Public key authenticated encryption with keyword search (PAEKS) is a cryptographic primitive applicable in cloud storage systems. It empowers cloud servers to conduct searches on encrypted data without decryption while safeguarding against the brute-force attack known as insider-keyword-guessing attacks (IKGAs). In contrast to the pioneering primitive PEKS, which is vulnerable to IKGAs, PAEKS incurs additional computational and communication overhead due to the sender keys' involvement in encryption and trapdoor-generation processes. Although the recent work improves the efficiency of PAEKS by re-encrypting received ciphertexts, the requirement of a fully trusted proxy is rather costly for users to implement in practice. To reduce the economic cost and to keep a high efficiency, we propose a new primitive ofProxy-free Public-key Authenticated Updatable and Searchable Encryption(PF-AUKS). The key concept is to let the cloud server, instead of the proxy, directly convert different-source ciphertexts into a uniform format securely. We propose a concrete PF-AUKS scheme that supports fast search, constant trapdoor generation, and secure ciphertext update. Theoretical evaluation and experimental results illustrate high algorithm running speed and retrieval efficiency. We formally define the security model of PF-AUKS and prove that our scheme is secure under this model.

Due to limited computational and storage capabilities, wireless medical sensor networks (WMSN) encounter considerable overhead in processing the storage and verification of numerous signatures. Multi-signatures allow a group of signers to produce a single, compact signature on the same message, significantly reducing storage requirements and communication bandwidth in WMSN. However, conventional multi-signature schemes are not quantum resistant, as their security assumptions will be compromised with the quick advancement in quantum computing. Alternatively, lattice-based cryptography is widely considered capable of withstanding quantum computing attacks. In this article, we introduce a quantum-resistant and non-interactive identity-based multi-signature scheme from lattices with public key aggregation (IBMS-pka). By leveraging the small integer solution (SIS) assumption, our scheme is proven secure within the random oracle model. Besides, our scheme enables users to choose their system identities (e.g., physical IP address or email address) as public keys compared to PKI-based schemes, and avoids the extra communication costs in contrast to interactive schemes. Meanwhile, our scheme outperforms other related works according to our experiments. Specifically, the multi-signature generation has a slightly higher efficiency compared to other related schemes, while the multi-signature verification has a larger enhancement. Moreover, the performance improvement becomes more evident as the number of signers grows.

To reduce data storage costs, more individuals are using cloud servers for reliable, scalable, cost-effective, and globally accessible solutions. However, storing data in plaintext on cloud servers can lead to data leakage risks. Moreover, the advancement of quantum computing poses a threat to traditional encryption algorithms. To counter quantum computing attacks and enable searches over encrypted keywords, lattice-based searchable encryption with conjunctive keyword search has been implemented. Nonetheless, existing schemes expose keyword fields and leaks additional information. To mitigate this, we propose a privacy-preserving method based on lattice hardness assumptions. It enables testing the existence of an encrypted keyword in a set of encrypted keywords without requiring the keyword fields. Additionally, we propose two improved methods: one for inclusion-based searches between two keyword sets, and another for range-based keyword searches. These form the basis for three lattice-based identity-based searchable encryption schemes that support disjunctive, conjunctive, and range keyword searches, respectively. The storage overhead of ciphertexts and trapdoors is unaffected by the number of keywords, making our scheme suitable for multi-keyword search scenarios. Our formal security analysis uses the learning with errors (LWE) assumption and our theoretical analysis and experimental simulations show comparable efficiency and low storage overhead.

To improve the quality of medical care and reduce unnecessary medical errors, electronic medical records (EMRs) are widely applied in hospital information systems. However, rapidly increasing EMRs bring heavy storage burden to hospitals. Professional data management service provided by cloud server can save the hospital local storage, and meanwhile, realize EMRs sharing among external researchers. However, the risk of leaking information of patients discourages hospitals to outsource patients’ EMRs to the remote cloud server. In this paper, a secure and efficient cloud storing and sharing method can be achieved by applying the proposed public key authenticated encryption with ciphertext update and keyword search (PAUKS). The proposed PAUKS scheme enables EMRs to be encrypted and queried without decryption, and is secure against inside keyword guessing attacks. Compared with the recently proposed PAEKS in literature, the PAUKS scheme enjoys smaller computation and communication overheads. The required number of trapdoors per query is constant in PAUKS scheme, instead of the linearly expanding as the number of senders increases in PAEKS. Furthermore, an inverted index can be built safely in PAUKS scheme to accelerate the query procedure. Experiment results show that our PAUKS scheme owns a comparable running overhead, but enjoys a higher query efficiency after ciphertexts update.

Cloud storage becomes the priority for storing and sharing data for enterprise users. Encrypting prior to uploading data to the cloud is the best way to protect business secrets, however, it hinders the convenient operations on plaintexts, such as searching over the cloud data. In addition, employees in an enterprise have multiple layer structures and a higher layer employee should have the privilege to monitor the lower layer employees’ data to check if these users violate the regulation without letting the employees be aware of. Public key encryption with keyword search (PEKS) is a well-known cryptographic primitive suitable for secure cloud storage, which supports keyword search without decryption in public key encryption settings. Unfortunately, no existing PEKS scheme supports the monitoring function without authorization from the sender. To address this issue, we propose a variant of PEKS named Hierarchical Public Key Encryption with Keyword Search (HPEKS) and provide a semi-generic construction utilizing a public key tree (PKTree) and a PEKS scheme. To better suit for the enterprise secret data sharing, we build an advanced HPEKS scheme, named designated-tester decryptable hierarchical public key encryption with keyword search (dDHPEKS), which enjoys stronger security and integrates the public key and symmetric key encryptions. We prove our dDHPEKS scheme secure under the security definition in the random oracle model. Particularly, it satisfies the security against outside offline keyword guessing attacks and furthermore, enjoys thetransparencyproperty so that the sender does not need to know the internal hierarchy structure of an enterprise in order to share encrypted data to the enterprise. Theoretical evaluation and concrete experiments show that our dDHPEKS scheme has comparable running efficiency with existing PEKS schemes.

Attribute-based encryption scheme is a promising mechanism to realize one-to-many fine-grained access control which strengthens the security in cloud computing. However, massive amounts of data and various data sharing requirements bring great challenges to the complex but isolated and fixed access structures in most of the existing attribute-based encryption schemes. In this paper, we propose an attribute-based hierarchical encryption scheme with extendable policy, called Extendable Hierarchical Ciphertext-Policy Attribute-Based Encryption (EH-CP-ABE), to improve the data sharing efficiency and security simultaneously. The scheme realizes the function of hierarchical encryption, in which, data with hierarchical access control relationships could be encrypted together flexibly to improve the efficiency. The scheme also achieves external and internal extension of the access structure to further encrypt newly added hierarchical data without updating the original ciphertexts or with only a minor update depending on the data sharing requirements, which simplifies the encryption process and greatly reduces the computation overhead. We formally prove the security of the scheme is IND-CCA secure in the random oracle model based on bilinear Diffie-Hellman assumption, and we also implement our scheme to demonstrate its efficiency and practicality.

Abstract Functional encryption (FE) is a novel paradigm for encryption scheme which allows tremendous flexibility in accessing encrypted information. In FE, a user can learn specific function of encrypted messages by restricted functional key and reveal nothing else about the messages. Inner product encryption (IPE) is a special type of functional encryption where the decryption algorithm, given a ciphertext related to a vector x and a secret key related to a vector y, computes the inner product x·y. In this paper, we construct an efficient private-key functional encryption (FE) for inner product with simulation-based security, which is much stronger than indistinguishability-based security, under the External Decisional Linear assumption in the standard model. Compared with the existing schemes, our construction is faster in encryption and decryption, and the master secret key, secret keys and ciphertexts are shorter.

Thanks to its convenience and cost-savings feature, cloud computing ushers a new era. Yet its security and privacy issues must not be neglected. Private set intersection (PSI) is useful and important in many cloud computing applications, such as document similarity, genetic paternity and data mining. The cloud server performs intersection operations on two outsourced encrypted datasets of data owners. In the existing protocols, however, data owners cannot decide whether to use all or part of their encrypted data to compute the intersection, nor can they specify whom to compare with. In this paper, we introduce an enhanced notion of outsourced PSI, called authorized PSI (APSI), which supports flexible authorization and cross-type authorized comparison of datasets. To demonstrate this notion, we propose a concrete APSI protocol, and prove it to be secure in the random oracle model based on simple number-theoretic assumptions. Experimental results show that our APSI protocol has performance comparable with existing related outsourced PSI protocols.

Abstract Thanks to the ease of access and low expenses, it is now popular for people to store data in cloud servers. To protect sensitive data from being leaked to the outside, people usually encrypt the data in the cloud. However, management of these encrypted data becomes a challenging problem, e.g. data classification. Besides, how to selectively share data with other users is also an important and interesting problem in cloud storage. In this paper, we focus on ciphertext-policy attribute based encryption with equality test (CP-ABEET). People can use CP-ABEET to implement not only flexible authorization for the access to encrypted data, but also efficient data label classification, i.e. test of whether two encrypted data contain the same message. We construct an efficient CP-ABEET scheme, and prove its security based on a reasonable number-theoretic assumption. Compared with the only existing CP-ABEET scheme, our construction is more efficient in key generation, and has shorter attribute-related secret keys and better security.