Cloud computing, which provides a brand-new service model, has become an important infrastructure in the information age, and has been widely used in numerous fields. The Key-Policy Attribute-Based Encryption (KP-ABE) scheme allows the encrypted data with fine-grained access control in the cloud environment. However, achieving large-scale user revocation in the application scenario of KP-ABE becomes one of the thorny problems. Furthermore, the computation and communication costs of the previous user revocation schemes were generally high, especially when a large number of users were revoked. To address these problems, an enhanced high-performance user-revocable KP-ABE scheme combined with the puncture method was proposed. In this article, the user could be revoked by the fine-grained restriction policy. When revoking the user, the cloud would run the puncture algorithm to embed the restriction policy defined by the data owner into the ciphertext. This method could effectively omit the re-encryption and key updating processes, by which the computation and communication overhead of the user revocation are efficiently reduced, and the user revocation becomes more flexible and efficient. Moreover, the Chosen-Plaintext Attack (CPA) security proof and extensive simulation results demonstrate the reliability and efficiency of the proposed scheme for user revocation in a cloud environment.

Nowadays, more individuals and corporations tend to use machine learning as a service (MLaaS) in cloud computing environment. However, when enjoying the pay-as-you-go mode and flexible capacity of cloud computing, it also increases the risk of privacy leakage for sensitive data. In this paper, we aim to efficiently implement privacy-preserving MLaaS, and focus on k-means clustering over outsourced encrypted cloud databases. Previous works mainly utilize partially homomorphic encryptions, which require a great number of interactive protocols with high computation and communication costs, making them not practical in real-world applications. To better solve this problem, we propose a new secure and efficient outsourced k-means clustering (SEOKC) scheme using fully homomorphic encryption with ciphertext packing technique, which achieves parallel computation without extra cost. The proposed scheme preserves privacy in three aspects: (1) database security, (2) privacy of clustering results and (3) hiding of data access patterns. We provide formal security analysis and evaluate the performance of the proposed scheme through extensive experiments. The experiment results show that our scheme needs much less computation cost (more than three orders of magnitude lower) than the state-of-the-art schemes, and is suitable to be applied on large databases.

The emerging cloud-based Internet of Things (IoT) paradigm enables IoT devices to directly upload their collected data to the remote cloud and allows data owners (DOs) to conveniently manage those data through cloud APIs, which has greatly reduced infrastructure investment and data management cost in many IoT applications. Considering that the outsourced data are out of the physical control of DOs and the cloud server (CS) cannot always be fully trusted, how to securely delete the unneeded sensitive data stored in cloud to prevent potential data leakage issues is a big challenge. Most of the existing solutions only support coarse-grained deletion and rely on the participation of the CS, so their flexibility and practicability are seriously restricted. In this article, based on an enhanced policy-based puncturable encryption (P-PUN-ENC) primitive, we propose a secure and fine-grained self-controlled outsourced data deletion scheme in cloud-based IoT. The main contribution of our scheme is that it enables DOs to precisely and permanently delete their outsourced IoT-driven data in a policy-based way without relying on the CS. To achieve this, we subtly utilize the logical relationship between the puncture policy and access policy, and design a policy transform method to convert the puncture process based on the puncture policies into the update process of access policies. Then, we utilize a key delegation technique in attribute-based encryption (ABE) to complete the corresponding key update operations. Additionally, to address the issue of growing key storage and decryption cost in P-PUN-ENC, we propose the outsourced policy-based puncturable encryption (OP-PUN-ENC) primitive by combining the key and decryption outsource technique with P-PUN-ENC. Comprehensive comparisons show that our proposed scheme can better meet the data deletion requirements in cloud-based IoT, and formal security proof and extensive simulation results demonstrate the reliability and efficiency of the proposed scheme.

Numerous crowdsourcing applications have emerged in our daily lives, which enable customers to outsource their complicated tasks to a crowd of workers. However, the information of task tags and worker profiles is explicitly obtained by the crowdsourcing server to recommend tasks effectively, which violates the privacy of both customers and workers. Moreover, the worker's ability to do the task should also be verified in a privacy-preserving way. To address these issues, we propose a privacy-preserving interest-ability based task allocation scheme in crowdsourcing, which protects both task and worker privacy and enables the crowdsourcing server to allocate tasks in a fine-grained way. Specifically, by utilizing attribute-based encryption (ABE) and proxy re-encryption based searchable encryption (PRE-SE) on the task content and task tags respectively, customers are able to enforce fine-grained ability requirements on their tasks, and workers can specify flexible interests to choose their desired tasks. Additionally, ElGamal signature enables workers to prove their abilities to the crowdsourcing server without revealing the task content. Numerical analysis and experiment results demonstrate that our proposed scheme is efficient in terms of computation and storage overhead and is practical to be implemented in crowdsourcing.

Data owners have benefited significantly from cloud computing for managing the numerous data produced by massive devices in various Internet of Things (IoT) applications, such as smart home and electronic healthcare. On the other hand, fine- grained access control on outsourced data is a big concern for data owners, after they lose physical control over their data. Key-policy attribute- based encryption (KP-ABE), which provides data confidentiality and fine-grained data access control simultaneously, can be naturally introduced in this cloud-based IoT paradigm. However, the primitive KP-ABE cannot achieve efficient data access control with flexible user revocation. In this paper, we propose an efficient and fine-grained data access control scheme based on the proxy re-encryption and key blinding techniques for cloud-based IoT. With the scheme, the decryption capability of misbehaving users can be efficiently revoked to prevent data disclosure. In addition, most of the costly update operations over ciphertexts and keys due to user revocation, are delegated to the cloud. Extensive experiment results demonstrate that our scheme is more efficient than existing solutions in terms of computation and communication overheads.

With the advent of big data era, clients who lack computational and storage resources tend to outsource data mining tasks to cloud service providers in order to improve efficiency and reduce costs. It is also increasingly common for clients to perform collaborative mining to maximize profits. However, due to the rise of privacy leakage issues, the data contributed by clients should be encrypted using their own keys. This paper focuses on privacy-preserving k -means clustering over the joint datasets encrypted under multiple keys. Unfortunately, existing outsourcing k -means protocols are impractical because not only are they restricted to a single key setting, but also they are inefficient and nonscalable for distributed cloud computing. To address these issues, we propose a set of privacy-preserving building blocks and outsourced k -means clustering protocol under Spark framework. Theoretical analysis shows that our scheme protects the confidentiality of the joint database and mining results, as well as access patterns under the standard semihonest model with relatively small computational overhead. Experimental evaluations on real datasets also demonstrate its efficiency improvements compared with existing approaches.