Abstract Named data networking (NDN) is considered a novel architecture of the next-generation Internet that delivers content by names. However, the human-readable name may potentially leak users’ privacy. Existing solutions have focused on encrypting to protect privacy, but they are neither efficient in the case of one publisher and multiple subscribers nor successful in supporting prefix matching. To address the above challenges, we propose an efficient and flexible name scheme with privacy preservation, which combines message-driven encryption with Bloom Filter. Firstly, message-driven encryption is utilized to protect name privacy, thus supporting efficient and secure encrypted name matching. Secondly, each name is divided into multiple components, and then each component is encrypted separately to support flexible prefix matching. Lastly, the technology of Bloom Filter with random numbers is explored to improve the efficiency and accuracy of name matching. Security and performance analysis shows that the proposed scheme effectively enhances the efficiency and accuracy of data matching while protecting name privacy.

With the rapid development of information technology and intelligence, there are more and more usage scenarios of graph data. Path queries have always been a hot topic of research for scholars. There are already many mature methods and ideas in the study of the path query on the plaintext graph. For the path query on graph data in the case of cloud outsourcing, it is necessary to consider both the construction of query algorithms and the protection of privacy information. The processing of graph privacy information through encryption, and then outsourcing to the cloud platform, is a common measure. The semantic‐based path query supporting multikeyword search is an extended path query method, which can improve the query function. For users, it is very troublesome to access and process the encrypted graph data. In this article, we propose a protecting‐privacy semantic‐based multikeyword path query scheme on the ciphertext graph (PSMP). Firstly, based on the principle of searchable encryption and vector operation, a secure index is constructed, and then the cloud server uses the secure index to implement path queries. This article demonstrates its security through formal analysis and verifies its effectiveness through experimental comparison and analysis. The work of this article has a certain promoting effect on the query processing and analysis of ciphertext graph data.

Efficiency, security, and flexibility are difficult to balance in a full policy hiding CP-ABE scheme. This paper creatively converts the privacy matching problem of access policy and a user’s private key to the privacy three-party set computation problem. Then the new privacy set computation problem is resolved by a message driven key generation method. Additionally, the ROBDD (Reduced Ordered Binary Decision Diagrams) is utilized to rich access structure expression and convert access policies into feasible path sets. Each feasible path is composed of attributes and these attributes are bound to the ciphertext using CP-ABE. Based on the innovative ideas mentioned above, we present a Lighten Fine-grained Access Control scheme supporting Full Policy Hidden (LFAC-FPH) that integrates data confidentiality protection, access policy rich expression but complete hiding, fine-grained access control, and lightweight terminal computing. Our scheme has three advantages: 1) High Efficiency. The proposed scheme can achieve fast privacy matching of access policies during user decryption. 2) Full Policy Hiding. The access policy bound by an owner on the ciphertext does not leak any information. Moreover, a user cannot know attributes they do not own. 3) High Flexibility. The decryption process does not require online from owners or KGC, and system attributes can be added at any time.

Proxy re-encryption (PRE) provides a promising solution for applications requiring efficient and secure ciphertext conversion, such as secure cloud data sharing. While the one with the function of ciphertext evolution is more desirable for some long-term schemes involving key update. Recently, Yao et al. constructed an identity-based conditional proxy re-encryption scheme simultaneously supporting authorization and ciphertext evolution. However, its delegated ciphertext can be re-authorized, which may cause the authorization to exceed the original delegator’s expectation. In contrast, the single-hop PRE authorization scheme may be more appropriate for systems requiring better control over authorization. In this paper, an identity-based proxy re-encryption scheme with single-hop conditional delegation and multi-hop ciphertext evolution (IBPRE-SHCD-MHCE) is proposed. Also, its description, construction, and security analysis are given. The analysis and experimental comparison results show that the proposed scheme has improved the computational efficiency and storage consumption compared with the two underlying schemes.

With the ever-increasing demands on decentralization and transparency of cloud storage, CP-ABE (Ciphertext Policy-Attribute-Based Encryption) has become a promising technology for blockchain-enabled data sharing methods due to its flexibility. However, real-world blockchain applications usually have some special requirements like time restrictions or power limitations. Thus, decryption outsourcing is widely used in data sharing scenarios and also causes concerns about data security. In this paper, we proposed a secure access control scheme based on CP-ABE, which could share contents during a particular time slot in blockchain-enabled data sharing systems. Specifically, we bind the time period with both ciphertexts and the keys to archive the goal of only users who have the required attributes in a particular time slot can decrypt the content. Besides, we use time slots as a token to protect the data and access control scheme when users want to outsource the decryption phase. The security analysis shows that our scheme can provide collusion resistance ability under a time restriction, and performance evaluations indicate that our scheme uses less time in decryption compared to other schemes while ensuring security.

Auction mechanisms have recently been studied as an efficient approach for dynamic resource allocation in a cloud market. Existing mechanisms are mostly limited to the offline setting or execute jobs in continuous time slots. This work focuses on a practical case of online auction design, where users bid for future cloud resources for executing their batch processing jobs with hard deadline constraints. We design an online primal-dual auction framework for Virtual Machine (VM) allocation with social welfare maximization, which is truthful, computationally efficient, and guarantees a small competitive ratio. We leverage the framework of post price auctions to design our online primal-dual algorithm, where a bid is accepted if its expected execution cost in future time slots is smaller than its bidding price. We interpret the dual variables as marginal prices per unit of resource, and iteratively update it according to the allocated amount of resource. Theoretical analysis and trace-driven simulation studies validate the efficacy of the online auction framework, including both its computational efficiency and economic efficiency.

To protect cloud data against corruption, enabling data integrity checking along with error recovery becomes quite critical. Recently, regenerating code has caught researchers' attention due to low repair traffic while preserving fault tolerance. Existing integrity checking schemes for regenerating code storage only support static data and have high auditing cost, which are not suitable for practical application. In this work, We propose a public auditing scheme for regenerating code based cloud storage supporting data dynamics. Our scheme allows the auditor to check the integrity of data stored across multiple servers and identify the location of corrupted data when data corruption is detected within one round. To support data dynamics, we design a novel update method based on matrix and index mechanism. The update method support multiple update requests performed in batch way without downloading and re-coding the data file and re-computing the data tags, such that the communication and computation cost can be greatly reduced. Theoretic analysis and experimental results show the security and efficiency of our proposed scheme.

Abstract Ciphertext‐policy attribute‐based encryption is becoming a cryptographic solution to realize fine‐grained access control. However, some important problems have not been effectively solved yet such as (i) low efficiency of dynamic change of a user or his attribute and (ii) high computation cost at user end. In this paper, we propose an access control scheme with dynamic user management using a version key and especially realize direct cloud‐aided attribute revocation without updating another user's key or re‐encrypting ciphertexts. We present a cloud‐aided decryption method with which most of decrypting work can be transferred to cloud. Compared with the existing schemes, our scheme causes less computation cost at user end and supports efficient dynamic change of a user or his attribute. Simulation indicates that our direct cloud‐aided attribute revocation method takes less time. Copyright © 2017 John Wiley & Sons, Ltd.

Cloud storage enables users to remotely store their data and share the data through the cloud. Existing integrity auditing schemes for shared data are often not identity-preserving and have high auditing cost, and hence are still far from practical application. In this work, we propose a public auditing scheme for shared data in cloud storage with identity privacy preservation. To preserve identity privacy against the auditor, we convert signatures computed by different users into signatures computed by the challenge user with proxy re-signature. Our scheme supports user revocation without re-signing signatures computed by revoked users, while the integrity of shared data can still be correctly checked. Furthermore, the auditing is efficient in the sense that the number of pairing operations during auditing is independent of the number of challenged blocks and users. We further present a batch auditing supporting multiple auditing delegations from different groups instead of only the same group. Security analysis demonstrates that our scheme is provably secure. Numeric analysis and simulation results show that both computation and communication costs of our scheme are lower than in existing schemes.