With the rapid evolution of Internet of Things (IoT) devices, privacy-sensitive data is exploding, creating significant obstacles in the sharing and retrieval of information. To enable high-precision data retrieval and fine-grained sharing, only the integration of Attribute-Based Searchable Encryption (ABSE) with cloud storage can fulfill these requirements while ensuring security. However, existing ABSE schemes face major limitations in IoT scenarios. Publicly accessible access policies and unprotected private key attribute sets pose risks of information leakage. In addition, the limited expressiveness of access policies and high computational overhead hinder their practical deployment in IoT environments. In this paper, we propose an Efficient Attribute-Based Searchable Encryption with Dual Privacy Protection (EASDP). By fully hiding access policies and attributes, our scheme ensures strong privacy against cloud inference attacks.We enhance the expressiveness of access control through sub-policy division and improve efficiency for resource-constrained IoT devices using techniques such as offline encryption, outsourced decryption, and keyword–attribute matching. The scheme is formally proven secure. The experimental results demonstrate its high performance in encryption and decryption at the user side and its suitability for various IoT devices, confirming its effectiveness in secure and flexible data sharing across IoT healthcare applications.

Due to limited computational and storage capabilities, wireless medical sensor networks (WMSN) encounter considerable overhead in processing the storage and verification of numerous signatures. Multi-signatures allow a group of signers to produce a single, compact signature on the same message, significantly reducing storage requirements and communication bandwidth in WMSN. However, conventional multi-signature schemes are not quantum resistant, as their security assumptions will be compromised with the quick advancement in quantum computing. Alternatively, lattice-based cryptography is widely considered capable of withstanding quantum computing attacks. In this article, we introduce a quantum-resistant and non-interactive identity-based multi-signature scheme from lattices with public key aggregation (IBMS-pka). By leveraging the small integer solution (SIS) assumption, our scheme is proven secure within the random oracle model. Besides, our scheme enables users to choose their system identities (e.g., physical IP address or email address) as public keys compared to PKI-based schemes, and avoids the extra communication costs in contrast to interactive schemes. Meanwhile, our scheme outperforms other related works according to our experiments. Specifically, the multi-signature generation has a slightly higher efficiency compared to other related schemes, while the multi-signature verification has a larger enhancement. Moreover, the performance improvement becomes more evident as the number of signers grows.

To improve the quality of medical care and reduce unnecessary medical errors, electronic medical records (EMRs) are widely applied in hospital information systems. However, rapidly increasing EMRs bring heavy storage burden to hospitals. Professional data management service provided by cloud server can save the hospital local storage, and meanwhile, realize EMRs sharing among external researchers. However, the risk of leaking information of patients discourages hospitals to outsource patients’ EMRs to the remote cloud server. In this paper, a secure and efficient cloud storing and sharing method can be achieved by applying the proposed public key authenticated encryption with ciphertext update and keyword search (PAUKS). The proposed PAUKS scheme enables EMRs to be encrypted and queried without decryption, and is secure against inside keyword guessing attacks. Compared with the recently proposed PAEKS in literature, the PAUKS scheme enjoys smaller computation and communication overheads. The required number of trapdoors per query is constant in PAUKS scheme, instead of the linearly expanding as the number of senders increases in PAEKS. Furthermore, an inverted index can be built safely in PAUKS scheme to accelerate the query procedure. Experiment results show that our PAUKS scheme owns a comparable running overhead, but enjoys a higher query efficiency after ciphertexts update.

Cloud computing offers on-demand availability of computing resources over the Internet. To attract users, cloud providers offer their resources as services at reasonable prices and provide various price models to reflect higher level of quality of service (QoS), which are referred as pricing schemes.$k$-times anonymous authentication ($k$-TAA) is an attractive approach to construct pricing schemes, providing access controllability, user anonymity and public traceability. In$k$-TAA schemes, authenticated users are permitted to anonymously access services from a provider at most$k$times, while the ones whose the number of access times exceeds$k$can be publicly traced. That is,$k$-TAA schemes offer a prepaid plan that charges users based on the amount of access times. Alternatively, pay-as-you-go (PAYG) is a pricing strategy that allows users to be charged based on the amount of usage, reducing the costs on unnecessary resources. Adopting$k$-TAA schemes to PAYG model, the access bound$k$is decided by the prepayment amount and the service usage is tracked by the number of access times. However, this approach is impractical, since existing$k$-TAA schemes only allow an one-time access in an authentication. This article aims to bridge this gap in the literature by designing an efficient and secure authentication system for PAYG cloud computing, supporting flexible access controllability, user anonymity and public traceability. To achieve this, we propose a new$k$-TAA primitive, called$k$-times anonymous pay-as-you-go authentication ($k$-TAA-PAYG), that allows users to access services for multiple times in an authentication as long as the number of their access times does not exceed$k$. We first formalize the definition and security model for$k$-TAA-PAYG scheme. Subsequently, we present a concrete construction of$k$-TAA-PAYG scheme, with the computational complexity as$O(1)$and the constant communicational cost. Finally, comparing with the most efficient$k$-TAA scheme proposed by Emuraet al., the experimental results show that our$k$-TAA-PAYG scheme is 2.5 to 3 times faster and saves up to 66 percent storage in grant processes. The time cost of an authentication of our$k$-TAA-PAYG scheme is constant (1.4-2.4 ms), while Emuraet al.’s scheme needs more than one second when the number of access time is greater than 1, 000.

Abstract Thanks to the ease of access and low expenses, it is now popular for people to store data in cloud servers. To protect sensitive data from being leaked to the outside, people usually encrypt the data in the cloud. However, management of these encrypted data becomes a challenging problem, e.g. data classification. Besides, how to selectively share data with other users is also an important and interesting problem in cloud storage. In this paper, we focus on ciphertext-policy attribute based encryption with equality test (CP-ABEET). People can use CP-ABEET to implement not only flexible authorization for the access to encrypted data, but also efficient data label classification, i.e. test of whether two encrypted data contain the same message. We construct an efficient CP-ABEET scheme, and prove its security based on a reasonable number-theoretic assumption. Compared with the only existing CP-ABEET scheme, our construction is more efficient in key generation, and has shorter attribute-related secret keys and better security.

In practice, adversaries may be able to acquire a part of private state of cryptographic system via side-channel attacks, on account of unexpected physical defects of cryptosystem, which is a serious threat to traditional cryptosystem that does not consider physical issues. Leakage-resilient cryptography was proposed to prevent adversaries from doing so. Unfortunately, there are few literatures in leakage-resilient signature. In this paper, we extend the framework of Dual-Form Signatures (DFSs) proposed by Gerbush et al. to the leakage setting, which provides a new path towards obtaining proofs under weaker assumptions. Applying this framework, we present a DFS scheme based on static assumptions with leakage bound (n−1−2c)logp2 where n is a positive integer greater than or equal to 2 and c is a fixed positive constant, which can be easily extended to the continual leakage model as well. Combining this result and the framework proposed by Huang et al., we can obtain identity-based signature schemes and certificateless signature schemes sharing the same leakage bound (n−1−2c)logp2⁠.