With the rapid advancement of Internet of Things (IoT) technology, the security and utilization of data outsourced to the cloud is a prerequisite for IoT application in actual production. Attribute-based keyword search (ABKS) has emerged as a powerful primitive for fine-grained search over encrypted data for IoT. While recent advanced ABKS schemes support more abundant functions and query structures, they do not consider multi-owner setting. Moreover, these schemes typically rely on a single trusted attribute authority for user certificate verification and private key distribution. This centralization creates a single point of failure and raises security concerns, such as key escrow. Furthermore, the existence of malicious entities necessitates verification mechanisms. However, most existing approaches introduce unvetted third-party validators, leading to reliability issues and privacy risks. Nevertheless, in numerous schemes, malicious entities persist in operational status, thereby compromising systemic security. To address these challenges, we propose ABKS with user-generated keys (ABKS-UGK), which decentralizes key generation to individual data users, fundamentally resolving the key escrow vulnerabilities in traditional schemes. It not only leverages blockchain’s immutability for secure result verification, but also incorporates a revocation mechanism against malicious entities. Extensive experimental evaluations demonstrate its efficiency and reliability, making it suitable for secure, verifiable data sharing in real world.

The Internet of Vehicles (IoV) faces critical challenges in balancing real-time data processing, privacy preservation, and secure data sharing amid growing intelligent transportation demands. While mobile edge computing (MEC) reduces latency by offloading tasks to MEC servers, efficient encrypted search and dynamic access control remain unresolved. Attribute-based keyword search (ABKS) enables privacy-preserving queries on encrypted data but exhibits critical limitations such as lack of revocable access for dynamic user privileges, exposed access policy that risk sensitive attribute leakage, and data integrity verification. Moreover, existing ABKS schemes further suffer from centralized key management in attribute-based encryption (ABE), introducing single points of failure and key escrow issues. To address these issues, we propose BC-RMABSE, a blockchain-enabled ABKS scheme. Our scheme leverages the vector space model to enable ranked multi-keyword searches, returning top-k relevant results for improved efficiency. Policy-hiding mechanisms and attribute revocation ensure flexible fine-grained access control while safeguarding sensitive attributes. A decentralized key distribution strategy using Pedersen’s (k, n) secret sharing protocol eliminates reliance on central authority, mitigating security risks. Blockchain technology enforces data integrity through tamper-proof consensus and resolves the "service-payment" imbalance via smart contracts, ensuring transactional fairness between users and untrusted service providers. Experimental analysis indicates that our scheme performs well in terms of both security and search efficiency.

With the rapid expansion of the Internet of Things (IoT), the shift from cloud computing to Mobile Edge Computing (MEC) has become necessary to address the low-latency requirements of real-time applications. Verifiable computation (VC) enables resource-limited clients to outsource their computation-intensive tasks to a powerful cloud while ensuring the correctness of the computation result. However, traditional VC schemes, originally designed for cloud computing, face challenges when applied to MEC environments, such as scalability issues, robustness, and efficiency concerns. To this end, we propose a verifiable distributed computation scheme for MEC, where computation tasks are distributed between a cloud server cluster (consisting of$n$servers) and an edge server. The cloud handles most of the computation through parallel sub-tasks, while the edge server verifies intermediate results and performs minimal computation to recover the final outcome. Our scheme guarantees that the result can be recovered if at least$t$servers, out of a total of$n$servers in the cloud server cluster, perform their computations honestly. By leveraging batch verification and matrix-optimized polynomial evaluations, our scheme significantly enhances scalability, fault tolerance, and efficiency. The extensive analysis and simulations demonstrate that our proposed scheme is more feasible than existing solutions.

Verifiable delegated set intersection over outsourced private datasets (VDPSI) enables two parties to outsource their private datasets and delegate the computation of set intersection to the cloud while being able to check the correctness of the result. In this process, the cloud learns nothing about the datasets and the intersection result. However, the existing VDPSI schemes suffer from three substantial shortcomings that limit their use: i) the whole dataset consists of only one subset, ii) they are designed for the static data, and iii) they cannot support other operations. To resolve these problems, we introduce a novel primitive called tag-based VDPSI (TVDPSI), which is designed for the multi-subset case where each subset is associated with one single tag for data classification. To protect privacy, the data is encrypted before being resided to the cloud. The tag is implicitly hidden in each encrypted element. As a result, the cloud cannot learn which data belongs to the same subset beyond the intersection set. Besides, the cloud cannot calculate the intersection except under the permissions of data owners. To the best of our knowledge, TVDPSI is the first VDPSI scheme supporting dynamic update and count operations. The detailed performance evaluation and simulation show that our protocol is more practical in cloud computing.

Verifiable databases (VDB) enables the data owner to outsource a huge unencrypted database to the powerful but untrusted cloud such that any client could later retrieve the database and check whether the cloud returns valid records or not. To the best of our knowledge, there is no prior work considering privacy. Besides, they assume that the data owner and the client are fully trusted while they may be semi-honest in the real world. To address these problems, we propose a new primitive called privacy-preserving publicly verifiable database (PPVDB), which not only guarantees the integrity of the queried result but also leaks no information. At the end of this protocol, the client can check whether the cloud returns a valid result and learns the queried result but nothing else about the database. Besides, the cloud learns nothing about the database and the query, and the data owner does not know which item that the client has queried. Motivated by the comparison among some strawman solutions, we incorporate verifiable computation for the polynomial with oblivious pseudorandom function to construct a PPVDB scheme, which is the first VDB scheme providing stronger security against the malicious cloud and the semi-honest client and data owner.

The epoch of the Internet of Things (IoT) has come by enabling almost everything to gather and share electronic information. Considering the unreliable factors of public IoT, how to outsource huge amounts of indispensable stream data generated by the nodes to the remote storage (RS) efficiently and securely is one of the most challenging issues. In this article, we propose a secure lightweight stream data outsourcing framework for IoT based on identity and blockchain. Taking advantage of identity-based cryptography and blockchain, for public IoT containing untrusted communication channels, nodes, RS, and even verifiers, we introduce a private mobile network and multiple verifiers to ensure that the stream data are stored intact and updated correctly, without the costs and risks brought by the public-key infrastructures (PKI). Meanwhile, the framework can also achieve privacy-preserving checking, by revealing no data to the other entities besides the RS, even in the blockchains. Our comprehensive analysis and experiments demonstrate that the proposed framework is suitable for lightweight devices and practical for IoT.

Abstract Vector commitment (VC) schemes allow committing to an ordered sequence of ${q}$ values ${(m_1,\cdots ,m_q)}$ in such a way that one can later open the commitment at specific positions. However, the existing VC schemes suffer from two substantial shortcomings that limit their use: (i) the commitments cannot be opened except at some specific positions, and (ii) their security only captures position-binding but offers no privacy: the client may learn additional information about the committed sequence through the proofs and the commitments. To resolve these problems, we first extend VC to a more expressive primitive called VC with sum binding (VCS), in which the commitment can also be opened to the sum of all elements in the committed sequence. VCS additionally satisfies the security of sum binding, which guarantees that the commitment cannot be opened to different sums. To enhance its privacy, we extend VCS to zero-knowledge VCS (ZKVCS), in which commitments and proofs constructed during the protocol execution leak nothing about the committed sequence. We formalize this new property by a standard real/ideal experiment. Meanwhile, the detailed performance analyses and simulations show that our proposed schemes are more practical. Finally, we introduce a novel notion of (zero-knowledge) verifiable database supporting sum and show how to construct it from our (ZK)VCS scheme.

Summary Since cloud computing and cloud storage have become a common practice in our daily life, people are paying more attention on protecting the privacy of their sensitive data. In this paper, we consider the problem of graph encryption in such a way that one can perform all‐path queries over an encrypted graph in a privacy‐preserving manner. A solution for such problem has many potential applications in network virtualization since graph data structures are commonly used to represent the topology of substrate and virtual networks. We propose a searchable symmetric encryption scheme for graph data that support all‐path queries. The scheme allows a client to encrypt a sensitive graph and outsource it to an untrusted server for storage. After that, the client can perform arbitrary all‐path queries between a source and a destination. For each query, the server computes and returns all the paths that satisfied the query. We prove that our scheme is secure against adaptive chosen‐query attacks in the semi‐honest setting.

Private set intersection (PSI) allows two parties to compute the intersection of their private sets while revealing nothing except the intersection. With the development of fog computing, the need has arisen to delegate PSI on outsourced datasets to the fog. However, the existing PSI schemes are based on either fully homomorphic encryption (FHE) or pairing computation. To the best of our knowledge, FHE and pairing operations consume a huge amount of computational resource. It is therefore an untenable scenario for resource-limited clients to carry out these operations. Furthermore, these PSI schemes cannot be applied to fog computing due to some inherent problems such as unacceptable latency and lack of mobility support. To resolve this problem, we first propose a novel primitive called “faster fog-aided private set intersection with integrity preserving”, where the fog conducts delegated intersection operations over encrypted data without the decryption capacity. One of our technical highlights is to reduce the computation cost greatly by eliminating the FHE and pairing computation. Then we present a concrete construction and prove its security required under some cryptographic assumptions. Finally, we make a detailed theoretical analysis and simulation, and compare the results with those of the state-of-the-art schemes in two respects: communication overhead and computation overhead. The theoretical analysis and simulation show that our scheme is more efficient and practical.

Summary The intersection operation on multisets has many applications in different scenarios, such as data mining and pattern matching. This motivates us to study the problem that when users outsource their private encrypted sets and delegate the set‐intersection operation on the corresponding plaintexts to the cloud, the cloud can manage to conduct the operation and make the result verifiable without the decryption capability. We formally introduced a model of Verifiable Intersection Operations on Encrypted Data in Cloud and presented the definitions of the correctness and security properties. We also proposed a concrete scheme basing on the bilinear‐map accumulator and re‐encryption. The scheme was proved secure under some cryptographic assumptions. And the experimental results of the algorithm implementation show the scheme is partly practical for real scenarios. Copyright © 2016 John Wiley & Sons, Ltd.