Government data sharing, a cornerstone of digital governance, is strategically vital for enhancing public services and maximizing data utility. While Ciphertext-Policy Attribute-Based Encryption (CP-ABE) offers a promising cryptographic solution for secure government data sharing due to its flexible access control, existing schemes face substantial limitations in policy privacy, dynamic permission management, and verifiability of query results, thus hindering real-world e-governance deployment. To address these challenges, we propose GovLink, an auditable, full policy hiding CP-ABE scheme that supports dynamic revocation and verifiable query results. Specifically, by integrating the matrix representation of a linear secret sharing scheme with hidden vector encryption, GovLink achieves fine-grained access control and robust policy hiding. Furthermore, we design an efficient dynamic revocation mechanism utilizing puncturable encryption and Lagrange interpolation, guaranteeing system forward security. To enhance auditability, GovLink introduces lightweight data update verification (using hash and XOR operations) and employs a multiset accumulator to ensure verifiable data update legitimacy and query result integrity. Security analysis confirms that GovLink meets stringent security requirements, including indistinguishability under chosen-plaintext attack and full policy indistinguishability. Empirical evaluations conducted using the JPBC cryptographic library demonstrate GovLink’s practical feasibility and efficiency in its core operations.

Cloud computing has emerged as a promising mode for storaging vast quantities of big data, which is vulnerable to potential security threats, making it urgent to ensure data confidentiality and integrity auditing. In addition, as a large number of duplicate data files exist in cloud storage, data deduplication is significant to improve storage efficiency. In this article, we propose a blockchain-assisted fine-grained deduplication and integrity auditing scheme for outsourced large-scale data in cloud storage, achieving internal deduplication and cross-user external deduplication for ciphertexts and authentication tags. By constructing sparse summation ciphertext tree, the scheme implements Proofs of Ownership protocol through vector commitment, and guarantees the retrieval of distributed deduplication data blocks by designing the reconstruction matrix and bloom filter. The scheme exploits blockchain and smart contracts to ensure transparent integrity auditing without a third-party auditor (TPA), thereby avoiding malicious auditing biases. Security analysis and performance evaluation demonstrate the feasibility of the scheme for deploying in cloud storage systems.

The goal of the energy internet is to enable communication between distributed energy endpoints to facilitate information exchange and trading matching. Blockchain, which ensures content consistency, bridges the gaps between multiple energy stakeholders and satisfies the need for universal trust. However, applying blockchain directly in peer-to-peer trading can result in the permanent inclusion of illegal or outdated data in blockchain databases, hindering efficient interaction. Driven by emerging application requirements and legal regulations, redactable blockchain (EuroS&P 2017) was introduced, allowing the block history to be rewritten via collisions in chameleon hash functions. Nevertheless, current solutions still face challenges, including trapdoor security risks, privacy leakage, and indefinite redactions. This paper presents a redactable energy blockchain scheme (REBS) with partially attribute-based policy hiding, which enables controlled multi-authority key generation and redactor attribute verification. To prevent the abuse of redaction permission, REBS employs time-updatable chameleon hash functions for redaction. Additionally, we design a delegation algorithm that adds dynamic flexibility to attribute verification nodes, permitting them to delegate key share distribution authority to other nodes on demand. The detailed security proofs and performance evaluations demonstrate the feasibility of REBS.

Data cleaning improves quality and consistency by detecting, localizing, and repairing “dirty” data without compromising sensitive information. Collaborative Data Cleaning employs a distributed model to avoid single points of failure and trust issues in centralized systems, although it incurs additional communication overhead. Blass et al. (S&P’23) were the first to implement CDC via balanced Private Set Intersection (PSI). Unbalanced PSI (e.g.,uPSI-CA, USENIX’23) does not address the localization of intersections within datasets and thus cannot be directly applied to CDC. uPSI-based data cleaning remains largely unexplored. In this paper, we propose an efficient CDC scheme for unbalanced datasets, nameduECDC.uECDCemploys oblivious key-value stores for slice matching, achieving: i) a reduction of 18% ~ 85% in offline phase runtime, and ii) a reduction of 8% ~ 43% in online phase runtime (under large-scale data settings on the server side), when compared to the slice-linking approach ofuPSI-CA. Moreover, we encode server-side data for fast localization of intersection data in unbalanced settings. Under the semi-honest adversary model,uECDCis provably secure. Implementation in Python and C++ demonstrates thatuECDCis practically feasible.

Data auditing contributes to checking the integrity of outsourced data, promoting the vigorous development of cloud storage services. In actual scenarios, such as migration of electronic medical records or data transfer of enterprise mergers and acquisitions, it always require data auditing to help clients with dynamic data migration and integrity checking. In this paper, we present an efficient dynamic certificateless outsourced data auditing mechanism supporting multi-ownership transfer (CDA-MOT), addressing the issue of key escrow and without needing complex certificate management. By integrating a certificateless multi-signature on the same data file into the construction of a homomorphic authenticator based on the Lagrange inverse Multinomial theorem, CDA-MOT not only achieves integrity verification but also enables clients to transfer ownership rights and responsibilities for multi-ownership data in collaboration with cloud servers. Utilizing blockchain systems to store necessary data conversion and update records, as well as smart contracts to fulfill auditing tasks, CDA-MOT owns the characteristics of openness, transparency, accountability, and decentralized public auditing. Besides, CDA-MOT could be further applied in the extension of dynamic update operations, even if outsourced data have been transferred. The security analysis and performance evaluation have demonstrated the feasibility of CDA-MOT in the secure deployment of cloud storage.

Encrypted medical data outsourced to cloud servers can be used for personal health certification, health monitoring, and medical research. These data are essential to support the development of the medical industry. However, the traditional peer-to-peer data-sharing paradigm can lead to data abuse by malicious data analysis centers. Moreover, the encryption used to protect users’ outsourced privacy restricts the flexibility of data retrieval. Based on the modified double trapdoor cryptosystem, we propose an authorized data retrieval scheme over aggregated encrypted medical data (ADR-AED) in cloud-assisted e-healthcare systems. In ADR-AED, patients can access and decrypt personal data and authorize the data analysis center (DAC) to retrieve corresponding data. Specifically, we design an authorized retrieval-test mechanism for a group of patients to DAC. This allows DAC to extract valuable information from a threshold number of authorized users. Additionally, each patient can flexibly retrieve fine-grained medical data in different periods and submit them to a doctor for diagnostic analysis. The security analysis and performance evaluation demonstrate the feasibility of ADR-AED in the deployment of cloud-assisted e-healthcare systems.

Keyword-based auditing (KA) provides a means for users to verify the integrity of only the outsourced data they are interested in. Existing KA schemes employ relation authentication labels to conduct targeted audits with keywords, which significantly improves the cost-effectiveness. However, such schemes typically support only a single-challenge scenario, which may not always be practical. To overcome this constraint, we introduce a hierarchical challenge mechanism grounded in user attributes. This mechanism leverages inequality and affiliation relationships to comply with a predefined tree structure for access policies. Incorporated during the challenge-response phase of the auditing model, it permits users to initiate cross-challenges. Expanding upon this hierarchical mechanism, we propose an attribute-based hierarchical keyword auditing scheme, abbreviated as$\mathcal{AHKA}$.$\mathcal{AHKA}$combines searchable encryption to conduct cross-targeted audits and benefits from the hash collision mapping of Bloom filters to safeguard against keyword guessing attacks. Moreover, we design a fault localization algorithm based on a variant of the binary search technique. It locates in batch the faulty cloud servers and damaged data blocks after an audit failure. As an integral part of$\mathcal{AHKA}$, the algorithm significantly enhances our scheme's practicability. Security analyses indicate that$\mathcal{AHKA}$can effectively withstand both forgery and replace attacks on audit proofs. The smart contract component ensures that our scheme's processes can be monitored and regulated. Experimental data corroborate that deploying$\mathcal{AHKA}$on the client side and on the blockchain is both efficient and feasible.

Cloud storage provides Data Owners (DOs) with flexible data storage and management services, but simultaneously poses various security concerns, of which the integrity of outsourced data, as the most important security issue, determines the widespread use of cloud storage services. In this article, we present an$\mathbf {\overline{A}}$nonymous$\mathbf {\overline{A}}$uthorized$\mathbf {\overline{A}}$uditing scheme over$\mathbf {\overline{K}}$eyword-based$\mathbf {\overline{S}}$earchable$\mathbf {\overline{C}}$iphertexts (AAA-KSC) in cloud storage systems. In AAA-KSC, we devise an anonymous authorization mechanism, only the designated Third Party Auditor (TPA) could decrypt DO's identity and execute auditing tasks. In particular, by utilizing the verification metadata, without breaking the privacy of DO's concerned keyword, TPA could check the integrity of outsourced ciphertexts containing the specific keyword. More attractively, we design an identity-based homomorphic signature algorithm that makes use of the polynomial encapsulation mechanism to tackle with large scale data files, and thus AAA-KSC enables TPA to fulfil integrity verification with nearly constant computational costs, which are independent of the number of encrypted files that contain the same keyword. We provide the correctness, and prove that AAA-KSC is adequately secure. The performance evaluation experimentally demonstrates the high efficiency and feasibility of AAA-KSC in the real applications of cloud storage systems.

Cloud computing provides users with convenient data storage services, which simultaneously poses various security concerns, the integrity of outsourced data has been termed as one of the most concerning security issues. Certificateless public auditing not only enables a third-party auditor (TPA) to check data integrity, but also avoids complex certificates management and inherent drawbacks of key escrow. Up to date, a few certificateless public auditing schemes have been proposed, without providing fast data dynamics or protecting the identity privacy of users. In this paper, we propose a lightweight conditional anonymous certificateless public auditing (CACPA) scheme, supporting much faster data dynamics in cloud storage systems. Based on a homomorphic hash function, we design a certificateless signature and integrate it into the construction of CACPA, reducing the computational costs of TPA substantially. CACPA achieves conditional identity privacy preservation, anyone cannot infer the real identity of a user based on outsourced data, only the private key generator (PKG) can revoke the users when some misbehaviors occur. We provide security analysis of CACPA, and conduct performance evaluation demonstrating the lightweight advantages of CACPA, and therefore it is suitable for auditors with resource-constrained mobile devices.