Blockchain has become a superior carrier for data storage due to its decentralization and immutability. How to realize privacy-preserving data sharing and controlled transfer of blockchain data access rights has become a challenging issue. Autonomous path proxy re-encryption allows the delegator to designate a series of delegatees to obtain decryption privileges according to a predefined sequence in a multi-hop manner. However, it faces the hop-skipping issue, where a malicious proxy can directly re-encrypt the ciphertext to the delegatees several hops afterwards, by skipping one or more delegatees in between, destroying the decryption privileges of the skipped delegatees. Furthermore, the intrinsic nature of proxy re-encryption makes it vulnerable to collusion attack, wherein the proxy and a delegatee might collude to construct a decryption device which can decrypt all the delegator’s ciphertexts, posing a serious threat to the delegator’s privacy. To address these challenging issues, we propose a generalized collusion and hop-skipping resistant autonomous path proxy re-encryption for blockchain (CHRAP-PRE). First, we decentralize the proxy’s privileges of re-encrypting ciphertexts to resist collusion attack. Second, we carefully design the decryption token mechanism so that only the person who gets the correct token can do the decryption, which is authorized by all previous persons in the path, thus controlling the decryption privileges to solve the hop-skipping problem. Finally, we formally prove that our proposed CHRAP-PRE achieves IND-HRA security under the Decisional Bilinear Diffie-Hellman (DBDH) assumption, resisting both collusion and hop-skipping attacks. Our comprehensive performance evaluation demonstrates that our scheme offers enhanced security while reducing communication overhead compared to the state-of-the-art.

Blockchain technology, with its characteristics of decentralization, immutability and traceability, provides a new platform and technical means for financial transactions, such as lending systems. There are critical security and efficiency demands: Firstly, due to the high volume of real-time concurrent lending transactions, the system must be highly efficient. Furthermore, to achieve fine-grained accountability for illegal lending approval under regulatory oversight, a weighted threshold architecture is required to enable multi-auditor reviews aligned with hierarchical differences among auditors (e.g., seniority or authority levels), and ensure compliance and fairness. Unfortunately, the existing work of threshold signatures face significant limitations: fully anonymous schemes lead to accountability challenges (e.g., difficulty in tracing malicious actors); node interactions during initialization result in prohibitively high overhead; excessive disclosure of identity information severely compromises signer privacy. These shortcomings render traditional schemes unsuitable for lending transactions in blockchain. In order to address these issues, we firstly propose an efficient fine-grained accountable weighted threshold signature (FAWTS). It enables non-interactive initialization without trusted third parties, achieves fine-grained accountability and introduces dynamic weighted thresholds. Then based on FAWTS, we design a conditional privacy-preserving lending transactions in blockchain, which assigns dynamic weighted thresholds for multiple auditors/lending transactions, enables fine-grained tracing of malicious auditors and achieves non-interactive auditor selection to meet high real-time processing demands. Finally, we formally prove that our proposed schemes achieve both the unforgeability and privacy requirements, while significantly reducing computational and communication overhead under extended functionalities.

Electronic voting systems play an important role in modern democratic governance and smart city services supported by the Internet of Things (IoT). However, ensuring privacy and verifiability effectively remains a considerable challenge, especially for identifiable ballot (B-ID) schemes. To address this issue, this paper introduces Evosmt, a novel verifiable privacy-preserving e-voting scheme. As far as we know, this is the first scheme aiming to safeguard voters’ privacy in the presence of a potentially malicious tallier without trusting multiple authorities. Evosmt uses bit-XOR encryption to provide compact 0/1 ciphertext proofs and adopts an optimized authenticated garbled circuit (GC) with almost universal linear hash functions for efficient tallying and verification. A security analysis of the scheme has been conducted to demonstrate its correctness, privacy preservation, and verifiability. Through experimental evaluation and comparison with classic authenticated garbled circuit schemes, the proposed scheme has shown more than 100× improvement in terms of setup speed and communication efficiency of each voter when the number of voters exceeds 1000. Compared with classic e-voting schemes, the proposed scheme exhibits negligible encryption and proof cost and much faster verification due to the optimized authenticated garbled circuit method.Thanks to its lightweight and efficient design, the scheme is highly suitable for large-scale IoT-enabled e-voting applications in smart city governance and distributed democratic services.

The security of distributed systems, especially blockchain-based applications, relies heavily on threshold signature protocols to maintain decentralization. Identifiable aborts are critical in these protocols, enabling detection and attribution of malicious behavior. However, existing threshold EdDSA schemes with identifiable aborts often rely on zeroknowledge proofs, which significantly increase computational overhead. Additionally, these schemes suffer from inefficient abort handling and difficulty defending against DDoS attacks targeting abort mechanisms. Furthermore, weighted threshold signature schemes frequently encounter weight centralization, where high-weight participants dominate decision-making. In this paper, we propose a threshold EdDSA protocol, named EdFROST, which is unforgeable and supports identifiable aborts under a chosen-message attack (IA-CMA), based on FROST3 proposed by Ruffing et al. (ACM CCS '22). Leveraging EdFROST, we present the first weighted threshold EdDSA scheme that considers both the number of participants and arbitrary weight distribution to mitigate the risk of weight centralization. We also design a game-theoretic incentive model, implemented via tamper-proof chaincode, achieving rational identifiable aborts with a unique sequential equilibrium. This model incentivizes honest behavior to maximize individual benefits while ensuring efficient abort handling and resisting DDoS attacks targeting IA. Experimental results demonstrate that the EdFROST and chaincode are efficient and lightweight, making them well-suited for large-scale distributed systems.

Zero-knowledge Succinct Non-interactive Argument of Knowledge (zkSNARK) is a powerful cryptographic primitive that enables a prover to convince a verifier that something is true without leaking the private witness. Current zkSNARKs face significant computational costs in generating proofs, which restricts their use in areas like private payments, confidential smart contracts, and anonymous credentials. Private delegation offers a practical solution by outsourcing the heavy computation to powerful external workers without leaking any private information. In this work, we propose HyperSiniel, an efficient private delegation framework for general zkSNARKs that achieves a new feature called guaranteed output delivery (GOD). HyperSiniel is designed to be compatible with any universal zkSNARKs constructed from a polynomial interactive oracle proof (PIOP) and a polynomial commitment scheme (PCS). It enables a computationally limited delegator to outsource proof generation to several workers in a fully non-interactive and privacy-preserving manner. Compared to the most state-of-the-art frameworks (e.g., Siniel [NDSS'25]), HyperSiniel ensures that the delegator always receives a correct proof, regardless of malicious worker behavior. We implement HyperSiniel and compare the performance with Siniel across varying bandwidths and circuit sizes. Under low-bandwidth conditions (10MBps), HyperSiniel incurs only an additional 25% overhead compared with Siniel, while the total running time of HyperSiniel is almost identical to Siniel under high-bandwidth settings (1000MBps). These results show that the strong robustness guarantee of GOD in HyperSiniel comes almost for free, making it a practical and secure solution for real-world zkSNARK delegation.

Anonymous credentials are ideal for decentralized systems like blockchains, as they enhance privacy, security, and regulatory compliance while maintaining flexibility and adaptability. These decentralized systems often require features such as weighted threshold issuance and tracing for elasticity of decision-making, fine-grained blindness for user privacy control, and issuer-hiding to reduce potential external threats. However, the latest advancements in anonymous credential schemes cannot meet all of these essential properties for blockchain systems. To address these challenges, we propose weighted threshold anonymous credentials with redactable fine-grained blind signature (WTAC). Firstly, by leveraging unlinkable redactable signatures (URS) and functional encryption techniques, our redactable fine-grained blind signature supports selective disclosure and permits credential issuers to learn a particular function value related to the attributes during issuance without revealing the actual attribute content. Secondly, we utilize weighted ramp secret-sharing (WRSS) and randomizable signatures to achieve weighted threshold anonymous credentials, which are issuer-hiding to both users and verifiers. Moreover, we provide a concrete construction instantiated by the Fiat-Shamir paradigm and demonstrate its application, a privacy-preserving auditable lending system in blockchain scenarios, achieving the integration of user privacy and regulatory compliance. Finally, we give a formal security proof of anonymity, fine-grained blindness, traceability, non-frameability, and issuer-hiding. Performance evaluation shows the practicability and efficiency of our proposed WTAC.

Secure off-chain payment plays an important role in blockchain ecosystems, requiring atomicity guarantees where either all payment channels update their balances or none do. While the Lightning Network achieves this through multi-hop Hash Time-Lock Contracts (HTLCs), a critical flaw persists. Specifically, contract conditions (e.g., hash preimages) are transmitted in plaintext across payment paths. Consequently, malicious intermediate nodes can launch interception attacks by claiming funds from predecessors without releasing the corresponding coins to successors. To mitigate this risk, we propose a secure off-chain payment protocol. Firstly, a new cryptographic primitive, namely ciphertext unlinkable autonomous path proxy re-encryption scheme (CUAP-PRE), is proposed. Unlike traditional multi-hop proxy re-encryption, it prevents malicious nodes by enabling the delegator to designate all delegatees he trusts. In addition, ciphertext unlinkability resists homology inference attacks and delegation path tracing to ensure anonymity. Building on CUAP-PRE, a secure off-chain payment protocol (SOCP) in blockchain is designed with an enhanced multi-hop Hash Time-Lock Contract of the Payment-Channel Network (PCN). The receiver at the end of one path of payment channel can control the decryption rights of payment condition in multi-hop delegation manner with reversed order, to unlock the corresponding bitcoins on hold. We then present formal security proofs to demonstrate that the proposed CUAP-PRE and SOCP are postcompromise secure under the Decisional Bilinear Diffie-Hellman (DBDH) assumption in the random oracle model. Comprehensive evaluations also demonstrate the effectiveness and practicability of our proposal.

Efficient and maliciously secure multiparty private set intersection (mPSI)—especially for variants enabling cardinality (mPSI-CA) or secret shared outputs with low communication overhead—faces ongoing challenges regarding performance and scalability. However, existing approaches are either based on strong security assumptions of non-colluding centers or are relatively expensive in terms of computational and communication overheads. Addressing these limitations, this paper introduces a new suite of protocols and formalizes them in a real/ideal model to prove the security of the protocols. Firstly, our core mPSI protocol achieves malicious security under the standard honest majority model, relying solely on symmetric-key primitives. The approach employs a lightweight, oblivious key-value store (OKVS)-based architecture where each non-pivot party sends only a single message to a designated pivot. This approach, inspired by Nevoet al.(CCS 2021), minimizes client overhead by carefully delegating core computations. We extend this framework to support cardinality (mPSI-CA) and secret sharing (mPSI-SS) functionalities, which require an additional non-collusion assumption among specific parties. We also introduce a Chinese Remainder Theorem (CRT)-based batching technique for parallel mPSI, achieving near-linear communication savings by compressing multiple OKVS structures. This method generally trades higher computational costs (from polynomial operations and CRT) for communication efficiency, but it is highly effective when communication is paramount or when batching numerous instances of small item sets, where encoding computations can be competitive. Finally, our implementation and evaluation of the proposed mPSI and mPSI-CA protocols in both LAN and WAN settings demonstrate their practical advantages. For instance, in the LAN setting depicted (15 parties,t= 7,m= 220), our mPSI protocol is 3.0× faster and uses 2.5× less communication than Nevoet al.(CCS 2021). Against the approach of Gaoet al.(CCS 2024), our maliciously secure protocol is 1.4× faster with comparable communication overhead under weaker assumptions.

The proliferation of mobile internet and sharing economy has catalyzed the emergence of Ride-Sharing Services (RSSs) as a paradigm of spatial crowdsourcing in intelligent transportation. Compared with ride-hailing, RSSs present heightened challenges in security and service quality management due to bidirectional disclosure of trip plans and complex matching logic. Existing secure RSS solutions predominantly operate under semi-honest threat models or suffer from prohibitive computational complexity in service composition. However, ensuring public verifiability of matching outcomes is equally critical to prevent manipulation and ensure accountability in decentralized environments. Moreover, achieving a harmonious trade-off among privacy preservation, public verifiability, and matching efficiency remains an open challenge in RSS systems. This work proposes TBRS, a novelTEE-Blockchain powered privacy-awareRide-Sharing framework, which innovatively addresses three core challenges in service computing: (1) formalizing aninclusive matching modelthat extends traditional identical matching through trajectory region overlap analysis and direction alignment verification; (2) designing anIndex-Preserving Bloom Filter (IP-BF)coupled with Hilbert R-tree spatial indexing, achieving$O(\log n)$matching complexity through computational geometry optimization; (3) implementing a hybrid trusted execution environment via SGX-enhanced consortium blockchain withprivate smart contracts, ensuring verifiable service operations management under malicious threats. The framework demonstrates significant advancements in service performance management through systematic experiments: 2${\times }$$\sim$11${\times }$acceleration in on-chain service composition, 6×$\sim$33× improvement in off-chain computation efficiency, while maintaining over 99% service matching accuracy. These results signify that TBRS effectively breaks the efficiency bottleneck of existing privacy-preserving RSS solutions, making decentralized ride-sharing practical for deployment.

Data duplication within large-scale corpora often impedes large language models' (LLMs) performance and privacy. In privacy-concerned federated learning scenarios, conventional deduplication methods typically rely on trusted third parties to perform uniform deletion, risking loss of informative samples while introducing privacy vulnerabilities. To address these gaps, we propose Federated ReWeighting (FedRW), the first privacy-preserving framework, to the best of our knowledge, that performs soft deduplication via sample reweighting instead of deletion in federated LLM training, without assuming a trusted third party. At its core, FedRW proposes a secure, frequency-aware reweighting protocol through secure multi-party computation, coupled with a parallel orchestration strategy to ensure efficiency and scalability. During training, FedRW utilizes an adaptive reweighting mechanism with global sample frequencies to adjust individual loss contributions, effectively improving generalization and robustness. Empirical results demonstrate that FedRW outperforms the state-of-the-art method by achieving up to $28.78\times$ speedup in preprocessing and approximately $11.42$\% improvement in perplexity, while offering enhanced security guarantees. FedRW thus establishes a new paradigm for managing duplication in federated LLM training.

With the rapid proliferation of Internet of Things (IoT)-enabled healthcare systems, sensitive data such as electronic health records (EHRs) are increasingly outsourced to semi-trusted e-health clouds, raising critical concerns about privacy and verifiability. This paper investigates secure and efficient keyword-based data retrieval in such environments. Key-aggregate searchable encryption (KASE) enables a data owner to share multiple encrypted documents with users using a single compact key, but existing schemes offer limited resistance to offline keyword guessing attacks (KGA) and insufficient protection against keyword privacy leakage. To systematically expose broader vulnerabilities in existing KASE constructions, we present a novel and general attack, termed expanded inside trapdoor attack (EITA), which targets both the security of aggregate keys and the privacy of keywords in unauthorized documents. Furthermore, flexible search methods and result verification are essential for improving KASE performance. To this end, we propose a new KASE scheme that supports conjunctive queries and employs aggregate signatures for verification, while being able to resist KGA and EITA. The security analysis and performance evaluation both demonstrate that our proposed scheme is provably secure and practically efficient in IoT-enabled healthcare settings.

Ring signatures are a crucial cryptographic tool underpinning blockchains and blockchain-based systems, and there are ongoing efforts to design different ring signatures to provide varying properties in a range of applications (e.g., batch verification of numerous ring signatures). In this article, we propose an efficient aggregate ring signature (ARS) scheme for anonymous transaction verification in blockchain. First, a comprehensive definition and the formal security model of our proposed ARS scheme are given, where the true identity of the signer will be protected against both the verifier and other signers contributing to the signature. Furthermore, we present a concrete ARS scheme that can aggregate multiple signatures produced by different signers of the same ring, by exploiting the compressed$\Sigma $-protocol. There are no interactions required among signers and only one single round between each signer and the aggregator. Building on the proposed ARS scheme, we present a confidential transaction (CT) protocol called ARSCT. The latter allows multiple transactions to be aggregated into one transaction. Finally, the formal security proof demonstrates our proposed ARS scheme achieves both anonymity and unforgeability, where signers’ anonymity is protected against both the verifier and the aggregator. Performance evaluations show that in simultaneous multiple signers situation, our scheme outperforms other mainstream ring signature schemes in verification efficiency.

In the distributed computing environment, it is important to efficiently achieve secure access to data. One of the widely applied encryption mechanisms is the multiauthority attribute-based encryption (ABE). However, most existing multiauthority setting schemes were relied on bilinear pairings, which causes the system to bear a relatively large burden in computation overhead. In this article, we proposes a decentralized multiauthority key-policy ABE scheme without bilinear pairings, its security is relied solely on the decisional Diffie-Hellman assumption. It removes the trusted central authority and prevents user collusion attacks. Except for the global coordination between the attribute authorities, any party can simply play the part of a standard attribute authority by generating public keys and issuing corresponding decryption key components for users. The proposed scheme provides heightened security and efficiency compared to the current pairing-free multiauthority ABE scheme, as well as superior computational efficiency when compared to those utilizing bilinear pairings.

Ring signatures are a useful cryptographic technique for anonymous transactions on the blockchain, which allows a user to sign a message on behalf of a group, without revealing which specific member of the group did the signing. However, the anonymity it provides can at times be too powerful and needs to be controlled when used in practice (e.g., on a reliable blockchain anonymous transaction system). In order to address this issue, we propose a linkable, k-times traceable and revocable ring signature (Lk-TRS). Specifically, with respect to the same issue, Lk-TRS not only establishes links among fewer than k signatures of a signer but also enables tracing of the identity when the signer signs k times. Based on our Lk-TRS, we propose a blockchain anonymous transaction system that supports the identity binding of a single user to multiple accounts, as well as the dynamic joining and exiting of users. This ensures the system meets practical requirements and offers runtime flexibility. We prove that our Lk-TRS achieves anonymity, unforgeability, linkability, k-traceability, and exculpability. Compared to the state-of-the-art, our Lk-TRS is more practical for large blockchain systems, maintaining a constant signature size regardless of the ring size.

Gordon et al. systematically studied the Universally Composable (UC) security of Multi-client Verifiable Computation (MVC), in which a set of computationally-weak clients delegate the computation of a general function to an untrusted server based on their private inputs, and proposed a UC-secure scheme ensuring that the protocol remains secure even when arbitrarily composed with other UC-secure instances. However, this scheme imposed a significant computational overhead on clients due to the utilization of fully homomorphic encryption, and the plaintext size scaled linearly with function input size. In this work, we present MVOC, a more efficient UC-secure MVC protocol, that significantly reduces the amortized overhead for clients in both semi-honest and malicious settings, by delegating a larger portion of the computation to the server. We enable clients to verify the garbled circuit before entering the online phase, ensuring security against malicious clients without incurring heavy overhead of compiling a semi-honest protocol into a malicious one. We present the detailed proof and analyze the theoretical complexity of MVOC. Furthermore, we implement our protocol and evaluate the performance, and the results demonstrate that the computation and communication overheads during the input phase can be decreased by at least 95.55% and 87.17%, respectively.

While techniques such as Homomorphic Encryption (HE) and Intel Software Guard Extensions (SGX) have been leveraged to secure outsourced electronic health record (EHR) computation, there are a number of known limitations (e.g., performance bottlenecks, lack of desired functionalities, or the reliance on a trusted third party). To address these challenging issues, this paper proposes MuEOC, an SGX-based multi-key homomorphic outsourcing computation scheme without a trusted third party. MuEOC is designed to support arbitrary depth multiplication and multi-key setup. In our approach, we first propose an SGX-assisted fully homomorphic encryption scheme (XFHE) under the randomized AGCD assumption. This allows us to replace costly bootstrapping with re-encryption in the enclave, and enable key-switching and Galois automorphism. Using XFHE as a building block, we construct a high-performance multi-key outsourcing computing protocol without the trusted third-party setup. Leveraging SGX, the MuEOC incorporates efficient sub-protocols of secure ciphertext transformation, secure polynomial evaluation, secure inner product, and secure non-linear function evaluation. We also present formal security proof which shows that our proposal guarantees the privacy of input EHR data and medical analysis results under the semi-honest model. Finally, experimental results demonstrate the outstanding efficiency of MuEOC.

Although the global navigation satellite system (GNSS) has been successfully applied in search and rescue operations for locating lost or damaged vehicles due to its significance in precise positioning, there are still challenges. To enhance the accuracy of localization, positioning can be done with the collaborative estimation provided by neighbouring mobile terminals as reference vehicles. Meanwhile, there are security and privacy implications associated with such an approach – e.g., potential for privacy leakage of both the positioning-related data (e.g., positions of reference vehicles, distances between reference vehicles and the target vehicle) and the estimated positions of the target vehicle. Such concerns are important to address in deployments for sensitive applications such as defense. For example, the location information of a damage vehicle on the battlefield should only be securely evaluated by search unit and be successfully decrypted by an authorized set of officers in rescue unit with the required authorization levels. Accordingly, the threshold should be flexibly allocated and changed for types of security surroundings. However, existing techniques of threshold public key homomorphic encryption approaches are not only computationally and communication intensive, but merely support a fixed pre-defined threshold. To address these challenges, we propose an efficient multilevel threshold changeable homomorphic data encapsulation mechanism (MCTh-HDEM). In MCTh-HDEM, we leverage the technique of multilevel threshold changeable secret sharing in order to support both batch encryption and lightweight matrix calculations in the encrypted domain, and also multilevel threshold changeable decryption. Then, we design a lightweight privacy-preserving vehicle positioning scheme (PPVPS), by refining our proposed MCTh-HDEM. The position of the lost and damaged target vehicle on the battlefield would be efficiently inferred by a set of reference vehicles in search unit while protecting positioning related data, and the target vehicle location can be flexibly decrypted by rescue unit. Finally, we give the formal security proofs of our proposed MCTh-HDEM and PPVPS. The performance evaluation and extensive experimental results demonstrate the efficiency and accuracy of our proposal.

Secure task matching has been a crucial research problem in crowdsourcing, requiring the alignment of workers’ preferences and requesters’ task requirements while ensuring user privacy and matching integrity. Recently, some researchers applied blockchain to crowdsourcing, either replacing the platform for decentralization or recording proofs for public verification to defend against malicious platforms. However, they still suffer from unitary coarse-grained matching models or expensive on-chain costs. To address these limitations, we propose PGVMatch, a privacy-aware and fine-grained crowdsourcing task-matching scheme with lightweight on-chain public verifiability. Our scheme is constructed on our newly proposed cryptographic primitive–Multi-authority Attribute-Based Keyword Search with Public Verifiability (MABKS-PV), which avoids access policy leakage and key escrow risks on a single authority, meanwhile adding constant-size proof generation and lightweight verification algorithms to a basic ABKS construction. In PGVMatch, requesters can select workers with fine-grained attribute demands, and workers can pick interested tasks with multi-keyword search, preserving dual-side privacy. The matching process is conducted off-chain, while constant-size proofs are recorded on-chain for efficient and public verification of matching integrity. Security analysis and extensive experiments on the Hyperledger Fabric blockchain demonstrate both the security and our superior performance. PGVMatch outperforms the existing scheme with the fastest matching result verification, achieving a 29% improvement in throughput and a 33% reduction in latency.

With the widespread adoption of electric vehicles (EVs), Vehicle-to-Vehicle (V2V) charging technology offers a more flexible solution for EV charging, significantly alleviating charging inconvenience, particularly in remote areas. However, the current V2V energy trading landscape lacks reliable management platforms with transparent transaction protocols. Furthermore, notable deficiencies exist in data privacy and security, which hinder the broader implementation of V2V charging services. Addressing these challenges, particularly the provision of secure and publicly auditable V2V charging without relying on centralized platforms or disclosing user privacy, has become a critical concern. For this reason, this paper presents PET, a decentralized Privacy-preserving Energy Trading system with public verifiability for EVs. PET is built upon the emerging blockchain technology to decentralize energy trading while ensuring accountability. We model energy demand-supply matching as range matching of locations and charge amounts between a buyer and sellers, and employ reverse auction to select the winner. For efficient and privacy-aware range proofs, we propose a novel batched hash chain-based range proof (BHW) primitive. In addition, PET integrates zk-SNARKs to verify payment correctness while maintaining user privacy. Our system supports public verifiability, entitling any third party to independently verify the transaction integrity. We analyze the privacy guarantees and public verifiability of PET. Extensive experiments implemented on Hyperledger Fabric further validate that PET delivers robust performance with a 4 × reduction in verification cost compared to that without batch proofs.

The Internet of Things (IoT) has greatly changed our lives and generated a large amount of data. Cloud storage helps IoT limited-resource IOT devices process the massive data. However, cloud servers are untrusted in most scenarios as they may illegally obtain sensitive data. Although existing symmetric searchable encryption (SSE) schemes can protect the privacy of outsourced data while preserve data availability, Most of them leak access and search patterns to the cloud server to gain better performance. Such leakages will be used to recover private information. Meanwhile, semi-honestly secure searchable encryption cannot prevent attacks done by the malicious server such as returning the false search result. Therefore, it is still a challenge to prevent malicious cloud server misbehavior, and preserve patterns, simultaneously. This paper proposes OpenSE to solve the aforementioned problems. First, this paper constructs FastOPE as a major building block. With the OPE protocol, the verifiable searchable encryption OpenSE can be trivially realized. After that, security proofs show that OpenSE is secure against malicious cloud servers with access and search pattern hidden. Finally, we implement experiments on real datasets to compare OpenSE with some state-of-the-art works in terms of running time of setup phase and search phase as well as storage overhead. The experimental results show that OpenSE outperforms the state-of-the-art works in terms of setup phase and storage overhead. In addition, the theoretic comparison shows that OpenSE outperforms most existing works in terms of security, in which OpenSE enjoys both verifiability and pattern hidden.

Mobile smart devices provide convenience for people’s daily life with the users’ data, but also put consumers’ privacy and security at risk. Privacy-enhancing technologies (PETs), including secure two/multi-party computation, have emerged as solutions to alleviate privacy concerns in mobile cloud computing (MCC). However, cloud servers, although capable of easing the burden of PETs, introduce potential risks by being malicious and colluding with computation parties to access additional private data. In this article, we propose a privacy-preserving cloud-assisted two-party computation scheme and the optimized variant with the half-gate method in MCC with a higher security level. To the best of our knowledge, the work is the first cloud-assisted two-party computation, designed to resist all collusion attacks in the malicious model. This is achieved by distributing circuit generation tasks among the parties and separately processing private inputs based on authenticated garbled circuits. Security analysis demonstrates that our scheme ensures correctness and fairness. Performance comparison results indicate the efficiency of our work, even with stronger security against malicious servers and any collusion attack. It outperforms the state-of-the-art scheme, particularly in terms of the server’s communication cost in the online phase, achieving a remarkable reduction of approximately 96.8%.

Private set intersection (PSI) facilitates the computation of intersection between the private sets of two parties, ensuring that no additional information beyond the intersection itself is revealed. However, most state-of-the-art are limited to static PSI, leaving updatable PSI untouched. Existing PSI protocols will cost huge computational resources to compute intersection on updated sets. More seriously, none of the existing updatable PSI approaches can achieve both secure addition and deletion operations in once update. To address these challenges, we propose Forward Private Updatable PSI (FUPSI) for two-party setting. FUPSI is designed to support addition and deletion simultaneously, while ensuring forward privacy against semi-honest adversaries. In this work, we analyze the infeasibility of secure synchronous addition and deletion in the existing updatable PSI approaches, by presenting a practical attack which would lead to privacy leakages while deletion function is performed. Then, to resist this attack against semi-honest adversaries, we demonstrate how FUPSI can protect the forward privacy of user sets, by utilizing a variant of keyword Private Information Retrieval (PIR) to hide sensitive intermediate parameters. Specifically in FUPSI, two parties execute keyword PIR to retrieve a flag indicating that the current element is added or deleted so as to determine whether it is in the participants’ datasets. Finally, we provide the formal security proof for our proposed FUPSI, and extensive experimental results demonstrate efficiency and the practicality of our proposal. For instance, the communication complexity of our proposal is only logarithmically related to the size of update sets and the computational overhead is mainly composed of logarithmical times PIR calculations. Owing to the variant of keyword PIR, our work also incurs minimal communication overhead even for enormous datasets, which performs well in updatable settings and slow networks.

Federated learning (FL) allows multiple parties, each holding a dataset, to jointly train a model without leaking any information about their own datasets. In this paper, we focus on vertical FL (VFL). In VFL, each party holds a dataset with the same sample space and different feature spaces. All parties should first agree on the training dataset in the ID alignment phase. However, existing works may leak some information about the training dataset and cause privacy leakage. To address this issue, this paper proposes OpenVFL, a vertical federated learning framework with stronger privacy-preserving. We first propose NCLPSI, a new variant of labeled PSI, in which both parties can invoke this protocol to get the encrypted training dataset without leaking any additional information. After that, both parties train the model over the encrypted training dataset. We also formally analyze the security of OpenVFL. In addition, the experimental results show that OpenVFL achieves the best trade-offs between accuracy, performance, and privacy among the most state-of-the-art works.

The security and privacy challenges faced by Vehicular Ad hoc Networks (VANETs) have led to the development of conditional privacy-preserving authentication (CPPA) schemes. Hardware security modules (HSMs) are seen as a promising solution for implementing these schemes while minimizing the burden on certificate storage. However, existing HSM-based CPPA schemes still have high computation overhead and do not meet the forward security requirements for system secret key (SSK) updates. To address these challenges, we propose an HSM-based lightweight CPPA scheme for VANETs that enjoy low computation costs. Most operations could be performed within the HSM before the message is ready to be signed, reducing real-time computation delay. The scheme also supports SSK updating using an identity-based batch multi-signature algorithm, which helps to provide forward security and vehicle revocation. Especially, the proposed SSK update scheme does not rely on any single trusted authority. Formal proof demonstrates that the proposed scheme satisfies the desired security notions. Our analysis shows that this scheme surpasses other similar ones in terms of efficiency when it comes to generating signatures.

Prevailing smart devices collect individual or industrial sensitive data for collaborative computation to provide convenient service in heterogeneous networks. Nowadays, protecting privacy and security is a significant issue and raises increasing concerns in academia and industry. But diverse smart devices are equipped with unequal resources and some devices with limited resources cannot afford expensive privacy-preserving computation. In this article, we propose a generic efficient and privacy-preserving cloud-assisted two-party computation scheme for smart devices in heterogeneous networks. We adopt the cloud server to assist the collaborative computation and reduce the overhead of smart devices. Besides, we apply preprocessing and online phases to guarantee different devices to operate with a lower burden online. What is more, the work is, to our best knowledge, the first to resist the malicious cloud server and computing parties simultaneously by adopting authenticated masked bits to strengthen the garbled circuit scheme. At the same time, our scheme can guarantee correctness and fairness, as shown in security analysis. The performance comparison result shows that this work is efficient and surpasses the previous best counterpart scheme while maintaining nearly identical computation cost. It outperforms in terms of total communication cost by 49% and total execution time by 32%, even though it takes extra and acceptable cost in the online phase for stronger security against the malicious server.

Searchable encryption (SE) allows a data owner to outsource encrypted documents to an untrusted cloud server while preserving privacy and achieving secure data sharing. However, most existing SE schemes have a trade-off between security and efficiency. Moreover, these SE schemes leak the server's partial database or search information to perform better. Recent attacks show that such leakages can be used to recover the content of queried keywords or partial database information. To solve this problem and ensure efficiency, this paper proposes labeled searchable encryption (LSE), an efficient searchable encryption scheme based on the labeled private set intersection. We also give formal proofs to prove the security of the proposed labeled PSI protocol and searchable encryption scheme. Finally, we do experiments to compare the performance with some state-of-the-art works, and the experimental results show that the LSE outperforms in terms of total size and generation time of the encrypted database as well as the total search time at client side.

Multiparty private set intersection (PSI) allows several parties, each holding a set of elements, to jointly compute the intersection without leaking any additional information. With the development of cloud computing, delegating the computation to an untrsuted cloud server is becoming a major problem, where the untrusted cloud server may try to get some sensitive information from clients' private information. However, it is complex to build an efficient and reliable scheme to protect user privacy. In order to overcome this problem, we propose DMPSI, an efficient delegated PSI (with cardinality) protocol in a multiparty setting. DMPSI avoids using heavy cryptographic primitives (mainly rely on symmetric-key encryption) to achieve better performance. In addition, both PSI and PSI with the cardinality of DMPSI are secure against semi-honest adversaries and allow any number of colluding clients (at least one honest client). We do experiments to compare the proposed DMPSI with some state-of-the-art works to evaluate overall performance. In addition, we also compare the proposed Oks-PRF with some state-of-the-art multi-point OPRF to highlight our efficiency. The experimental results show that proposed both Oks-PRF and DMPSI(-CA) has better performance and is scalable in the number of clients and the set size.

Since data outsourcing poses privacy concerns with data leakage, searchable symmetric encryption (SSE) has emerged as a powerful solution that enables clients to perform query operations on encrypted data while preserving their privacy. Dynamic SSE schemes have been proposed to handle update operations. However, it is shown that updates might increase the risk of information leakage. Meanwhile, to meet the requirement of real-world applications, it is desirable to have the searchable encryption scheme which supports both multiple clients and multi-keyword queries. To address these issues, this paper proposes MMDSSE, a multi-client forward secure dynamic SSE scheme that supports multi-keyword queries. MMDSSE allows the clients narrow down the results by providing an arbitrary subset of the entire archive, and thus suitable for cloud storage environment. Security analysis and experimental evaluations show that MMDSSE is secure and efficient.

Private Set Intersection (PSI) is one of the most important functions in secure multiparty computation (MPC). PSI protocols have been a practical cryptographic primitive and there are many privacy-preserving applications based on PSI protocols such as computing conversion of advertising and distributed computation. Private Set Intersection Cardinality (PSI-CA) is a useful variant of PSI protocol. PSI and PSI-CA allow several parties, each holding a private set, to jointly compute the intersection and cardinality, respectively without leaking any additional information. Nowadays, most PSI protocols mainly focus on two-party settings, while in multiparty settings, parties are able to share more valuable information and thus more desirable. On the other hand, with the advent of cloud computing, delegating computation to an untrusted server becomes an interesting problem. However, most existing delegated PSI protocols are unable to efficiently scale to multiple clients. In order to solve these problems, this paper proposes MDPPC, an efficient PSI protocol which supports scalable multiparty delegated PSI and PSI-CA operations. Security analysis shows that MDPPC is secure against semi-honest adversaries and it allows any number of colluding clients. For 15 parties with set size of 220on server side and 216on clients side, MDPPC costs only 81 seconds in PSI and 80 seconds in PSI-CA, respectively. The experimental results show that MDPPC has high scalability.

Vehicular social networks (VSNs) are likely to play an increasingly important role of the future smart cities, supporting traffic management, real-time warning, and sharing data (e.g., condition, vehicular, and warning). However, there are existing security and privacy issues with vehicular data, which directly lead to the insufficient utilization of vehicular data. In this article, a blockchain-based lightweight searchable data sharing scheme is presented. Specifically, the proposed protocol achieves efficient data matching and data sharing by uniting the feature of public-key encryption with equality test (PKE-ET) and proxy re-encryption (PRE), meanwhile ensuring reliable matching results by invoking smart contacts. Moreover, a reputation-based dynamic PBFT consensus mechanism is provided. By analyzing the reputation and behavior of the consensus nodes, we further reduce the probability of malicious nodes becoming the consensus nodes, thus decreasing the computing overhead and communication costs in the consensus process. Finally, the security of the proposed protocol is demonstrated based on a computation Diffie–Hellman assumption in the Random Oracle model. According to the performance analysis, it was found that compared to the other protocols, the proposed protocol is computationally lightweight.

Recommender systems facilitate personalized service provision through the statistical analysis and model training of user historical data (e.g., browsing behavior, travel history, etc). To address the underpinning privacy implications associated with such systems, a number of privacy-preserving recommendation approaches have been presented. There are, however, limitations in many of these approaches. For example, approaches that apply public key (fully) homomorphic encryption (FHE) on different users. historical ratings under a unique public key of a target recommendation user incur significant computational overheads on resource-constrained local users and may not be scalable. On the other hand, approaches without utilizing public key FHE can neither resist chosen ciphertext attack (CCA), nor be straightforwardly applied to the setting of distributed servers. In this paper, a lightweight privacy-preserving distributed recommender system is proposed. Specifically, we present a new cryptographic primitive (i.e., tag-based multikey fully homomorphic data encapsulation mechanism; TMFH-DEM) designed to achieve CCA security for both input privacy and result privacy. TMFH-DEM enables a set of distributed servers to collaboratively execute efficient privacy-preserving outsourced computation on multiple inputs encrypted under different secret keys from different data owners, without using public key FHE. Building on TMFH-DEM, we propose a lightweight privacy-preserving distributed recommender system, which flexibly returns all the recommended items with certain predicted ratings for all target users. Formal security proof shows that our proposal achieves both user historical rating data privacy and recommendation result privacy. Findings from our evaluations demonstrate its practicability in terms of scalability, recommendation accuracy, computational and communication efficiency.

Federated learning is increasingly popular, as it allows us to circumvent challenges due to data islands, by training a global model using data from one or more data owners/sources. However, in edge computing, resource-constrained end devices are vulnerable to be compromised and abused to facilitate poisoning attacks. Privacy-preserving is another important property to consider when dealing with sensitive user data on end devices. Most existing approaches only consider either defending against poisoning attacks or supporting privacy, but not both properties simultaneously. In this paper, we propose a differentially private federated learning model against poisoning attacks, designed for edge computing deployment. First, we design a weight-based algorithm to perform anomaly detection on the parameters uploaded by end devices in edge nodes, which improves detection rate using only small-size validation datasets and minimizes the communication cost. Then, differential privacy technology is leveraged to protect the privacy of both data and model in an edge computing setting. We also evaluate and compare the detection performance in the presence of random and customized malicious end devices with the state-of-the-art, in terms of attack resiliency, communication and computation costs. Experimental results demonstrate that our scheme can achieve an optimal tradeoff between security, efficiency and accuracy.

Proxy Re-Encryption (PRE), a special cryptographic primitive, can efficiently perform ciphertext conversion on the cloud. To enable the data owner (i.e. delegator) to authorize a file access path according to the different priorities of the users (i.e. delegatees), autonomous path proxy re-encryption (AP-PRE) was proposed, where the delegator can generate a proxy re-encryption autonomous path in order of the delegatees’ priority. If one delegatee does not hold the decryption right, the ciphertext can be converted to a new ciphertext that can be decrypted by the next delegatee with lower priority in the path. Although AP-PRE enables the delegator to pre-define the whole decryption path, the access policy only supports a linked path and the data owner disallows the nodes in the proxy path to generate delegating branches to access its data. Such a linked path may be too long in practice, especially when the system scales up (i.e. the average complexity of encrypted data access isO(n)wherendenotes the number of delegatees). Hence, we propose a generalized autonomous path proxy re-encryption (APB-PRE) scheme for supporting branch functionality. Firstly, by setting the token and a carefully designed ciphertext structure, the branch functionality of the path delegation is realized. Specifically, we utilize the bilinearity of bilinear pairing to construct the token for the transition of the label embedded in the ciphertext in different paths, resulting in a far more flexible access structure with a tree-like topology. In APB-PRE, the delegatees with lower priority who need to share data can complete the decryption task earlier, without affecting the decryption of the high-priority delegatees. Finally, we prove that it achieves IND-HRA security under the Decisional Bilinear Diffie-Hellman (DBDH) assumption. Benefiting from the creation of branching paths, users on the branching path can get the re-encrypted ciphertext much earlier. Therefore, the average complexity of encrypted data access reduces toO(log n)compared to AP-PRE. The experimental results show that our proposal can extend the branching functionalities of AP-PRE with only moderate computational cost.

Real-time navigation is a fundamental service with the emerging techniques of intelligent transportation and crowdsensing. Unfortunately, the breach of location privacy significantly impedes its wide adoption. Most existing state-of-the-art exploit either pseudonyms or public key fully homomorphic encryption (FHE) to protect location privacy, which requires an online certificate authority (CA) or loads intolerably heavy computational/communication overhead on resource-constrained vehicular users. In this paper, a new cryptographic primitive named efficient multiparty delegated computation (MPDC) is firstly proposed, where any one-way trapdoor permutation is required to perform constant times (i.e. twice) on each resource-constrained data provider, to encrypt a batch of messages and enable types of secure evaluations over ciphertexts encrypted under multiple keys of multiple parties. Based on MPDC, we devise a lightweight privacy-preserving real-time intelligent traffic navigation scheme (EPNS) in cloud-assisted VANETs. The proposed approach predicts an optimal driving route of shortest time without disclosing either vehicular users' private location or the navigation result to the collusion between the semi-trusted cloud/cryptography service provider (CSP) and unauthorized users, by securely evaluating auto-regression moving average (ARMA) model with spatiotemporal correlations of high accuracy and efficiency. Finally, formal security proofs and the extensive evaluations demonstrate the utility and the practicability of our approaches.

Recent methods in sequential recommendation focus on learning multi-interest embedding vectors from a user's behavior sequence for the next-item recommendation. However, behavior sequential data may result from users' conformity towards popular items, which entangles users' real interests and tends to recommend popular items by using interest embeddings. In this paper, we propose a novel multi-interest framework with causal embedding for sequential recommendation, called MiceRec. Specifically, we first obtain two embedding layers from behavior sequence by assigning items with separate embeddings for interest and conformity, then extract multiple pure interests from one embedding layer, while the other for users' conformity extraction. According to the colliding effect of causal inference, we mine cause-specific data for training causal embeddings. Our framework significantly outperforms state-of-the-art solutions on two real-world datasets1. We further demonstrate that the learned multi-interest embeddings successfully separate from each other, and show that conformity information is almost squeezed out from interest embeddings.

Smart grids bring advantages of reliability and high efficiency by real-time communication technologies in contrast to the traditional grids. However, smart grids also raise concerns about privacy and security for the individual fine-grained information collection. In order to guarantee privacy and security in the grids, we propose an efficient and privacy-preserving multidimensional data aggregation scheme without a third trusted party and supporting fast error detection, named EPMDA-FED, in the article. First, we adopt a Chinese Remainder Theorem (CRT) to pack multidimensional data and encrypt the processed data using the keys generated by the negotiation among users and the control center (CC). Second, our scheme is efficient for encryption without high-cost additive homomorphic public-key encryption (PKE) scheme, such as the Paillier cryptosystem and supporting batch verification with fast error detection. Our proposed error detection algorithm is quite efficient with sublinear computational complexity. Besides, through security analysis, EPMDA-FED is semantically secure against collusion attack and the consistency of negotiated key, authenticity, and data integrity of the users’ reports are guaranteed. Finally, performance evaluation shows EPMDA-FED is more efficient than the existing competing approaches in terms of computational and communication overheads.

With the rapid development of computer networks, the network architecture has been more and more complex and diverse. Smart grid is a kind of wireless sensor network consuming energy in smart city. Smart grid communications have developed rapidly in recent years, while the privacy, integrity, and confidentiality of user data have been the main security issues. However, lattice-based homomorphic cryptography can resist quantum attacks and effectively provide the security of the scheme. In this article, we proposed an aggregate signature scheme based on new Batch RSA. After that, a data aggregation scheme is proposed based on this aggregate signature scheme and the qualified homomorphic cryptosystem. Compared to the previous schemes, our scheme is more secure because we implement seven properties, such as post quantum, privacy, and so on. Compared to the representative scheme proposed by Abdallahet al., our scheme has lower computation and communication overhead. In addition, the cryptographic algorithms involved in our scheme are lightweight. The network model in our scheme is suitable for large intelligent communities. So, our scheme is very suitable for the residential area network.

Signal processing in the encrypted domain is a potential tool to protect sensitive signals against untrusted cloud servers and unauthorized users in the delegated computing setting, without affecting the accuracy of large volume of signal analyzing and processing. Most existing approaches use Paillier’s public key additively homomorphic encryption to encrypt each signal in a large bundle; thus, incurring significant computational costs at local, often resource-constrained, devices while guaranteeing only signal input privacy. To address these limitations, in this paper, an efficient privacy-preserving outsourced discrete wavelet transform scheme (PPDWT), comprising PPDWT-1 and PPDWT-2, without leveraging public key (fully) homomorphic encryption is proposed. Specifically, PPDWT-1 is proposed to achieve signal input privacy against the collusion between the honest-but-curious cloud and unauthorized users, and the proposed PPDWT-2 protects both signal input privacy and coefficient privacy against collusion attacks. Both constructions leverage the offline execution of any one-way trapdoor permutation only once to encrypt batch signals, and permit signal processing in the encrypted domain. In our approach, only authorized users can successfully decipher the result of discrete wavelet transform. Compared to the$O(|l|)$computational complexity on the user’s end in existing state-of-the-art public key homomorphic encryption-based techniques, our approach only incurs$O(1)$computational complexity which is independent to size of the signal inputs$|l|$. We also discuss the expanding factor, the upper bound and various extensions to privacy-preserving discrete cosine/fourier transform in the encrypted domain. Finally, our proposed PPDWT is formally proved secure under the universal composability (UC) model. We then evaluate the proposed approach using case studies to demonstrate its effectiveness and practicability.

Self-organizing vehicular social networks underpin many location-based services (LBS) such as those that collect and share environmental information (e.g., traffic and weather conditions) among vehicular users and the infrastructure. There are, however, security and privacy considerations in the sharing of such information, and one popular approach is to design lightweight authentication solutions for LBS. Existing approaches may suffer from limitations such as significant computational and/or storage overheads, latency and time delays, and consequently impractical for resource-constrained on-board units. In this paper, we propose an efficient privacy-preserving LBS bundle authentication scheme (hereafter referred to as SAVE) through secure redundancy filtering in self-organizing vehicular social networks. Firstly, an enhanced self-healing key distribution protocol with distributed revocation is proposed to reduce communication cost for retransmitting lost key material and resist free-riding attacks to enhance the authentication efficiency. Then, based on it, a generalized version of online/offline aggregate signature is proposed to achieve batch LBS bundle verification based on arbitrary one-way function holding the property of multiplicative homomorphism. Finally, an efficient zero-knowledge range proof based on lightweight one-way hash chain is designed to decide the redundancy of LBS bundles without disclosing vehicular users’ location privacy. Formal security proof and extensive simulation results demonstrate that our proposed SAVE achieves identity privacy, two levels of location privacy and the practicability in reality.

Parking has been a big problem in metro cities. On one hand, it is very difficult to find a public parking lot in convenience. On the other hand, a lot of private parking lots are at waste while their owners are at work. Parking lots sharing emerged to address this issue. It allows more parking choices on the drivers side, while brings economic benefits on the parking lots side. In this paper, a privacy-preserving scope-query searchable encryption scheme based on blockchain (PSSBP) is proposed for parking lots sharing in vehicular networks. PSSBP manipulates dynamic group signatures, Cuckoo filter, Pedersen commitment and smart contract to achieve privacy-preservation and fairness. The security analysis and experimental results show that PSSBP is feasible for parking lots sharing in real life environments.

Bitcoin, the first decentralized cryptocurrency system, uses a simple but effective difficulty adjustment algorithm to stabilize its average time of the block creation at 10 minutes. Over time, the volatility of the Bitcoin price has become higher and higher, and it causes the total hashrate (the hash power of the entire network) constantly fluctuating. Both facts and our experimental results prove that Bitcoin's difficulty adjustment algorithm cannot respond in time while the total hashrate is constantly fluctuating. Hence, we propose a consensus protocol with a real-time difficulty adjustment algorithm, RTPoW. RTPoW allows the blockchain to adjust the difficulty target of each block by predicting the real-time total hashrate, so the block time can remain stable even if the total hashrate is wildly fluctuating. To evaluate the effect of RTPoW, we implemented a simulator of an experimental environment and tested our algorithm. The results obtained have confirmed its effectiveness and stability.

In this paper, we introduce DPFDT - a decentralized privacy-preserving fair data trading system using smart contracts. In this system, data as a digital commodity can be sold by the seller to the buyer at a certain price. We first design a conditional anonymous scheme based on block-chain and a fair trading protocol. Then we integrate them to form DPFDT to provide fairness, conditional anonymity, privacy-preserving, and decentralization. A conditional anonymous scheme means that the user’s operations are carried out through anonymous accounts, but when an anonymous account does some malicious behaviors, its real account will be traced. A protocol is said to be fair if and only if the buyer pays, and he will be guaranteed to receive the correct data. While a few fair exchange protocols based on smart contracts have been proposed, the DPFDT has the following advantages: (1) Adding privacy-preserving into the system, including the privacy of both parties’ identities in trading and the privacy of the buyers’ needs; (2) Authorizing buyers the right to specify the order. That is, sellers will be asked in the order specified by the buyer; (3) Introducing a paid trial stage in the trading process, the loss of paying for unwanted goods will be minimized. Besides, security analysis shows that the proposed scheme has transaction security and trade security. Finally, experiments are done on the Ethernet platform. It shows that the DPFDT is efficient and practical in real-life applications.

Abstract Searchable encryption (SE) allows the cloud server to search over the encrypted data and leak information as little as possible. Most existing efficient SE schemes assume that the leakage of search pattern and access pattern is acceptable. A series of work was proposed, instructing malicious users to use this leakage to come up with attacks. Especially, with a devastating attack proposed by Zhang et al., the cloud server can reveal the keywords queried by normal users by using some injected files. From the method of constructing uniform $(k,n)$-set of a finite set $A$ proposed by Cao, we put forward a new file-injection attack. In our attack, the server needs fewer injected files than the previous attack when the size of $T$ is larger than 9 and the size of keyword set is larger than $2T$, where $T$ is the threshold of the number of keywords in each injected file. Our attack is more practical and easier to implement in the real scenario.

With the fast development of Internet of Things (IoT) especially for smart grid and electric vehicle (EV) networking, vehicle-to-grid (V2G) communications have been increasingly studied and recognized as one of the most convincing tools for general road transportation, to effectively reduce the oil demands and gas emissions. Unfortunately, a series of security and privacy issues have significantly impeded its wide adoption. The existing work mainly focused on the static environment, which cannot be directly applied to the mobile setting where EVs travel across regions. The dynamic pricing metric in V2G networks depends on the real-time electricity usage aggregation in one region. To address this issue, in this article, an efficient privacy-preserving data aggregation and dynamic pricing service PADP in V2G IoT is proposed, by designing an identity-based sequential aggregate signed data (SASD) based on factoring and a threshold homomorphic encryption. In the proposed threshold homomorphic encryption, a legal ciphertext can be generated if and only if no less than threshold k individual illegal ciphertexts are aggregated. Therefore, the aggregated power consumption data can be successfully decrypted while the individual power consumption privacy of honest EV users can be well protected against even the collusion between a malicious power charging station and compromised EVs. Furthermore, the technique of SASD guarantees entity authentication with a minimized amount of transmitted data. Finally, formal security proof and extensive performance evaluation demonstrate the effectiveness and practicability of our proposed PADP.

The demands for the fairness, security, and efficiency of the supply chain have grown significantly due to the rise of globalization. However, some problems of the information flow, logistics, and capital flow in the supply chain remain a challenge, such as the information asymmetry between upstream and downstream, substandard quality of goods, difficulty in traceability, and default of payment. Therefore, this paper proposes a blockchain-based supply chain framework (SESCF), which solves the supply chain problems securely and efficiently. First, the use of blockchain and smart contracts ensures the information symmetry in the supply chain system. Second, the radio frequency identification (RFID) provides a unique identity of goods, which helps in real-time quality monitoring. Additionally, the immutability and distributed storage of the blockchain play an important role in tracking the origin of goods. Third, the efficient payment channel is used to solve the problem of payment defaults. Furthermore, simulations of smart contracts along with the security analyses are presented in this paper. We also implement a blockchain-based supply chain system (SescfDapp), which is built upon a Consortium blockchain. Large-scale experiments and detailed analysis prove the feasibility and efficiency of our proposed system.

Outsourced pattern matching delegates the task of finding all positions pattern$P$appears in text$T$to the cloud from resource-constrained devices. Unfortunately, it has brought a series of security and privacy issues. Most of the state-of-the-art either disclosed text/pattern privacy or exploited the computationally-intensive techniques of public key fully homomorphic encryption (FHE), commitment schemes and zero knowledge proof to achieve both text/pattern privacy and verifiability. To address these issues, as a building block, an efficient privacy preserving verifiable outsourced discrete fourier transform protocol OVFT is first devised based on any one-way trapdoor permutation (OWTP). Based on OVFT, we propose an efficient secure verifiable outsourced polynomial multiplication protocol OPVML which is further exploited in designing our final protocol PVOPM for verifiable privacy-preserving outsourced pattern matching. Without exploiting public key FHE, the proposed PVOPM achieves both verifiability and text/pattern privacy against the collusion between the cloud and malicious receiver/sender, by generating authentication proofs of constant size and executing constant times of any one-way trapdoor permutation, independent to both the text size$n$and the pattern size$m$. Finally, formal security proof under universal composable (UC) model and extensive evaluations demonstrate the efficiency and practicability of our proposed PVOPM.

Big data analytics has been regarded as a promising technology to yield better insights into future development by government and industry. Data collection and aggregation are necessary pre-steps to enable data analysis. However, data may be dispersed across multiple places and in different formats. Even worse, data can be encrypted under various encryption mechanisms when data owners try to secure the confidentiality of the data. This makes data aggregation extremely challenging, if not impossible, especially when the encryption keys cannot be shared for various reasons. In this paper, we take the first step in addressing this problem. More specifically, we propose a new notion of cross-domain encryption switching service that securely bridges two well-studied encryption mechanisms, namely traditional public key encryption and identity-based encryption. As of independent interest, our notion supports keyword search over encrypted data, i.e., after encryption switching one may search over the (outsourced) data without loss of data and query secrecy. We provide a provably-secure instantiation satisfying the notion, and further present the efficiency analysis to show the scalability. Our proposed scheme may be applicable in multi-domain cloud storage system.

Secure cloud storage, which is an emerging cloud service, is designed to protect the confidentiality of outsourced data but also to provide flexible data access for cloud users whose data is out of physical control. Ciphertext-Policy Attribute-Based Encryption (CP-ABE) is regarded as one of the most promising techniques that may be leveraged to secure the guarantee of the service. However, the use of CP-ABE may yield an inevitable security breach which is known as the misuse of access credential (i.e., decryption rights), due to the intrinsic “all-or-nothing” decryption feature of CP-ABE. In this paper, we investigate the two main cases of access credential misuse: one is on the semi-trusted authority side, and the other is on the side of cloud user. To mitigate the misuse, we propose the first accountable authority and revocable CP-ABE based cloud storage system with white-box traceability and auditing, referred to as CryptCloud±. We also present the security analysis and further demonstrate the utility of our system via experiments.

Searchable Symmetric Encryption(SSE) remains to be one of the hot topics in the field of cloud storage technology. However, malicious servers may return incorrect search results intentionally, which will bring significant security risks to users. Therefore, verifiable searchable encryption emerged. In the meantime, single-keyword query limits the applications of searchable encryption. Accordingly, more expressive searchable encryption schemes are desirable. In this paper, we propose a verifiable conjunctive keyword search scheme based on Cuckoo filter (VCKSCF), which significantly reduces verification and storage overhead. Security analysis indicates that the proposed scheme achieves security in the face of indistinguishability under chosen keyword attack and the unforgeability of proofs and search tokens. Meanwhile, the experimental evaluation demonstrates that it achieves preferable performance in real-world settings.

Attribute-based encryption received widespread attention as soon as it was proposed. However, due to its specific characteristics, some restrictions on attribute set are not flexible enough in actual operation. In addition, since access authorities are determined according to users' attributes, users sharing the same attributes are difficult to be distinguished. Once a malicious user makes illicit gains by their decryption authorities, it is difficult to track down specific user. This paper follows practical demands to propose a more flexible key-policy attribute-based encryption scheme with black-box traceability. The scheme has a constant size of public parameters which can be utilized to construct attribute-related parameters flexibly, and the method of traitor tracing in broadcast encryption is introduced to achieve effective malicious user tracing. In addition, the security and feasibility can be proved by the security proofs and performance evaluation in this paper.

With the location-based services (LBS) booming, the volume of spatial data inevitably explodes. In order to reduce local storage and computational overhead, users tend to outsource data and initiate queries to the cloud. However, sensitive data or queries may be compromised if cloud server has access to raw data and plaintext token. To cope with this problem, searchable encryption for geometric range is applied. Geometric range search has wide applications in many scenarios, especially the circular range search. In this paper, a practical and secure circular range search scheme (PSCS) is proposed to support searching for spatial data in a circular range. With our scheme, a semi-honest cloud server will return data for a given circular range correctly without uncovering index privacy or query privacy. We propose a polynomial split algorithm which can decompose the inner product calculation neatly. Then, we define the security of our PSCS formally and prove that it is secure under same-closeness-pattern chosen-plaintext attacks (CLS-CPA) in theory. In addition, we demonstrate the efficiency and accuracy through analysis and experiments compared with existing schemes.

Machine learning, particularly the neural network (NN), is extensively exploited in dizzying applications. In order to reduce the burden of computing for resource-constrained clients, a large number of historical private datasets are required to be outsourced to the semi-trusted or malicious cloud for model training and evaluation. To achieve privacy preservation, most of the existing work either exploited the technique of public key fully homomorphic encryption (FHE) resulting in considerable computational cost and ciphertext expansion, or secure multiparty computation (SMC) requiring multiple rounds of interactions between user and cloud. To address these issues, in this article, a lightweight privacy-preserving model training and evaluation scheme LPTE for discretized NNs (DiNNs) is proposed. First, we put forward an efficient single key fully homomorphic data encapsulation mechanism (SFH-DEM) without exploiting public key FHE. Based on SFH-DEM, a series of atomic calculations over the encrypted domain, including multivariate polynomial, nonlinear activation function, gradient function, and maximum operations are devised as building blocks. Furthermore, a lightweight privacy-preserving model training and evaluation scheme LPTE for DiNNs is proposed, which can also be extended to convolutional NN. Finally, we give the formal security proofs for dataset privacy, model training privacy, and model evaluation privacy under the semi-honest environment and implement the experiment on real dataset MNIST for recognizing handwritten numbers in DiNN to demonstrate the high efficiency and accuracy of our proposed LPTE.

Blockchain can be utilized to enhance both security and efficiency for location-based service (LBS) in vehicular social networks (VSNs), due to its inherent decentralization, anonymity, and trust properties. Unfortunately, the existing approaches either lack effective authentication, which is vulnerable to the man-in-the-middle attack, or require an online certificate authority (CA) where frequent interactions with resource-constrained vehicles are required. To address these challenging issues, in this article, a lightweight threshold CA for consortium blockchain along with a privacy-preserving LBS protocol in blockchain enforced VSNs is proposed. First, a lightweight threshold CA framework LTCA is proposed by devising a threshold proxy signature, where the proxy signing key is issued by a coalition of threshold number of CAs playing the roles of authorized nodes in the consortium blockchain. Without the intervene of an online CA, each vehicle in the online phase can authenticate its identity by itself each time its blockchain address (i.e., account address) is updated. Then, based on the proposed LTCA, an efficient privacy-preserving LBS protocol PPVC is contrived to protect each vehicle’s conditional identity privacy with a moderate cost. Finally, both security analysis and performance evaluation demonstrate the effectiveness and efficiency of our proposed LTCA and PPVC in blockchain enforced VSNs.

Location-based service (LBS) in vehicular ad hoc networks (VANETs) has significantly benefited information acquisition from geographically-based social networking. Authentication guarantees the unforgeability and the effectiveness of the LBS information. Unfortunately, owing to a large quantity of redundant or useless LBS messages disseminated in VANETs, the heavy authentication overhead of the existing work adopting a periodically released authentication key, filtering with message identifiers or exploiting public key (fully) homomorphic encryption (FHE), is either intolerable by resource-constrained on-board units (OBUs) or inappropriate to the realtime controlling requirement for VANETs. In this paper, an efficient multi-key secure outsourced computation scheme MSOC without exploiting public key FHE is first proposed, in the setting of two non-colluding servers, namely the cloud and the cryptographic service provider (CSP). Then, based on MSOC, an efficient and secure comparison protocol LSCP is devised, without the interaction between the server and the users. Furthermore, a lightweight privacy-preserving authentication protocol LPPA for LBS in VANETs is proposed, by eliminating duplicate and useless encrypted LBS messages before authentication is executed, through a newly devised efficient privacy-preserving information filtering system. Both user’s location privacy and interest privacy are well protected against even the collusion between the roadside units (RSUs) serving as the cloud (or CSP) and malicious users. Especially, the property of ciphertext re-encryption of our proposed MSOC also guarantees the interest pattern privacy whether two users accept the same LBS information. Finally, formal security proof and extensive simulation results verify the effectiveness and practicability of our proposed LPPA.

ABKS has drawn much attention from research and industry in recent years, an ABKS scheme is an encryption scheme that supports keyword search and access control. Attribute-Based Encryption is a public key encryption that enables users to encrypt and decrypt message based on attributes. In a typical implementation, the size of the ciphertext is proportional to the number of attributes associated with it and the decryption time is proportional to the number of attributes used during decryption. Inherit from ABE technology, the computation cost and ciphertext size in most ABKS schemes grow with the complexity of the access policy. On the other hand, we found that the traditional ABKS schemes cannot resist our secret-key-recovery attack. To deal with the above problems, we present new ciphertext policy attribute based encryption with fast keyword search constructions. Our constructions preserve the fine-grained access control inherited from the ABE system while supporting hidden policy and fast keyword search. Our constructions feature multi-value-independent compared with the existing attribute based searchable encryption schemes. The performance analysis demonstrates the efficiency of our constructions. We offer rigorous security proof of our second scheme, which is IND-CKA and IND-CPA secure.

Cognitive radio network (CRN) enables dynamic spectrum management where spectrum aggregation and sharing have significantly facilitated relieving the supply-demand gap among skyrocketing number of mobile devices. Secondary users (SUs) can collaboratively detect and exploit the available spectrums of primary users (PUs) from different locations. Unfortunately, it has brought a series of security threats leaking user's location privacy to unauthorized entities. The existing work either had privacy breaches or depended on computationally-intensive public key homomorphic encryption loading intolerably high complexity on resource-constrained SUs. To well address these issues, in this paper, a lightweight privacy-preserving spectrum aggregation and auction scheme PPSAS is proposed in CRNs without leveraging public key homomorphic encryption. Firstly, a new primitive of efficient privacy preserving multiparty data aggregation protocol PPMDA is proposed based on any one-way trapdoor permutation. Then based on PPMDA, an efficient privacy preserving spectrum aggregation scheme PPSRA and spectrum auction scheme PPSSA are respectively devised to constitute our proposed PPSAS. Especially, a decentralized PPMDA is extended to resist collusion attack and a secure extended outsourced stable complete marriage matching protocol is given to flexibly realize SU/auctioneer optimization. Finally, formal security proof and extensive simulations demonstrate that our proposed PPSAS well protects the SUs' location privacy against collusion attacks and possesses the advantages over the sate-of-the-art in terms of auctioneer's revenue, SUs' satisfaction, computational and communication overhead.

Searchable encryption is a cryptographic primitive that allows users to search for keywords on encrypted data. It allows users to search in archives stored on cloud servers. Among searchable encryption schemes, those supporting multiuser settings are more suitable for daily application scenarios and more practical. However, since the cloud server is semi-trusted, the result set returned by the server is undefined, and most existing multi-user searchable encryption schemes rely heavily on trusted third parties to manage user permission. To address these problems, verifiable multi-user searchable encryption schemes with dynamic management of user search permissions, weak trust on trusted third parties and are desirable. In this paper, we propose such a scheme. Our scheme manages user permission and key distribution without a trusted third party. User search permission and user access permission matrices are generated separately to manage user permissions dynamically. In addition, our scheme can verify the result set returned by the cloud server. We also show that our scheme is index and trapdoor indistinguishable under chosen keyword attacks in the random oracle model. Finally, a detailed comparison experiment is made by using the actual document data set, and the results show that our scheme is efficient and practical.

Abstract Lossy trapdoor functions (LTDFs) were introduced by Peikert and Waters (STOC 2008) and have a number of applications in cryptography. All-but-many lossy trapdoor functions (ABM-LTDFs) are generalizations of LTDFs studied by Hofheinz (Eurocrypt 2012). Specially, using ABM-LTDFs to construct public key encryption (PKE) scheme with selective opening security has been proven feasible. Existing ABM-LTDFs were built on pairings, lattices and decisional composite residuosity (DCR) assumption. However, pairing-based ABM-LTDFs and DCR-based ABM-LTDFs rely on non-standard assumptions. In this paper, we construct an ABM-LTDF under the decisional RSA subgroup (DRSA) assumption, and we employ it to construct PKE scheme with selective opening security. We also propose a construction of DCR-based ABM-LTDF relying on standard assumption in Appendix.

Fault-tolerant aggregate signatures allow the verification algorithm to recognize and verify all the valid individual signatures in an aggregate signature. However, in ordinary aggregate signature schemes, if there is a single faulty individual signature in the valid aggregate, the whole aggregate will be invalid. This will make great difficulties in many applications including secure logging and batch verification in vehicular ad hoc network et al. In this paper, inspired by the finite set theory called uniform (k,n)-set proposed by Cao, we put forward a novel fault-tolerant aggregate signature scheme. Our new scheme is more efficient compared with previous fault-tolerant aggregate signature scheme based on cover-free family. It is noted that our scheme is quite easy to be implemented in the real scenario.

In this paper, we introduce a new cryptographic primitive, called autonomous path proxy re-encryption (AP-PRE), which is motivated by several application scenarios where the delegator would like to control the whole delegation path in a multi-hop delegation process. Compared with the traditional proxy re-encryption, AP-PRE provides much better fine-grained access control to delegation path. Briefly speaking, in an AP-PRE scheme, the delegator designates a path of his preferred delegatees. The path consists of several delegatees with the privilege from high to low. If the delegatee in the path cannot complete the decryption, the decryption right is automatically delegated to the next one in the path. In this way, the delegator can ensure that the delegation has always been done among those delegatees the delegator trusts. Moreover, an AP-PRE scheme has to obey the following path rules. The delegation, for ciphertexts of a delegator i, can only be carried out on the autonomous path Paidesignated by the delegator i, in the sense that (1) re-encrypted ciphertexts along the autonomous path Pa cannot branch off Pa with meaningful decryption, and (2) original ciphertexts generated under pkjfor j ≠ i (i.e., for a path Pajdifferent from Pai) cannot be inserted into (i.e., cannot be transformed along) the autonomous path Paiwith meaningful decryption. We give the formal definition, as well as the formal security model, for this cryptographic primitive. Under this concept, we construct an IND-CPA secure AP-PRE scheme under the decisional bilinear DiffieHellman (DBDH) assumption in the random oracle model. Our scheme is with the useful properties of proxy re-encryption, i.e., unidirectionality and multi-hop.

Autonomous vehicles are expected to be a disruptive technology that has the potential to revolutionize the human mobility. However, the recent research progress on intra-vehicle network (e.g., the revealing of a series of security vulnerabilities of CAN design) has demonstrated that the security issue still represents one of the major challenges of future self-driving cars. In this study, we propose a novel edge based anomaly detection system, coined VeAnDe, which exploits edge based sensor data fusion to identify the anomaly events. VeAnDe analyzes pair-wise correlations between different intra-vehicle sensors, and utilizes these correlations to examine whether an anomaly has occurred within the vehicle. More specifically, the pair-wise correlations are organized as ring architecture to reduce the computation overhead. Furthermore, the major components of VeAnDe are embedded in edge computing devices, which enables VeAnDe to be more efficient and privacy-preserving. We evaluate the performance of VeAnDe under different scenarios, and our experimental results demonstrate its feasibility and efficiency.

Attribute-based encryption with keyword search (ABKS) is a system that supports keyword search and access control. By inheriting from attribute-based encryption technology, most current ABKS schemes incur large computation costs in encryption phase and keyword search phase. In a typical implementation, the size of ciphertext is proportional to the number of attributes associated with the access policy, so that the keyword search time and the decryption time are proportional to the number of attributes used in the access policy. To deal with the above problem, we present a new ciphertext-policy attribute-based encryption with fast keyword search scheme. Our scheme preserves the fine-grained access control inherited from the ABE system while supporting hidden policy and fast keyword search. In particular, the proposed scheme can efficiently support AND-gate access policy with multiple attribute values. Moreover, our scheme features multi-value-independent which have constant computation costs compared with the existing ABKS schemes. With the “aggregation” technique, the keyword search phase only needs three pairings, which is a great advantage over previous ABKS schemes. We offer rigorous security proof of our scheme, and the performance analysis demonstrates the efficiency of our scheme.

For disaster recovery, we store backups of a file in several positions far away from each other. If we delegate this task to an untrusted cloud service provider, a verification method is desired. In this paper, we construct a generic transformation from “proof of retrievability” to “proof of multic opy”. We present this work in two stages. In the first stage, we propose a generic protocol of “proof of file position” based on an arbitrary secure “proof of retrievability” protocol. In the second stage, we propose a “proof of multicopy” protocol based on our “proof of file position” protocol. Both of our protocols are provably secure.

Ciphertext-policy attribute-based encryption (CP-ABE) has been proposed to enable fine-grained access control on encrypted data for cloud storage service. In the context of CP-ABE, since the decryption privilege is shared by multiple users who have the same attributes, it is difficult to identify the original key owner when given an exposed key. This leaves the malicious cloud users a chance to leak their access credentials to outsourced data in clouds for profits without the risk of being caught, which severely damages data security. To address this problem, we add the property of traceability to the conventional CP-ABE. To catch people leaking their access credentials to outsourced data in clouds for profits effectively, in this paper, we first propose two kinds of non-interactive commitments for traitor tracing. Then we present a fully secure traceable CP-ABE system for cloud storage service from the proposed commitment. Our proposed commitments for traitor tracing may be of independent interest, as they are both pairing-friendly and homomorphic. We also provide extensive experimental results to confirm the feasibility and efficiency of the proposed solution.

As a sophisticated mechanism for secure finegrained access control over encrypted data, ciphertext-policy attribute-based encryption (CP-ABE) is one of the highly promising candidates for cloud computing applications. However, there exist two main long-lasting open problems of CP-ABE that may limit its wide deployment in commercial applications. One is that decryption yields expensive pairing cost which often grows with the increase of access policy size. The other is that one is granted access privilege for unlimited times as long as his attribute set satisfies the access policy of a given ciphertext. Such powerful access rights, which are provided by CP-ABE, may be undesirable in real-world applications (e.g., pay-as-youuse). To address the above drawbacks, in this paper, we propose a new notion called auditable σ-time outsourced CF-ABE, which is believed to be applicable to cloud computing. In our notion, expensive pairing operation incurred by decryption is offloaded to cloud and meanwhile, the correctness of the operation can be audited efficiently. Moreover, the notion provides σ-time fine-grained access control. The cloud service provider may limit a particular set of users to enjoy access privilege for at most σ times within a specified period. As of independent interest, the notion also captures key-leakage resistance. The leakage of a user's decryption key does not help a malicious third party in decrypting the ciphertexts belonging to the user. We design a concrete construction (satisfying our notion) in the key encapsulation mechanism setting based on Rouselakis and Waters (prime order) CP-ABE, and further present security and extensive experimental analysis to highlight the scalability and efficiency of our construction.

Content Centric Networking (CCN) is an effective communication paradigm that well matches the features of wireless environments. To be considered a viable candidate in the emerging wireless networks, despite the clear benefits of location-independent security, CCN must at least have parity with existing solutions for confidential and anonymous communication. This paper designs a new cryptographic scheme, called Asymmetric Index Encapsulation (AIE), that enables the router to test whether an encapsulated header matches the token without learning anything else about both of them. We suggest using the AIE as the core protocol of anonymous Content Centric Networking. A construction of AIE which strikes a balance between efficiency and security is given. The scheme is proved to be secure based on the DBDH assumption in the random oracle with tight reduction, while the encapsulated header and the token in our system consist of only three elements.

Wireless sensor networks (WSNs) are increasingly used in smart cities which involve multiple city services having quality of service (QoS) requirements. When misbehaving devices exist, the performance of current delivery protocols degrades significantly. Nonetheless, the majority of existing schemes either ignore the faulty behaviors’ variability and time-variance in city environments or focus on homogeneous traffic for traditional data services (simple text messages) rather than city services (health care units, traffic monitors, and video surveillance). We consider the problem of fault-aware multiservice delivery, in which the network performs secure routing and rate control in terms of fault activity dynamic metric. To this end, we first design a distributed framework to estimate the fault activity information based on the effects of nondeterministic faulty behaviors and to incorporate these estimates into the service delivery. Then we present a fault activity geographic opportunistic routing (FAGOR) algorithm addressing a wide range of misbehaviors. We develop a leaky-hop model and design a fault activity rate-control algorithm for heterogeneous traffic to allocate resources, while guaranteeing utility fairness among multiple city services. Finally, we demonstrate the significant performance of our scheme in routing performance, effective utility, and utility fairness in the presence of misbehaving sensors through extensive simulations.

In cloud computing, computationally weak users are always willing to outsource costly computations to a cloud, and at the same time they need to check the correctness of the result provided by the cloud. Such activities motivate the occurrence of verifiable computation (VC). Recently, Parno, Raykova and Vaikuntanathan showed any VC protocol can be constructed from an attribute-based encryption (ABE) scheme for a same class of functions. In this paper, we propose two practical and efficient semi-adaptively secure key-policy attribute-based encryption (KP-ABE) schemes with constant-size ciphertexts. The semi-adaptive security requires that the adversary designates the challenge attribute set after it receives public parameters but before it issues any secret key query, which is stronger than selective security guarantee. Our first construction deals with small universe while the second one supports large universe. Both constructions employ the technique underlying the prime-order instantiation of nested dual system groups, which are based on the $d$-linear assumption including SXDH and DLIN assumptions. In order to evaluate the performance, we implement our ABE schemes using $\textsf{Python}$ language in Charm. Compared with previous KP-ABE schemes with constant-size ciphertexts, our constructions achieve shorter ciphertext and secret key sizes, and require low computation costs, especially under the SXDH assumption.

The paper presents an identity based encryption (IBE) under selective opening attacks (SOA) whose security is almost-tightly related to a set of computational assumptions in composite-order bilinear groups. Our result is a combination of Bellare, Waters and Yilek's method [TCC, 2011] for constructing (not tightly) SOA secure IBE and Hofheinz, Koch and Striecks’ technique [PKC, 2015] on building almost-tightly secure IBE in the multi-ciphertext setting. In the paper, we first tune Bellare et al.’s generic construction for SOA secure IBE to show that a one-bit IBE achieving ciphertext indistinguishability under chosen plaintext attack in the multi-ciphertext setting (with one-sided public openability) tightly implies a multi-bit IBE secure under the selective opening attack. Next, we almost tightly reduce such a one-bit IBE to static assumptions in the composite-order bilinear groups employing the technique of Hofheinz et al. This yields the first SOA secure IBE with almost-tight reduction.

Summary Smart grid is ever‐increasingly adopted by nations and governments for its grand development with the underlying technologies of power management and information communications. The real‐time electricity usage can be monitored and aggregated by the smart meters deployed in the household for further analysis, control, and pricing. However, the existing solutions mainly depend on Paillier's additive homomorphic encryptions taking high computational complexity, and the aggregation mainly focused on the time series data generated by one single user. In this paper, we propose an efficient privacy‐preserving temporal and spacial data aggregation from one‐way functions in smart grid communications, which also allows spacial data aggregation from multiple users. The proposed construction can guarantee the unconditional security of users' metering power data privacy from the community gateway and the operation center, and the Adaptive Chosen Ciphertext Attack (CCA2) security of the aggregation result that can only be accessed by the authorized operating center. Both temporal and spacial data aggregation only require computing the underlying one‐way function once. The formal security proof and performance evaluations demonstrate the efficiency and the practicability of our scheme. Copyright © 2015 John Wiley & Sons, Ltd.

Abstract In this work, we generalize the paradigm of the hash proof system (HPS) proposed by Cramer and Shoup (EUROCRYPT 2002). In the center of our generalization, we lift a subset membership problem to a distribution‐distinguishing problem. Our generalized HPS clarifies and encompasses all the known public‐key encryption (PKE) schemes that essentially implement the idea of an HPS. Moreover, besides the existing smoothness property, we introduce an additional property named anonymity for HPS. As a natural application, we consider anonymity for PKE in the presence of key leakage and provide a generic construction of leakage‐resilient anonymous PKE from an anonymous HPS. We then extend our generalization to the identity‐based setting. Concretely, we generalize the paradigm of the identity‐based HPS (IB‐HPS) proposed by Boneh et al. (FOCS 2007) and Alwen et al. (EUROCRYPT 2010) and introduce anonymity for it. As an interesting application of the anonymous IB‐HPS, we consider security for PKE with keyword search (PEKS) in the presence of token leakage and provide a generic construction of leakage‐resilient secure PEKS from leakage‐resilient anonymous identity‐based encryption, which in turn is based on anonymous IB‐HPS. Copyright © 2013 John Wiley & Sons, Ltd.

Abstract Enabling privacy preserving outsourced data aggregation is regarded as an important issue for multi‐domain wireless networks. In this paper, we present a novel hybrid cloud‐based privacy‐preserving outsourced data aggregation framework. To achieve this, we introduce a hybrid storage cloud and aggregator cloud architecture, in which both of the storage clouds and aggregator cloud are assumed to be untrusted. On the basis of this security assumption, we firstly propose two novel basic protocols, including the proactive privacy‐preserving aggregation and reactive privacy‐preserving aggregation schemes, which are based on the idea of secret sharing. The proactive scheme allows the user to proactively split their data to multiple storage clouds to avoid data leaking while the reactive scheme allows the users to store their encrypted data in storage cloud and aggregator to finish the data aggregation based on the encrypted data. Moreover, on the basis of the proactive privacy‐preserving data aggregation and reactive privacy‐preserving data aggregation, we further propose an advanced protocol, which can resist the malicious data mining attack. The detailed performance simulations are given to demonstrate the security, effectiveness, and efficiency of the proposed scheme. Copyright © 2014 John Wiley & Sons, Ltd.

Nowaday, secure cloud computation has become more and more attractive. We propose a protocol for privacy-preserving pattern matching. Then, we prove that the construction is simulation-based secure in the semi-honest setting. Finally, the efficiency analysis shows our scheme outperforms the previous works. Specially, compared with Fast' protocol our scheme is more efficient and the text owner does not need real-time online in the query phase. Thus, this protocol is flexible to query by light weight equipments such as mobile phones. Copyright © 2016 John Wiley & Sons, Ltd.

For the first time, one new conception, multi-proxy multi-signature binding positioning protocol, is proposed. Based on the secure positioning protocol, one model of multi-proxy multi-signature binding positioning protocol is proposed. In the model, positioning protocol is bound to multi-proxy multi-signature tightly, not loosely. Further, we propose one scheme of multi-proxy multi-signature binding positioning protocol, its correctness is proved, and its security is analyzed. Copyright © 2016 John Wiley & Sons, Ltd.

Verifiable outsourced computation enables a computational resource-constrained mobile device to outsource the computation of a function F on multiple inputs x1, …, xnto the cloud that is generally assumed to possess abundant powers. The most existing work depends on Yao's Garbled Circuit and fully homomorphic encryptions that took considerable computational overhead on weak clients. In this paper, a more efficient verifiable outsourced computation of encrypted data EVOC supporting any functions from any one-way trapdoor function is proposed, based on our newly-devised privacy preserving data aggregation supporting both addition and multiplication operations without exploiting fully homomorphic encryption (FHE). It solves the open problem suggested by Gennaro et al. that how to devise a verifiable computation scheme that used a more efficient primitive than FHE. Finally, the formal security proof and extensive efficiency evaluations demonstrate our proposed EVOC satisfies the target security and privacy requirements and far outperforms the state-of-the-art in terms of computational and communication complexity.

Cloud-assisted e-healthcare systems significantly facilitate the patients to outsource their personal health information (PHI) for medical treatment of high quality and efficiency. Unfortunately, a series of unaddressed security and privacy issues dramatically impede its practicability and popularity. In e-healthcare systems, it is expected that only the primary physicians responsible for the patients treatment can not only access the PHI content but verify the real identity of the patient. Secondary physicians participating in medical consultation and/or research tasks, however, are only permitted to view or use the content of the protected PHI, while unauthorized entities cannot obtain anything. Existing work mainly focuses on patients conditional identity privacy by exploiting group signatures, which are very computationally costly. In this paper, we propose a white-box traceable and revocable multi-authority attribute-based encryption named TR-MABE to efficiently achieve multilevel privacy preservation without introducing additional special signatures. It can efficiently prevent secondary physicians from knowing the patients identity. Also, it can efficiently track the physicians who leak secret keys used to protect patients identity and PHI. Finally, formal security proof and extensive simulations demonstrate the effectiveness and practicability of our proposed TR-MABE in e-healthcare cloud computing systems.

Abstract Mobile social network (MSN), which is built upon popular smart phone devices and enables mobile users with similar interests to connect with one another, has received considerable attention in recent years. A common phenomenon that makes the MSN vivid today is mobile users often like to share attractive things to their friends in MSN. In this paper, based on this common phenomenon, we propose an efficient recommendation‐based data dissemination (ReDD) protocol for MSN, which can efficiently disseminate high‐quality messages in a privacy‐preserving way. Specifically, in the proposed ReDD protocol, each mobile user, based on both his or her own view and his or her friends' recommendations, will form his or her personal estimation on the quality of a message. Only if the estimation of quality reaches a threshold, the message will be disseminated. In this way, high‐quality messages can be widely spread in the network and occupy more network resources than low‐quality ones. In order to check the validity of friends' recommendations, ReDD also employs an efficient anonymous authentication technique, which ensures that only the friends of a user can verify recommendations made by the user. Detailed security analysis demonstrates that ReDD can effectively resist various attacks launched by attackers and ensure identity privacy of nodes, confidentiality of shared keys and integrity of data packets. In addition, extensive simulations are also conducted to evaluate the performance of ReDD in terms of the number of active nodes and the average active time, and the simulation results show that high‐quality messages can be disseminated widely and efficiently, while low‐quality ones will be eliminated shortly to avoid occupying network resources. Copyright © 2014 John Wiley & Sons, Ltd.

In this paper, we present a new identity-based encryption IBE scheme using bilinear pairings. Compared with the famous IBE scheme of Boneh and Franklin, ours is more practical in the multiple private key generator multiple-PKG environment. We prove that our scheme meets chosen ciphertext security in the random oracle model, assuming the intractability of the standard bilinear Diffie-Hellman problem. Copyright © 2013 John Wiley & Sons, Ltd.

In Ciphertext-policy attribute-based encrypt- ion (CP-ABE), ciphertexts are associated with access policies, which do not have to contain the identities of eligible receivers, and attributes are shared by multiple users. CP-ABE is useful for providing fine-grained access control on encrypted data. However, it also has a practicality concern that a malicious user, with his attributes shared with other users, might leak his decryption privilege as a decryption blackbox, for some financial gain or other incentives, as there is little risk of getting caught. There are two types of decryption blackboxes that reflect different practical scenarios. A key-like decryption blackbox is associated with an attribute set SDand can decrypt ciphertexts with access policies satisfied by SD. A policy-specific decryption blackbox is associated with an access policy ADand can decrypt ciphertexts with AD. Policy-specific decryption blackbox has weaker decryption capacity than key-like decryption blackbox, but tracing it is deemed to be more difficult. In the preliminary version (in CCS 2013) of this paper, we proposed a new CP-ABE scheme which is adaptively traceable against key-like decryption blackbox. The scheme has sublinear overhead, which is the most efficient one to date supporting fully collusion-resistant blackbox traceability. The scheme is fully secure in the standard model, and supports any monotonic access structures. In this paper, we further show that the scheme is also selectively traceable against policy-specific decryption blackbox. Furthermore, and more importantly, we prove a general statement that if a CP-ABE scheme is (selectively) traceable against policy-specific decryption blackbox, it is also (selectively) traceable against key-like decryption blackbox, which implies that we now only need to focus on building CP-ABE schemes which are traceable against policy-specific decryption blackbox.

Ciphertext-policy attribute-based encryption (CP-ABE) enables fine-grained access control to the encrypted data for commercial applications. There has been significant progress in CP-ABE over the recent years because of two properties called traceability and large universe, greatly enriching the commercial applications of CP-ABE. Traceability is the ability of ABE to trace the malicious users or traitors who intentionally leak the partial or modified decryption keys for profits. Nevertheless, due to the nature of CP-ABE, it is difficult to identify the original key owner from an exposed key since the decryption privilege is shared by multiple users who have the same attributes. On the other hand, the property of large universe in ABE enlarges the practical applications by supporting flexible number of attributes. Several systems have been proposed to obtain either of the above properties. However, none of them achieve the two properties simultaneously in practice, which limits the commercial applications of CP-ABE to a certain extent. In this paper, we propose two practical large universe CP-ABE systems supporting white-box traceability. Compared with existing systems, both the two proposed systems have two advantages: 1) the number of attributes is not polynomially bounded and 2) malicious users who leak their decryption keys could be traced. Moreover, another remarkable advantage of the second proposed system is that the storage overhead for traitor tracing is constant, which are suitable for commercial applications.

Cloud-assisted vehicular delay tolerant networks (DTNs) have been utilized in wide-ranging applications where a continuous end-to-end connection is unavailable, the message transmission is fulfilled by the cooperation among vehicular nodes and follows a store-carry-and-forward manner, and the complex computational work can be delegated to the disengaged vehicles in the parking lots which constitute the potential vehicular cloud. Nevertheless, the existing incentive schemes as well as the packet forwarding protocols cannot well model continuous vehicle collaboration, resist vehicle compromise attacks and collusion attacks, leaving the privacy preservation issues untouched. In this paper, a novel threshold credit-based incentive mechanism (TCBI) is proposed based on the modified model of population dynamics to efficiently resist the node compromise attacks, stimulate the cooperation among intermediate nodes, maximize vehicular nodes’ interest, and realize the fairness of possessing the same opportunity of transmitting packets for credits. Then, a TCBI-based privacy-preserving packet forwarding protocol is proposed to solve the open problem of resisting layer-adding attack by outsourcing the privacy-preserving aggregated transmission evidence generation for multiple resource-constrained vehicles to the cloud side from performing any one-way trapdoor function only once. The vehicle privacy is well protected from both the cloud and transportation manager. Finally, formal security proof and the extensive simulation show the effectiveness of our proposed TCBI in resisting the sophisticated attacks and the efficiency in terms of high reliability, high delivery ratio, and low average delay in cloud-assisted vehicular DTNs.

Distributed m-healthcare cloud computing system significantly facilitates efficient patient treatment for medical consultation by sharing personal health information among healthcare providers. However, it brings about the challenge of keeping both the data confidentiality and patients’ identity privacy simultaneously. Many existing access control and anonymous authentication schemes cannot be straightforwardly exploited. To solve the problem, in this paper, a novel authorized accessible privacy model (AAPM) is established. Patients can authorize physicians by setting an access tree supporting flexible threshold predicates. Then, based on it, by devising a new technique of attribute-based designated verifier signature, a patient self-controllable multi-level privacy-preserving cooperative authentication scheme (PSMPA) realizing three levels of security and privacy requirement in distributed m-healthcare cloud computing system is proposed. The directly authorized physicians, the indirectly authorized physicians and the unauthorized persons in medical consultation can respectively decipher the personal health information and/or verify patients’ identities by satisfying the access tree with their own attribute sets. Finally, the formal security proof and simulation results illustrate our scheme can resist various kinds of attacks and far outperforms the previous ones in terms of computational, communication and storage overhead.

Smart Grid technologies are ever-increasingly being adopted by nations and governments, primarily for a huge technological advancement in the areas of power management and information and communications. The smart meters deployed in a household can monitor electricity usage in real-time, and aggregate the data for further analysis and control; however, the existing solutions mainly depend on Paillier's additive homomorphic encryptions, which are of high computational complexity. This inefficiency makes them impracticable in smart grid, which embraces thousands of users and requires frequent data aggregation. In this paper, we propose a privacy-preserving aggregation framework, followed by a concrete construction using Elgamal encryption, which is secure under chosen plaintext attack (CPA) but not chosen ciphertext attack (CCA). Then, we further extend the concrete construction into a CCA-secure counterpart. In addition to efficient data aggregation, the proposed scheme can protect the user's meter data from sophisticated attacks, which are sponsored by the community gateway and the users. The formal security proof and performance evaluations illustrate the efficiency and the practicability of our scheme as well as its strong security.

Rumor blocking and Sybil Attack are regarded as two main security threats in online social networks. The existing work on rumor blocking mainly considers how to minimize the number of protectors used to protect bridge ends. In this study, our experiments based on the Twitter data set show that the existence of the sybil users will dramatically reduce the effectiveness of the rumor blocking by 30%. Motivated by this, we propose a novel sybil-aware least cost rumor blocking framework which jointly considering how to minimize the impact sybil attacks on rumor blocking and optimize the rumor blocking effectiveness. The proposed SLCRB algorithm is well demonstrated by extensive simulations and discussions.

In this paper, we introduce a general paradigm called identity-based extractable hash proof system (IB-EHPS), which is an extension of extractable hash proof system (EHPS) proposed by Wee (CRYPTO'10). We show how to construct identity-based key encapsulation mechanism (IB-KEM) from IB-EHPS in a simple and modular fashion. Our construction provides a generic method of building and interpreting CCA-secure IB-KEMs based on computational assumptions. As instantiations, we realize IB-EHPS from the bilinear Diffie–Hellman assumption and the modified bilinear Diffie–Hellman assumption, respectively. Besides, we carefully investigate the relation between EHPS and IB-EHPS, and indicate possible refinement and generalization of EHPS.

Wireless mesh networks are promising means of providing network coverage to areas where infrastructure is difficult to install. However, little work has been done on leveraging security and transmission overheads among multicast members in a multihop wireless network. This paper proposes a novel architecture for multicast wireless mesh network by exploiting a cryptographic primitive, certificateless proxy re-encryption. The methodology we present reduces the transformation ciphertexts from ki¾?n down to k+n, where k and n denote the length of the best route from the sender to the target users and the number of the valid receivers in the group, respectively. The proxy re-encryption scheme used in our architecture is newly constructed. Our proxy re-encryption scheme is against adaptive chosen- ciphertext attacks in the standard model. Copyright © 2013 John Wiley & Sons, Ltd.

The articles in this special section focus on trust, network security, and privacy deployed in parallel and distributed systems.

Malicious and selfish behaviors represent a serious threat against routing in delay/disruption tolerant networks (DTNs). Due to the unique network characteristics, designing a misbehavior detection scheme in DTN is regarded as a great challenge. In this paper, we propose iTrust, a probabilistic misbehavior detection scheme, for secure DTN routing toward efficient trust establishment. The basic idea of iTrust is introducing a periodically available Trusted Authority (TA) to judge the node's behavior based on the collected routing evidences and probabilistically checking. We model iTrust as the inspection game and use game theoretical analysis to demonstrate that, by setting an appropriate investigation probability, TA could ensure the security of DTN routing at a reduced cost. To further improve the efficiency of the proposed scheme, we correlate detection probability with a node's reputation, which allows a dynamic detection probability determined by the trust of the users. The extensive analysis and simulation results demonstrate the effectiveness and efficiency of the proposed scheme.

In the context of Ciphertext-Policy Attribute-Based Encryption (CP-ABE), if a decryption device associated with an attribute set S_D appears on eBay, and is alleged to be able to decrypt any ciphertexts with policies satisfied by S_D, no one including the CP-ABE authorities can identify the malicious user(s) who build such a decryption device using their key(s). This has been known as a major practicality concern in CP-ABE applications, for example, providing fine-grained access control on encrypted data. Due to the nature of CP-ABE, users get decryption keys from authorities associated with attribute sets. If there exists two or more users with attribute sets being the supersets of S_D, existing CP-ABE schemes cannot distinguish which user is the malicious one who builds and sells such a decryption device. In this paper, we extend the notion of CP-ABE to support Blackbox Traceability and propose a concrete scheme which is able to identify a user whose key has been used in building a decryption device from multiple users whose keys associated with the attribute sets which are all the supersets of S_D. The scheme is efficient with sub-linear overhead and when compared with the very recent (non-traceable) CP-ABE scheme due to Lewko and Waters in Crypto 2012, we can consider this new scheme as an extension with the property of fully collusion-resistant blackbox traceability added, i.e. an adversary can access an arbitrary number of keys when building a decryption device while the new tracing algorithm can still identify at least one particular key which must have been used for building the underlying decryption device. We show that this new scheme is secure against adaptive adversaries in the standard model, and is highly expressive by supporting any monotonic access structures. Its additional traceability property is also proven against adaptive adversaries in the standard model.

Cognitive Radio Network (CRN) is regarded as a promising way to address the increasing demand for wireless channel resources. It solves the channel resource shortage problem by allowing a Secondary User (SU) to access the channel of a Primary User (PU) when the channel is not occupied by the PU. The latest FCC's rule in May 2012 enforces database-driven CRNs, in which an SU queries a database to obtain spectrum availability information by submitting a location based query. However, one concern about database-driven CRNs is that the queries sent by SUs will inevitably leak the location information. In this study, we identify a new kind of attack against location privacy of database-drive CRNs. Instead of directly learning the SUs' locations from their queries, our discovered attacks can infer an SU's location through his used channels. We propose Spectrum Utilization based Location Inferring Algorithm that enables the attacker to geo-locate an SU. To thwart location privacy leaking from query process, we propose a novel Private Spectrum Availability Information Retrieval scheme that utilizes a blind factor to hide the location of the SU. To defend against the discovered attack, we propose a novel prediction based Private Channel Utilization protocol that reduces the possibilities of location privacy leaking by choosing the most stable channels. We implement our discovered attack and proposed scheme on the data extracted from Google Earth Coverage Maps released by FCC. Experiment results show that the proposed protocols can significantly improve the location privacy.

ABSTRACT Two novel public key encryption schemes based on the non‐Abelian factorization problems were proposed. Both of them are proved to be indistinguishable against adaptively chosen ciphertext attack (IND‐CCA2) in the random oracle models. These constructions have the potential to resist Shor's quantum algorithm attack proposed in 1994 and give affirmative answers for the open question announced by Myasnikov, Shpilrain and Ushakov in 2011. Copyright © 2013 John Wiley & Sons, Ltd.

ABSTRACT In this paper, we present a more efficient chosen‐ciphertext secure proxy re‐encryption scheme in the standard model with less ciphertext size and without any strong unforgeable one‐time signature. Our scheme is unidirectional and single‐hop. The security of our scheme is under the reasonable complexity assumption—the decisional bilinear Diffie–Hellman assumption in bilinear groups. There are no proxy re‐encryption schemes achieving chosen‐ciphertext security in the standard model without a strong unforgeable one‐time signature in the literature. Copyright © 2012 John Wiley & Sons, Ltd.

ABSTRACT Digital signatures are one of the fundamental security primitives because they provide authenticity and nonrepudiation in the broadcast/multicast communication networks. However, the current broadcast/multicast authentication standards are vulnerable to signature flooding because excessive signature verification requests exhaust the computational resource of victims. The situation becomes worse in the case of the energy‐constrained networks such as wireless sensor networks and mobile ad hoc networks. As an essential variation of ordinary digital signature schemes, multisignature schemes enable a single compact signature to authenticate a message under a set of different signers. In this paper, we first propose an efficient identity‐based multisignature scheme with three interactive rounds under quadratic residue assumption, which equals to the large integer factoring assumption. By using the technique of quadratic residue‐based multiplicatively homomorphic equivocable commitment, an advanced identity‐based multisignature scheme is proposed to achieve to reduce the interactive round complexity to two rounds. We give the formal security proof that our schemes are existentially unforgeable under adaptively chosen message attacks and chosen identity attacks in the random oracle model. Compared with the previous work, our schemes are very efficient. In particular, our schemes are featured by the weak assumption and the efficient signing and verification procedures. Copyright © 2012 John Wiley & Sons, Ltd.

In a ciphertext-policy attribute-based encryption (CP-ABE) system, decryption keys are defined over attributes shared by multiple users. Given a decryption key, it may not be always possible to trace to the original key owner. As a decryption privilege could be possessed by multiple users who own the same set of attributes, malicious users might be tempted to leak their decryption privileges to some third parties, for financial gain as an example, without the risk of being caught. This problem severely limits the applications of CP-ABE. Several traceable CP-ABE (T-CP-ABE) systems have been proposed to address this problem, but the expressiveness of policies in those systems is limited where only and gate with wildcard is currently supported. In this paper we propose a new T-CP-ABE system that supports policies expressed in any monotone access structures. Also, the proposed system is as efficient and secure as one of the best (non-traceable) CP-ABE systems currently available, that is, this work adds traceability to an existing expressive, efficient, and secure CP-ABE scheme without weakening its security or setting any particular trade-off on its performance.

The Database-driven Cognitive Radio Network is regarded as a promising way for a better utilization of radio channels without introducing the interference to the primary user. However, it is also facing a series of security threats. In this study, we identify a new kind of location privacy related attack which could geo-locate a secondary user from the spectrum he used. We propose a Spectrum Utilization based Location Inference Algorithm, which is based on the intersection of the possible location sets revealed by each channel access or channel transition event under the presence of the primary user. We implement our algorithm on the data extracted from Google Earth Coverage Maps released by FCC. Our experiement results show that, $80\%$ SUs could be located to 10 cells based on 25 or less channels.

Delay Tolerant Networks (DTNs) have been utilized in wide-raging applications where a continuous end-to-end connection is unavailable and the message transmission is fulfilled by the cooperation among DTN nodes and follows a store-carry-and-forward manner such as vehicular networks. A series of incentive schemes were proposed to stimulate the selfish nodes to take on the energy-consuming job of forwarding bundles. However, the Onboard Units (OBU) equipped on vehicles are vulnerable to node compromise attack and the existing incentive mechanisms cannot well resist such sophisticated attacks sponsored by colluding vehicles and model the continuous collaboration among vehicles. In this paper, a novel threshold credit-based incentive mechanism is proposed based on the modified model of population dynamics to efficiently prevent the node compromise attacks, stimulate the cooperation among intermediate nodes, maximize vehicular nodes' interests and realize the fairness of possessing the same opportunity to forward packets for credits. Then, based on it, a secure and reliable packet forwarding protocol TIS is proposed. By devising a time order-preserving aggregated signature scheme, it also effectively solves the open problem of resisting the layer-adding attack launched by the collusion of intermediate vehicles. Finally, the security analysis and the extensive simulations show the effectiveness of our proposed TIS in resisting the sophisticated attacks mentioned above and the efficiency in terms of high reliability, high delivery ratio and low average delay in vehicular DTNs.

ABSTRACT We consider public key encryption (PKE) schemes with auxiliary input, that is, the adversary is given any computationally uninvertible function of the secret key. Previous result only achieves security under chosen‐plaintext attacks (CPA). In this paper, we construct public key encryption schemes that are secure under chosen‐ciphertext attacks even when the adversary is given any computationally uninvertible function of the secret key as an auxiliary input. We follow the Naor–Yung ‘double encryption’ paradigm and generally transform any chosen‐plaintext attack secure public key encryption into a chosen‐ciphertext attack secure one in the auxiliary input model. Copyright © 2012 John Wiley & Sons, Ltd.

Since there always exists a possibility that some users' private keys are stolen or expired in practice, it is important for identity based encryption (IBE) system to provide a solution to revocation. The current most efficient revocable IBE system has a private key of size O(log ns) and update information of size O(r log(n/r)) where r is the number of revoked users. In this paper, we present a new revocable IBE system in which the private key only contains two group elements and the update information size is O(r). We show that the proposed constructions for the revocation mechanism are more efficient in terms of space cost and provide a generic methodology to transform a non-monotonic attribute based encryption into a revocable IBE. We also demonstrate how the proposed method can be employed to develop an efficient hierarchical revocable IBE system.

In this paper, we propose an event-aided packet forwarding (EPF) protocol, which enables patients to efficiently communicate with each other in privacy-preserving Mobile Healthcare Social Networks (MHSNs). Since patients with common illnesses often attend the same related activities, EPF makes use of these activities in forwarding illness-related messages to the target patients so that it can achieve high target patients coverage ratio. In addition, EPF also adopts predicate encryption to guarantee patient privacy and message confidentiality. Through security analysis, we demonstrate that EPF can effectively resist various attacks launched by adversaries, and ensure patient identity and illness privacy. Extensive simulations are also conducted to evaluate the performance of EPF in terms of average target patients coverage ratio, average number of packet copies, and average packet delay.

Delay/Disruption tolerant networks (DTNs) are self-organized wireless networks, where end-to-end network connectivity is not available and the data forwarding relies on the assumption that the intermediate nodes are ready to "store, carry and forward" messages in an opportunistic way. This assumption can be easily violated by the selfish nodes which may be unwilling to use their precious resources by serving as relays. Due to the unique network characteristics, incentive issue is extraordinarily challenging in DTNs. To tackle this issue, in this paper, we propose MobiGame, a user-centric reputation based incentive protocol for DTNs, which allows a node to manage its reputation evidence. For the fairness requirement, we define a game-theoretic framework to design reasonable costs and reward parameters in the MobiGame's bundle forwarding, which leads to a Perfect Bayesian Equilibrium. Performance simulations are given to demonstrate the security, effectiveness and efficiency.

This paper presents the first multi-use unidirectional proxy re-encryption scheme proven-secure against chosenciphertext attacks and collusion attacks in the standard model. Although our proposal features a linear ciphertext size and decryption time in the number of translations, we emphasize that it is the first multi-use and unidirectional realization of the primitive satisfying the chosen-ciphertext security and collusion resistance. The proposal gives an answer to the problem proposed by Canetti and Hohenberger at ACM CCS 2007.

Abstract This paper investigates the security model for authenticated key exchange protocols. We further enhance the enhanced Canetti‐Krawczyk (eCK) model by introducing a notion called strong key compromise impersonation (SKCI) resilience which is first identified in this paper. SKCI resilience guarantees that the adversary cannot masquerade as another party B to communicate with party A even if the static private key and the ephemeral private key of party A are compromised. We point out that the three‐pass authenticated key exchange protocol generically transformed from the two‐pass one secure in the eCK model cannot resist the SKCI attack. Finally, we introduce a new authenticated key exchange protocol SIG‐DH+ and prove that it satisfies our new definition. Copyright © 2010 John Wiley & Sons, Ltd.

Abstract ID‐based one‐pass authenticated key exchange protocol allows the sender Alice to generate a session key without interacting with receiver Bob. As a result, it is better suitable for some application scenarios than the two‐pass counterpart. However, currently there are few ID‐based one‐pass authenticated key exchange protocols with a security proof in a formal model. The paper investigates the ID‐based one‐pass authenticated key exchange protocol in the enhanced Canetti–Krawczyk (eCK) model. We propose a new ID‐based one‐pass authenticated key exchange protocol IDOAKE, which is shown secure under Bilinear Diffie–Hellman (BDH) assumption in the eCK model. To the best of our knowledge, our protocol is the first provably secure ID‐based one‐pass authenticated key exchange in the eCK model. Copyright © 2010 John Wiley & Sons, Ltd.

Abstract By allowing a proxy to blindly perform meaningful transformations from one ciphertext to another, proxy re‐encryption (PRE) is an important cryptographic primitive in many applications, such as encrypted email forwarding and distributed file system. Due to its usefulness, various PRE schemes have been proposed; however, only one can simultaneously achieve chosen ciphertext security (CCA security) and collusion‐resistance. When such schemes are deployed, lack of CCA security will cause secret leaking, and lack of collusion‐resistance will cause non‐repudiation damage. In this paper, we propose a novel approach (denoted SCCR) to simultaneously achieve CCA security and collusion‐resistance in PRE, which faces daunting new challenges. We address these challenges by using CCA‐secure (2, 2) threshold cryptosystem to obtain public verifiability, and the method of key management in identity‐based encryption (IBE) to achieve collusion‐resistance. These two novel techniques have not been yet used in any previous PRE schemes. A unique characteristic of SCCR is that it is a generic construction which has more advantages than a concrete PRE scheme does. Copyright © 2009 John Wiley & Sons, Ltd.

Nowadays, most proxy signature schemes are based on the difficulty of DLP (Discrete Logarithm Problem) or ECDLP (Elliptical Curve Discrete Logarithm Problem). As though many proxy signature schemes based on DLP or ECDLP have been proposed, it makes us discouraged that some disadvantages can be found

Bundle Authentication is a critical security service in Delay Tolerant Networks (DTNs) that ensures authenticity and integrity of bundles during multi-hop transmissions. Public key signatures, which have been suggested in existing bundle security protocol specification, achieve bundle authentication at the cost of an increased computational, transmission overhead and a higher energy consumption, which is not desirable for energy-constrained DTNs. On the other hand, the unique ``store-carry-and-forward'' transmission characteristic of DTNs implies that bundles from distinct/common senders can be buffered opportunistically at some common intermediate nodes. This ``buffering'' characteristic distinguishes DTN from any other traditional wireless networks, for which an intermediate cache is not supported. To exploit such a buffering characteristic, in this paper, we propose an Opportunistic Batch Bundle Authentication Scheme (OBBA) to achieve efficient bundle authentication. The proposed scheme adopts batch verification techniques, allowing a computational overhead to be bounded by the number of opportunistic contacts instead of the number of messages. Furthermore, we introduce a novel concept of a fragment authentication tree to minimize communication cost by choosing an optimal tree height. Finally, we implement OBBA in a specific DTN scenario setting: packet-switched networks on campus. The simulation results in terms of computation time, transmission overhead and power consumption are given to demonstrate the efficiency and effectiveness of the proposed schemes.

In this paper, we present a new ID-based two-party authenticated key exchange (AKE) protocol, which makes use of a new technique called twin Diffie-Hellman problem proposed by Cash, Kiltz and Shoup. We show that our scheme is secure under bilinear Diffie-Hellman (BDH) assumption in the enhanced Canetti-Krawczyk (eCK) model, which better supports the adversary's queries than previous AKE models. To the best of our knowledge, our scheme is the first ID-based AKE protocol provably secure in eCK model.

Attribute based proxy re-encryption scheme (ABPRE) is a new cryptographic primitive which extends the traditional proxy re-encryption (public key or identity based cryptosystem) to the attribute based counterpart, and thus empower users with delegating capability in the access control environment. Users, identified by attributes, could freely designate a proxy who can re-encrypt a ciphertext related with a certain access policy to another one with a different access policy. The proposed scheme is proved selective-structure chosen plaintext secure and master key secure without random oracles. Besides, we develop another kind of key delegating capability in our scheme and also discuss some related issues including a stronger security model and applications.

Ciphertext policy attribute based encryption (CPABE) allows a sender to distribute messages based on an access policy which can be expressed as a boolean function consisting of (OR, AND) gates between attributes. A receiver whose secret key is associated with those attributes could only decrypt a ciphertext successfully if and only if his attributes satisfy the ciphertext's access policy. Fine-grained access control, a new concept mentioned by GPSW in CCS'06 can realize a more delicate access policy which could be represented as an access tree with threshold gates connecting attributes.

The well-known method for a group key exchange (GKE) protocol to be against insider attack is to make use of signatures. However, using signatures considerably degrades the performance of the GKE protocol. In this paper, we propose a new method to resist insider attack. The underlying tool of our method is a two-party authenticated key exchange (AKE) protocol, which can be used to authenticate all other participants' session identifiers instead of using signatures. Based on the two- party AKE protocol, we propose an efficient insider-resistant GKE protocol without signatures. We show that our proposal is provably secure against insider attack if the underlying two-party AKE protocol is secure.

Private information retrieval enables the sensitive data to be obtained only if the data authorizers allow the data receivers to access to the data. Sometimes the owners are of a group and there is no need for all members to authorize the receivers. Moreover, the right to authorize could be unequal for different authorizers in the group.

The focus of this paper is to design an efficient certificateless threshold signature scheme (CLTHS) for data report authentication in mobile ad-hoc network, by which relatively small subsets of very large groups can report data that is aggregated and ``certified" by means of a signature. Examples include vehicular networks where cars report traffic conditions, sensor networks that report aggregate data such as temperature or radiation levels, military devices transmitting information to be reported to various commands, and more. We first define the security notion for certificateless threshold signature. Different from the adversarial model defined by Wang et al., our definition considers Type I and Type II adversary separately. At the same time, we develop the simulatability and relationship between certificateless threshold signature and the underlying certificateless signature. We also propose the first CLTHS scheme which is proved existentially unforgeable against adaptively chosen message attack without random oracles. Compared with the previous scheme, our scheme is much more efficient.

Abstract In electronic communication and wireless communication, message authentication should be necessary. However, traditional method message authentication code (MAC) employs a symmetric cryptographical technique and it needs to keep a shared private key between two parties. For convenience, people now begins to use public key techniques to provide message authentication. In wireless communication, we shall save more space for message itself because of the limited resources. Therefore, we believe that our proposed digital signature scheme will be more fitful for this kind of communication due to the following merits: (1) in addition to inheriting the merits of RSA signature such as high verification efficiency, the proposed scheme also shows its advantage over RSA by resisting low public key exponent attack; (2) comparing with 1024 bits RSA, our digital signature scheme can sign 2048‐bit long message once, and generate a signature with 1025 bits length which doubles the capacity of the 1024‐bit RSA signature; (3) the scheme is provably secure and its security is tightly related to the hardness of conic‐based (CB)‐RSA assumption. Copyright © 2008 John Wiley & Sons, Ltd.

In this paper, we discuss identity-based encryption in multiple PKG environment. We formulate the security notions for multi-receiver multi-PKG identity-based encryption (IBE) and present an efficient multi-receiver IBE scheme which is proven secure against a new hard problem called N-xDBDH in random oracle model.

The focus of this paper is to design an efficient and secure solution addressing the key escrow problem in proxy re-signature schemes, i.e., the proxy knows the user's private key, which damages the essential requirement - "non-repudiation" property of proxy re-signature schemes. In this paper, we first define the security model for threshold proxy re-signature scheme, and then propose two threshold proxy re-signature schemes based on Ateniese's (see ACM CCS, p.310-319, 2005) and Shao Jun's (see Progress in Cryptology - INDOCRYPT 2007, vol.4859 of LNCS, p.197-209, 2007) approach. To our knowledge, there is no threshold proxy re-signature scheme that has been formally presented yet.

To achieve secure group communications, it is critical to develop a secure group key management strategy to guarantee security of the group keys. In this paper, based on the forward security and secret sharing techniques, we propose a new dynamic group key management scheme to minimize the rekeying cost. The forward security technique reduces the rekeying operations in joining event, while the secret sharing technique ensures the scalability in leaving event. In addition, the proposed scheme can provide anonymous authentication as well as forward and backward confidentiality. Theoretical analysis also confirms the efficiency of the proposed scheme.

User authentication is essential in service-oriented communication networks to identify and reject any unauthorized network access. The state-of-the-art practice in securing wireless networks is based on the authentication, authorization and accounting (AAA) framework where one or multiple identical and duplicated AAA servers are adopted to authenticate mobile users (MUs), handle authorization requests, and collect accounting data. However, the conventional AAA framework cannot tolerate a server compromise event due to misuse, misconfiguration, and malicious access, etc., which may cause serious damages and resource abuses to the network operation. In this paper, we propose a novel design paradigm toward a compromise-resilient authentication architecture in service-oriented wireless mesh networks (WMNs) based on the (t, n) threshold signature technique, termed Threshold User Authentication (TUA) scheme. With the TUA scheme, only t or more out of n AAA servers in the WMN can cooperatively grant the network access to a MU, while any t-1 or less cannot. Detailed protocol-aspect design and implementations are presented. Extensive analysis on efficiency and reliability of authentication functionality is conducted to gain a deeper understanding on the parameter settings and optimization, which demonstrates the effectiveness of the TUA scheme. We conclude that the proposed authentication scheme can contribute to the WMN network design in metropolitan areas where numerous mesh points (MPs) coexist and are managed under a single control plane with multiple distributed AAA servers.

In this paper, we present a novel anonymous secure routing protocol for mobile ad hoc networks (MANETs). The proposed protocol not only provides anonymity from all the intermediate nodes, but also integrates the authenticated key exchange mechanisms into the routing algorithm design. Furthermore, a new attack on anonymous services, called snare attack, is introduced, where a compromised node lures a very important node (VIN) into communicating with him and traces back to the VIN by following the route path. An adversary can then snare the VIN and launch decapitation strike on the VIN. Finally, we present a novel DECOY mechanism as a countermeasure to enhance anonymity of VINs and defeat snare attack.

User authentication is essential in service-oriented communication networks to identify and reject any unauthorized network access. The state-of-the-art practice in securing wireless networks is based on the technique of authentication, authorization and accounting (AAA) framework where an AAA server is adopted to authenticate mobile users (MUs), handle authorization requests, and collect accounting data. However, the traditional AAA framework is by way of a single authentication server, and cannot tolerate AAA server failure due to various malicious attacks such as denial-of-service (DoS) attack, or any other failure event such that the authentication server is compromised due to misuse, misconfiguration and malicious access, etc. Thus, a more resilient approach is to adopt multiple authentication servers, where any authentication request is handled by more than one authentication servers in order to resist any compromise event of an authentication server. To meet this design objective, we introduce a novel compromise-resilient authentication system based on (t, n) threshold signature technique. With the proposed system, only t or more out of n authentication servers can cooperatively allow a MU to have network access, and any t-1 or less cannot. Case study of reliability analysis is conducted to demonstrate the effectiveness of the system. The proposed authentication system is expected to particularly contribute to wireless mesh networking (WMN) in metropolitan areas where thousands of nodes may coexist and are managed under a single control plane such that duplicated AAA servers are necessary.

Abstract Deniable authentication, which was introduced to realize secure online negotiation, has been an extensive topic of research. Wang et al. proposed an efficient deniable authentication protocol based on ElGamal cryptography. However, in this article, we show that Wang et al.'s protocol (WLT protocol) is vulnerable to the person‐in‐the‐middle (PIM) attack. An adversary who launches a PIM attack can impersonate a valid user to communicate with the verifier, which will eventually lead to the failure of an online negotiation. To mitigate this security breach, we propose an improved deniable authentication protocol based on Wang et al.'s scheme. Further, a detailed security analysis is conducted to verify the proposed scheme. © 2006 Wiley Periodicals, Inc. NETWORKS, Vol. 48(4), 179–181 2006

Abstract Secure and authenticated message transmission is one of the major aims of mobile communication security research. To achieve this goal, a typical methodology in mobile communication is a mobile device and its server first establish a session key, then use the session key to encrypt all subsequent messages. However, establish such an authenticated session key itself is a hard work, and only use the session key to encrypt subsequent messages also cannot provide nonrepudiation. Therefore, there is a desire to seek an alternative method. In this paper, we would like to propose a new authenticated encryption protocol for mobile communication. The proposed protocol, compared with other authenticated encryption protocols, will simultaneously achieve confidentiality, integrity, authentication, nonrepudiation, and perfect forward secrecy. Copyright © 2006 John Wiley & Sons, Ltd.