The Internet of Medical Things (IoMT) has rapidly developed due to its ability to enhance the efficiency of medical data collection and utilization. Encryption technology is vital for ensuring IoMT data security and privacy. However, existing solutions often fail when secret keys or random numbers are exposed under coercion, undermining their effectiveness and security. Additionally, medical data stored on cloud platforms is vulnerable to risks, such as tampering or loss. To address these challenges, we propose CR2-ABE, a novel encryption scheme specifically designed for the IoMT environment. CR2-ABE combines chameleon hash functions and deniable encryption techniques, enabling medical data owners and recipients to present deceptive messages under coercion, thereby enhancing the coercion resistance of sensitive medical data. Moreover, CR2-ABE employs ciphertext-policy attribute-based encryption (CP-ABE) to facilitate fine-grained access control for medical data, while also leveraging blockchain technology to ensure data integrity and tamper resistance within cloud services. In terms of user management, CR2-ABE implements a policy revocation mechanism that operates directly on ciphertexts using software Guard extensions (SGX). We rigorously prove the correctness and semantic security of CR2-ABE, demonstrating its resilience against coercion attacks. Comprehensive evaluation results show that CR2-ABE exhibits significant performance improvements in key generation, encryption, decryption, and policy revocation compared to other solutions. Therefore, CR2-ABE possesses strong security and scalability.

Self-Sovereign Identity (SSI) shifts identity management authority from central institutions to users, enhancing privacy protections. However, malicious identity providers may collude with users to issue credentials that pass verification but contain false information. While multi-signature schemes enable joint credential issuance by multiple identity providers to mitigate this risk, they result in a linear increase in the size of signatures within credentials and verification keys as the number of identity providers grows, leading to substantial storage overhead for both users and verifiers. Furthermore, malicious verifiers may leak users' credentials to third parties or unlawfully duplicate them, causing users to lose control over the distribution of their credentials. To address these challenges, we propose the Accountable Many-to-One Signature Scheme with Short Verification Key (ASVK-MOSS), a multi-signature scheme with designated verifiers and accountability that ensures fixed sizes for both the verification key and the signature. We prove the security of the proposed ASVK-MOSS under the random oracle model. Building on ASVK-MOSS, we design a novel SSI system, namedMO-SSI, in which multiple identity providers jointly sign the user's personal information to generate a credential with fixed sizes. Service providers only need to store a minimal, fixed-size verification key to validate the credentials from any set of identity providers. Additionally, the designated verifier and accountability mitigate risks posed by malicious service providers and identity providers within MO-SSI. The theoretical analysis and experimental results demonstrate its effectiveness and feasibility.

Trust management has been widely employed to determine a user's trustworthiness based on evaluations from other entities, and trustless users are those with low trustworthiness due to dishonest or malicious behaviors. To overcome the defects of traditional centralized trust management, decentralized trust management has been proposed, leveraging blockchain to store trust data, e.g., user interaction evaluations, securely. However, blockchain-based decentralized trust management usually suffers from throughput limitation, hindering timely record users' trust data, delaying expose trustless users. As a result, trustless users may still interact with others in the system with the outdated trustworthiness, undermining the reliability and fairness of the system. Furthermore, decentralized pseudonymous networks suffer from a trust cold-start problem due to lacking users' prior interaction history or endorsements from trusted third parties, making it hard for newly joined users to assess the trustworthiness. To address these issues, we propose TUES in this paper, an efficient Trustless User Exposure Scheme. TUES stores trust data in a trust blockchain collectively maintained by all users. To efficiently expose trustless users, we design a dynamic consensus mechanism for TUES. This dynamic consensus mechanism integrates three novel consensus algorithms, efficiently utilizing network throughput to record trust data of trustless users and ensure the consistency of the blockchain. Additionally, TUES includes a multi-signature-based scheme to allocate initial trust values to users, thus resolving the trust cold-start problem in decentralized pseudonymous networks. Analysis and experiments show that TUES improves the efficiency of exposing trustless users while maintaining the consistency of the trust blockchain. It also increases the cost for adversaries conducting Sybil, whitewashing and Byzantine attacks.