With the rapid evolution of Internet of Things (IoT) devices, privacy-sensitive data is exploding, creating significant obstacles in the sharing and retrieval of information. To enable high-precision data retrieval and fine-grained sharing, only the integration of Attribute-Based Searchable Encryption (ABSE) with cloud storage can fulfill these requirements while ensuring security. However, existing ABSE schemes face major limitations in IoT scenarios. Publicly accessible access policies and unprotected private key attribute sets pose risks of information leakage. In addition, the limited expressiveness of access policies and high computational overhead hinder their practical deployment in IoT environments. In this paper, we propose an Efficient Attribute-Based Searchable Encryption with Dual Privacy Protection (EASDP). By fully hiding access policies and attributes, our scheme ensures strong privacy against cloud inference attacks.We enhance the expressiveness of access control through sub-policy division and improve efficiency for resource-constrained IoT devices using techniques such as offline encryption, outsourced decryption, and keyword–attribute matching. The scheme is formally proven secure. The experimental results demonstrate its high performance in encryption and decryption at the user side and its suitability for various IoT devices, confirming its effectiveness in secure and flexible data sharing across IoT healthcare applications.

Abstract The encryption of user data is crucial when employing electronic health record services to guarantee the security of the data stored on cloud servers. Attribute-based encryption (ABE) scheme is considered a powerful encryption technique that offers flexible and fine-grained access control capabilities. Further, the multi-user collaborative access ABE scheme additionally supports users to acquire access authorization through collaborative works. However, the existing multi-user collaborative access ABE schemes do not consider the different weights of collaboration users. Therefore, using these schemes for weighted multi-user collaborative access results in redundant attributes, which inevitably reduces the efficiency of the ABE scheme. This paper proposes a revocable and verifiable weighted attribute-based encryption with collaborative access scheme (RVWABE-CA), which can provide efficient weighted multi-user collaborative access, user revocation, and data integrity verification, as the fundamental cornerstone for establishing a robust framework to facilitate secure sharing of electronic health records in a public cloud environment. In detail, this scheme employs a novel weighted access tree to eliminate redundant attributes, utilizes encryption version information to control user revocation, and establishes Merkle Hash Tree for data integrity verification. We prove that our scheme is resistant against chosen plaintext attack. The experimental results demonstrate that our scheme has significant computational efficiency advantages compared to related works, without increasing storage or communication overhead. Therefore, the RVWABE-CA scheme can provide an efficient and flexible weighted collaborative access control and user revocation mechanism as well as data integrity verification for electronic health record systems.

To reduce data storage costs, more individuals are using cloud servers for reliable, scalable, cost-effective, and globally accessible solutions. However, storing data in plaintext on cloud servers can lead to data leakage risks. Moreover, the advancement of quantum computing poses a threat to traditional encryption algorithms. To counter quantum computing attacks and enable searches over encrypted keywords, lattice-based searchable encryption with conjunctive keyword search has been implemented. Nonetheless, existing schemes expose keyword fields and leaks additional information. To mitigate this, we propose a privacy-preserving method based on lattice hardness assumptions. It enables testing the existence of an encrypted keyword in a set of encrypted keywords without requiring the keyword fields. Additionally, we propose two improved methods: one for inclusion-based searches between two keyword sets, and another for range-based keyword searches. These form the basis for three lattice-based identity-based searchable encryption schemes that support disjunctive, conjunctive, and range keyword searches, respectively. The storage overhead of ciphertexts and trapdoors is unaffected by the number of keywords, making our scheme suitable for multi-keyword search scenarios. Our formal security analysis uses the learning with errors (LWE) assumption and our theoretical analysis and experimental simulations show comparable efficiency and low storage overhead.

The cloud-edge collaborative data sharing supporting data confidentiality can be realized by adopting outsourced Attribute-Based Encryption (ABE) schemes. Yet, most existing schemes in such kind of scenarios are facing challenges such as vulnerable terminal devices that are easy to be attacked, lack of flexible authorization management methods for a large number of devices, and lack methods to securely specify on-demand data sharing domains. In this paper, we propose a Domain-specific On-demand Access Control scheme with fully Independent Revocation (DOACIR), which not only realizes a three-layer on-demand data sharing framework for cloud-edge collaborative IoT environments but also allows data uploader to restrict the data sharing domain through a succinct way. The attribute authority and multiple edge servers perform data access authorization collaboratively to improve the data sharing efficiency as well as avoid the key-abuse problem and key-leakage problem. Fully independent user revocation is also realized in DOACIR to flexibly manage terminal devices in IoT. Further, we improve the scheme to support cross-domain data sharing, namely Cross-Domain DOACIR (CD-DOACIR), by improving the encryption phase allowing data uploader to specify any number of sharing domains while the size of ciphertext remains constant. We provide the security proofs of DOACIR and CD-DOACIR, and the experiment results demonstrate the effectiveness and efficiency of our solutions in cloud-edge collaborative on-demand data sharing.

J1C2 Presentation Abstract at IEEE SERVICES 2022 for IEEE Transactions on Services Computing, doi: 10.1109/TSC.2021.3086023

Cloud storage service provides a convenient way for users to store massive data. To guarantee the integrity of the outsourced data, provable data possession (PDP) schemes for multi-copy data and multi-cloud have been proposed respectively. To avoid a single point of failure and to increase the security of the outsourced data, many users store multiple copies on multiple cloud servers. However, few protocols support multi-copy data and multi-cloud at the same time. Considering that three entities (third-party auditor, cloud organizer and cloud storage servers) participate in the auditing process, it is difficult for users to locate the position of the faults, including entity position, file position and data block corruption position, when the auditor reports data corruption. In this paper we propose a certificateless multi-copy public auditing protocol in multi-cloud storage, which supports to locate the faults entities and corrupted data blocks. Specifically, instead of relying on a trusted centralized judgement entity to deal with the faults detection, smart contracts combined with the binary search technique are utilized to help achieve the reliability of faults localization result and the accuracy of the judgement. Additionally, the proposed protocol supports data dynamics update, including data modification, insertion and deletion. Theoretical analysis and experiment results show that our protocol is efficient and practical.

Attribute-based encryption scheme is a promising mechanism to realize one-to-many fine-grained access control which strengthens the security in cloud computing. However, massive amounts of data and various data sharing requirements bring great challenges to the complex but isolated and fixed access structures in most of the existing attribute-based encryption schemes. In this paper, we propose an attribute-based hierarchical encryption scheme with extendable policy, called Extendable Hierarchical Ciphertext-Policy Attribute-Based Encryption (EH-CP-ABE), to improve the data sharing efficiency and security simultaneously. The scheme realizes the function of hierarchical encryption, in which, data with hierarchical access control relationships could be encrypted together flexibly to improve the efficiency. The scheme also achieves external and internal extension of the access structure to further encrypt newly added hierarchical data without updating the original ciphertexts or with only a minor update depending on the data sharing requirements, which simplifies the encryption process and greatly reduces the computation overhead. We formally prove the security of the scheme is IND-CCA secure in the random oracle model based on bilinear Diffie-Hellman assumption, and we also implement our scheme to demonstrate its efficiency and practicality.

Traditional data sharing systems are facing new challenges when implementing access control with more and more complex data sharing requirements. Flexibility of user revocation in completely decentralized environments needs to be taken into account. In this article, we propose a Key-Policy Attribute-Based Encryption scheme with Multiple and Flexible Revocation (MAFR-KP-ABE) to achieve the features of decentralized authorization and flexible revocation. We prove the security of our MAFR-KP-ABE scheme in the standard model and provide the comparison with relevant schemes to demonstrate its efficiency. Then we propose a fine-grained access control system based on MAFR-KP-ABE scheme and blockchain that matches the need of paid data sharing services with several security properties enhanced. Security analysis and system implementation are given subsequently to demonstrate our system efficient and secure.

Thanks to its convenience and cost-savings feature, cloud computing ushers a new era. Yet its security and privacy issues must not be neglected. Private set intersection (PSI) is useful and important in many cloud computing applications, such as document similarity, genetic paternity and data mining. The cloud server performs intersection operations on two outsourced encrypted datasets of data owners. In the existing protocols, however, data owners cannot decide whether to use all or part of their encrypted data to compute the intersection, nor can they specify whom to compare with. In this paper, we introduce an enhanced notion of outsourced PSI, called authorized PSI (APSI), which supports flexible authorization and cross-type authorized comparison of datasets. To demonstrate this notion, we propose a concrete APSI protocol, and prove it to be secure in the random oracle model based on simple number-theoretic assumptions. Experimental results show that our APSI protocol has performance comparable with existing related outsourced PSI protocols.