addresses these issues by letting the sender and receiver specify access control policies that the other party should comply with and ensure message confidentiality and authenticity. Nevertheless, to the best of our knowledge, there is currently no existing bilateral access control scheme capable of achieving secure data forwarding. In response to this issue, we propose a privacy-preserving proxy bilateral access control scheme, which simultaneously achieves all the above functionalities. Subsequently, we prove the message confidentiality and authenticity under the standard assumptions in the random oracle model. Finally, extensive theoretical analysis and performance evaluation demonstrate that the scheme provides unique features and comparable performance.

Mobile social networks (MSNs) offer convenient and ubiquitous services to expand social circles, share information, etc. These services require strict security measures to prevent the spread of deceptive content, misleading information, and malicious behavior. Achieving bilateral access control, message confidentiality and authenticity, and identity privacy can establish a positive network environment. Identity-based matchmaking encryption (IB-ME) with all the above features is a promising cryptographic primitive for MSNs. However, IB-ME can only specify one receiver. To share data with multiple users, the sender needs to encrypt the same message many times, resulting in higher frequencies of communication. Moreover, in multi-receiver scenarios, revocation of decryption permission may be necessary due to the possibility of malicious behavior, organization changes, or discontinuing subscription services. To our knowledge, no cryptographic primitives have been developed that satisfy these requirements. To address these challenges, we introduce the concept of revocable multi-receiver IB-ME and formalize its syntax and security definitions. We propose a revocable multi-receiver IB-ME scheme that provides privacy and authenticity in the random oracle model. Our evaluation demonstrates that it is efficient, and the sizes of system parameters and secret keys are independent of the number of receivers and revoked receivers.

Similar with other outsourced services, cloud storage faces the serious issue of user data security. To keep data confidential against unauthorized cloud servers and users, Attribute-Based Encryption (ABE) for access control is widely adopted. However, ABE-based access control schemes are being criticized for their high computation overhead, such as in key generation, decryption and revocation. Considering the mobile cloud storage environment where these computation tasks are executed by mobile devices or sensors, this drawback appears more serious. In this paper, we propose an efficient and secure attribute-based access control scheme for mobile cloud storage. Specifically, we construct the first Key-Policy ABE (KP-ABE) scheme with outsourced key generation and decryption, and propose an efficient revocation method for it. Moreover, we prove the proposed scheme is immune to the collusion attack and secure in the standard model. Extensive experiment demonstrates that the efficient key generation, decryption, and revocation are achieved with the help of the cloud servers.