Scholars are currently exploring Identity-Based Matchmaking Encryption (IB-ME), which allows senders and receivers to specify identities for decryption, protecting sensitive data in ciphertexts. Our work advances Revocable Identity-Based Matchmaking Encryption (RIB-ME) by adding revocation of decryption rights from unauthorized users. However, most RIB-ME systems rely on the Diffie-Hellman assumption, making them vulnerable to quantum computing threats. Current security models also fail to fully capture adversaries' evolving capabilities, risking unexpected exploits. To address this, we propose a flexible RIB-ME framework, inspired by Wang et al., using a two-tier revocable hierarchical identity-based encryption (RHIBE) approach integrated with post-quantum cryptography. This creates the first quantum-resistant RIB-ME system. We also introduce a detailed security model defining adversaries' strengths and attack patterns over time, enhancing the system's robustness and reliability across various practical scenarios.

This paper introduces a novel public-key searchable encryption (PKSE) scheme that supports a new search pattern: exclusionary subset search, which cannot be trivially realized from the current PKSE schemes. This pattern enables users to retrieve ciphertexts that do not contain a specific subset of keywords, offering a more intuitive and efficient approach in scenarios where excluding a limited set of keywords is crucial. Besides, our scheme is built over lattices, and support constant-size trapdoors, which take advantages against the existing lattice-based constructions.

In recent years, scholars have developed Identity-Based Matching Encryption (IB-ME), which enables both the sender and the receiver to specify identities, ensuring ciphertext confidentiality only when these identities match. Building on this concept, our work introduces Revocable Identity-Based Matching Encryption (RIB-ME), which incorporates a revocable mechanism to withdraw decryption rights from unauthorized users. Current RIB-ME schemes rely on a variant of the Diffie-Hellman assumption, rendering it susceptible to quantum computing attacks. To address this vulnerability, we propose a generic construction of RIB-ME inspired by Wang et al. Our approach employs two-level Revocable Hierarchical Identity-Based Encryption (RHIBE) and Identity-Based Signature (IBS) and is compatible with post-quantum encryption schemes. This enables the development of a generic construction of RIB-ME and the creation of the first post-quantum RIB-ME through the use of post-quantum constructions.

Cloud computing is increasingly popular today. Cloud services such as data-outsourcing services provide a growing number of users access to cloud storage for large quantities of data, and enterprises are turning to cloud storage for cost-effective remote backup. In 2011, DEPSKY shows and overcomes four limitations hinder the effectiveness of cloud storage: loss of availability, loss and corruption of data, loss of privacy, and vendor lock-in. Unfortunately, DEPSKY lacks an error detection mechanism and comes with heavy computing costs. Therefore, we propose a new data-outsourcing scheme overcoming not only the four limitations, but also the shortcomings of DEPSKY. In this paper, we modify Nyberg's accumulator and apply it to our three proposed error-detection methods. Moreover, we specially design a fast recovery method that is faster than DEPSKY and alternative methods.

The fifth-generation mobile network (5G) integrates various application services in a heterogeneous network environment. Compared to the traditional networks, 5G is not just an extension of the 4th generation, which contains three important properties, enhanced mobile broadband (eMBB), massive machine type communications (mMTC), and ultra-reliable and low latency communications (URLLC). 5G applies the functionalities of Network Function Virtualization and Software-Defined Networking to support multiple services and proposes a new concept called Network Slicing. Users can access different services quickly in the 5G network supported by network slicing. In a traditional network like 4G, if a user wants to access different services, it will be necessary to perform different authentication procedures that cause additional burden and operation cost in the user's device. However, the 5G network inherits the previous network architecture. Hence, the user's device still needs to be authenticated by the core network. Besides, providing a guarantee of connecting to a correct network slice is one of the prime concerns. The paper presents an authentication scheme tailored for the 5G network. In the proposed scheme, the authentication is decentralized to the edge clouds to achieve low latency. Moreover, the authentication flow is no longer attached to the operator all the time to reduce time latency. The proposed scheme is secure against the attackers who aim to impersonate users, network operators, or even network slices, and it also provides secure session key exchange. Empirical performance assessment in terms of its functionalities gains better acceptability of the proposed scheme than other existing ones.

Due to the fact that the higher density of mobile devices is expected, the fifth generation (5G) mobile networks introduce small cell networks (SCNs) to prevent exhausting radio resources. SCNs improve radio spectrum utilization by deploying more base stations (BSs) in the networks. Even though authenticated key exchange (AKE) is still essential to ensure entity authentication and confidentiality in mobile communications. Besides, user anonymity is required to guarantee the footprints of mobile communications being concealed. However, AKE with user anonymity may increase the latency of communications dramatically in total due to several times more frequency in SCNs. The increase of latency will be more serious when an AKE protocol supports user anonymity, where traceability and revocability to users are necessary. Thus, this paper presents a secure region-based handover scheme (ReHand) with user anonymity and fast revocation for SCNs. ReHand greatly reduces the communication latency when user equipments (UEs) roam between small cells within the region of a macro BS, i.e., eNB, and the computation costs due to the employment of symmetry-based cryptographic operations. Compared to the three related prior arts, ReHand dramatically reduces the latency from 82.92% to 99.99% by region-based secure handover. Nevertheless, this paper demonstrates the security of ReHand by theoretically formal proofs.

Local user access is important to machine-to-machine (M2M) communication because it possesses unique advantages over remote access in that it offers instant services, provides reliable connection, and offloads the traffic of M2M access networks. Local access control is also essential for authorized users to access M2M devices. In this paper, we propose a local authentication and access control scheme (LACS), which allows M2M devices to locally verify the access rights and access privileges of the users. In particular, the property of device heterogeneity is considered in our LACS. The resource-constrained M2M devices can securely outsource heavy computation to user equipment with or without the help of a gateway for energy saving. Our LACS satisfies the security criteria of: 1) user anonymity; 2) mutual authentication; 3) secure key agreement; and 4) securely outsourcing computation. All of these criteria are theoretically proved using a formal model. Experimental data also demonstrates the efficiency of the proposed LACS and the effectiveness of the design with regard to computation offloading.