Mining attacks allow adversaries to obtain a disproportionate share of the mining reward by deviating from the honest mining strategy in the Bitcoin system. Among them, the most well-known are selfish mining (SM), block withholding (BWH), fork after withholding (FAW) and bribery mining. In this paper, we propose two novel mining attacks: bribery semiselfish mining (BSSM) and bribery stubborn mining (BSM). Unlike prior work (e.g., selfish mining, block withholding), these attacks integrate bribery mechanisms to strategically influence miner behavior, leading to a 6% higher relative extra reward for adversaries in BSSM compared to semi-selfish mining and a 2% increase in BSM compared to selfish mining. This creates a novel “bribery miner's dilemma” where target miners face a Nash equilibrium conflict: individually optimal to accept bribes, but globally optimal to reject them, directly impacting the decentralization and reward distribution of the mining ecosystem. Furthermore, quantitative analysis and simulation have verified our theoretical analysis. We propose practical measures to mitigate more advanced mining attack strategies based on bribery mining and provide new ideas for addressing bribery mining attacks in the future. However, how to completely and effectively prevent these attacks is still needed on further research.

Updatable oblivious key management (UOKMS) allow users to outsource encrypted data along with a symmetric key-generating token to a cloud server. The designated recipient uses this token and interacts with multiple key servers to derive the decryption key and then access the data. To ensure secure access and prevent impersonation attacks, users must authenticate to each key server using distinct credentials during key derivation. This introduces computational overhead that scales linearly with the number of key servers, especially posing challenges for resource-constrained devices. Moreover, UOKMS assumes that users' devices are fully trustworthy, but real-world cases show that they may be embedded with backdoors that covertly exfiltrate cryptographic secrets. To address these challenges, we propose a secure re-randomized password-derived public/secret key pairs generation mechanism that protects the symmetric key-generating token, eliminates interactive authentication with key servers, and resists password-guessing attacks. Our design incorporates a protocol-aware reverse firewall that mitigates backdoor threats by generating unbiased randomness and transforming interactive messages through re-randomization and de-randomization. Building on this, we develop ATTEST, a password-based data protection scheme for cloud storage against backdoor attacks. Security and performance evaluations demonstrate that ATTEST offers strong security with practical efficiency.

Communication protocol is a fundamental component of modern networking. With proliferation of networking and communication, users have become more concerned about privacy. This leads to development of end-to-end encrypted messaging systems which provides confidential communication. Besides confidentiality, there is an increasing demand for additional security properties such as unforgeability, anonymity, off-the-record (OTR), and consistency. However, efficiently achieving these properties simultaneously, especially on resource-constrained mobile devices, remains a significant challenge. In this paper, we propose MERIT, a novel multi-designated receiver authenticated broadcast encryption scheme that satisfies all the above security guarantees in a highly efficient manner. MERIT ensures the following key properties: (i) unforgeability prevents unauthorized parties from generating valid messages; (ii) privacy safeguards the messages and identities of the sender and receivers from non-designated parties; (iii) OTR ensures that receivers cannot later prove the origin of the messages even with their secret keys; and (iv) consistency ensures that all designated receivers obtain identical decrypted messages and identities. The core building block of MERIT is a practical multi-designated verifier signature (PMDVS), which might be of independent interest. We employed a novel batched cut-and-choose technology to prove that the ciphertext is well-formed. This results in an order-of-magnitude efficiency improvement in our scheme compared to its counterparts that rely on general-purpose zero-knowledge proofs. We then show how MERIT leverages PMDVS to provide unforgeability, privacy, OTR, and consistency in the scenario of group messaging. We provide security analysis to demonstrate that MERIT satisfies these security guarantees. We also conduct a thorough performance implementation, and the experimental results demonstrate that MERIT is highly efficient for deployment on mobile devices.

In networks, clients access various servers. Servers need to authenticate clients' identities and provide services to clients who pass the authentication. Password-based threshold single-sign-on authentication (PbT-SSO) delegates multiple identity servers to authenticate a client with the client's password, and issue a token for subsequent access. However, existing PbT-SSO schemes are based on conventional hardness problems, which are vulnerable to adversaries equipped with quantum computers in the near future. Once quantum computers are accessible, adversaries can retrieve passwords by off-line dictionary guessing attacks (DGA) from the credentials of clients' passwords. Moreover, quantum adversaries can derive identity servers' secret from public information and further forge tokens with the secret. Motivated by these issues, we propose a password-based threshold single-sign-on authentication from learning with errors problem (LWE), dubbed LPbT-SSO, which is resistant to quantum attacks. LPbT-SSO evaluates a one-way function of passwords, and takes the function outputs as credentials. Since the function is grounded on LWE problem intractable for quantum computation, quantum adversaries cannot recover passwords by off-line DGA. Additionally, LPbT-SSO leverages a lattice-based threshold signature scheme to issue tokens, and guarantees that no adversary can forge a valid token. The comprehensive performance evaluation demonstrates that LPbT-SSO is efficient in terms of computation, storage, and communication costs.

Password-based authentication is widely applied in Internet of Things (IoT). It allows IoT devices to identify users with passwords to resist unauthorized access. However, choices of weak passwords, especially popular ones, might violate users’ privacy and lead to large-scale network attacks. Collection of popular passwords among IoT devices to establish blocklists via a service provider can prevent use of weak passwords. To protect unpopular passwords during collection, existing privacy-preserving schemes rely on expensive cryptographic primitives (e.g., garbled circuits and zero-knowledge proofs), which would impose heavy communication and computation burdens on constrained devices and hinder wide deployment of these schemes. In this paper, we propose EAGER+, an efficient privacy-preserving scheme for weak password collection in IoT against perpetual leakage. EAGER+ is mainly built on secret sharing and symmetric encryption, thereby enabling lightweight computation and communication on IoT devices. In EAGER+, we conceive a password-locked encryption with conditional decryption mechanism to efficiently identify popular passwords, where a password is essentially locked under itself in the encryption to guarantee its security, and the password can be revealed from the ciphertext by the service provider only if a sufficient number of devices exploit it. The mechanism is integrated with a servers-aided password-hardening mechanism to resist offline dictionary guessing attacks. Moreover, EAGER+ uses a key renewal mechanism to periodically update secrets for password hardening on key servers to thwart perpetual leakage towards the secrets. We formally analyze the security of EAGER+, and conduct experimental evaluations to show that EAGER+ is more efficient than existing schemes.

We propose a threshold password-hardening updatable oblivious key management system dubbed TPH-UOKM for cloud storage. In TPH-UOKM, a group of key servers share a user-specific secret key for a user, and assist the user in producing her/his password-derived private key in a threshold and oblivious way, where the password is hardened to resist offline dictionary guessing attacks. Anyone can outsource data protected with the user’s password-derived public key to the cloud server, and merely the user holding the correct password can recover the password-derived private key for data access. TPH-UOKM can accomplish decryption ofNciphertexts with the complexityO(1) of communication between a user and the key servers, which outperforms existing schemes. TPH-UOKM supports password update. The cloud server can update all protected data of a user with an update token to be accessible only with the new password, which resists password leakage. We present a two-level proactivization mechanism to periodically update user-specific secret key shares and the key servers to thwart perpetual compromise of them, where the renewal of user-specific secret key shares reduces computation and communication costs compared to existing approaches. Provable security and high efficiency of TPH-UOKM are demonstrated by comprehensive analyses and performance evaluations.

Password-based threshold single-sign-on authentication (PbTA) allows multiple identity servers to in a threshold manner authenticate a user and issue a token, with which the user accesses relevant services. We analyze existing PbTA schemes and reveal a potential threat: vulnerability against perpetual credential leakage, in which “perpetual” adversaries could perpetually attempt to compromise long-lived credential databases maintained by identity servers. Compromising a threshold number of credential databases enables the adversaries to launch offline dictionary guessing attacks (DGA) or illegally obtain users’ tokens. To address these issues, we first propose a basic device-enhanced PbTA scheme (DE-PbTA), where an auxiliary device collaborates with identity servers in hardening a user’s password during authentication, such that perpetual adversaries cannot learn the password from compromised credentials via offline DGA. Using the hardened password, a private key can be derived to decrypt ciphertexts from identity servers for token construction, which protects the user’s tokens against perpetual adversaries. Then, we extend basic DE-PbTA to support dynamic usage of multiple devices, where a user can actively choose$t^{\prime } $devices out of$n^{\prime } $for authentication. Provable security and high efficiency of the basic/enhanced DE-PbTA scheme are demonstrated by comprehensive analysis and experimental evaluations.

Single-sign-on authentication is widely deployed in mobile systems, which allows an identity server to authenticate a mobile user and issue her/him with a token, such that the user can access diverse mobile services. To address the single-point-offailure problem, threshold single-sign-on authentication (PbTA) is a feasible solution, where multiple identity servers perform user authentication and token issuance in a threshold way. However, existing PbTA schemes confront critical drawbacks. Specifically, these schemes are vulnerable to perpetual secret leakage attacks (PSLA): an adversary perpetually compromises secrets of identity servers (e.g., secret key shares or credentials) to break security. Besides, they fail to achieve popular password collection, which is an effective means of enhancing system security. In this paper, we propose a secure PbTA scheme with popular password collection, dubbed AugSSO. In AugSSO, we conceive an efficient key renewal mechanism that allows identity servers to periodically update secret key shares in batches, and require storage of hardened password-derived public keys in credentials for user authentication, thereby resisting PSLA. We also present a popular password collection mechanism, where an aggregation server is introduced to identify popular passwords without disclosing unpopular ones. We provide security analysis and performance evaluation to demonstrate security and efficiency of AugSSO

IoT-based sharing economy is a win-win business model, where a transferor owns idle IoT devices and transfers the right to use a device to a user for a fee. Considering usage of multiple devices and privacy preservation, anonymous single-sign-on (ASSO) is a feasible solution for authentication. ASSO allows a user to access multiple devices with one token issued by the transferor and prevents the transferor from identifying the user. We also observe that in the scenario of IoT-based sharing economy, the token should (i) support attributes since a device should be available only to users with specific attributes (e.g., age) and (ii) avoid incurring significant communication/computation overhead as IoT devices are resource-constrained. In this paper, we proposed PILOT, a privacy-preserving single-sign-on with fine-grained access control for IoT devices. When a user attempts to access a device, he/she requests a token from the transferor. The token is actually a blind signature that cannot be tracked, and contains the user’s attributes which facilitate fine-grained access control on the device. Besides, the token consists of only four group elements and verification of the token involves only several exponentiation operations. This renders PILOT superior in terms of communication/computation overhead and suitable for IoT devices.

Continuous Group Key Agreement (CGKA) is the core of a new generation of End-to-End secure (E2E) cryptographic multi-party applications. CGKA allows the members in a dynamic group to agree on the current state for continuous communicating. The first CGKA protocol deployed in practical E2E applications is Inside-Secure TreeKEM (ITK), in which members use flood broadcasting to transition to the same new state for subsequent communications. However, flood broadcasting requires spread of a large amount of messages, while only a small part of the messages is needed for one specific member. This would incur substantial communication costs. To reduce the communication costs, Server-Aided ITK (SAIK) was proposed. SAIK employs a server to split the whole uploaded messages into multiple pieces, and deliver each piece to a specific member, thereby saving bandwidth of members. However, SAIK relies on a central server and hence is vulnerable to the single-point-of-failure problem. The problem is that if the server is unavailable, it will cause a sharp reduction in efficiency and increasing cost. In this work, we first formalize CGKA with smart contract (ScCGKA), which replaces the central server with smart contracts to solve the single-point-of-failure problem. We give a concrete construction of ScCGKA, dubbed the improved ITK with smart contract (ScITK). ScITK is constructed on ITK and can be deployed in real-world E2E applications. In ScITK, participants collaboratively negotiate and deploy a smart contract on the Ethereum blockchain to perform the splitting-delivering procedure. We give a formal security model to capture security properties that CGKA needs to achieve and a correctness property. The comparison between our ScITK and existing approaches shows that ScITK not only reduces communication cost, but also removes the server’s costs.

Single-sign-on authentication (SSO) enables a user to obtain a token from an identity server, and access multiple service providers with the token. In conventional SSO, the identity server can identify the user through the token, which compromises the user’s privacy. Anonymous SSO is proposed to solve this problem. However, the unconditional anonymity precludes identification of fraudulent users and leads to increase in illegitimate activities. In this paper, we propose SONAR, an anonymous single-sign-on authentication protocol that supports fraud detection. The identity server first accesses a user’s trustworthiness using fraud detection. We observe that directly refusing to issue tokens to an untrustworthy user allows the user to immediately realize that he have been detected, which poses security problems. Instead, we postpone the moment the user realizes he has been detected until he attempts to access a service provider. We also illustrate the benefits of this postponement using denial of service attacks as an example. In the proposed SONAR, the identity server issues the user (regardless of his trustworthiness) with a token that contains a covert channel, which is restricted to conveying only a 0/1 bit that is hidden from the user. The restriction of the channel prevents the identity server from tracking the user by embedding specific information in the channel, and meanwhile the 0/1 bit indicates whether the user is trustworthy or not. The token is actually a randomizable signature and can be randomized by the user, while the embedded bit remains unchanged. The user accesses a service provider with a randomized token, which protects the user from being identified as well as informs the service provider whether the user’s access should be permitted. We provide a formal security proof to demonstrate that SONAR is secure, and conduct a performance evaluation to show efficiency of SONAR.

Bitcoin-NG is an extensible blockchain protocol based on the same trust model as Bitcoin. It divides each epoch into one keyblock and multiple microblocks, effectively improving the transaction processing capacity. Bitcoin-NG adopts a special incentive mechanism (i.e., the transaction fees in each epoch are split to the current and next leader) to maintain its security. However, there are some limitations to the existing incentive analysis of Bitcoin-NG in recent works. First, the incentive division method of Bitcoin-NG only includes some specific mining attack strategies of the adversary, while ignoring more stubborn attack strategies. Second, once adversaries find a whale transaction, they will deviate from the honest mining strategies to obtain an extra reward. In this paper, we are committed to solving these two limitations. First, we propose a novel mining strategy named Greedy-Mine attack. Then, we formulate a Markov reward process (MRP) model to analyze the competition of honest miners and adversaries. Furthermore, we analyze the extra reward of adversaries and summarize the mining power proportion required for malicious adversaries to launch Greedy-Mine to obtain extra returns. Meanwhile, we make a backward-compatibility progressive modification to Bitcoin-NG protocol that would raise the threshold of propagation factor from 0 to 1. Finally, we get the winning condition of adversaries when adopting Greedy-Mine, compared with honest mining. Simulation and experimental results indicate that Bitcoin-NG is not incentive compatible, which is vulnerable to Greedy-Mine attack.

Applications (Apps) generate large amounts of data on users’ storage-limited local devices. To alleviate the burden of local storage, users can outsource their App-generated data to a remote cloud server. Secure data outsourcing needs data portability and blindness. The former enables users to access data from multiple devices using a single password, and the latter ensures data privacy against unauthorized individuals. Portable blind cloud storage (PBCS) can satisfy both requirements. However, existing PBCS schemes are vulnerable to offline password guessing attacks (OPGA) if both the App server and the cloud server are compromised: an adversary can learn users’ passwords from compromised registered information of users. In this paper, we propose a PBCS scheme called IPBCS that is secure against OPGA. In IPBCS, a user hardens her/his password with a secret key, which is stored in trusted execution environments (TEE). With the hardened password and a user-specific randomness, a token can be derived for user authentication . By adopting TEE to protect secret keys, IPBCS guarantees security against OPGA even if both servers are compromised. Moreover, IPBCS adopts a password-based authentication mechanism to support authentication over public channels. Security analysis and performance evaluation demonstrate that IPBCS is secure and efficient.

Two-factor authentication key exchange (AKE) is an effective way to strengthen the security of password-authenticated key exchange. Most two-factor AKE schemes using smart cards as the second factor require users to have the second factor with them any time, which causes users inconveniences. Biometrics provide a user-friendly manner to achieve two-factor AKE since they need not be carried. However, biometrics may have less entropy than expected and would suffer from offline guessing attacks. In this paper, we propose a secure two-factor authentication key exchange scheme TAKE that resists offline guessing attacks against biometrics and passwords. In TAKE, a user generates a combined factor of his/her biometrics and password. To protect the combined factor, the user and the server leverages secure two-party computation to blind it with a key which is protected in a trusted execution environment. Thus, TAKE prevents an adversary from eavesdropping on the combined factor, and simultaneously guarantees that he cannot recover the combined factor from blinded one to undertake offline guessing attacks even if he compromises the server and obtains the blinded combined factor. We provide the formal security proof of TAKE. The experiments show that TAKE is efficient in terms of storage, computation, and communication overhead.

Single-sign-on (SSO) authentication enables a user to gain a token from the identity server, with which the user accesses multiple services. To address single-point-of-failure of SSO, threshold SSO, where a group of identity servers issue a user with a token in the threshold manner, is introduced. SSO including threshold schemes suffers from privacy disclosure. One can learn a user's identity and access pattern from her/his token. Recent works focus on privacy preservation of SSO. However, these works merely consider scenarios of one single identity server SSO. No works that address privacy preservation of threshold SSO have emerged. In this work, we propose TSAPP, a threshold SSO authentication scheme preserving privacy. Each identity server issues a user with a partial token which is a signature on the user's pseudonym. With a threshold number of partial tokens, the user constructs a token, blinds the token with random numbers and accesses services with blinded tokens. Such mechanism preserves the user's identity, simultaneously protects the user's access pattern since adversaries cannot link the user's accesses, even if identity servers are corrupted. Security analysis demonstrates that TSAPP satisfies properties of anonymity, unlinkability, unforgeability and password-safety. The performance evaluation demonstrates that TSAPP is efficient in practice.

Multi-factor authenticated key exchange (AKE) enables a user to be authenticated by a server using multiple factors and negotiate a shared session key to protect subsequent communications. Most existing multi-factor AKE schemes utilize biometrics as one factor due to their uniqueness and invariance properties. To support matching for noisy biometrics and protect them, fuzzy extractors are employed to extract a constant random string from varying biometric measurements without disclosing biometric data. However, the fuzzy extractors used in these schemes merely work on biometrics with an entropy rate greater than the error rate. Hence these schemes are unsuitable for biometrics with low entropy rates. In this paper, we propose a secure two-factor AKE scheme dubbed AHEAD from passwords and biometrics, which eliminates the limitation of biometric entropy rates. In AHEAD, we conceive a matching mechanism to simultaneously check whether an input biometric measurement with low entropy rates is close enough to the registered one, and whether an input password exactly matches the registered password. The mechanism allows a valid user to generate a secret element shared with the server in an oblivious way. By adopting a randomization technique, the secret element can be randomized for derivation of session keys. The security and efficiency of AHEAD are demonstrated by formal security proofs and experimental evaluations.

We propose a protection mechanism for password-based credential databases maintained by service providers against leakage, dubbed PCDL. In PCDL, each authentication credential is derived from a user’s password and a salt, where a service provider employs a set of key servers to share the salt in a threshold way. With PCDL, an external adversary cannot derive any information about the underlying passwords from a compromised credential database, even if he can compromise some of the key servers. The most prominent manifestation of PCDL is transparency: integrating PCDL with existing password-based authentication schemes does not require users to perform any additional operation (and thereby does not change users’ interaction patterns), yet enhances the security guarantee significantly. PCDL serves as an independent component only deployed on the service provider side to harden the credential database. As such, PCDL is well compatible with existing password-based authentication schemes. We analyze the security of PCDL and conduct a performance evaluation, which shows that PCDL is secure and efficient.

Cryptocurrency allows for immutable and transparent payments in the decentralized manner. The transparency nature inevitably leads to leakage of users’ private information. Although existing schemes provided privacy preservation in cryptocurrencies, they fail to consider regulation and facilitates conducting illegal activities. To solve this problem, several works aimed at striking a balance between preservation of users’ privacy and identification of malicious users. However, they introduced a central authority (which runs counter to the decentralization design of cryptocurrencies), and reveals only the pseudonym of a malicious user other than her/his real identity due to lack of authentication. In this work, we propose PICTURE, a privacy-preserving cryptocurrency with threshold authentication and regulation. In PICTURE, a user registers to a group of authorities (instead of a centralized one) who cooperatively issue the user with a master account which is actually a randomizable signature. The user randomizes the master account to be authenticated and transact anonymously. Besides, the transaction contains a record, with which the authorities can reveal the user’s identity (that is used in registration) in the threshold way. Our construction enables the user to prove that the record is well-formed with only a standard Schnorr’s protocol, leading to lower overheads compared with existing works. We provide a formal security proof to demonstrate that PICTURE is secure, and conduct a comprehensive performance evaluation to show that PICTURE is ready to be deployed in real world.

Decentralized finance (DeFi) relies on crypto assets in blockchains to provide financial services. High volatility of crypto assets puts users at risk of financial loss. Options contracts address this issue by empowering a buyer to exchange his asset with that of a seller, which mitigates risks for both parties. Existing options contract protocols have the following two weaknesses: (i) The buyer have to lock his asset during the contract's lifespan, incurring heavy opportunity costs; (ii) Turing-completed smart contract (TCSC)/hash time lock contract (HTLC) is required to exchange assets, which restricts applicability as TCSC/HTLC is supported by a limited number of blockchains. In this paper, we propose UP-BLOC, a universal and practical blockchain-based options contract. We construct UP-BLOC using a buyer-pay-first design, and propose a blockchain-based secret storage mechanism to ensure the security of the assets involved. This allows the buyer to engage in an options contract without locking any asset and resulting opportunity costs, and thus is more practical than existing works. Besides, UP-BLOC achieves the exchange of assets using standard digital signatures instead of TCSC/HTLC. Hence, UP-BLOC is compatible with all blockchains and is universal. Security analysis and performance evaluation demonstrate that UP-BLOC is secure and efficient.

The utilization of the broadband subliminal channel allows a sender to covertly transmit a message to a receiver through digital signatures. This method requires the sender to relinquish the signing key to the receiver. As a result, the receiver has the ability to employ the signing key to sign any data on behalf of the sender without the sender’s knowledge or consent. Meanwhile, difficulties may arise if the sender is unwilling to disclose the signing key to the receiver. In this paper, we propose a broadband subliminal channel that can be used in digital signature schemes (e.g., DSA, ECDSA, ElGamal, and Schnorr) without disclosing the signing key to the receiver. As it writes the message on a digital signature, we call it WMoS. We first implement WMoS in the Elliptic Curve Digital Signature Algorithm (ECDSA). We then provide the security proof to show that signatures generated in WMoS have the same security level as standard ECDSA signatures. Moreover, we discuss the variants of WMoS in ECDSA and use them to construct applications. Furthermore, we use the implementation of WMoS to generate a signature for an Ethereum transaction to demonstrate its feasibility. We also evaluate the efficiency of WMoS in ECDSA, and the results show that WMoS in ECDSA can generate a signature as efficiently as the standard ECDSA.

This article analyzes existing smart contract-based public data integrity verification schemes and identifies certain weaknesses. First, the fair arbitration mechanism deployed in these schemes fails to meet the users’ requirements as it may not promptly notify users of data corruption or loss. Second, to ensure outsourced data confidentiality, existing data integrity schemes use a conventional encrypted method, where each user randomly selects a key to encrypt the outsourced data. Such a method results in varying ciphertexts for the same data by different users, leading to additional storage costs for the cloud server. Third, users’ devices, if poorly designed or even intentionally backdoored, can potentially exfiltrate secrets and compromise the security of schemes. To address these issues, we propose the first backdoor-resistant public data integrity verification scheme based on smart contracts (ASSIST). The key idea is to introduce a new entity (a whistleblower) to periodically monitor the state of verification results recorded in the blockchain. This allows for timely notification of data corruption to users. ASSIST requires users to encrypt their data with a cryptographic primitive called message-locked encryption (MLE), which motivates different users to produce the same ciphertext for the same data and reduces storage costs for cloud servers. We also deploy a cryptographic reverse firewall between users’ devices and the external to rerandomize interactive messages, making the exfiltration impossible. We provide rigorous security proofs to demonstrate the security of ASSIST. The performance evaluation shows that ASSIST is efficient regarding computation and communication costs.

Certificate revocation checking (CRC) is a fundamental requirement in certificate-based public-key cryptographic systems. Most existing CRC schemes are not tailored for edge-cloud computing systems, and directly applying these schemes would cause security and efficiency problems. In this article, we first propose a two-layer edge-cloud-assisted CRC framework, dubbed ECA-CRC, where edge nodes utilizing a probabilistic checking algorithm serve as a first layer, and the cloud server utilizing a deterministic checking algorithm serves as a second layer. Both the edge nodes and the cloud server collaboratively provide verifiable CRC services for devices. The most prominent manifestations of ECA-CRC are that: 1) most CRC requests can be processed with the probabilistic checking layer, which reduces the checking delay significantly while providing an accurate CRC service and 2) devices can detect the irresponsible behavior of the service provider, including using an incorrect revoked certificate set (RCS) to compute checking results or procrastinating on updating the RCS, as soon as possible. We then propose an efficient instantiation of ECA-CRC, dubbed eECA-CRC, by utilizing a Merkle hash tree (MHT)-based homomorphic signature, Cuckoo filter, and Othello. We formally prove the security of eECA-CRC against the irresponsible service provider under the random oracle model. We implement an eECA-CRC prototype and conduct a comprehensive performance evaluation based on a public certificate database. Our results show that 95% of CRC requests are completed on the edge nodes, and only 5% of CRC requests need to be handled by the cloud server.

Public key encryption with keyword search (PEKS) provides secure searchable data encryption in cloud storage. Users can outsource encrypted data and keywords to a cloud server, and search target one without disclosing sensitive information. To achieve resistance against off-line keyword guessing attacks, existing practical PEKS schemes employ independent key server(s) to assist users in producing keywords to be encrypted (called server-derived keywords) in an online manner. In this article, we analyze server-aided PEKS schemes and reveal a potential threat: vulnerability against subversion attacks, where algorithms in server-aided PEKS might be maliciously implemented to undermine security. In a subverted encryption implementation, a subliminal channel is established to control randomness generation such that biased ciphertexts covertly leak plaintext information. We further present a specific subversion attack against generation of server-derived keywords to violate keywords’ confidentiality. To address these issues, we propose SR-PEKS, a subversion-resistant PEKS scheme based on cryptographic reverse firewalls (CRF). In SR-PEKS, CRF sanitizes messages transmitted in server-derived keyword generation to resist the presented subversion attack. CRF also participates in a collaborative randomness generation protocol to yield unbiased randomness for encryption, thereby eliminating the subliminal channel. Provable security and high efficiency of SR-PEKS are demonstrated by comprehensive analyses and performance evaluations.

In this paper, we propose a servers-aided password-based subsequent-key-locked encryption mechanism to ensure the confidentiality of outsourced electronic health records (EHRs). The encryption mechanism achieves conditional forward transparency: a doctor can only access a patient's EHRs related to the current diagnosis with the patient's delegation. It also achieves portability: to delegate a doctor for accessing a specific part of EHRs, the patient only needs to send one key (at most 256 bits) in addition to the delegation information to the doctor; the patient does not need to maintain any secret in a local device. Then, we propose a blockchain-based secure EHR provenance mechanism, where a data structure of EHR provenance record is designed to precisely reflect the EHRs’ provenance information; a smart contract on a public blockchain is deployed to secure both EHRs and the corresponding provenance records. Finally, we develop a cloud-based eHealth system, dubbed HealthFort, based on the two mechanisms. Security analysis and comprehensive performance evaluation are conducted to demonstrate that HealthFort is secure and efficient.

In this paper, we introduce a concept of transparent integrity auditing and propose a concrete scheme based on the blockchain, which goes one step beyond existing public auditing schemes, since the auditing does not rely on third-party auditors while freeing users from heavy communication costs on auditing the data integrity. Then we construct a secure transparent deduplication scheme based on the blockchain that supports deduplication over encrypted data and enables users to attest the deduplication pattern on the cloud server. Such a scheme allows users to directly benefit from data deduplication and protects data content against anyone who does not own the data. Finally, we integrate the proposed transparent integrity auditing scheme and transparent deduplication scheme into one system, dubbed BLIND. We evaluate BLIND from security and efficiency, which demonstrates that BLIND achieves a strong security guarantee with high efficiency.

With cloud services, data users can retrieve encrypted data while preserving data confidentiality. However, this new paradigm suffers from many security concerns. A major concern is how to avoid insider Keyword-Guessing Attacks (KGA), which implies that the internal attackers can guess the candidate keywords successfully in an off-line manner. To address this issue, recently, two verifiable searchable encryption schemes (published in IEEE Transactions on Cloud Computing, doi: 10.1109/TCC.2020.2989296) in cloud storage were proposed which enjoys many desirable features. In this letter, we demonstrate that the schemes are insecure against insider keyword-guessing attack. Specifically, we show that the adversary can derive the keywords in an off-line manner.

In this article, we propose SPADE, an encrypted data deduplication scheme that resists compromised key servers and frees users from the key management problem. Specifically, we propose a proactivization mechanism for the servers-aided message-locked encryption (MLE) to periodically substitute key servers with newly employed ones, which renews the security protection and retains encrypted data deduplication. We present a servers-aided password-hardening protocol to resist dictionary guessing attacks. Based on the protocol, we further propose a password-based layered encryption mechanism and a password-based authentication mechanism and integrate them into SPADE to enable users to access their data only using their passwords. Provable security and high efficiency of SPADE are demonstrated by comprehensive analyses and experimental evaluations.

We investigate existing “password+hardware token”-based authentication schemes deployed in real-world applications and observe that they are vulnerable to critical threats. Specifically, a compromised manufacturer may issue a backdoored hardware token to a user and later recover the user’s secret, which is well known as backdoor attacks. Additionally, an authentication credential in these schemes consists of two parts: the one is derived from the password, the other one is derived from the hardware token. However, since the two parts are independent of each other, if an adversary can physically access the hardware token of a victim, he is able to break security of these schemes by performing dictionary-guessing attacks (DGA), which is called mislaying-then-DGA. In this paper, we design a non-interactively re-randomizable reverse firewall signature mechanism for securing hardware tokens, such that the user’s secret is well protected even if a backdoor is embedded. We also utilize a servers-aided password-based encryption mechanism to harden hardware tokens, so as to “seamlessly” integrate the two factors into one credential. Based on the above mechanisms, we develop a secure two-factor authentication scheme, dubbed ATTACH. We evaluate ATTACH in terms of security and efficiency to demonstrate it achieves a strong security guarantee with high efficiency.

Public verification enables cloud users to employ a third party auditor (TPA) to check the data integrity. However, recent breakthrough results on quantum computers indicate that applying quantum computers in clouds would be realized. A majority of existing public verification schemes are based on conventional hardness assumptions, which are vulnerable to adversaries equipped with quantum computers in the near future. Moreover, new security issues need to be solved when an original data owner is restricted or cannot access the remote cloud server flexibly. In this paper, we propose an efficient identity-based data outsourcing with public integrity verification scheme (DOPIV) in cloud storage. DOPIV is designed on lattice-based cryptography, which achieves post-quantum security. DOPIV enables an original data owner to delegate a proxy to generate the signatures of data and outsource them to the cloud server. Any TPA can perform data integrity verification efficiently on behalf of the original data owner, without retrieving the entire data set. Additionally, DOPIV possesses the advantages of being identity-based systems, avoiding complex certificate management procedures. We provide security proofs of DOPIV in the random oracle model, and conduct a comprehensive performance evaluation to show that DOPIV is more practical in post-quantum secure cloud storage systems.

In this paper, we propose an efficient private set intersection protocol, named LL-PSI, to enable two parties (where each party has an individual set) to obtain the intersection of their sets without leaking other information about their sets to each other. Compared with existing protocols, LL-PSI reduces the computational latency of the intersection between two sets significantly at the expense of communication costs between the parties. Based on LL-PSI, we propose a privacy-preserving friend matching scheme for mobile social networks, dubbed PAIRING. PAIRING allows users to match with those who have common interests while preserving users' private information against the semi-honest server and curious users. We analyze the security of PAIRING and conduct a comprehensive performance evaluation, which demonstrates that PAIRING is secure and efficient.

In this paper, we investigate actual cloud-assisted electronic health (eHealth) systems in terms of security, efficiency, and functionality. Specifically, we propose a password-based subsequent-key-locked encryption mechanism to ensure the confidentiality of outsourced electronic health records (EHRs). We also propose a blockchain-based secure EHR provenance mechanism by designing the data structure of the EHR provenance record and deploying a public blockchain and smart contract to secure both EHRs and their provenance records. With the two mechanisms, we develop BESURE (blockchain-based cloud-assisted eHealth system with secure data provenance) to provide a secure EHR storage service with efficient provenance. Security analysis and comprehensive performance evaluation are conducted to demonstrate that BESURE is secure and efficient.

In this paper, a new nonlinear adaptive control method for controlling the polynomial type-2 fuzzy systems with uncertain parameters is presented. In this paper, it is assumed that the vector state of the system is not always available, and so it is necessary to first use the observer and, while stabilizing the system, control it with minimal error. The control gain is calculated by using least squares in such a way that the vector of the polynomial type-2 fuzzy system state vector follows the state of a stable reference system. In the simulation, the cart-pole system is considered. This nonlinear complex system first converts to a polynomial type-2 fuzzy model and then is well controlled by the proposed method. Also, changes in parameters and the effect of disturbance have also been studied. The results show that the proposed method is effective.

In this article, we analyze the inherent characteristics of smart grids, and point out that some electricity consumption data are very sensitive and should be encrypted. However, once the corresponding private key is compromised, the content of encrypted data would be leaked, thereby violating users' privacy. Additionally, since a control center (CC) is always required to conduct accurate statistic analysis on these data for subsequent services, it is highly demanded for CC to check the integrity of encrypted data. To this end, based on a modified Boneh-Goh-Nissim (BGN) cryptosystem, we propose a key-leakage resilient encrypted data aggregation (KLR-EDA) scheme with lightweight verification in fog-assisted smart grids. KLR-EDA enables each fog node to aggregate first-level verifiable encrypted data from smart meters in the same grid area, and forward them to the cloud server (CS) for long-term storage. Upon receiving flexible challenging list of fog nodes from CC, CS produces second-level verifiable encrypted aggregated data and returns the results to CC. KLR-EDA enables CC to check the integrity of encrypted aggregated data efficiently, and further obtain the statistic analysis results on the aggregated data without learning any information of individual user. In particular, even the private key of CC is exposed or compromised, any adversary cannot break users' privacy. We provide security analysis of KLR-EDA, and conduct performance evaluation to demonstrate its lightweight statistical analysis and verification advantages on the CC side.

The deployment of cloud storage services has significant benefits in managing data for users. However, it also causes many security concerns, and one of them is data integrity. Public verification techniques can enable a user to employ a third-party auditor to verify the data integrity on behalf of her/him, whereas existing public verification schemes are vulnerable toprocrastinating auditorswho may not perform verifications on time. Furthermore, most of public verification schemes are constructed on the public key infrastructure (PKI), and thereby suffer from certificate management problem. In this paper, we propose acertificatelesspublicverification scheme againstprocrastinatingauditors (CPVPA) by usingblockchain technology. The key idea is to require auditors to record each verification result into a transaction on a blockchain. Because transactions on the blockchain are time-sensitive, the verification can be time-stamped after the transaction is recorded into the blockchain, which enables users to check whether auditors perform the verifications at the prescribed time. Moreover, CPVPA is built on certificateless cryptography, and is free from the certificate management problem. We present rigorous security proofs to demonstrate the security of CPVPA, and conduct a comprehensive performance evaluation to show that CPVPA is efficient.

Cloud storage enables users to outsource data to storage servers and retrieve target data efficiently. Some of the outsourced data are very sensitive and should be prevented for any leakage. Generally, if users conventionally encrypt the data, searching is impeded. Public-key encryption with keyword search (PEKS) resolves this tension. Whereas, it is vulnerable to keyword guessing attacks (KGA), since keywords are low-entropy. In this paper, we present a secure PEKS scheme called SEPSE against KGA, where users encrypt keywords with the aid of dedicated key servers via a threshold and oblivious way. SEPSE supports key renewal to periodically replace an existing key with a new one on each key server to thwart the key compromise. Furthermore, SEPSE can efficiently resist online KGA, where each keyword request made by a user is integrated into a transaction on a public blockchain (e.g., Ethereum), which allows key servers to learn the number of keyword requests made by the user without requiring a synchronization between them for per-user rate limiting. Security analysis and performance evaluation demonstrate that SEPSE provides a stronger security guarantee compared with existing schemes, at the expense of acceptable computational costs.

Wireless body area networks (WBANs) rely on powerful cloud storage services to manage massive medical data. As precise medical diagnosis analysis is heavily based on these medical data, any altered medical data may cause severe consequences, the integrity of outsourced medical data has become the most concerning security issue. Up to date, most existing public auditing mechanisms have been proposed to check the data integrity, but they could not achieve conditional identity privacy, any patient would not like others to know his/her real identity corresponding to certain serious disease, and some malicious patients should be revoked timely due to misbehaviors. Additionally, they are vulnerable to malicious auditors, by colluding with the cloud server to cheat patients. In this paper, we propose a conditional identity privacy-preserving public auditing (CIPPPA) mechanism for cloud-based WBANs. CIPPPA is the first public auditing mechanism achieving conditional identity privacy of patients in WBANs, the real identity of a patient is unknown to anyone in cloud-based WBANs other than the private key generator (PKG). We attempt to integrate Ethereum blockchain into CIPPPA, which gives assistance to patients for validating malicious auditing behaviors. Formal security analysis and performance evaluation demonstrate that CIPPPA is practical for cloud-based WBANs.

Cloud-assisted Industrial Internet of Things (IIoT) relies on cloud computing to provide massive data storage services. To ensure the confidentiality, sensitive industrial data need to be encrypted before being outsourced to cloud storage server. Public-key encryption with keyword search (PEKS) enables users to search target encrypted data by keywords. However, most existing PEKS schemes are based on conventional hardness assumptions, which are vulnerable to adversaries equipped with quantum computers in the near future. Moreover, they suffer from key exposure, and thus the security would be broken once the keys are compromised. In this paper, we propose a forward secure PEKS scheme (FS-PEKS) based on lattice assumptions for cloud-assisted IIoT, which is post-quantum secure. We integrate a lattice-based delegation mechanism into FS-PEKS to achieve forward security, such that the security of the system is still guaranteed even the keys are compromised by the adversaries. We define the first formal security model on forward security of PEKS, and prove the security of FS-PEKS under the model. As the keywords of industrial data are with inherently low entropy, we further extend FS-PEKS to resist insider keyword guessing attacks (IKGA). The comprehensive performance evaluation demonstrates that FS-PEKS is practical for cloud-assisted IIoT.

In this letter, we point out that the privacy-preserving adaptive trapdoor hash authentication tree scheme (published in IEEE TIFS, doi: 10.1109/TIFS.2020.2986879) can be invalidated by an adversarial cloud server: if the outsourced data is arbitrarily modified, the cloud server still can pass the third-party auditor's auditing.

We analyze a path validation scheme with constant-size proof (published in IEEE Transactions on Information Forensics and Security) and demonstrate that this scheme fails to achieve unforgeability. An adversary can forge a valid proof with a non-negligible probability.

Password-based single-sign-on authentication has been widely applied in mobile environments. It enables an identity server to issue authentication tokens to mobile users holding correct passwords. With an authentication token, one can request mobile services from related service providers without multiple registrations. However, if an adversary compromises the identity server, he can retrieve users' passwords by performing dictionary guessing attacks (DGA) and can overissue authentication tokens to break the security. In this paper, we propose a password-based threshold single-sign-on authentication scheme dubbed PROTECT that thwarts adversaries who can compromise identity server(s), where multiple identity servers are introduced to authenticate mobile users and issue authentication tokens in a threshold way. PROTECT supports key renewal that periodically updates the secret on each identity server to resist perpetual leakage of the secret. Furthermore, PROTECT is secure against off-line DGA: a credential used to authenticate a user is computed from the password and a server-side key. PROTECT is also resistant to online DGA and password testing attacks in an efficient way. We conduct a comprehensive performance evaluation of PROTECT, which demonstrates the high efficiency on the user side in terms of computation and communication and proves that it can be easily deployed on mobile devices.

Multimedia data needs huge storage space, and application of multimedia data needs powerful capability of computing. Cloud computing can help owner of multimedia data to deal with it. But, multimedia data on cloud may reveal privacy of data owner, such as sex, hobbies, address, looks, and so on. Data owner can encrypt multimedia data for confidentiality before uploading it to cloud. However, encrypted multimedia data makes its utilization difficult. In this paper, we first discover pre-existing schemes have problems of huge storage space, security and low efficiency due to their inefficient and insecure algorithms. Then, we provide an effective and practical privacy-preserving scale-invariant feature transform (SIFT) scheme for encrypted image. It uses leveled homomorphic encryption based on our new encoding schemes, our new homomorphic comparison, division and derivative encryption. Our new secure SIFT scheme can realize higher computing efficiency, greatly reduce communication costs and interactive times between user and server, and perform correct feature key point detection, accurate feature point description and image matching. We evaluate security and efficiency of our new secure SIFT scheme, and compare our new secure SIFT scheme with other schemes in detail. The result shows that it is closest to the original SIFT algorithm.

We point out that the key agreement and key protection scheme (published in IEEE Transactions on Information Forensics and Security, doi: 10.1109/TIFS.2018.2850299) fails to achieve the two-factor security. We demonstrate that in the scheme, if an adversary can control the master device of a target user, he can impersonate the user to pass the server's authentication.

We propose Chronos+, an accurate blockchain-based time-stamping scheme for outsourced data, where both the storage and time-stamping services are provided by cloud service providers. Specifically, Chronos+integrates a file into a transaction on a blockchain once the file is created, which guarantees the file's latest creation time to be the time when the block containing the transaction is appended to the blockchain. A sufficient number of consecutive blocks that are latest confirmed on the blockchain is embedded into the file at the creation time. These blocks serve as a time-dependent random seed to prove the earliest creation time, due to blockchains' chain quality property. Chronos+makes the file's timestamp corresponding to a time interval formed by the earliest and latest creation times which are derived from the heights of the corresponding blocks. Due to blockchains' chain growth property, such a height-derived timestamp can ensure that the time intervals' range is within a few minutes so as to guarantee the accuracy. We also point out potential threats towards outsourced time-sensitive files and present security analyses to prove that Chronos+is secure against these threats. Comprehensive performance evaluations demonstrate the efficiency and practicality of Chronos+.

Message-locked encryption (MLE) is a special type of symmetric encryption enabling deduplication over ciphertexts. Since an MLE key is extracted from the message itself, it is vulnerable to brute-force attacks. Existing schemes employ an independent key server to help in generating MLE keys, where the MLE key is extracted from the message and a server-side secret to thwart brute-force attacks. Whereas, the security of these schemes depends on the reliability of the key server, which causes the single-point-of- failure problem. In this paper, we propose DECKS, an encrypted data \underline{de}duplication scheme against the \underline{c}ompromised \underline{k}ey \underline{s}erver. DECKS employs multiple key servers to assist users in generating MLE keys using an oblivious and threshold-based protocol, such that compromising any key server would not break the security. To free DECKS from trusting a specific group of key servers during the lifetime of protected data, the key servers are periodically replaced by new ones to renew the security protection. Provable security and high efficiency of DECKS are demonstrated by comprehensive analyses and experimental evaluations.

It is common to certify when a file was created in digital investigations, e.g., determining first inventors for patentable ideas in intellectual property systems to resolve disputes. Secure time-stamping schemes can be derived from blockchain-based storage to protect files from backdating/forward-dating, where a file is integrated into a transaction on a blockchain and the timestamp of the corresponding block reflects the latest time the file was created. Nevertheless, blocks' timestamps in blockchains suffer from time errors, which causes the inaccuracy of files' timestamps. In this paper, we propose an accurate blockchain-based time-stamping scheme called Chronos. In Chronos, when a file is created, the file and a sufficient number of successive blocks that are latest confirmed on blockchain are integrated into a transaction. Due to chain quality, it is computationally infeasible to pre-compute these blocks. The time when the last block was chained to the blockchain serves as the earliest creation time of the file. The time when the block including the transaction was chained indicates the latest creation time of the file. Therefore, Chronos makes the file's creation time corresponding to this time interval. Based on chain growth, Chronos derives the time when these two blocks were chained from their heights on the blockchain, which ensures the accuracy of the file's timestamp. The security and performance of Chronos are demonstrated by a comprehensive evaluation.

Public-key encryption with keyword search (PEKS) enables users to search over encrypted data and retrieve target data efficiently. However, most of existing PEKS schemes are vulnerable to adversaries equipped with quantum computers in the near future, and even incur complex certificate management procedures due to the public key infrastructure (PKI). To this end, we propose a proxy-oriented identity-based encryption with keyword search (PO-IBEKS) scheme from lattices for cloud storage, which is post-quantum secure. In PO-IBEKS, an original data owner authorizes a proxy to encrypt sensitive data as well as corresponding keywords and upload ciphertexts to clouds, which alleviates the data processing burden on the original data owner. Besides, PO-IBEKS can resist inside keyword guessing attacks (IKGA) from misbehaved cloud servers by integrating the learning with errors (LWE) encryption and preimage sampleable function. Each entity in PO-IBEKS is identified with her/his recognizable information, thereby eliminating managing certificates. Formal security analysis proves that PO-IBEKS can achieve ciphertext indistinguishability, existential unforgeability, and delegation security. Experimental results demonstrate PO-IBEKS is much more practical when compared with existing schemes.

In this paper, we analyze the inherent characteristic of electronic medical records (EMRs) from actual electronic health (eHealth) systems, where we found that first, multiple patients would generate large amounts of duplicate EMRs and second, cross-patient duplicate EMRs would be generated numerously only in the case that the patients consult doctors in the same department. We then propose the first efficient and secure encrypted EMRs deduplication scheme for cloud-assisted eHealth systems (HealthDep). With the integration of our analysis results, HealthDep allows the cloud server to efficiently perform the EMRs deduplication, and enables the cloud server to reduce storage costs by more than 65% while ensuring the confidentiality of EMRs. Security analysis shows that HealthDep provides a stronger security guarantee than Marforio et al.'s scheme (NDSS 2014) and Bellare et al.'s scheme (USENIX Security 2013). Algorithm implementation and performance analysis demonstrate the feasibility and high efficiency of HealthDep.

The ownership of RFID tag is often transferred from one owner to another in its life cycle. To address the privacy problem caused by tag ownership transfer, we propose a tag privacy model which captures the adversary’s abilities to get secret information inside readers, to corrupt tags, to authenticate tags, and to observe tag ownership transfer processes. This model gives formal definitions for tag forward privacy and backward privacy and can be used to measure the privacy property of tag ownership transfer scheme. We also present a tag ownership transfer scheme, which is privacy-preserving under the proposed model and satisfies the other common security requirements, in addition to achieving better performance.

Cloud storage services allow users to outsource their data to cloud servers to save local data storage costs. However, unlike using local storage devices, users do not physically manage the data stored on cloud servers; therefore, the data integrity of the outsourced data has become an issue. Many public verification schemes have been proposed to enable a third-party auditor to verify the data integrity for users. These schemes make an impractical assumption-the auditors have enough computation capability to bear expensive verification costs. In this paper, we propose a novel public verification scheme for the cloud storage using indistinguishability obfuscation, which requires a lightweight computation on the auditor and the delegate most computation to the cloud. We further extend our scheme to support batch verification and data dynamic operations, where multiple verification tasks from different users can be performed efficiently by the auditor and the cloud-stored data can be updated dynamically. Compared with other existing works, our scheme significantly reduces the auditor's computation overhead. Moreover, the batch verification overhead on the auditor side in our scheme is independent of the number of verification tasks. Our scheme could be practical in a scenario, where the data integrity verifications are executed frequently, and the number of verification tasks (i.e., the number of users) is numerous; even if the auditor is equipped with a low-power device, it can verify the data integrity efficiently. We prove the security of our scheme under the strongest security model proposed by Shi et al. (ACM CCS 2013). Finally, we conduct a performance analysis to demonstrate that our scheme is more efficient than other existing works in terms of the auditor's communication and computation efficiency.

Summary Cloud computing, as a new‐generation IT architecture, offers an applicable approach for the medical storage and exchange in electronic health networks. However, it also brings the security and privacy concerns because patients lost physical control of their health information. Therefore, it is critical to maintain fairly retrievable to the private medical records over suspicious cloud servers. Wang proposed a fair remote retrieval (FRR) model to enable an independent third party to secure that it is integrated and retrievable to outsource private medical records. One distinctive feature of FRR is to support and address the medical tangle between hospitals and patients, and employ a committee to recover the necessary original data. Unfortunately, FRR cannot ensure the integrity of the remote medical records as claimed. Specifically, a malicious cloud server could cheat the verifier that its medical information were well‐maintained. But in fact, it only holds the hash values of the original data. Moreover, it can generate a valid but malicious response without being detected by the verifier, and all the medical records are discarded with the help of tag queries. Finally, we present an improved protocol named an improved fair remote retrieval protocol (IFR)2to fix the security minor faults with preserving all the properties of FRR. Copyright © 2015 John Wiley & Sons, Ltd.

Summary To satisfy the applications in certificateless environment, many researchers have been investigating certificateless aggregate signature schemes. Several schemes that are independent with the aggregated numbers are proposed to reduce the computation overhead. In these schemes, the pairing computations that in verification procedure needs are a constant value. Recently, Hou et al. proposed an improved certificateless aggregate signature scheme. They demonstrated the scheme is provably secure in the random oracle model. However, we find that their scheme is insecure in their security model by giving a concrete attack. Then, we propose an improved certificateless signature scheme and use it to construct a new certificateless signature scheme with enhanced security and aggregation. Furthermore, we provide formal security proof of our new scheme. Compared with other four schemes, our enhanced protocol is more suitable for realistic applications. Copyright © 2015 John Wiley & Sons, Ltd.

Cyber-physical-social system (CPSS) allows individuals to share personal information collected from not only cyberspace but also physical space. This has resulted in generating numerous data at a user's local storage. However, it is very expensive for users to store large data sets, and it also causes problems in data management. Therefore, it is of critical importance to outsource the data to cloud servers, which provides users an easy, cost-effective, and flexible way to manage data, whereas users lose control on their data once outsourcing their data to cloud servers, which poses challenges on integrity of outsourced data. Many schemes have been proposed to allow a third-party auditor to verify data integrity using the public keys of users. Most of these schemes bear a strong assumption: the auditors are honest and reliable, and thereby are vulnerability in the case that auditors are malicious. Moreover, in most of these schemes, an auditor needs to manage users certificates to choose the correct public keys for verification. In this paper, we propose a secure certificateless public integrity verification scheme (SCLPV). The SCLPV is the first work that simultaneously supports certificateless public verification and resistance against malicious auditors to verify the integrity of outsourced data in CPSS. A formal security proof proves the correctness and security of our scheme. In addition, an elaborate performance analysis demonstrates that the SCLPV is efficient and practical. Compared with the only existing certificateless public verification scheme (CLPV), the SCLPV provides stronger security guarantees in terms of remedying the security vulnerability of the CLPV and resistance against malicious auditors. In comparison with the best of integrity verification scheme achieving resistance against malicious auditors, the communication cost between the auditor and the cloud server of the SCLPV is independent of the size of the processed data, meanwhile, the auditor in the SCLPV does not need to manage certificates.

For some time, the modeling and verification of web services composition are focused on control flow. Recent years, data validation has gained researchers' attention too, as it is important to the correct execution of the composed web service. To verify data-related requirements of web services composition, we present a Petri net-based method for the data validation of web services composition developed with Web Service Business Process Execution Language. Data-flow related aspects of the WS-BPEL process are described with WS-CPN, which is a special kind of Colored Petri net supporting the description of XML Schema types. In WS-CPN, data types are described by CPN ML, a description language for Colored Petri net. We present WS-CPN models for various activities of a WS-BPEL process, which can be combined together to obtain the WS-CPN model for the entire composition process. Data validation problems in web services composition including redundant data, lost data, inconsistent data and misdirected data are discussed, and the methods for validating these problems are given based on WS-CPN.

A new concept called multi-proxy multi-signcryption is introduced in this paper. In a multi-proxy multi-signcryption scheme, a group of original signcrypters can authorize a group of proxy signcrypters under the agreement of all signcrypters in the original group. Then only the cooperation of all signcrypters in the proxy group could generate a multi-proxy multi-signcryption. We propose a multi-proxy multi-signcryption scheme based on bilinear pairings. The proposed scheme has the following characteristics: (i) the size of multi-proxy multi-signcryption is independent of the number of original and proxy signcrypters. (ii) it provides the fair protection for the original signcrypter group and the proxy group.(iii) the key management problem is simplified because of using ID-based cryptography. Finally, we give an application of the proposed scheme in electronic commerce.

Proxy blind signature is a cryptographic research hotspot, and has been applied in many occasions. Many proxy blind signature schemes were proposed, however, all the schemes rely on secure channels to transmit proxy secret key. Therefore, Lu, Cao and Zhou proposed a new proxy blind multi-signature scheme recently, which does not need a secure channel and is provably secure under the random oracle model. In this letter, however, we show that their scheme is not secure against the original signer's forgery attack. Moreover, we give four improved proxy key generation algorithms to counter this attack.

Recently, Yu et al. proposed two identity based signcryption schemes, one is an identity based signcryption scheme for multiple receivers and the other is an identity based signcryption scheme without random oracles. They showed their former scheme is secure against adaptive chosen ciphertext attacks and unforgeable in the random oracle model, and the latter scheme is secure against adaptive chosen ciphertext attacks and unforgeable in the standard model. In this paper, however, we show that their first scheme is vulnerable to universal forgery attack and their second scheme is not secure against adaptive chosen ciphertext attack.

Abstract The analysis of workflow is crucial to the correctness of workflow applications. This paper introduces a simple and practical method for analyzing workflow logic models. Firstly, some definitions of the models and some properties, such as throughness, no‐redundant‐transition and boundedness, are presented. Then, we propose an approach based on synchronized reachability graphs (SRGs) to verify these properties. The SRG uses the characteristics of synchronizers in workflow logic models and mitigates the state explosion by constructing synchronized occurrence sequences rather than interleaving occurrence sequences. This paper also proposes some refined and feasible reduction rules which can preserve vital properties of workflow logic models. Using these two techniques, the SRG‐based verification method can achieve higher efficiency. Furthermore, this research also develops a verification tool based on the method, presents the analysis results of some practical cases and compares our method with others. Copyright © 2007 John Wiley & Sons, Ltd.