The rapid growth of sensitive cross-domain data, such as electronic health records and genomic sequences in healthcare, presents significant opportunities for large-scale, multi-institutional collaborative analysis. Meeting stringent privacy regulations while utilizing data has become a critical challenge. Private set operations (PSO) play a crucial role to address this challenge. PSO protocols enable privacy-preserving data alignment across parties (such as interinstitutional data matching based on private set intersection (PSI)) and secure data aggregation (such as federated data aggregation through private set union (PSU)), providing fundamental support for cross-domain data collaboration. This type of technology is not only applicable to multi-center medical research but also has broad value in other scenarios requiring confidential data sharing. However, existing delegated/outsourced PSO schemes face two key limitations: (1) high client-side preprocessing overhead, requiring clients to expensively mask private data before uploading; (2) performance and single-point dependency bottlenecks in client-assisted computation where one client must act as a computational leader. To address these issues, we propose a secret-shared PSO framework for lightweight clients. In our scheme, the clients can go offline while servers perform all computations, significantly reducing clients’ burden. Notably, our protocol can be extended to support multi-party settings, making it well-suited for collaborative research across multiple institutions. In addition, we prove the security of all constructions under the semi-honest model. Experiments show that when the set sizen≥ 216, our protocol has a significant advantage and is well-suited for lightweight client that holds a large set.

Cloud computing facilitates scalable data sharing across multiple organizations and users, but also raises concerns about data privacy. Matchmaking encryption (ME) is a prominent technique that enforces bilateral access control in cloud services such as cloud marketplace, allowing both senders and receivers to specify policies for the encrypted data to be revealed. However, receivers may be at risk of being exposed to malicious or harmful content, thus undermining their trust in cloud service platforms. To this end, we introduce MBAC, a content-moderated bilateral access control framework for privacy-preserving cloud data sharing services, which allows receivers to acquire data from authentic senders while preserving their anonymity, and report malicious content in a verifiable manner, i.e., empowering the service provider to hold senders accountable. MBAC is built upon a novel primitive called franking broadcast ME (FBME), which generates a franking signature for the data by designating the service provider as the moderator to ensure accountability and deniability, and encrypts both the data and its franking signature while embedding the sender secret key for privacy and authenticity. We then present a concrete construction of FBME from key-private public key encryption, strongly unforgeable one time signature and non-interactive zero-knowledge proof. Formal security analysis and extensive experiments demonstrate that MBAC provides efficient bilateral access control and content moderation for cloud data sharing services.

With the rapid advancement of technology, cloud computing has emerged as the most popular and promising service platform. A cloud user can delegate heavy computation tasks to cloud servers. To ensure the correctness of outsourced processing (e.g., machine learning and data mining), the cloud server must prove that the processing has been executed properly. However, even without malicious intent, it is possible for a cloud server to produce incorrect results. Consequently, clients may outsource the same task to multiple cloud servers and receive various results, aiding them in selecting the best outcome. To protect data privacy, the cloud server must encrypt the results before sending them back to the user. Yet, processing and verifying encrypted results remain significant challenges. To avoid the expensive computational overhead of decrypting ciphertexts from cloud servers one by one, clients prefer to use homomorphic encryption (HE) to obtain the combined output from a single server. However, existing schemes fall short of efficiently verifying the correctness of computations over encrypted data processed by multiple cloud servers, especially in extracting the results computed by each server. In this paper, we introduce a new framework for verifiable outsourced computing systems. In this system, each cloud server's computation result is protected by Paillier encryption, and the edge server can verify these results using zero-knowledge proofs and aggregate the verified ciphertexts. The client can extract the combined plaintext through the Base-3 conversion algorithm to identify each cloud server's results and any non-participating servers. We also prove the security of our scheme and analyze its performance from both theoretical and experimental aspects. Performance analysis shows that our system significantly reduces the client's workload and is userfriendly

With the rapid popularization of electric vehicles (EVs) in modern society, vehicle-to-grid (V2G) has been widely concerned as an emerging technology. However, various privacy and security issues arise frequently in the energy interaction between EVs and the smart grid (SG), such as the lack of secure authentication and disclosure of EVs’ identity. Although many crypto-based schemes are proposed to achieve secure authentication of V2G networks, they rely on certificate authority (CA) or private key generator (PKG). In response to this problem, some certificateless signature-based schemes have been proposed. Nevertheless, most of them are not suitable for V2G networks due to the high computational cost and communication overhead, and they do not consider the problem of tracking illegal signatures. Therefore, we propose a traceable and privacy-preserving authentication scheme with supporting batch verification for energy trading in V2G networks. We use the method of binary tree level traversal to quickly track EVs with illegal signatures, which can reduce computational resources. Besides, the proposed scheme is easier to be deployed in real world because of avoiding the problems of key escrow and certificate management. Finally, we conduct a comprehensive security analysis and performance evaluation regarding our scheme. We prove that our proposed scheme is secure under the random oracle model (ROM), and the experimental results illustrate that the proposed scheme has less computational cost and communication overhead as compared to the existing schemes.

With the evolution of wireless body area networks (WBANs), wearable equipment will improve the human healthcare service. However, the medical data generated in WBANs increase dramatically with time, and the massive data cause the storage burden. With the help of cloud computing, the cloud service provider (CSP) can assist data owners in storing these data collected by sensors. By keeping their data in the CSP, the data integrity and authenticity is a big concern of data owners. To date, many data integrity auditing protocols have been proposed to address this issue. Most of them rely on traditional public-key mechanism, or identity-based cryptography (IBC), or certificateless cryptography (CLC). However, they suffer from the heavy cost of certificate management, key escrow, or the requirement of a secret channel for each user, respectively. To solve these drawbacks, we propose an efficient certificate-based data integrity auditing protocol for cloud-assisted WBANs. In our protocol, the computation cost in tag generation for a data block is fixed, and is independent of the size of the data block. We prove our protocol is secure in the random oracle model (ROM) and use the Java pairing-based cryptography library (JPBC) to implement the protocol. The experimental results show that our protocol is computationally efficient and practical.

With the appearance and flourishing development of the Internet of Things (IoT), wireless sensor networks technology has been attracting increasing attention. Network coding is an indispensable technology in the wireless sensor networks, which can improve network transmission throughput. However, pollution attacks is a serious security problem that must be faced in the process of data coding. Although the homomorphic network coding signature schemes can solve this troublesome, the high signature generation and verification cost of these schemes will reduce the transmission efficiency. In this article, we propose an efficient identity-based linearly homomorphic network coding signature scheme for wireless sensor networks to guarantee data integrity and authenticity. In our scheme, the computation cost of signature generation and verification are both independent of the size of the data packet. The scheme is proved secure against existential forgery under adaptive chosen identity and adaptive chosen subspace attacks in random oracle model. Using Java pairing-based Cryptography Library (JPBC), the simulation results illustrate that our scheme is more efficient in practical application.

Abstract With the flourishing development of the Internet of Things (IoT), the electronic health system (EHS) as a leading technology has attracted widespread attention. However, the unsatisfactory network transmission throughput hinders practical applications of EHS to some extent. Network coding can solve this problem, but it also incurs another drawback called pollution attack. Pollution attack can be prevented by using homomorphic network coding signature schemes to check whether a corrupted packet is injected. However, existing schemes require high computational cost for signature verification which will reduce the transmission efficiency. A lightweight certificateless linearly homomorphic network coding signature scheme is proposed. This scheme requires a quite low computational cost when both signing and verifying a data packet. In addition, it is proved that the scheme is secure, and it was implemented by using the Java Pairing‐Based Cryptography Library (JPBC) on a personal computer (PC). The simulation results illustrate that our scheme is efficient.