With the rapid advancement of cloud computing and the exponential growth of data, the demand for secure data querying and sharing has become increasingly prominent. Identity-Based Encryption with Keyword Search (IBEKS) and Hierarchical IBEKS (HIBEKS) address the issue of secure data querying, as it enables resource-constrained clients to effectively search for encrypted data stored in the cloud. However, existing HIBEKS schemes lack flexible data-query mechanisms among users in the same level, are highly vulnerable to attacks launched by quantum computers and Keyword Guessing Attacks (KGA), and lead to relatively high end-to-end latency. To meet more complex and diverse application requirements and address these vulnerabilities, we introduce a novel primitive called Hierarchical Identity-Based Puncturable Encryption with Keyword Search (HIBPEKS). The decryption keys held by higher-level users are capable of generating decryption keys for lower-level users, thereby enhancing the ability to perform multi-level encrypted data queries within the user group. In addition, to control the query of encrypted data, higher-level users can use specific tags to puncture decryption keys (for lower-level users), so that lower-level users will no longer be able to query the parts of the data associated with the punctured tags. Technically, we have improved the previous lattice-based IBEKS schemes and implemented an efficient and flexible data query mechanism in a hierarchical setting by exploiting Puncturable Encryption (PE) techniques. Moreover, we formalize the security model of HIBPEKS and prove its security within the framework of the random oracle model. Finally, we experimentally evaluate HIBPEKS and show that HIBPEKS is computationally efficient and practical.

Tabular data are widely used in practice, and decision trees can effectively process such data. However, training high-quality decision trees with tabular data from a single entity is often insufficient. Therefore, vertical federated decision trees based on order-preserving encryption and differential privacy (OP-VFDT) have been proposed as effective methods for learning from tabular data distributed across multiple entities. Nevertheless, OP-VFDT’s prediction performance may degrade due to partial overlapping attribute skew, which is a type of nonindependent and identically distributed (Non-IID) divergences. Existing solutions in common federated learning focus on opti-mizing local model training and updates, which are absent in OP-VFDT, making them inapplicable. Additionally, OP-VFDT using deterministic encryption algorithms is vulnerable to frequency-analyzing attacks.In this paper, we propose a novel OP-VFDT training method along with an encryption algorithm to enhance prediction performance and security under partial overlapping attribute skew. The training method employs the idea of stacking ensemble learning, implementing a two-layer training architecture. Leveraging the characteristic that each node splitting in decision trees relies on one attribute, two overlapping attribute restructuring strategies are devised to train the first-layer XGBoost models and enrich the feature information for ensemble learning. The encryption algorithm, by synthesizing non-deterministic order-preserving encryption with differential privacy, enables resistance against frequency-analyzing and differential attacks. In experiments with varying overlapping attribute noise scales, compared with the baseline, the proposed method achieved up to 5.55% and 4.79% accuracy improvements on Covtype and Poker datasets, respectively, and reduced the MSE by up to 3.29 (19.12%) and 68.46 (86.80%) for CASP and CCPP datasets, respectively.

Ring Confidential Transaction (RingCT) protocols are widely used in cryptocurrencies to protect user privacy. Consequently, a corresponding digital signature scheme, such as a ring signature scheme that hides the signers’ identities, is required. Accordingly, the security of a RingCT protocol depends on the confidentiality of the secret signing keys of the underlying ring signature scheme. However, existing solutions like hardware wallets, Trusted Execution Environments (TEEs), and threshold signature schemes have limitations such as specified expensive hardware, targeting attacks at CPUs on insufficiently secure hardware, and overheads caused by multiple parties. On the contrary, program obfuscation for signature schemes offers advantages over these existing approaches. Concretely, we propose a novel obfuscator that secures the secret keys of the concise linkable spontaneous anonymous group (CLSAG) signature scheme, which is the latest ring signature scheme used in Monero’s RingCT protocol. To achieve enhanced security, the proposed obfuscator leverages Paillier homomorphic encryption to transform secret keys into an obfuscated form resistant to attacks. The security of the proposed obfuscator has been formally proved. Computational efficiency has been both theoretically analyzed and experimentally evaluated with positive results on various testing platforms.

Digital identities and credentials are important for authentication and authorization. Most contemporary digital identity systems rely on a central service provider, which may lead to privacy and centralization issues, such as data lost and information misuse. To address the problems, selective disclosure approaches within the self-sovereign identity have been proposed. However, these approaches primarily focus on data minimization, often overlooking the need for presentation unlinkability and identity supervisibility. In this paper, we propose a blockchain-based selective disclosure approach that supports presentation unlinkability, attribute aggregation, and identity traceability. We implement our approach and evaluate its efficiency by comparing it with approaches including atomic credentials, hashed values and selective disclosure signatures. The results demonstrate that our approach successfully achieves all intended objectives with high efficiency, rendering it applicable to realistic scenarios such as cross-chain authentication and access control in IoT.

With the rapid growth of wireless sensor networks, secure data transmission, storage, and distribution in such networks has become an urgent demand. To defend against security risks such as data leakage, key compromise, and unauthorized misuse of data simultaneously, we propose a novel obfuscatable ciphertext-policy attribute-based re-encryption scheme with a specially designed obfuscator. The proposed scheme leverages program obfuscation to transform the re-encryption program codes into an unintelligible form and embed the private keys into the obfuscated implementation. Consequently, the proposed scheme protects data confidentiality and keeps the secrecy of the private key while providing fine-grained access control. Formal proofs for the security of the proposed re-encryption scheme and the obfuscator are provided. Extensive experiments have been conducted on representative platforms, including cloud servers, workstations, and embedded devices, to evaluate the computational efficiency and energy consumption of the scheme. Experimental results indicate that the scheme achieves high efficiency on various platforms and economical energy consumption on typical embedded devices with constrained resources.