Federated Learning (FL) facilitates collaborative model training among industrial Internet of Things (IoT) devices without necessitating the exchange of raw data. However, it faces several challenges, including privacy breaches, adversarial behavior from clients or servers, and frequent client dropouts. Current approaches typically address only a subset of these issues and often depend on computationally intensive cryptographic techniques that are ill suited for resource-limited environments. To address these shortcomings, this study introduces a bidirectionally verifiable FL framework (BVFL) that employs a double-masking strategy to ensure robust privacy protection. In addition, BVFL incorporates efficient verification mechanisms to ascertain both the integrity of client-updated models and the accuracy of server-side aggregation. The proposed scheme also enables consistency validation among clients and maintains resilience against client dropouts. Experimental evaluations indicate that the computational overhead of BVFL is comparable to that of the VerSA scheme, and both demonstrate the lowest computational overhead when compared to other verifiable schemes. BVFL provides a comprehensive and practical privacy-preserving solution for federated learning within IoT systems.

The ciphertext-policy attribute-based encryption (CPABE) for cloud storage data sharing not only enhances multi-user access control but also safeguards the data privacy. Nevertheless, current CPABE schemes often face challenges when deployed for users with limited computational capabilities, such as in IoT environments, including long ciphertexts and the substantial overhead involved in revoking user attributes. To mitigate challenges, we propose a cloud storage data-sharing framework which incorporates fine-grained attribute revocation and weight exchangeability (RWE-CPABE) with direct revocation mechanism. The weight threshold is converted into a set of 0-encoded values, thereby reducing the length of the ciphertext. Additionally, attribute weights are transformed into a 1-encoding set, which minimizes the number of weight keys required. Incorporating a user list within the ciphertext enables, thereby obviating users' need to alter their keys and preventing a linear increase in revocation costs. Furthermore, we introduce a methodology for mapping similar attributes to a common secret value, which enables attribute weight exchange and broadens access policy options. By delegating certain decryption operations to servers, we alleviate the computational burden on data users. RWE-CPABE achieves adaptive chosen-ciphertext attack (CCA2) security in the standard model while demonstrating superior efficiency—reducing cipher text length by 32% and revocation costs to O(1) versus prior linear-growth approaches—making it ideal for resource-constrained cloud environments.

Summary Through the Industrial Internet of Things (IIoT), the manufacturing enterprises have significantly enhanced the production efficiency. The transmission of data in IIoT over public channels has brought about information leakage issues. Therefore, it is crucial to agree on a session key among the participants. In recent years, numerous authenticated key exchange (AKE) schemes have been designed. However, those AKE schemes which adopt the certificateless approach to tackle certificate management and key escrow may remain vulnerable to quantum attacks, and other AKE schemes which are based on lattice hard problem so as to achieve the post quantum security may incur key management issues. To simultaneously address the aforementioned challenges, we propose a lightweight certificateless lattice‐based authenticated key exchange (C2LAKE) scheme. Upon the hardness assumptions of the inhomogeneous small integer solution (ISIS) and computational bilateral inhomogeneous small integer solution (CBi‐ISIS) problems, the C2LAKE scheme has been demonstrated to be secure in the eCK model and the random oracle model (ROM). Better trade‐off among security and functionality features, and communication and computation costs make the C2LAKE scheme suitable and applicable in the IIoT environment.

The Internet of Things (IoT) often relies on the cloud services for data sharing. To ensure the confidentiality of data, proxy re-encryption (PRE) is always applied when encrypting outsourced data. However, the existing conditional PRE schemes lack support for attaching weights to conditions, thus limiting the flexibility of re-encryption privilege management. To address this issue, we propose a cloud-sharing scheme based on the dual attribute conversion (DAC-CSS) specifically designed for IoT applications. The DAC-CSS scheme utilizes PRE techniques to convert identity-based encryption (IBE) ciphertext into attribute-based encryption (ABE) ciphertext. We design the condition policies for PRE based on the data attributes and their weights. This allows the proxy to convert only the IBE ciphertext that satisfies the conditions and generates ABE ciphertext. We construct user access policies based on the user attributes and their weights to ensure that only users satisfying the access policies can decrypt the ABE ciphertext. Based on the extended decisional parallel bilinear Diffie-Hellman exponent (EDPBDHE) assumption, we prove that the proposed scheme achieves security against adaptively chosen ciphertext attacks based on the access policy and identity selection (selective-CCA2) under the random oracle model (ROM). The experiments demonstrate that the proposed scheme gains high computational efficiency.

Two-factor authentication is one of the widely used approaches to allow a user to keep a weak password and establish a key shared with a server. Recently, a large number of chaotic maps-based authentication mechanisms have been proposed. However, since the Diffie–Hellman problem of the Chebyshev polynomials defined on the interval [−1,+1] can be solved by Bergamo et al.’s method, most of the secure chaotic maps-based key agreement protocols utilize the enhanced Chebyshev polynomials defined on the interval (−∞,+∞). Thus far, few authenticated key agreement protocols based on chaotic maps have been able to achieve user unlinkability. In this paper, we take the first step in addressing this problem. More specifically, we propose the notions of privacy in authenticated key agreement protocols: anonymity-alone, weak unlinkability, medium unlinkability, and strong unlinkability. Then, we construct two two-factor authentication schemes with medium unlinkability based on Chebyshev polynomials defined on the interval [−1,1] and (−∞,+∞), respectively. We do the formal security analysis of the proposed schemes under the random oracle model. In addition, the proposed protocols satisfy all known security requirements in practical applications. By using Burrows-Abadi-Needham logic (BAN-logic) nonce verification, we demonstrate that the proposed schemes achieve secure authentication. In addition, the detailed comparative security and performance analysis shows that the proposed schemes enable the same functionality but improve the security level.

The Internet of Things (IoT) is one of the latest internet evolutions. Cloud computing is an important technique which realizes the computational demand of largely distributed IoT devices/sensors by employing various machine learning models. Gradient descent methods are widely employed to find the optimal coefficients of a machine learning model in the cloud computing. Commonly, the data are distributed among multiple data owners, whereas the target function is held by the model owner. The model owner can train its model over data owner’s data and provide predictions. However, the dataset or the target function’s confidentiality may not be kept in secret during computations. Thus, security threats and privacy risks arise. To address the data and model’s privacy mentioned above, we present two new outsourced privacy-preserving gradient descent (OPPGD) method schemes over horizontally or vertically partitioned data among multiple parties, respectively. Compared to previously proposed solutions, our methods improve in comprehensiveness in a more general scene. The data privacy and the model privacy are preserved during the whole learning and prediction procedures. In addition, the execution performance evaluation demonstrates that our schemes can help the model owner to optimize its target function and provide exact prediction with high efficiency and accuracy.

Abstract The paper presents a password‐based authenticated key‐agreement protocol for multi‐server environments by using Chebyshev chaotic maps. The protocol allows a user to login to different servers via a single password. The proposed scheme has removed the weakness of multi‐server authenticated key‐agreement schemes, which adopt the architecture of two‐level servers. After a user has finished the first login to a service providing server, the control server is not required to be online for the user's subsequent logins. Compared with the related multi‐server authentication schemes, our scheme meets more security requirements, such as mutual authentication, perfect forward security, freedom of password change, scalability of login, resistance to the stolen verifier attacks, resistance to server spoofing attacks, and two‐factor security. Detailed analysis shows that the proposed scheme can resist several kinds of attacks. The proposed scheme is provably secure under the CDH assumption of Chebyshev polynomials in the random oracle model. Furthermore, it offers the user and server with privacy‐preserving, that is, anonymity and untraceability. Any adversary can neither figure out the identities of users or the identities of service providing servers nor link different sessions with a user or a server. Copyright © 2016 John Wiley & Sons, Ltd.

ABSTRACT In a proxy signature scheme, an original signer delegates her signing capability to a proxy signer who generates a signature on message on behalf of the original signer. By the combination of a blind signature with a proxy signature, the proxy signer can produce a proxy blind signature on message. Identity‐based public key cryptosystem has an efficient key management as compared with certificate‐based public key settings. In this paper, we propose an efficient identity‐based pairing‐free proxy blind signature scheme. The proxy blind signature scheme is provably secure upon the discrete logarithm assumptions in the random oracle model. Compared with other proxy blind signature schemes in the literature, the proposed proxy blind signature scheme is more efficient. Copyright © 2012 John Wiley & Sons, Ltd.

ABSTRACT The three‐party authenticated key agreement protocol enables two clients to authenticate each other and agree on a session key over an insecure public network with the help of a trusted server. The password‐based three‐party authenticated key agreement protocols often have two drawbacks: (1) the server must store large numbers of passwords and (2) low‐entropy passwords easily suffer from potential guessing attacks. The public key infrastructure‐based three‐party authenticated key agreement protocols need no password. In 2008, Chen et al. proposed a round‐efficient three‐party authenticated key agreement protocol that needs no password or public key cryptosystem. However, the computation costs and communication loads of their protocol are still high. In 2009, Yang et al. proposed an efficient three‐party authenticated key exchange protocol based upon elliptic curve cryptography for mobile commerce environments. Unfortunately, both three‐party authenticated key agreement protocols are insecure. In this paper, we propose a novel three‐party authenticated key agreement protocol that requires neither public key cryptosystem nor password. Compared with the previous three‐party authenticated key agreement protocols, the novel three‐party authenticated key agreement protocol requires considerably fewer rounds, lower communication cost and smaller computation cost. The comparisons have shown that our three‐party authenticated key agreement protocol is more practical than other three‐party authenticated key agreement protocols. The proposed protocol is provably secure on the basis of the intractability of the computational Diffie–Hellman problems in the random oracle model. Copyright © 2012 John Wiley & Sons, Ltd.

In a proxy signature scheme, the proxy signer generates a signature on a message. By the combination of a blind signature with a proxy signature, a proxy blind signature permits the proxy signer produce a blind signature on a message. In this paper, a proxy blind signature scheme based on bilinear pairings is proposed. The proxy blind signature scheme is proved secure upon the discrete logarithm assumptions, decisional bilinear Diffie–Hellman assumptions and Chosen-Target computational Diffie–Hellman assumptions in the Random Oracle Model. In the real world, the customers can withdraw and store money from all levels of the bank. On the basis of the new proxy blind signature, this manuscript proposed an electronic cash (e-cash) scheme. The e-cash scheme can provide unforgeability of e-cash, anonymity of honest customers and efficient traceability of double spending.