The contemporary healthcare ecosystem is being radically reshaped by the burgeoning deployment of Internet of Medical Things (IoMT) technologies; however, this ubiquity inevitably expands the attack surface regarding data confidentiality and user privacy. To mitigate the risk of sensitive physiological data leakage, this paper introduces a novel cryptographic primitive: Fuzzy Matching Data Sharing with Equality Test (FMDS-ET), optimized for the constraints of IoMT environments. Distinct from traditional approaches, our construction enforces a bilateral fine-grained access control mechanism. Specifically, decryption is authorized if and only if the cardinality of the intersection between the attribute sets and access policies of both the transmitter and the recipient surpasses a predefined threshold. This design not only bolsters the resilience of mutual authentication but also facilitates secure data dissemination and ciphertext equality test. Furthermore, it provides a viable solution for privacy-preserving data classification and record linkage. We provide a formal definition of the system syntax and prove its semantic security in the random oracle model. Comprehensive performance evaluations confirm that the proposed scheme maintains low computational overhead, rendering it highly feasible for resource-constrained medical sensors.

Public‐key authenticated encryption with keyword search (PAEKS) is a novel cryptographic primitive to resist against keyword‐guessing attacks (KGAs) and preserve the privacy of keywords in both ciphertexts and trapdoors. Recently, a designated‐server PAEKS (dPAEKS) scheme was proposed to withstand KGAs. The scheme was claimed to satisfy both multi‐ciphertext indistinguishability (MCI) and multi‐trapdoor privacy (MTP). However, our cryptanalysis demonstrates that it is insecure against KGAs, where a malicious server (inside attacker) can obtain the information of the keywords embedded in the ciphertext and the trapdoor. As a result, both the MCI and MTP of the scheme are broken. In addition, the paper also shows that it is possible to break the security of MTP, even for an outside attacker. Finally, we also provide a method to fix these security flaws.

Wireless systems are of paramount importance in enabling ubiquitous data transmission for various Internet of Things (IoT) applications. However, due to the broadcast nature and openness of wireless channels, such systems face inherent security challenges. Covert communication is an enabling technology for secure wireless communications while the Unmanned Aerial Vehicle (UAV)-assisted covert communication is particularly promising for enhancing covert performance. This paper investigates joint covert and secure communications in a two-hop UAV-assisted wireless system, where a source S transmits a covert message to a destination D with the help of an untrusted UAV, while being subject to detection by a warden W. We first design a covert transmission scheme for the proposed system with the considerations of both covert and secure constraints. We then develop theoretical models for the warden1detection error probability and the covert-and-secure rate (CSR) from S to D. Based on these models, we further explore the optimal power control for CSR maximization under both covertness and security constraints. Finally, numerical results are presented to validate the theoretical models and demonstrate the performance of covert and secure communications in the UAV-assisted system.

Wireless Body Area Networks (WBANs) have gained significant attention due to their numerous advantages in healthcare monitoring and applications. However, WBANs also face challenges related to data transmission security and privacy protection. Many researchers have proposed solutions to address these issues, but most of them are based on one-to-one communication models, which suffer from security vulnerabilities. Hence, we first review the previous protocol and show potential attack scenarios. Building upon their work, we propose an enhanced certificateless multi-receiver secure data transmission protocol for WBANs. Our proposal addresses security concerns and improves the efficiency and practicality of data transmission in WBANs. The security analysis and performance evaluation demonstrate that the proposed protocol achieves higher security levels, increases efficiency, and enhances practicality compared to existing approaches. Furthermore, our protocol provides a reliable framework for secure data transmission in WBANs, ensuring the privacy of users and maintaining the integrity and confidentiality of sensitive medical information.

In this paper, to secure the communication between autonomous vehicle and its digital representative in the vehicular digital twin system, we propose a GAN augmentation-based continuous authentication scheme. Specifically, in the proposed scheme, we first introduce a data augmentation technique based Generative Adversarial Network (GAN) that provides the augmentation of raw data from vehicle sensors. We then present the efficient authentication: 1) We train a Convolutional Neural Network (CNN) using raw and augmented data; 2) Deep features are extracted through a combination of Principal Component Analysis (PCA) and CNN; 3) We train the OC-SVM classifier during the registration to ensure the legality of vehicle in the authentication phase. Performance evaluations via extensive simulations demonstrate the efficiency and effectiveness of the proposed scheme in terms of GAN loss and accuracy.

We propose a one‐time blind signature scheme based on coding theory, which is improved on the basis of the SHMWW protocol. By adding two blinding factors, the anonymity of users is protected. The analysis proves that the scheme is secure and meets the requirements of completeness, blindness, and one‐more unforgeability. Under the 128‐bit security level, our scheme can achieve a signature length of 2.1 kB. The experimental results show that our scheme has a short signature length and high execution efficiency. Our scheme can also be applied to electronic forensics of traffic accidents on the Internet of Vehicles, which can protect users’ privacy.

The conflict between data privacy and sharing among healthcare institutions creates data silos, causing wasteful duplication, incomplete information, and potential hindrances to scientific research. In this article, we present a privacy-preserving medical data sharing scheme based on cloud-assisted private set intersection (PSI) and aggregate signature technique. First, we propose a novel authenticated cloud-assisted PSI, named AC-PSI, which can achieve client authentication and randomized processing of private data by using Diffie–Hellman-based oblivious pseudorandom function (DH-OPRF) and vector oblivious linear-function evaluation-based oblivious pseudorandom function (VOLE-OPRF), respectively. Second, based on the AC-PSI and locally verifiable signature (LVS), we design a privacy-preserving and secure medical data sharing scheme, which can provide enhanced security features by enabling access control of computing resources and resist precomputation attacks from external sources. Our approach has been proven through a rigorous analysis of security. Finally, through comparative analysis with the existing schemes, it is demonstrated that the proposed AC-PSI and medical data sharing scheme has low communication and computation overhead while achieving a higher level of privacy preservation and security.

Wireless connectivity in smart cities relies on widely deployed Internet of Things (IoT) systems. However, the broadcast and open nature of wireless channels in such systems also raise serious security concerns. Covert communication technology presents a promising solution for tackling these challenges. In the multi-relay assisted wireless systems where the warden acts as a jammer, this paper investigates the performance of covert communication. First, the transmission model is introduced and the warden behavior is defined, which will perform detection and jamming throughout the covert communication process. Due to the warden’s jamming, the transmitter must increase its transmit power in order to ensure successful decoding, which increases the risk of detection. To explore this tradeoff in depth, this paper proposes a new theoretical framework to analyze the performance metrics of covert communication. These performance metrics are analyzed and derived under two relay selection schemes, i.e., random selection scheme and superior-link selection scheme. The maximum covert rate is optimized by power control under the condition that the covertness and outage requirements are satisfied. Finally, the results of simulations and numerical experiments confirm the theoretical analysis and visualize the performance of covert communication in systems with active warden.

This paper investigates the covert communications via cooperative jamming and relay selection in a wireless relay system, where a source intends to transmit a message to its destination with the help of a selected relay, and a warden attempts to detect the existence of wireless transmissions from both the source and relay, while friendly jammers send jamming signals to prevent warden from detecting the transmission process. To this end, we first propose two relay selection schemes, namely random relay selection (RRS) and max-min relay selection (MMRS), as well as their corresponding cooperative jamming (CJ) schemes for ensuring covertness in the system. We then provide theoretical modeling for the covert rate performance under each relay selection scheme and its CJ scheme and further explore the optimal transmit power controls of both the source and relay for covert rate maximization. Finally, extensive simulation/numerical results are presented to validate our theoretical models and also to illustrate the covert rate performance of the relay system under cooperative jamming and relay selection.

With the increasing connectivity between and within vehicles, in-vehicle network security has received considerable attention. As the most widely used protocol in in-vehicle network, Controller Area Network (CAN) bus lacks security mechanisms by design, and is vulnerable to various attacks. Although many frameworks have been proposed to solve the security issues of CAN buses, spoofing attacks by compromised Electronic Control Units (ECUs) and reducing message latency while ensuring security remains a challenge. In this paper, we propose an authentication and key distribution scheme for the CAN bus. Specifically, the scheme includes ECU identity authentication, key distribution, and authentication of data frames. By utilizing physically unclonable functions (PUF) technique, each ECU avoids the risk of long-term key leakage, simplifies the key distribute process, and reduces the communication overhead of vehicles. Compared with the state-of-the-art group-based schemes, the proposed scheme has lower computational and communication overhead.

One of the 5G support for IoT is Massive Machine Type Communication (mMTC). However, it also poses a great challenge to the IoT network, which cannot cope with the massive number of devices accessing at the same time. In this paper, we propose a group-oriented authentication scheme which supports a large number of devices accessing. In particular, the proposed scheme enables lightweight intra-group authentication and leader election through collaborative filtering techniques. In addition, our solution enables secure and efficient key agreement and mutual authentication by using Round-Efficient and Sender-Unrestricted Dynamic Group Key Agreement (RESUD-GKA), aggregate signature with forward security and proxy signature. We also introduce software-defined networking (SDN) and combine mobile edge computing (MEC) and network function virtualization (NFV) to fully utilize the links and greatly reduce the time cost. Ultimately, multiple security objectives of the protocol are assessed through the utilization of security analysis and the formal verification tool Scyther. Performance evaluation shows that the proposed scheme has lower bandwidth and transmission overhead compared to existing schemes.

Abstract With the rapid development of smart health, the privacy problem of medical data has become more prominent. Aiming at the problem of mining the potential value of medical data and realizing secure sharing, a fine‐grained medical data sharing scheme based on federated learning is proposed. The scheme uses collaboration‐oriented attribute‐based encryption technologies to formulate fine‐grained access strategies, allowing medical institutions or doctors to decrypt individually or collaboratively with certain conditions to achieve the purpose of accurately screening the required medical data. In the proposed scheme, the model parameters are shared such that the screened medical data is modeled and analyzed based on federated learning, which allows more people to enjoy top medical resources. In addition, a blockchain‐based incentive mechanism is used to reward medical institutions which are either honest with high‐quality or helpful in decryption. Hence, the enthusiasm of various medical institutions to screen data and participate in federal learning is improved. Finally, security analysis shows that the scheme is secure, and theoretical analysis and simulation test show the practicability of the scheme.

The rapid development of smart healthcare system in the Internet of Things (IoT) has made the early detection of many chronic diseases more convenient, quick, and economical. However, when healthcare organizations collect users’ health data through deployed IoT devices, there are issues of compromising users’ privacy. In view of this situation, this paper introduces federated learning technology to solve the problem of data security. In this paper, we consider the two main problems of federated learning applications in IoT smart healthcare system: (1) how to reduce the time overhead of system running and (2) how to authenticate that the user device uploading data is deployed by the system itself. To solve the above problems, we propose the first federated learning scheme based on full dynamic secret sharing. First, we use a two‐mask protocol to keep the user’s local model parameters confidential during federated learning. Then, based on homogeneous linear recursive equation, homomorphic hash function, and elliptic curve cryptosystem, the full dynamic secret sharing and user identity authentication are realized. In addition, our scheme allows users to join or quit during training. Finally, we have carried out simulation test on this scheme. The experimental results show that the efficiency of our scheme is improved by about 60% on average in the case of no user dropping and by about 30% in the case of some users dropping.

Outsourcing medical data to healthcare cloud has become a popular trend. Since medical data of patients contain sensitive personal information, they should be encrypted before outsourcing. However, information retrieval methods based on plaintext cannot be directly applied to encrypted data. In this article, we present a new cryptographic primitive named conjunctive keyword search with secure channel free and autonomous path delegation function (AP-SCF-PECKS), which can be applied in scenarios where patients want to search for and autonomous delegate their private medical information without revealing their private key. Particularly, the proposed solution allows patients to set up multi-hop delegation path with their preferences, and the delegated doctors in the path can search for and access the patient’s private medical information with priority from high to low. Patients can ensure that authorized doctors are always trustworthy, and unauthorized users cannot obtain the private medical information of patients. Moreover, the scheme supports the conjunctive keyword search, secure channel free, and is secure against chosen keyword attack, chosen ciphertext attack, and keyword guessing attack. The security of proposed scheme has been formally proved in the standard model. Finally, the performance evaluations demonstrate that the overhead of proposed scheme are modest for healthcare cloud scenarios.

The deployment of ultra-dense networks in the fifth-generation (5 G) network architecture can significantly improve the quality of wireless links, but this will cause frequent handovers of mobile users and increase authentication delays. Furthermore, the simultaneous influx of a large number of mobile users may cause serious network congestion. Aiming at these problems, this article proposes a novel authentication scheme supporting multi-user access, which fully considers the scenarios of intra-domain handover and inter-domain handover across AMF. Using the characteristics of the network architecture integrated with mobile edge computing (MEC) and software-defined networks (SDN), the user's moving path can be predicted in advance to speed up the handover process. Most importantly, the proposed scheme can perform secure, efficient and flexible mutual authentication and key agreement between the group and the core network by using aggregated message authentication codes with detecting functionality (AMAD) and contributory broadcast encryption technique. Through the use of BAN Logic and Scyther tool verification, the proposed scheme can not only realize multiple user authentication and key agreement, but also fulfill various security goals. Performance evaluations demonstrate that the proposed scheme has moderate computational and communication overhead, and lower transmission overhead compared with existing schemes, which can effectively reduce authentication delay.

Privacy-preserving online ride-hailing (ORH) service enables riders and drivers to conveniently establish optimized ride-hailing through mobile applications without disclosing their location information. In order to alleviate the load of central server and unnecessary increased response latency caused by centralized schemes, we investigate the privacy-preserving ORH matching service in distributed deployment environment. In this paper, we first design three secure outsourced calculation protocols based on Distributed Two-Trapdoor Public-Key Cryptosystem (DT-PKC), including ciphertext packing, blinding and decryption protocol across domains (CPBD), secure Euclidean square distance calculation protocol across domains (SESDC) and secure minimum distance selection protocol (SMDS). Then, we apply the protocols to construct a privacy-preserving distributed ORH matching scheme named pdRide. Geographically distributed road-side unit (RSU) and computation service provider (CSP) collaborate to securely select the matching driver for the requesting rider within a range. Specifically, SESDC can effective calculate the Euclidean square distances between multiple drivers and requesting rider over the encrypted location information with different keys. SMDS can select the driver with the minimum distance for the requesting rider on the encrypted distances. Finally, experiment results demonstrate its effectiveness in terms of communication overhead, computation overhead and transmission latency.

With the processes of collecting, analyzing, and transmitting the data in the Internet of Things (IoT), the Internet of Medical Things (IoMT) comprises the medical equipment and applications connected to the healthcare system and offers an entity with real time, remote measurement, and analysis of healthcare data. However, the IoMT ecosystem deals with some great challenges in terms of security, such as privacy leaking, eavesdropping, unauthorized access, delayed detection of life-threatening episodes, and so forth. All these negative effects seriously impede the implementation of the IoMT ecosystem. To overcome these obstacles, this article presents an efficient, outsourced online/offline revocable ciphertext policy attribute-based encryption scheme with the aid of cloud servers and blockchains in the IoMT ecosystem. Our proposal achieves the characteristics of fine-grained access control, fast encryption, outsourced decryption, user revocation, and ciphertext verification. It is noteworthy that based on the chameleon hash function, we construct the private key of the data user with collision resistance, semantically secure, and key-exposure free to achieve revocation. To the best of our knowledge, this is the first protocol for a revocation mechanism by means of the chameleon hash function. Through formal analysis, it is proven to be secure in a selectively replayable chosen-ciphertext attack (RCCA) game. Finally, this scheme is implemented with the Java pairing-based cryptography library, and the simulation results demonstrate that it enables high efficiency and practicality, as well as strong reliability for the IoMT ecosystem.

Finding an empty parking lot in a downtown or busy area is difficult and time consuming. Smart parking services enable vehicles to obtain real-time parking information, which has great potential to mitigate the parking problem. Compared with the existing parking methods, the cooperative parking information sharing based on vehicular crowdsourcing has lower cost and higher accuracy. However, vehicles face the threat of identity and trajectory privacy leakage. In order to provide secure and reliable parking service, we propose a secure and reliable smart parking scheme (SRSP) with dual privacy preservation. Specifically, a novel group signature technique can be equipped to achieve anonymous authentication among vehicles, parking server, and fog node. Meanwhile, the mix zone method combined with differential privacy can be utilized to hide the vehicles' trajectory. Moreover, message-lock encryption technique enables fog node to detect and delete duplicated reports to reduce the computational overhead of parking server. An incentive mechanism is proposed, which can not only reward contributing vehicles but also prevent the same vehicle from getting multiple rewards. In addition, the trust model is designed to evaluate the reliability of vehicles based on direct trust and recommendation trust. Finally, security analysis demonstrates that SRSP can achieve security objectives. Performance evaluation shows that SRSP has lower computational overhead compared with the existing schemes.

In the Big Data Era, outsourcing computation has become increasingly significant as it supplies computation resources for clients with limited resources. However, there are still many security challenges such as payment fairness, privacy protection, and verification. In this paper, we propose a secure publicly verifiable outsourcing computation scheme for the large-scale matrix QR decomposition. In the proposed scheme, client can pay for outsourcing services through blockchain-based payment system which achieves the payment fairness. Moreover, to protect privacy, both permutation matrix and block diagonal matrix are applied in encryption process. Meanwhile, to achieve the public verification, the computational complexity is reduced by using the matrix digest technology. It is worth mentioning that our scheme is provable and secure under the co-CDH assumption.

The evolving fifth generation (5G) cellular networks will be a collection of heterogeneous and backward-compatible networks. With the increased heterogeneity and densification of 5G heterogeneous networks (HetNets), it is important to ensure security and efficiency of frequent handovers in 5G wireless roaming environments. However, existing handover authentication mechanisms still have challenging issues, such as anonymity, robust traceability and universality. In this paper, we address these issues by introducing RUSH, a Robust and Universal Seamless Handover authentication protocol for 5G HetNets. In RUSH, anonymous mutual authentication with key agreement is enabled for handovers by exploiting the trapdoor collision property of chameleon hash functions and the tamper-resistance of blockchains. RUSH achieves universal handover authentication for all the diverse mobility scenarios, as exemplified by the handover between 5G new radio and non-3GPP access regardless of the trustworthiness of non-3GPP access and the consistency of the core network. RUSH also achieves perfect forward secrecy, master key forward secrecy, known randomness secrecy, key escrow freeness and robust traceability. Our formal security proofs based on the BAN-logic and formal verification based on AVISPA indicate that RUSH resists various attacks. Comprehensive performance evaluation and comparisons show that RUSH outperforms other schemes in both computation and communication efficiencies.

As a milestone in the development of outsourcing services, cloud computing enables an increasing number of individuals and enterprises to enjoy the most advanced services from outsourcing service providers. Because online payment and data security issues are involved in outsourcing services, the mutual distrust between users and service providers may severely impede the wide adoption of cloud computing. Nevertheless, most existing solutions only consider a specific type of services and rely on a trusted third-party to realize fair payment. In this paper, to realize secure and fair payment of outsourcing services in general without relying on any third-party, trusted or not, we introduce BPay, an outsourcing service fair payment framework based on blockchain in cloud computing. We first propose the system architecture, adversary model and design goals of BPay, then describe the design details. Our security and compatibility analysis indicates that BPay achieves soundness and robust fairness and it is compatible with the Bitcoin blockchain and the Ethereum blockchain. The key to the robust fairness and compatibility lies in an all-or-nothing checking-proof protocol and a top-down checking method. In addition, our experimental results show that BPay is computationally efficient. Finally, we present the applications of BPay in outsourcing services.

The high-precision maps can provide additional information on roads and conditions, which plays an important role in autonomous vehicles (AVs) navigation. Compared with the existing map update methods, the real-time map updates based on crowdsensing have lower cost and higher accuracy. However, in the process of map update, the map service platform (MSP) cannot recruit enough vehicle users to obtain the sensing data due to a lack of incentive mechanism. Therefore, how to motivate more vehicle users to provide high-quality sensing data is the key for real-time map updates. In this article, we propose a secure and privacy-preserving incentive scheme for reliable real-time map updates, named SPIR. Specifically, under the condition of limited service platform budget and limited vehicle user's ability, an effective incentive mechanism based on reverse auction is presented, which can solve two core problems: i.e., payment control for MSP and completion quality for vehicle users. Meanwhile, a credit management and payment system based on the blockchain technique are designed. In addition, the partially blind signature technique is applied to guarantee the security of the incentive mechanism and protect the privacy of vehicle users. Both theoretical analysis and simulation results indicate that the proposed SPIR achieves near-optimal benefits, which can provide the fair reward for vehicle users and reasonable budget for the MSP. In the real-time map update services, SPIR can guarantee the computational efficiency and data reliability.

In recent years, it has become popular to upload patients’ medical data to a third-party cloud server (TCS) for storage through medical Internet of things. It can reduce the local maintenance burden of the medical data and importantly improve accuracy in the medical treatment. As remote TCS cannot be fully trusted, medical data should be encrypted before uploading, to protect patients’ privacy. However, encryption makes search capabilities difficult for patients and doctors. To address this issue, Huang et al. recently put forward the notion of Public-key Authenticated Encryption with Keyword Search (PAEKS) against inside keyword guessing attacks. However, the existing PAEKS schemes rely on time-consuming computation of parings. Moreover, some PAEKS schemes still have security issues in a multiuser setting. In this paper, we propose a new and efficient PAEKS scheme, which uses the idea of Diffie-Hellman key agreement to generate a shared secret key between each sender and receiver. The shared key will be used to encrypt keywords by the sender and to generate search trapdoors by the receiver. We prove that our scheme is semantically secure against inside keyword guessing attacks in a multiuser setting, under the oracle Diffie-Hellman assumption. Experimental results demonstrate that our PAEKS scheme is more efficient than that of previous ones, especially in terms of keyword searching time.

As an important application of the Internet of Things technologies, mobile healthcare crowd sensing (MHCS) still has challenging issues, such as privacy protection and efficiency. Quite recently in the IEEE Internet of Things Journal (DOI: 10.1109/JIOT.2018.2828463), Liuet al.proposed a large-scale concurrent data anonymous batch verification scheme for MHCS, claiming to provide batch authentication, nonrepudiation, and anonymity. However, after a close look at the scheme, we point out that the scheme suffers two types of signature forgery attacks and hence fails to achieve the claimed security properties. In addition, a reasonable and rigorous probability analysis indicates that the security reduction from the security of the scheme to the hardness of the computational Diffie–Hellman problem is invalid. We hope that similar design flaws can be avoided in future design of anonymous batch verification schemes for MHCS.

Due to the advantages of larger content and error correction capability, quick response (QR) code is commonly used as a tagging technology for the Internet of Things (IoT) recently. However, the cover message of QR code can be easily decoded by a QR code reader, which causes the security and privacy of the cover message to raise the important issues. In this paper we present a new secret hiding scheme based on QR code. The proposed scheme has low computational complexity and is suitable for low-power devices in IoT systems because of utilizing the error correction property of QR code to hide secret information. The proposed scheme hides the secret information without changing the cover message of QR code and the user can get the cover message by using a general scanner, which contributes to reducing attacker’s curiosity. The hidden secret information can be read by a special scanner with the help of the user key. One thing which is better than other known schemes is that the proposed scheme can resist contrast analysis attack. In addition, experimental results show the proposed scheme has feasibility, low computational complexity, and high hiding payload.

With the digitalization of various industries, the combination of cloud computing and the industrial Internet of Things (IIoT) has become an attractive data processing paradigm. However, the cloud-assisted IIoT still has challenging issues, including authenticity of data, untrustworthiness of third parties, and system robustness and efficiency. Recently, a lightweight certificateless signature (CLS) scheme for the cloud-assisted IIoT, that was claimed to address both authenticity of data and untrustworthiness of third parties, has been proposed by Karati et al. (2018). In this paper, we demonstrate that the CLS scheme fails to achieve the claimed security properties by presenting four types of signature forgery attacks. We also propose a robust certificateless signature (RCLS) scheme to address the aforementioned challenges. Our RCLS only needs public channels and is proven secure against both public key replacement attacks and malicious-but-passive third parties in the standard model. Performance evaluation indicates that the RCLS scheme outperforms other CLS schemes and is suitable for the IIoT.

With the progress of cloud computing, many users hope in time to upload their data into cloud for sharing. For sensitive data, the owner must encrypt it before sending it to cloud server. The state of the art method for fine-grained access control on encrypted data is attribute-based encryption (ABE). Though ABE is believed to be an outstanding technique for secure data sharing, it has many efficiency drawbacks. For example, its ciphertext size and decryption time increase linearly with the number of attributes used during encryption and decryption, and it is hard to revoke a user’s access ability. In this paper, we propose a method to outsource the decryption of ABE via public cloud computing, and to control a user’s decryption capacity through a bounded revocation technique. The public cloud server can transform any user’s ABE ciphertexts into short ElGamal-type ciphertexts via the user’s public transformation key. The transformed ciphertexts are actually ElGamal-type identity-based ciphertexts obtained through a bounded-collision identity-based encryption scheme, and the decryption time only requires one exponentiation. Our scheme can revoke user’s decryption ability. But it limits to scenario with bounded number of revocation.

With the rapid development of the Internet of Things and cloud computing technologies, smart health (s-health) is expected to significantly improve the quality of health care. However, data security and user privacy concerns in s-health have not been adequately addressed. As a well-received solution to realize fine-grained access control, ciphertext-policy attribute-based encryption (CP-ABE) has the potential to ensure data security in s-health. Nevertheless, direct adoption of the traditional CP-ABE in s-health suffers two flaws. For one thing, access policies are in cleartext form and reveal sensitive health-related information in the encrypted s-health records (SHRs). For another, it usually supports small attribute universe, which places an undesirable limitation on practical deployments of CP-ABE because the size of its public parameters grows linearly with the size of the universe. To address these problems, we introduce PASH, a privacy-aware s-health access control system, in which the key ingredient is a large universe CP-ABE with access policies partially hidden. In PASH, attribute values of access policies are hidden in encrypted SHRs and only attribute names are revealed. In fact, attribute values carry much more sensitive information than generic attribute names. Particularly, PASH realizes an efficient SHR decryption test which needs a small number of bilinear pairings. The attribute universe can be exponentially large and the size of public parameters is small and constant. Our security analysis indicates that PASH is fully secure in the standard model. Performance comparisons and experimental results show that PASH is more efficient and expressive than previous schemes.

With the development of the smart health (s-health), data security and patient privacy are becoming more and more important. However, some traditional cryptographic schemes can not guarantee data security and patient privacy under various forms of leakage attacks. To prevent the adversary from capturing the part of private keys by leakage attacks, we propose a secure leakage-resilient s-health system which realizes privacy protection and the safe transmission of medical information in the case of leakage attacks. The key technique is a promising public key cryptographic primitive called leakage-resilient anonymous Hierarchical Identity-Based Encryption. Our construction is proved to be secure against chosen plaintext attacks in the standard model under the Diffie-Hellman exponent assumption and decisional linear assumption. We also blind the public parameters and ciphertexts by using double exponent technique to achieve the recipient anonymity. Finally, the performance analysis shows the practicability of our scheme, and the leakage rate of the private key approximates to 1/6.

The rapid advancements in the Internet of Things (IoT) and cloud computing technologies have significantly promoted the collection and sharing of various data. In order to reduce the communication cost and the storage overhead, it is necessary to exploit data deduplication mechanisms. However, existing data deduplication technologies still suffer security and efficiency drawbacks. In this paper, we propose two secure data deduplication schemes based on Rabin fingerprinting over wireless sensing data in cloud computing. The first scheme is based on deterministic tags and the other one adopts random tags. The proposed schemes realize data deduplication before the data is outsourced to the cloud storage server, and hence both the communication cost and the computation cost are reduced. In particular, variable-size block-level deduplication is enabled based on the technique of Rabin fingerprinting which generates data blocks based on the content of the data. Before outsourcing data to the cloud, users encrypt the data based on convergent encryption technologies, which protects the data from being accessed by unauthorized users. Our security analysis shows that the proposed schemes are secure against offline brute-force dictionary attacks. In addition, the random tag makes the second scheme more reliable. Extensive experimental results indicate that the proposed data deduplication schemes are efficient in terms of the deduplication rate, the system operation time, and the tag generation time.

Several factors (e.g., balancedness, good correlation immunity) are considered as important properties of Boolean functions for using in cryptographic primitives. A Boolean function is perfect algebraic immune if it is with perfect immunity against algebraic and fast algebraic attacks. There is an increasing interest in construction of Boolean function that is perfect algebraic immune combined with other characteristics, like resiliency. A resilient function is a balanced correlation-immune function. This paper uses bivariate representation of Boolean function and theory of finite field to construct a generalized and new class of Boolean functions on even variables by extending the Carlet-Feng functions. We show that the functions generated by this construction support cryptographic properties of 1-resiliency and (sub)optimal algebraic immunity and further propose the sufficient condition of achieving optimal algebraic immunity. Compared experimentally with Carlet-Feng functions and the functions constructed by the method of first-order concatenation existing in the literature on even (from 6 to 16) variables, these functions have better immunity against fast algebraic attacks. Implementation results also show that they are almost perfect algebraic immune functions.

Recently, the platoon-based vehicular cyber-physical system (VCPS) has attracted significant attention because the platoon based driving pattern can bring many benefits. In the platoon-based VCPS, the platoon members may change quite dynamically because vehicles can join or leave the platoon at any time. Therefore, how to securely and efficiently set up and maintain a platoon is a challenge. To address this issue, in this paper, we propose a secure and privacy-preserving group setup framework, called SPGS, for platoon-based VCPS. The key components of SPGS are two group setup policies that can be developed based on two kinds of techniques: attribute-based encryption and contributory key agreement. Based on these group setup policies, we propose two authentication protocols, respectively. The first one can authenticate all vehicles in the platoon simultaneously. The second one can guarantee anonymous authentication with traceability. With SPGS, a temporary platoon can be securely set up and maintained, and platoon merging/splitting can also be flexibly supported. Finally, we carry out extensive analysis to show the security and efficiency of our proposed SPGS. Copyright © 2016 John Wiley & Sons, Ltd.

In order to realize attribute-based data sharing in cloud computing, multi-authority attribute-based encryption (MA-ABE) is extremely attractive. However, most of the existing MA-ABE schemes cannot support a fully large attribute universe and are not suitable for resource-constrained mobile data owners in that the computation cost in secret key generation and encryption is extremely heavy. To tackle the earlier challenges, we propose an online/offline MA-ABE scheme, which realizes both the online/offline secret key generation and the online/offline encryption while supporting a fully large attribute universe. In the offline phase, one global-identity authority and multiple attribute authorities do the majority of the work to issue attribute secret keys before knowing users' global identity and attributes. The data owner can perform most of the encryption computation tasks before knowing the actual message and access structure. Furthermore, the online phase can rapidly assemble the final decryption key and ciphertexts when related specifications become known. Particularly, global-identity authority and attribute authorities need not to cooperate in the whole process. Our online/offline MA-ABE scheme allows the access policies encoded in linear secret sharing schemes. The formal selective security proof and extensive performance analysis indicate that our scheme is very suitable for data sharing in mobile cloud computing. Copyright © 2016 John Wiley & Sons, Ltd.

Abstract With a great variety of potential applications, machine‐type communications (MTC) is gaining a tremendous interest from mobile network operators and research groups. MTC is standardized by the 3rd Generation Partnership Project (3GPP), which has been regarded as the promising solution facilitating machine‐to‐machine communications. In the latest standard, 3GPP proposes a novel architecture for MTC, in which the MTC server is located outside the operator domain. However, the connection between the 3GPP core network and MTC server in this scenario is insecure; consequently, there are distrustful relationships among MTC device, core network, and MTC server. If the security issue is not well addressed, all applications involved in MTC cannot be put into the market. To address this problem, we propose an end‐to‐end security scheme for MTC based on the proxy‐signature technique, called E2SEC. Specifically, both the MTC device and MTC server can establish strong trustful relationships with each other by using the proxy signatures issued by the 3GPP core network. Moreover, we present some implementation considerations of E2SEC and analyze the performance during authentication by comparing the operational cost of three cases that apply three different signature algorithms, that is, ElGamal, Schnorr, and DSA. Through security analysis by using Automatic Cryptographic Protocol Verifier (ProVerif), we conclude that the proposed E2SEC scheme can achieve the security goals and prevent various security threats. Copyright © 2015 John Wiley & Sons, Ltd.

Progressive Edge-Growth(PEG) Algorithm is a good candidate to generate Tanner Graphs with a large girth by establishing edges or connections between symbol and check nodes in an edge-by-edge manner. In this paper, we propose an extended PEG algorithm for constructing Low-Density Parity-Check (LDPC) codes with very high rate when given a lower bound of girth. Simulation results show the bit error rates of constructed LDPC codes with very high rate or large girth.

Blind signature is the concept to ensure anonymity of e-coin. Untracebility and unlinkability are two main properties of real coin, which require mimicking electronically. Proxy signature schemes allow a proxy signer to generate a proxy signature on behalf of an original signer. All the previous proxy signature schemes are based on ElGamal-type schemes. We propose a new proxy blind signature scheme based on an ID-based signature scheme, which uses bilinear pairings of elliptic curves or hyperelliptic curves.