The Industrial Internet of Things (IIoT) enables real-time data collection, sharing, and analysis across heterogeneous devices, driving digital transformation in manufacturing, energy, logistics, and beyond. In multi-source and multi-receiver IIoT environments, digital signature technology serves as a critical mechanism to guarantee data integrity, authenticity, and non-repudiation. However, existing schemes typically ignore the varying sensitivity of data when designating verifiers, leading to either over-privileged or insufficient verification. To bridge this gap, we propose TS-DVM, an efficient threshold signature scheme featuring a dual-verification mode. TS-DVM supports two selectable verification policies, an inclusion mode, which authorizes only a specified subset of verifiers for high-sensitivity data, and an exclusion mode, which blocks a small blacklist for general-sensitivity data. A central controller adaptively chooses the mode based on data classification, then instructs an edge server to embed verifier-set information into the combined signature. By integrating Shamir’s secret sharing and Schnorr threshold signature, TS-DVM tolerates up ton−toffline or faulty signers, significantly boosting robustness. We formally prove that TS-DVM achieves partial-signature unforgeability under the Discrete Logarithm assumption and resists collusion between malicious signers and the edge server. Comparative performance analysis shows that TS-DVM outperforms several state-of-the-art threshold signature schemes in terms of efficiency. Experimental results on a JPBC-based implementation confirm that TS-DVM incurs minimal computational costs in both inclusion and exclusion modes, demonstrating its suitability for resource-constrained IIoT deployments.

Ciphertext-Policy Attribute-Based Encryption (CP-ABE) is suited for securing electronic health records (EHRs), as it enables fine-grained access control over sensitive medical data while preserving interoperability. However, existing schemes face significant challenges in dynamic user revocation and efficient decryption, including privacy leakage during revocation and difficulties in tracing malicious users. To address these issues, we propose T-DRED, a traceable and dynamic revocation-enabled decryption scheme based on secure aggregation functions. T-DRED employs a secure aggregation function to dynamically insert revoked user identities into a revocation list, enabling selective ciphertext updates and reducing revocation overhead. To preserve privacy, revocation status is verified through membership determination without revealing user identities. To improve decryption efficiency, our scheme innovatively adopts a two-phase decryption process, separating user identity verification from policy verification. In the first phase, lightweight membership verification identifies valid users; in the second phase, attribute-policy matching is performed. Additionally, each user key contains a white-box tracing identifier, allowing the system to trace and revoke malicious users upon key leakage. Revoked users are denied access to both new and historical ciphertexts via list updates, realizing integrated trace-and-revoke functionality. In terms of security, under the standard model and based on theq-BDHE andl-SDH assumptions, the IND-CPA, traceability, and membership verification security of our T-DRED scheme are formally proven. Experimental results show that T-DRED improves encryption and decryption efficiency over existing related schemes.

Within the context of the Industrial Internet of Things (IIoT), interorganizational collaboration and data interchange enable enhanced data analytics and extraction. The joint data mining yields improved data access, analytical precision, and uncovers concealed patterns. However, during the process of joint data mining, there are data privacy concerns such as data leakage and misuse, necessitating the protection of data privacy. In this article, we propose a secure multiparty computation (MPC) approach, aiming to achieve the separation of data ownership and usage which ensures that multiple parties can perform computations without revealing sensitive inputs. Additionally, we utilize Beaver triples to reduce polynomial degrees and lower communication costs. Furthermore, we demonstrate consistency checks and computation verification to attest to the result consistency and data confidentiality under the semihonest adversary model. When evaluated with 20 parties on an Intel i7-10700 CPU, a single 128-bit field multiplication transmits 2.6 KB and completes in 21 ms over a 1 Mbps link. Even at 500 parties the budget remains 62.6 kB (490 ms). Compared with six representative MPC and homomorphic schemes, the proposed design achieves the lowest overall communication cost and competitive computation time. Integrated into a privacy-preserving DBSCAN implementation, the framework clusters 1000 2-D points with plaintext-level accuracy in millisecond-level, demonstrating practical applicability to multisource data mining.

Under the rapid development of big data and cloud computing, emerging applications have seen significant improvements in efficiency and service quality. Nevertheless, the conflict between data sharing and privacy preservation remains a major obstacle to the advancement of big data technology. Addressing this issue, this study introduces a solution tailored to the big data environment, which achieves privacy protection and auditability in data sharing and processing. This approach separates data ownership, usage, and validation to mitigate privacy breaches and improper computing behaviors. Leveraging blockchain technology, a transparent governance platform is constructed to identify and track illegal data and computing activities. Furthermore, the solution integrates noninteractive zero-knowledge proofs for publicly verifying data consistency and computing validity on the blockchain. Experimental analysis on computational latency, communication costs, and encryption parameters confirms the feasibility and efficacy of this approach.

Blockchain-based smart legal contract, as a legally binding executable contract, has attracted extensive attentions in trade finance. However, since the contract is deployed on open and transparent blockchain network, all transaction data are publicly visible, which brings to privacy disclosure problem. Aiming at this problem, we introduce an improved architecture of smart legal contract with privacy protection, involving contract development, deployment, and execution. In this architecture, the sensitive data of transaction are declared and protected in the form of contract terms. These terms allow the compiler to link predefined cryptographic algorithms into smart contract programs, and then to generate executable contract code. Furthermore, as predefined cryptographic algorithms, we construct a new dual-mode identity-based broadcast encryption (DM-IBBE) scheme to meet specific-purpose or generic-purpose privacy by using selective encryption mode or exclusive encryption mode, respectively. We proved that our DM-IBBE scheme is semantically secure under the decisional Diffie–Hellman assumption. In addition, our experimental results show that the proposed scheme can satisfy the privacy requirements of transaction, and it is practicable and easy-to-develop for introducing privacy preserving mechanisms into smart legal contract languages.

The increasing popularity of remote Cloud File Sharing (CFS) has become a major concern for privacy breach of sensitive data. Aiming at this concern, we present a new resource sharing framework by integrating enterprise-side Attribute-Based Access Control/eXtensible Access Control Markup Language (ABAC/XACML) model, client-side Ciphertext-Policy Attribute-Based Encryption (CP-ABE) scheme, and cloud-side CFS service. Moreover, the framework workflow is provided to support the encrypted-file writing and reading algorithms in accordance with ABAC/XACML-based access policy and attribute credentials. However, an actual problem of realizing this framework is that policy matrix, derived from access policy, seriously affects the performance of existing CP-ABE from Lattice (CP-ABE-L) schemes. To end it, we present an optimal generation algorithm of Small Policy Matrix (SPM), which only consists of small elements, and generates an all-one reconstruction vector. Based on such a matrix, the improved CP-ABE-L scheme is proposed to reduce the cumulative errors to the minimum and prevent the enlargement of error bounds. Furthermore, we give the optimal estimation of system parameters to implement a valid Error Proportion Allocation (EPA). Our experimental results indicate that our scheme has short size of parameters and enjoys efficient computation and storage overloads. Thus, our new framework with optimization methods is conducive to enhancing the security and efficiency of remote work on CFS.

In this article, we address the problem of secure sensitive data sharing for the specified recipients in Blockchain Internet of Things (BIoT). To do it, we present a cryptographic solution to meet the requirements of decentralization and convenience through key management and programmable ciphertext. First, we design a new ciphertext-policy decentralized-key attribute-based encryption (CP-DK-ABE) scheme. After the master secret key is shared into all full nodes in the form of threshold secret sharing, a decentralized multiparty computation protocol is used to generate the user’s private key in an interactive way. Meanwhile, the attribute subkeys associated with the private key can be reconstructed by obtaining a fragment from each of full nodes, so as to achieve the cooperative management of attribute key through all of full nodes. Furthermore, following the blockchain’s script system, we introduce five new opcodes to represent ciphertext in the programmable format. Such a mechanism provides flexible capability to represent the logical relationship of the access control policy among attribute subciphers in the CP-DK-ABE ciphertext by the scripting language. As a result, the processes of encryption and decryption are implemented entirely by the script interpreter on the blockchain node, thereby greatly improving the convenience of programming in BIoT devices. In addition, we prove that the proposed CP-DK-ABE scheme is key private and semantically secure for a limited number of corrupted full nodes under the decisional linear and bilinear Diffie–Hellman assumption, respectively.