Efficient and Secure Cloud Data Distribution and Sharing Scheme in Groups

Provably secure identity-based authenticated key agreement protocols with malicious private key generators

In Identity-Based Encryption (IBE) system, the Private Key Generator (PKG) holds the master secret key and is responsible for generating private keys for the users. This incurs the key-escrow problem, i.e. the PKG can decrypt any user' any ciphertexts without any possible detection. Also, compromising the master secret key will enable an adversary to do anything to the whole system, and having the master secret key be unavailable implies that new users cannot obtain private keys from the PKG, and existing users cannot get their private keys back from the PKG when they lost them. To address the key-escrow problem and protect the master secret key as much as possible with strong security and availability, distributed PKG protocols supporting threshold policy have been adopted in some IBE schemes. In this paper, we propose a distributed PKG protocol that supports the policy to be any monotonic access structures. Also, we propose the first distributed PKG protocol that supports the dynamic changes of the PKGs and the policy, while remaining the master secret key unchanged. The two protocols do not need any third party acting as a trusted dealer to present, and the master secret key should never be generated or resided in any one single site. The protocols are applicable to a generic IBE template, which covers many existing important IBE schemes. When applied to this generic type of IBE schemes, the two distributed PKG protocols do not affect the encryption and decryption algorithms, and only each user knows his own private key.

Identity-based revocation system (IBRS) generates the ciphertext with a revoked identity list such that only the non-revoked identities can use their private keys to decrypt this ciphertext. IBRS can be efficiently applied in some practical applications, such as the pay-TV systems when the number of revoked identities are much less than the non-revoked ones. However, since IBRS is based on identity-based cryptography, it also suffers from the inherent key escrow problem where the private key generator (PKG) has full control of each user’s private key. As a consequence, it is hard to judge whether a pirated private key is generated by the PKG or the suspected user. There is no study on IBRS fulfilling accountability in literature to date. In this paper, we introduce the notion of accountable authority IBRS (A-IBRS), which provides accountability in IBRS schemes. In an A-IBRS, the aforementioned problem can be alleviated and resolved. Furthermore, a full black-box A-IBRS can distinguish the creator of a black box between the PKG and the associated user and the dishonest PKG is allowed to access the decryption results of the user private key. We formalize the definition and security models of the full black-box A-IBRS schemes. Then, we present a concrete full black-box A-IBRS scheme with constant-size master public key and private key. Finally, we prove the security of our scheme under the defined security models without random oracle.

The rapid development of network technology has brought new challenges to data security. As the first gateway of a certain mobile internet system, access authentication is an essential step that guarantees the internal security of the network. However, there are some problems in traditional cryptosystem-based authentication mechanisms, such as certificate management problem and centralized key escrow problem. Centralized storage of user information is restricted by the server, the security of the server is not within the user’s control, the stability of the server cannot be guaranteed, and personal privacy on the server may be leaked. In this paper, we focus on the private key escrow problem caused by the Private Key Generator (PKG) in Identity-Based Cryptosystems (IBC) mechanism and propose a Blockchain-assisted user public-private key generation scheme (BAKG) which introduces the blockchain to improve the robustness and reliability of key management. In BAKG, the user’s private key is determined by itself through combining the partial private keys from different PKGs, which prevents the risk of private key exposure caused by a single PKG. Meanwhile, based on the theory of the Combined Public Key (CPK) algorithm, we have designed a feasible blockchain-based key generation logic and developed a prototype authentication system based on the above concept. We further analyze the security of BAKG and the analytical results show that BAKG can meet various security requirements. In addition, according to the performance evaluation results, BAKG has good performance in both read/write consensus and different key length calculations, which means it has good potential for lightweight authentication applications.KeywordsBlockchainAuthenticationIdentity-Based CryptosystemsCombine public key

Recently, Chen et al. proposed an identity-based quantum signature scheme (IDQSS). Their scheme has the advantages of the classical identity-based signature (IDS) scheme. However, Chen et al.’s scheme cannot resist against the private key generator (PKG)’s forgery attack. On the other hand, in their scheme, many rounds of quantum swap tests have to be performed by the verifier during the signature verification phase. To improve the security and efficiency of the IDQSS, a new IDQSS is proposed. In our scheme, the private key of the signer is generated by PKG according to the signer’s identity, which is used as the corresponding public key. The signer generates a quantum signature with her private key and the secret parameters shared with the verifier. Anyone can verify the quantum signature with the identity of the signer. Our scheme overcomes the security drawback of Chen et al.’s scheme and inherits the merits of the classical IDS system. It has the security properties such as information-theoretical security, non-repudiation and unforgeability. At the same time, in our scheme, the verifier need not perform any quantum swap test. Therefore, our IDQSS is more secure and efficient.

Hierarchical Identity-Based Encryption (HIBE) is a generalization of Identity-Based Encryption (IBE) that mirrors an organizational hierarchy, however, the residual key escrow problem has still remained. This paper introduces a new scheme, based on the security notion of anonymous ciphertext indistinguishability against key generation center (ACI-KGC) security proposed by Chow, to remove the inherent key escrow problem. The scheme employs multiple Identity Certification Authorities (ICAs) which can ensure that the Private Key Generators (PKGs) distribute private key without knowing the list of user’s identity information, so as to prevent malicious PKGs from decrypting message on behalf of user or maliciously make user’s private key public. Security analysis shows that the scheme can solve the key escrow with keeping the high-efficiency and security of HIBE system. In contrast to Chen’s T-HIBE and Chow’s scheme, to generating the user’s private key, our scheme does not require the multiple KPAs or the complex interactive protocol which take too much extra computation costs. And comparing with GS-HIBE, our scheme focuses on solving the key escrow problem with outstanding performance and security of HIBE system.

The objective of the PKA encryption scheme is to complement, or replace, existing Public Key Infrastructures (PKI) [1]. In this scheme, the initialization step is based on the secure exchange of addressable cryptographic tables between the communicating parties. These tables are generated either with random numbers, or with arrays of addressable Physical Unclonable Function (PUFs). The subsequent communications between the parties can therefore occurs over untrusted channels, by exchanging dynamically generated public keys. Private keys are, generated independently with all communicating parties using their cryptographic tables, and the shared public keys. The private keys are combined with methods such as the Advanced Encryption Standard (AES) to encrypt and decrypt the communication between users. The generation of private keys is done without mathematical computations that are potentially vulnerable to quantum computers using algorithms such as the one developed by Shor [2]. PKA is fast and requires approximately 800 CPU clock cycles. We implemented, and tested the PKA dynamic key exchange scheme in legacy systems to secure PC-to-PC communication, and PC to smart card communication with AES.

Identity-based cryptosystems were introduced to overcome one of the main problems in public key encryption, the generation of public and private keys. In the identity-based cryptosystem, an identifier such as an e-mail address of a user can be used to generate public and private keys by a trusted third party. The trusted third party uses a system-wide master secret to provide private keys to a user. Identity-based cryptosystems can be constructed using the idea of pairings. This article discusses four different identity-based cryptosystems: the Boneh-Franklin scheme, the Cock's scheme, the Authenticated IBE scheme and the Hierarchical IBE scheme. This article also discusses the security notions considered for the identity-based cryptosystem. The security notions considered are: one-wayness, indistinguishability, semantic security and non-malleability. An architecture consisting of a public parameter server and private key generator for the implementation of the identity-based cryptosystems is also discussed.

Due to the limited energy of underwater wireless sensor network (UwWSN) and the need to protect node location privacy, aggregate signature (AGGS) scheme which can batch verification signature is proposed to meet these requirements. Due to moving at high speed and the limited bandwidth of communication in vehicular ad hoc network (VaNET), certificateless aggregate signature (CTLAS) with the private key being generated by the signer itself and PKG (Private Key Generator) is proposed to solve the above problems. Recently, Yang et al. proposes a CTLAS scheme which can be applied into VaNET and Hua proposes an AGGS scheme which can be applied into UwWSN. This paper shows that Yang et al.'s CTLAS scheme and Hua's AGGS scheme both are not secure. In Yang et al.'s CTLAS scheme, an attacker can forge a signature assume that the attacker cannot know the masker key of PKG but the attacker can replace the public key of the signer. In Hua's AGGS scheme, a malicious node can forge a signature for any nodes after the malicious node obtains a temporary key. As an improvement, this paper also proposes an improved method for Yang et al.'s scheme and Hua's scheme respectively.

Currently, the pervasive cooperation of a group of Unmanned Aerial Vehicles (UAVs) has gained a lot of attention and use for its low price and widespread availability. For drones from different network domains to cooperate with each other, temporary Internet of Drones (IoD) is needed. The collaboration with drones requires frequent identity verification. However, owing to unreliable environment and weak connectivity of the IoD. Unmanned aerial vehicles (UAVs) are weak in energy, computing, cross-domain and memory resources. It is very difficult to design an efficient and the complete authentication scheme without abundant computing and memory resources. The conventional authentication methods are not suitable for IoD, Public Key Infrastructure (PKI) needs online and high bandwidth resources, at the same time, the construction and operation and maintenance costs of certificate authority (CA) are very high; Identity-Based Cryptograph (IBC) using a lot of operational resources, is a “heavy” algorithm, and in different domains (private key distribution from different Private Key Generator (PKG)) is difficult to authenticate each other. This paper proposes a two-layer lightweight key management scheme based on Unified Multi-domain Identity (UMI), which implement cross-domain authentication, effectively reduce the computing and traffic brought by public key certificate verification which is especially suitable for UAVs network. Finally, through verification, the scheme has better performance and security than other schemes.KeywordsUnmanned aerial vehicles (UAVs)Key authenticationPublic-key cryptographyInternet of Drones (IoD)

Most anonymous Conference Key Distribution (CKD) systems cannot provide forward security, which is a very important property. Even though some CKD systems provide that property, they can only provide partial forward security, not perfect forward security. An identity-based CKD scheme with user anonymity is proposed in this paper. Under the one-way hash (OWH) [1] and bilinear Diffie-Hellman (BDH) [2] cryptographic assumptions, the proposed scheme is secure against passive attacks, impersonation attacks and conspiracy attacks. Moreover, by distributing a random number to the participants through the Private Key Generator (PKG), this scheme provides perfect forward security, that is, even if the private keys of all the participants (including the chairman) are compromised, the conference key contributed by the chairman in the past will not be compromised.

In the world of evolving technologies the energy like solar or electricity and utilities industry, plays major role includes smart meters and smart grids, which provides companies with exceptional capabilities for forecasting demand, determining customer usage patterns, preventing outages, minimizing the loss and more. Advances in technologies and its usage generates unprecedented data volume, speed and complexity which should be preserved securely for later usage for accurate predictions. Managing the large volume information generated by short-interval reads of smart meter data by various smart devices is a challenge for existing IT resources in storing them and also ensuring the privacy of sensitive customer meter data is also a major issue in smart meter deployments. Security should be provided for data which is stored at data centers at cloud and also at local energy distributer centers at two tiers. In this paper we focus on security regarding storage of big data at data centres as well as at local distribution such as databases. So we propose MDET (Multiple Data Encryption Technique) which allows encryption of each record two times at storage centres by using Generator based encryption technique. In this technique the data in the database is encrypted twice so that the data record should be decrypted once at data centre as well as at the local distribution centre by private keys at two levels so that privacy of consumer data is not lost at either data storage centre at cloud or at local distribution centre.

Since computer systems and communication become each time more pervasive, information security takes attention, requiring guarantees for data authentication, integrity and confidentiality. Pervasive communication and computer systems intend to provide access to information and services anytime and anywhere, demanding cryptographic systems more practical and that consider the characteristics of emerging network paradigms, such as wireless communication, device constraints and mobility. Identity-Based Cryptography (IBC) is an asymmetric key cryptographic technology that employs as user’s public key any unique information related to the identity of the user. IBC efficiently manages keying material and provides an easy way to issue a pair of keys applying user information. However, it assumes the existence of a Trusted Third Party (TTP), called Private Key Generator (PKG), which is responsible for generating the corresponding user private key. Relying on a TTP and using an identity as the base of the scheme result in different weaknesses on the system, as the inherent key escrow problem. This chapter investigates those weaknesses, and it points out the stat-of-the-art of proposed solutions to avoid them. This chapter also provides an overview of Identity-Based Encryption (IBE), Identity-Based Signature (IBS) and Identity-Based Key Agreement (IBKA), emphasizing IBE due to being an open problem for many years. This chapter concludes highlighting IBC applications and future trends.

Data centers are essential components of the modern digital world. They provide the necessary resources and infrastructure to enable access to online services and applications, enabling individuals and organizations to communicate, collaborate, and access information in real time. Data centers are an essential part of the internet and are used to manage and store data, providing access to a wide range of services. They provide organizations with the ability to store, access, and process data. Data centers are the backbone of the digital revolution, enabling organizations and individuals to connect with the world. Data centers are essential for providing secure access to data and resources. They are designed with security features such as firewalls, encryption, and authentication that protect data from unauthorized access. Data centers also provide advanced networking and storage solutions to ensure data is secure, reliable, and available for use. Data centers are also important for reducing operational costs. They provide the necessary resources and infrastructure to reduce hardware and software costs, as well as energy costs associated with running hardware and applications. This reduces the overall cost of doing business and allows organizations to focus on their core competencies.

Cloud Computing is known as a provider of dynamic services. It utilizes a very large, scalable and virtualized resource over the Internet. So many industries have joined this bandwagon nowadays. One of the major research issues is to maintain good Quality of Service (QoS) of a Cloud Service Provider (CSP). The QoS encompasses different parameters, like, smart job allocation strategy, efficient load balancing, response time optimization, reduction in wastage of bandwidth, accountability of the overall system, etc. The efficient allocation strategy of the independent computational jobs among different Virtual Machines (VM) in a Datacenter (DC) is a distinguishable challenge in the Cloud Computing domain and finding out an optimal job allocation strategy guided by a good scheduling heuristic for such an environment is an NP-complete problem. So different heuristic approaches may be used for better result. The related works with other NP- complete problems have shown that solutions guided by heuristic approaches can often be improved by applying local scheduling procedure for allocating independent jobs in the virtual machines (VM) inside a Datacenter (DC), which, when combined with fast construction heuristics, can find out the shorter schedules on benchmark problems than the other solution methodologies found in different literatures, and in significant less time. This paper highlights a smart job allocation strategy for a CSP by applying Round-Robin (RR) scheduling policy.