Even though role-based access control (RBAC) can tremendously help us to minimize the complexity in administering users, it still needs to realize the notion of roles at the resource level. In this paper, we propose a practical cryptographic RBAC model, called role-key hierarchy model, to support various security features, including signature, identification, and encryption on role-key hierarchy. In addition, several advanced features, such as role or user revocation, tracing, and anonymity, are implemented as well. With the help of rich algebraic structure of elliptic curves, we introduce a unified and complete construction of role-based cryptosystem to verify the rationality and validity of our proposed model. In addition, a proof-of-concept prototype implementation and performance evaluation is discussed to demonstrate the feasibility and efficiency of our mechanisms.

Numerous cryptographic techniques have been developed to be used on mobile devices for various security and privacy protections. However, these cryptographic primitives, working under different mathematical assumptions, tend to become more and more complex and intricate, which makes it increasingly more difficult for proper implementation and management. Thus, it is desired to simplify management and improve efficiency by means of designing a general function family to meet a variety of security requirements. In this paper, we present such a family of square functions, including SqHash, SqMAC and SqPRF, based on a specially truncated function (MSB or LSB). We further improve the efficiency of these algorithms by using “circular convolution with carry bits” which makes parallel processing possible. We prove the security of these functions based on the privacy in hidden number problem and hard-core predicate of one-way function. We also show that the proposed schemes achieve better performance with a complexity reduction from O(n2) to O(kn/w) for n-bit message, k-bit output and w-bit word size.

Abstract—Access control is one of the most important security mechanisms in cloud computing. Attribute-based access control provides a flexible approach that allows data owners to integrate data access policies within the encrypted data. However, little work has been done to explore temporal attributes in specifying and enforcing the data owner’s policy and the data user’s privileges in cloud-based environments. In this paper, we present an efficient temporal access control encryption scheme for cloud services with the help of crypto-graphic integer comparisons and a proxy-based re-encryption mechanism on the current time. We also provide a dual comparative expression of integer ranges to extend the power of attribute expression for implementing various temporal constraints. We prove the security strength of the proposed scheme and our experimental results not only validate the effectiveness of our scheme, but also show that the proposed integer comparison scheme performs significantly better than previous bitwise comparison scheme.

A hybrid cloud is a cloud computing environment in which an organization provides and manages some internal resources and has others provided externally. However, this new environment could bring irretrievable losses to the clients due to a lack of integrity verification mechanism for distributed data outsourcing. To support scalable service and data migration, in this paper we address the construction of a collaborative integrity verification mechanism in hybrid clouds where we consider the existence of multiple cloud service providers to collaboratively store and maintain the clients' data. We propose a collaborative provable data possession scheme adopting the techniques of homomorphic verifiable responses and hash index hierarchy. In addition, we articulate the performance optimization mechanisms for our scheme and prove the security of our scheme based on multi-prover zero-knowledge proof system, which can satisfy the properties of completeness, knowledge soundness, and zero-knowledge. Our experiments also show that our proposed solution only incurs a small constant amount of communications overhead.