With the rapid advancement of industrial automation and intelligent manufacturing, an increasing volume of sensing data generated by Industrial Internet of Things (IIoT) devices is being transmitted to cloud platforms. Identity-based broadcast proxy re-encryption (IB-BPRE), as an efficient cryptographic mechanism, has been deployed in IIoT data-sharing environments. However, existing IB-BPRE schemes are susceptible to identity privacy breaches of data recipients. Furthermore, IIoT devices are structurally vulnerable to key escrow compromises resulting from the exposure of encrypted key. To mitigate these critical security challenges, we propose a privacy-preserving certificateless-based broadcast proxy re-encryption scheme for data sharing in cloud-based IIoT, and formally prove its security against chosen ciphertext attacks under the random oracle model. The PCL-BPRE scheme employs a Lagrange interpolation polynomial to obfuscate the identity information of data receivers. Additionally, it integrates certificateless encryption to eliminate the inherent key escrow dependency in IB-BPRE, thereby preventing unauthorized disclosure of private keys in the event of a compromised key generation center. Experimental results validate that the proposed scheme achieves both strong practical feasibility and computational efficiency in IIoT data-sharing.

Authentication is an important security issue for multi-access edge computing (MEC). However, the existing authentication schemes have not achieved a good balance between privacy preserving, efficiency, and low computation overhead on the device side. To address this issue, we propose an efficiency-improved and conditional privacy-preserving authentication scheme suitable for resource-constrained MEC devices. Our core idea is integrating the merkle hash tree (MHT) into the anonymous authentication scheme constructed by the blockchain and key derivation function (KDF) to improve efficiency. The MHT not only reduces the on-chain storage overhead brought by the increasing pseudo-public keys of KDF, but also utilizes few hash functions to achieve lightweight${\bm {k}}$-times authentications with the same edge server. Despite these advantages, managing pseudo-key pairs in the form of MHT leafs still brings efficiency and unlinkability problems. We construct the partially shuffled merkle hash tree to only shuffle leafs within the device group, and combine with the KDF to update MHTs in a public manner by synchronizing pseudo-key pairs. Consequently, the efficiency of key update can be ensured. Moreover, a time-bound key derivation function based on physically unclonable function and BIP-32 is developed to provide immediate and permanent device revocation. Only the remaining valid pseudo-public keys of the revoked device will be recorded on the blockchain, which reveals no linkable information and avoids frequently reconstructing all the MHTs. We prove the authentication security and discuss other security features. A proof-of-concept prototype was implemented to conduct experiments and comparative analysis for performance evaluation.

Authentication is an important security issue for multi-access edge computing (MEC). To restrict user access from untrusted devices, Bring Your Own Device (BYOD) policy has been proposed to authenticate users and devices simultaneously. However, when integrating BYOD policy into MEC authentication to improve security, issues of efficient binding and user-device conditional anonymity have not been well supported. To address these issues, we propose Bring Your Device Group (BYDG) policy by constructing efficient and privacy-preserving user-device authentication. Our core idea is to use key sequences generated by PUFs-based key derivation functions (KDFs) to not only construct efficient binding relationships, but also achieve conditional anonymity for device groups. Specifically, a flexible and secure binding method is first developed by leveraging Chinese Remainder Theorem (CRT) to bind user with device groups. Each device’s CRT modulus is derived from the key sequence to construct many-to-many user-device binding relationships, which are managed in the form of on-chain Pedersen Commitment. Moreover, we design an identity anonymizing and tracing method for device groups. The key sequence is regarded as traceable device pseudo-identities, and then inserted into the cuckoo filter to reduce the on-chain storage overhead and mitigate malicious login attempts with low costs. Based on above two methods, the combination of Pedersen Commitment and Zero-Knowledge Proof of Knowledge is used to achieve user-device authentication with conditional anonymity. The security analysis was presented to demonstrate important security properties. A proof-of-concept prototype was implemented to conduct performance evaluation and comparative analysis.

ABSTRACT To protect user privacy and data security in cloud computing, a secure k‐nearest neighbor computation‐enhanced scheme on encrypted database has been proposed by Wong, Cheung, Kao and Mamoulis. The scheme is proven resistant to the known‐plaintext attack. We show that contrary to claims, the enhanced asymmetric scalar‐product‐preserving encryption cannot resist known‐plaintext attack by directly solving a secret key from a set of known plaintext–ciphertext pairs. Copyright © 2014 John Wiley & Sons, Ltd.