In traditional cloud storage systems, attribute-based encryption (ABE) is regarded as an important technology for solving the problem of data privacy and fine-grained access control. However, in all ABE schemes, the private key generator has the ability to decrypt all data stored in the cloud server, which may bring serious problems such as key abuse and privacy data leakage. Meanwhile, the traditional cloud storage model runs in a centralized storage manner, so single point of failure may leads to the collapse of system. With the development of blockchain technology, decentralized storage mode has entered the public view. The decentralized storage approach can solve the problem of single point of failure in traditional cloud storage systems and enjoy a number of advantages over centralized storage, such as low price and high throughput. In this paper, we study the data storage and sharing scheme for decentralized storage systems and propose a framework that combines the decentralized storage system interplanetary file system, the Ethereum blockchain, and ABE technology. In this framework, the data owner has the ability to distribute secret key for data users and encrypt shared data by specifying access policy, and the scheme achieves fine-grained access control over data. At the same time, based on smart contract on the Ethereum blockchain, the keyword search function on the cipher text of the decentralized storage systems is implemented, which solves the problem that the cloud server may not return all of the results searched or return wrong results in the traditional cloud storage systems. Finally, we simulated the scheme in the Linux system and the Ethereum official test network Rinkeby, and the experimental results show that our scheme is feasible.

A Blockchain-Based Framework for Data Sharing With Fine-Grained Access Control in Decentralized Storage Systems

Cloud storage service supplies people with an efficient method to share data within a group. The cloud server is not trustworthy, so lots of remote data possession checking (RDPC) protocols are proposed and thought to be an effective way to ensure the data integrity. However, most of RDPC protocols are based on the mechanism of traditional public key infrastructure (PKI), which has obvious security flaw and bears big burden of certificate management. To avoid this shortcoming, identity-based cryptography (IBC) is often chosen to be the basis of RDPC. Unfortunately, IBC has an inherent drawback of key escrow. To solve these problems, we utilize the technique of certificateless signature to present a new RDPC protocol for checking the integrity of data shared among a group. In our scheme, user's private key includes two parts: a partial key generated by the group manager and a secret value chosen by herself/himself. To ensure the right public keys are chosen during the data integrity checking, the public key of each user is associated with her unique identity, for example the name or telephone number. Thus, the certificate is not needed and the problem of key escrow is eliminated too. Meanwhile, the data integrity can still be audited by public verifier without downloading the whole data. In addition, our scheme also supports efficient user revocation from the group. The security of our scheme is reduced to the assumptions of computational Diffie-Hellman (CDH) and discrete logarithm (DL). Experiment results exhibit that the new protocol is very efficient and feasible.

Certificateless Public Integrity Checking of Group Shared Data on Cloud Storage

As a milestone in the development of outsourcing services, cloud computing enables an increasing number of individuals and enterprises to enjoy the most advanced services from outsourcing service providers. Because online payment and data security issues are involved in outsourcing services, the mutual distrust between users and service providers may severely impede the wide adoption of cloud computing. Nevertheless, most existing solutions only consider a specific type of services and rely on a trusted third-party to realize fair payment. In this paper, to realize secure and fair payment of outsourcing services in general without relying on any third-party, trusted or not, we introduce BPay, an outsourcing service fair payment framework based on blockchain in cloud computing. We first propose the system architecture, adversary model and design goals of BPay, then describe the design details. Our security and compatibility analysis indicates that BPay achieves soundness and robust fairness and it is compatible with the Bitcoin blockchain and the Ethereum blockchain. The key to the robust fairness and compatibility lies in an all-or-nothing checking-proof protocol and a top-down checking method. In addition, our experimental results show that BPay is computationally efficient. Finally, we present the applications of BPay in outsourcing services.

https://ink.library.smu.edu.sg/cgi/viewcontent.cgi?article=5112&context=sis_research

Outsourcing Service Fair Payment Based on Blockchain and Its Applications in Cloud Computing

Ciphertext-Policy Attribute-Based Keyword Search (CP-ABKS) facilitates search queries and supports fine-grained access control over encrypted data in the cloud. However, prior CP-ABKS schemes were designed to support unshared multi-owner setting, and cannot be directly applied in the shared multi-owner setting (where each record is accredited by a fixed number of data owners), without incurring high computational and storage costs. In addition, due to privacy concerns on access policies, most existing schemes are vulnerable to off-line keyword-guessing attacks if the keyword space is of polynomial size. Furthermore, it is difficult to identify malicious users who leak the secret keys when more than one data user has the same subset of attributes. In this paper, we present a privacy-preserving CP-ABKS system with hidden access policy in Shared Multi-owner setting (basic ABKS-SM system), and demonstrate how it is improved to support malicious user tracing (modified ABKS-SM system). We then prove that the proposed ABKS-SM systems achieve selective security and resist off-line keyword-guessing attack in the generic bilinear group model. We also evaluate their performance using real-world datasets.

https://ink.library.smu.edu.sg/cgi/viewcontent.cgi?article=5121&context=sol_research

Privacy-Preserving Attribute-Based Keyword Search in Shared Multi-owner Setting

Hierarchical attribute based encryption with continuous leakage-resilience

Attribute based encryption (ABE) is a popular cryptographic technology to protect the security of users’ data. However, the decryption cost and ciphertext size restrict the application of ABE in practice. For most existing ABE schemes, the decryption cost and ciphertext size grow linearly with the complexity of access structure. This is undesirable to the devices with limited computing capability and storage space. Outsourced decryption is considered as a feasible method to reduce the user's decryption overhead, which enables a user to outsource a large number of decryption operations to the cloud service provider (CSP). However, outsourced decryption cannot guarantee the correctness of transformation done by the cloud, so it is necessary to check the correctness of outsourced decryption to ensure security for users’ data. Current research mainly focuses on verifiability of outsourced decryption for the authorized users. It still remains a challenging issue that how to guarantee the correctness of outsourced decryption for unauthorized users. In this paper, we propose an ABE scheme with verifiable outsourced decryption (called full verifiability for outsourced decryption), which can simultaneously check the correctness for transformed ciphertext for the authorized users and unauthorized users. The proposed ABE scheme with verifiable outsourced decryption is proved to be selective CPA-secure in the standard model.

Full Verifiability for Outsourced Decryption in Attribute Based Encryption

The invention discloses an encryption system based on attributes. The encryption system comprises a system parameter setting module, a key generation module, an encryption module, a decryption module, a cryptograph retrieval module, a re-encryption key generation module, a re-encryption module and a private key re-generation module, wherein the system parameter setting module is used for generating system public parameters, the key generation module is used for generating private keys of users for decrypting messages according to attribute sets of the users; the encryption module is used for encrypting the messages; the decryption module is used for decrypting the messages, the cryptograph retrieval module is used for retrieving the cryptographs; the re-encryption key generation module is used for generating re-encryption keys and updating the cryptographs and the private keys; the re-encryption module is used for re-encrypting the messages on the basis of the original cryptographs; the private key re-generation module is used for updating the private keys of the users. The invention further discloses an encryption method based on the attributes. By the encryption system and method based on the attributes, the problem of privacy protection during cloud computing can be solved, attribute withdrawal and safety retrieval of the cryptographs are supported, and the encryption system is high in flexibility.

Encryption method and system based on attributes

The invention discloses a method and a system for protecting a condition privacy of an internet of vehicles based on certificateless batch verification. The method comprises the following steps: a key generation center KGA and a track authentication center TRA jointly generate a master key and a system parameter of the internet of vehicles; according to the system parameter and vehicle user real identity information, the TRA generates a pseudonym identity of a vehicle user; the KGC generates a partial private key of the vehicle user; the vehicle user generates an own key; the vehicle user signs a message; an RSU carries out verification on a signature; and the RSU carries out the batch verification on the signature. According to the method and the system disclosed by the invention, by adopting a certificateless cryptography system, the unsolvable inherent certificate management problem and the certificate maintenance problem in the traditional public key cryptography system are effectively solved; and meanwhile, the key escrow problem caused by an identity-based cryptography system is also avoided; by adopting a batch verification technology, the signature verification efficiency in the internet of vehicles is improved; and in the internet of vehicles, the key generation center KGA and the track authentication center TRA are adopted to realize the condition privacy protection on the internet of vehicles.

Method and system for protecting condition privacy of internet of vehicles based on certificateless batch verification

The invention discloses an Internet of vehicle condition privacy protection method based on certificateless aggregate signcryption and a system, wherein the method and the system have excellent performance based on a certificateless password system. According to the method, problems of certificate management and secret key escrow can be avoided, calculation efficiency of the Internet of vehicle during aggregate signcryption verification and aggregate signcryption efficiency during network transmission are improved, condition privacy protection of Internet-of-vehicle users is realized, and the method and the system can be safely utilized in the open Internet of vehicle.

Internet of vehicle condition privacy protection method based on certificateless aggregate signcryption and system

The invention provides an outsourced key generation and decryption property-based system capable of realizing keyword search. The outsourced key generation and decryption property-based system capable of realizing the keyword search comprises a public parameter setting server, a user private key generation server, an outsourced user private key generation server, a trap door generation server, an encryption server, an outsourced decryption server and a decryption server, wherein the public parameter setting server is in charge of generating a system master key and public parameters; the user private key generation server is in charge of generating a private key pair and a local user private key; the outsourced user private key generation server is in charge of generating an outsourced user private key; the trap door generation server is in charge of assisting a user to generate an inquiry password and a trap door; the encryption server is in charge of encrypting a message and generating corresponding ciphertext and keyword indexes; the outsourced decryption server is in charge of decrypting an outsourced part of the ciphertext according with user right and searching for matching ciphertext by adopting the trap door submitted by the user; and the decryption server decrypts partially decrypted ciphertext, so that the message is restored. The invention provides a method for searching ciphertext matched with keywords.

Wang Yao

Papers

Full Verifiability for Outsourced Decryption in Attribute Based Encryption

Encryption method and system based on attributes

Method and system for protecting condition privacy of internet of vehicles based on certificateless batch verification

Internet of vehicle condition privacy protection method based on certificateless aggregate signcryption and system

Outsourced key generation and decryption property-based system capable of realizing keyword search and decryption method