Information Centric Networking (ICN) is a new network architecture that aims to overcome the weakness of existing IPbased networking architecture. Instead of establishing a connection between the communicating hosts, ICN focuses on the content, i.e., data, transmitted in network. Content copies in ICN can be cached at different locations. The content is out of its owner's control once it is published. Thus, enforcing access control policies on distributed content copies is crucial in ICN. Attribute-Based Encryption (ABE) is a feasible approach to enforce such control mechanisms in this environment. However, applying ABE in ICN faces two challenges: from management perspective, it is complicated to manage attributes in distributed manners; from privacy protection perspective, unlike in traditional networks, the enforced content access policies are public to all the ICN users. Thus, it is desirable that unauthorized content viewers are not able to retrieve the access policy. To this end, a privacy-preserving access control scheme for ICN and its corresponding attribute management solution are presented in this paper. The proposed approach is compatible with existing flat name based ICN architectures.

With the proliferation of mobile devices in recent years, there is a growing concern regarding secure data storage, secure computation, and fine-grained access control in data sharing for these resource-constrained devices in a cloud computing environment. In this work, we propose a new efficient framework named Constant-size Ciphertext Policy Comparative Attribute-Based Encryption (CCP-CABE) with the support of negative attributes and wildcards. It embeds the comparable attribute ranges of all the attributes into the user's key, and incorporates the attribute constraints of all the attributes into one piece of ciphertext during the encryption process to enforce flexible access control policies with various range relationships. Accordingly, CCP-CABE achieves the efficiency because it generates constant-size keys and ciphertext regardless of the number of involved attributes, and it also keeps the computation cost constant on lightweight mobile devices. We further discuss how to extend CCP-CABE to fit a scenario with multiple attribute domains, such that the decryption proceeds from the least privileged attribute domain to the most privileged one to help protect the privacy of the access policy. We provide security analysis and performance evaluation to demonstrate their efficiency at the end.

Ciphertext Policy Attribute-Based Encryption (CP-ABE) enforces expressive data access policies and each policy consists of a number of attributes. Most existing CP-ABE schemes incur a very large ciphertext size, which increases linearly with respect to the number of attributes in the access policy. Recently, Herranzproposed a construction of CP-ABE with constant ciphertext. However, Herranzdo not consider the recipients’ anonymity and the access policies are exposed to potential malicious attackers. On the other hand, existing privacy preserving schemes protect the anonymity but require bulky, linearly increasing ciphertext size. In this paper, we proposed a new construction of CP-ABE, named Privacy Preserving Constant CP-ABE (denoted as PP-CP-ABE) that significantly reduces the ciphertext to a constant size with any given number of attributes. Furthermore, PP-CP-ABE leverages a hidden policy construction such that the recipients’ privacy is preserved efficiently. As far as we know, PP-CP-ABE is the first construction with such properties. Furthermore, we developed a Privacy Preserving Attribute-Based Broadcast Encryption (PP-AB-BE) scheme. Compared to existing Broadcast Encryption (BE) schemes, PP-AB-BE is more flexible because a broadcasted message can be encrypted by an expressive hidden access policy, either with or without explicit specifying the receivers. Moreover, PP-AB-BE significantly reduces the storage and communication overhead to the order of${\mbi {O}}(\log {\mbi {N}})$, where${\mbi {N}}$is the system size. Also, we proved, using information theoretical approaches, PP-AB-BE attains minimal bound on storage overhead for each user to cover all possible subgroups in the communication system.

The ubiquitous sensing-capable mobile devices have been fuelling the new paradigm of Mobile Crowd Sensing (MCS) to collect data about their surrounding environment. To ensure the timeliness and quality of the data samples in MCS, it is critical to select qualified participants to maintain sensing coverage ratios over important spatial areas (i.e., hotspots) during time periods of interest and meet various Quality of Service (QoS) requirements of sensing applications. In this paper, we examine the problems of sensing task assignment to minimize the overall cost and maximize the total utility in MCS while adhering to the QoS constraints and prove that they are NP-hard problems. Consequently, we present heuristic greedy approaches as the baseline solutions and further propose new hybrid approaches with the greedy algorithm and bees algorithm combined to address them. We demonstrate that the hybrid approaches significantly outperform the greedy approaches through extensive simulation and the analysis is given in the end.

The mobile marketing is growing exponentially worldwide due to the emerging high speed wireless Internet and the proliferation of smartphones with powerful processors. Consequently, the management of the massive volume of mobile identities has sparked a lot of interest in both industry and academia, as they turn out to be a heavy burden for many mobile application startups. The conventional federated identity management technologies have been developed to delegate the users' identity tasks across different security domains to reduce the burden over the identity service consumers (i.e., Relying Party). However, they also raises serious security and privacy issues, such as the vulnerability to Single Point of Failure (SPOF) and the privacy leakage with respect to users' historical access information. To address these issues, we architect a novel Distributed Privacy-preserving Mobile Access Control (DP-MAC) framework. This framework also leverages a dual-root trust model to prevent identity theft in case of mobile device loss. In the end, we give performance evaluation and prove its applicability by implementing our system in the Cloud Computing platform and android smartphones based on jPBC in real-world settings.

In many secure application scenarios, establishing a temporary group without revealing group member information is difficult but desirable. Secure group communication can significantly reduce the computation and communication overhead. Traditional group key management schemes are based on a hierarchical tree. Any network entity who wants to set up a group needs to know the keys of the other group members, i.e., the group key establishment must be done before starting the group communication. As a result, the group needs the group formation beforehand. In this paper, we propose a secure grouping scheme providing anonymity for group members to outsiders. Our approach is based on Attribute Based Encryption (ABE) schemes. In our scheme, each network entity is assigned with a set of attributes. Each group is identified by a logical combination of attributes, i.e., the group access policies. The presented solution has an advantage that there is no need for any prior knowledge of other group members. Instead, the sender just needs to focus on the group access policies. Our scheme further preserves the group formation policies by using a gradual exposure method on attributes. Compared to existing hidden-policy schemes, our solution can greatly reduce the computation and communication overhead.