The new development trends including Internet of Things (IoT), smart city, enterprises digital transformation and world's digital economy are at the top of the tide. The continuous growth of data storage pressure drives the rapid development of the entire storage market on account of massive data generated. By providing data storage and management, cloud storage system becomes an indispensable part of the new era. Currently, the governments, enterprises and individual users are actively migrating their data to the cloud. Such a huge amount of data can create magnanimous wealth. However, this increases the possible risk, for instance, unauthorized access, data leakage, sensitive information disclosure and privacy disclosure. Although there are some studies on data security and privacy protection, there is still a lack of systematic surveys on the subject in cloud storage system. In this paper, we make a comprehensive review of the literatures on data security and privacy issues, data encryption technology, and applicable countermeasures in cloud storage system. Specifically, we first make an overview of cloud storage, including definition, classification, architecture and applications. Secondly, we give a detailed analysis on challenges and requirements of data security and privacy protection in cloud storage system. Thirdly, data encryption technologies and protection methods are summarized. Finally, we discuss several open research topics of data security for cloud storage.

/pdf/data-security-and-privacy-protection-for-cloud-storage-a-51q9ennl7z.pdf

Data Security and Privacy Protection for Cloud Storage: A Survey

Blockchain-Based Healthcare System (HS-BC) is an electronic medical record (EMR) data-sharing system, which significantly facilitates the storage, access, and sharing of EMR data, and provides patients with timely and effective medical diagnosis and treatment. However, due to the high openness of the blockchain, security and privacy still are major concerns in HS-BC. In this paper, we propose an attribute-based signature scheme with attribute revocation to protect the privacy of the user’s identity in HS-BC. Under the premise of using attributes to identify users and protect their identity, the user combines the attribute master-key and the attribute update-key to calculate the attribute signing key, where the attribute master-key is related to the user identity and attribute set, and the attribute update-key is related to the attribute revocation. Through making use of the KUNodes algorithm, attribute revocation can effectively achieve. The designed attribute-based signature scheme requires relatively few pairing operations and does not rely on a central authority. Besides, we formally conducted a security analysis and proved that the proposed scheme is unforgeable, collusion resistant and privacy-preserving. Finally, we evaluate the proposed attribute-based signature scheme in terms of storage and efficiency. Comparison and experimental results show that it is feasible.

/pdf/revocable-attribute-based-signature-for-blockchain-based-54tkv4w07d.pdf

Revocable Attribute-Based Signature for Blockchain-Based Healthcare System

With the processes of collecting, analyzing, and transmitting the data in the Internet of Things (IoT), the Internet of Medical Things (IoMT) comprises the medical equipment and applications connected to the healthcare system and offers an entity with real time, remote measurement, and analysis of healthcare data. However, the IoMT ecosystem deals with some great challenges in terms of security, such as privacy leaking, eavesdropping, unauthorized access, delayed detection of life-threatening episodes, and so forth. All these negative effects seriously impede the implementation of the IoMT ecosystem. To overcome these obstacles, this article presents an efficient, outsourced online/offline revocable ciphertext policy attribute-based encryption scheme with the aid of cloud servers and blockchains in the IoMT ecosystem. Our proposal achieves the characteristics of fine-grained access control, fast encryption, outsourced decryption, user revocation, and ciphertext verification. It is noteworthy that based on the chameleon hash function, we construct the private key of the data user with collision resistance, semantically secure, and key-exposure free to achieve revocation. To the best of our knowledge, this is the first protocol for a revocation mechanism by means of the chameleon hash function. Through formal analysis, it is proven to be secure in a selectively replayable chosen-ciphertext attack (RCCA) game. Finally, this scheme is implemented with the Java pairing-based cryptography library, and the simulation results demonstrate that it enables high efficiency and practicality, as well as strong reliability for the IoMT ecosystem.

O 3 -R-CP-ABE: An Efficient and Revocable Attribute-Based Encryption Scheme in the Cloud-Assisted IoMT System

The industrial Internet-of-things (IIoT) can be seen as the usage of Internet-of-things technologies in industries, which provides a way to improve the operational efficiency. An attribute-based signature (ABS) has been a very useful technique for services requiring anonymous authentication in practice, where a signer can sign a message over a set of attributes without disclosing any information about his/her identity, and a signature only attests to the fact that it is created by a signer with several attributes satisfying some claim predicate. However, an ABS scheme requires exponentiation and/or pairing operations in the signature generation and verification algorithms, and hence, it is quite expensive for resource-constrained devices like a sensor in the IIoT network to run an ABS scheme. To reduce the computational overheads for both signers and verifiers, it has been suggested to introduce a server to help with signature generation and verification, but existing results on the ABS with “server-aided computation” either suffer from the security issues or are not sufficiently efficient. In this paper, we consider server-aided ABS one step further, and propose a notion called server-aided ABS with revocation (SA-ABSR), which not only securely mitigates the workloads of users in generating and verifying signatures, but also enables user revocation by having the server immediately stop signature generations for revoked signers. We formally define the security model for SA-ABSR, present a concrete construction of SA-ABSR based on a standard ABS scheme, and prove its security under the defined security model. Also, we implement the proposed SA-ABSR scheme and the underlying standard ABS scheme to evaluate the performance, from which it is easy to see that the proposed SA-ABSR scheme is more efficient than its underlying ABS scheme.

https://ink.library.smu.edu.sg/cgi/viewcontent.cgi?article=5150&context=sis_research

Server-Aided Attribute-Based Signature With Revocation for Resource-Constrained Industrial-Internet-of-Things Devices

However, most of the existing asymmetric-PAKE protocols either are based on traditional hash functions under random oracles or depend on non-quantum-secure hardness assumptions and remain insecure in the quantum era. To bridge the gap between the asymmetric-PAKE and quantum-safe, in this paper, we resort to smooth projective hash functions (SPHF) and commitment-based password-hashing schemes (PHS) over lattice-based cryptography, and we propose the construction of round-optimal asymmetric PAKE protocol secure against quantum attacks. Our construction eliminates the costly non-interactive zero-knowledge (NIZK) method, bypasses assumptions of the random oracle model, and achieves quantum resistance. We also show that our asymmetric-PAKE protocol can achieve balanced security and robustness under the Bellare-Pointcheval-Rogaway (BPR) model. Finally, we develop a prototype implementation of our instantiation and use it to evaluate its performance in realistic settings.

Quantum-Safe Round-Optimal Password Authentication for Mobile Devices

Personal e-health records (EHR) enable medical workers (e.g., doctors and nurses) to conveniently and quickly access each patient’s medical history through the public cloud, which greatly facilitates patients’ visits and makes telemedicine possible. Additionally, since EHR involve patients’ personal privacy information, EHR holders would hesitate to directly outsource their data to cloud servers. A natural and favorite manner of conquering this issue is to encrypt these outsourced EHR such that only authorized medical workers can access them. Specifically, the ciphertext-policy attribute-based encryption (CP-ABE) supports fine-grained access over encrypted data and is considered to be a perfect solution of securely sharing EHR in the public cloud. In this paper, to strengthen the system security and meet the requirement of specific applications, we add functionalities of user revocation, secret key delegation and ciphertext update to the original ABE, and propose a revocable-storage hierarchical attribute-based encryption (RS-HABE) scheme, as the core building of establishing a framework for secure sharing of EHR in public cloud. The proposed RS-HABE scheme features of forward security (a revoked user can no longer access previously encrypted data) and backward security (a revoked user also cannot access subsequently encrypted data) simultaneously, and is proved to be selectively secure under a complexity assumption in bilinear groups, without random oracles. The theoretical analysis indicates that the proposed scheme surpasses existing similar works in terms of functionality and security, at the acceptable cost of computation overhead. Moreover, we implement the proposed scheme and present experiments to demonstrate its practicability.

RS-HABE: Revocable-Storage and Hierarchical Attribute-Based Access Scheme for Secure Sharing of e-Health Records in Public Cloud

For a cryptosystem with a large number of users, it is necessary to provide an efficient revocation mechanism to preserve the security of whole system. In this paper, we aim to provide a scalable revocation mechanism for attribute-based signature (ABS). Specifically, we first formally define the syntax of revocable ABS (RABS), followed with a corresponding security model that considers a realistic threat called signing key exposure. Then, built on the ideas of an ABS scheme and binary data structure, we present a concrete construction of RABS with signing key exposure resistance. Finally, the proposed scheme is proved to be existentially unforgeable under adaptively chosen message attacks in the selective-predicate model, without random oracles. In addition to the necessary revocation functionality, the proposed scheme remains efficient in terms of storage cost and computation complexity.

Xinyi Huang

Papers

RS-HABE: Revocable-Storage and Hierarchical Attribute-Based Access Scheme for Secure Sharing of e-Health Records in Public Cloud

Revocable Threshold Attribute-Based Signature against Signing Key Exposure