As image data outsourcing to mobile cloud grows, data privacy has become a major concern. Privacy-preserving image retrieval aims to search over encrypted data without requiring decryption. However, existing schemes face three critical challenges: struggle to balance accuracy, efficiency, and security; limited scalability for large-scale image retrieval in multi-user settings; and vulnerability to security threats arising from user permission changes or key compromises. In this paper, we propose ELSEIR, a novel framework for accurate, efficient, and privacy-preserving image retrieval. ELSEIR leverages a deep hashing model to extract image feature vectors and designs an irreversible random hash code generation module that combines secure permutation keys with two differential privacy methods for privacy protection. To enable accurate searches in multi-user settings, ELSEIR introduces a key conversion protocol that allows the cloud to unify ciphertexts encrypted under different user keys via corresponding switch keys. Furthermore, we extend the framework to ABE-ELSEIR, which supports immediate and efficient user revocation. We further provide formal security proofs demonstrating that the proposed frameworks are resilient against known-plaintext and key collusion attacks. Extensive experiments on real-world datasets show that our scheme achieves accuracy comparable to the unprotected baseline, while surpassing existing approaches in both retrieval accuracy and efficiency.

Secure cloud-edge data sharing has been researched recently to provide high quality on-demand data service. Attribute-based encryption (ABE) is a promising solution that achieves data confidentiality and flexible access control simultaneously. But three major issues remain when adapting ABE in cloud-edge, namely reliable user revocation, high performance on devices, and trust issues of public cloud. First, existing direct user revocation mechanisms focus on preventing a revoked user from decrypting header ciphertexts even when key exposure occurs, but ignore the payload security. Second, how to conveniently apply deployment on diverse platforms and run programs on resource-constrained devices with high efficiency is a challenge. Finally, no universal guarantee of cloud computation and management tasks, thus lazy or malicious cloud may not follow the protocol and perform improper actions on purpose. In this work, we propose a Hardware-Assisted Hybrid Fully Outsourced Revocable Attribute-Based Proxy Re-Encryption (H²O-RABPRE) scheme that supports reliable user revocation for full data traffic and hardware-assisted fully outsourced computation. Moreover, we design a hardware-assisted data-sharing framework with rapid deployment for cloud-edge, which integrates the developed SGX-MCL to protect outsourced tasks executed by cloud/edge devices against malicious behaviors and utilizes the enhanced WebAssembly runtime, WasmCrypto, a unified deployment approach for IoT devices with near-native performance. We implement the scheme on an SGX cloud server, a laptop, a Raspberry Pi, and an ESP32 board, and the results indicate that the proposed scheme is practical.

Attribute-based encryption (ABE) is a highly promising mechanism for secure fine-grained access control over encrypted data, particularly in cloud storage applications. However, the integration of built-in key escrow and susceptibility to key exfiltration poses a prevalent challenge during the implementation of ABE. In this paper, we present a novel ABE scheme called T-ABE to address the above challenges. Specifically, T-ABE utilizes a Trusted Execution Environment (i.e. Intel SGX) to provide a precise security guarantee for the entire process, from establishing trust between users and ABE services to key generation and management, ensuring that the entire scheme can provide users with secure and reliable ABE key hosting services even when deployed in untrustworthy cloud service providers. Through comprehensive security analysis and experimental demonstration, we have demonstrated the advantages of T-ABE in practical applications. We are confident that this new scheme has the potential to effectively tackle the outsourced key escrow challenges encountered by ABE.