Cloud-assisted Internet of Things (IoT) is a new paradigm to compensate for the disadvantage of limited resources in IoT and extend the functional boundary of IoT. How to preserve the data privacy while identifying the data source in cloud-assisted IoT is a huge challenge and many cryptographic primitives such as matchmaking encryption (ME) are hence introduced to reach this goal. However, we observe that these tools fail to deal with some rigorous cases in which the data owner does not want anyone to disclose the entire data and even authorized users can only obtain a specified part. In this paper, to address such issue, we design a privacy-preserving data computing system with bilateral access control (PDCS-BAC) for cloud-assisted IoT based on a new primitive called identity-based matchmaking functional encryption (IB-MFE). We give the formal definition and security model of IB-MFE, then present two concrete IB-MFE schemes for inner-product function. Thus, PDCS-BAC manages to simultaneously provide flexible privacy computation with enhanced data privacy, bilateral access control, and data authenticity. Finally, we conduct comprehensive performance evaluations to demonstrate the practicability of our schemes for cloud-assisted IoT.

We present an inner‐product matchmaking encryption (IP‐ME) scheme achieving weak privacy and authenticity in prime‐order groups under symmetric external Diffie–Hellman (SXDH) assumption in the standard model. We further present an IP‐ME with Monotone Span Program Authenticity (IP‐ME with MSP Auth) scheme, where the chosen sender policy is upgraded to MSP, and the scheme also achieves weak privacy and authenticity in prime‐order groups under SXDH assumption in the standard model. Both of the schemes have more expressive functionalities than identity‐based matchmaking encryption (IB‐ME) scheme, and are simpler than Ateniese et al.’s modular ME scheme (Crypto’ 19). But our schemes only achieve a very limited flavor of security, which is reflected in the privacy.