Outsourcing Online/offline Proxy Re-encryption for Mobile Cloud Storage Sharing

Attribute-based encryption (ABE) is suitable for mobile cloud storage to protect data confidentiality and realize fine-grained data access control. It is essential for ABE schemes to achieve attribute revocation as users’ attributes may be changed frequently. Keyword search over encrypted data also needs to be solved in the mobile cloud storage. In addition, computational efficiency is a consideration for the resource-constrained mobile device. Focusing on the above-mentioned problems, an efficiently revocable and searchable ABE (RSABE) scheme for the mobile cloud storage is proposed. In our scheme, the function of attribute revocation is efficiently achieved by delegating the update of secret key and ciphertext to the powerful cloud server. Keyword search is also supported, in which data owners and users can generate the keywords index and search trapdoor, respectively, without relying on always online trusted authority. Furthermore, an outsourced decryption technology is used to reduce the computational load of decryption on user side. Our RSABE scheme is proven to be semantically secure against selective ciphertext policy and chosen plaintext attack, and to be secure against chosen keyword attack in the random oracle model. Finally, performance evaluation demonstrates that our scheme is highly efficient.

In this paper, an identity-based conditional proxy re-encryption (PRE) scheme is proposed, where a delegator provides a re-encryption key satisfying one condition to a semi-trusted proxy who can convert a ciphertext encrypted under the delegator’s public key into one that can be decrypted using the delegatee’s private key. We address the identity-based proxy re-encryption scheme, where the delegator and the delegatee request keys from a trusted party known as a key generator center (KGC), who generates private keys for delegator and delegatee based on their identities. Meanwhile, the identity-based conditional proxy re-encryption scheme satisfies the properties of PRE including unidirectionality, non-interactivity and multi-hop. Additionally, the identity-based conditional proxy re-encryption scheme is efficient in terms of both the communication cost and the computing cost, and can realize security secret sharing in cloud computing environments.

In order to avoid data loss when user's mobile device is stolen or lost, users are encouraged to use mobile cloud storage to transfer and store the data from mobile terminals to the cloud as a means of data backup. Although various encryption mechanisms have been proposed to protect the security in cloud side by cloud service providers, the traditional cloud systems still cannot persuade the users that the data are securely protected if the secure mechanisms are not implemented by the user side. To prevent cloud service providers from leaking personal information, a security scheme implemented in the client side for mobile cloud storage with the name of UMCloud is proposed. The proposed scheme adopts a comprehensive mixture cryptosystem to provide protection of confidentiality and integrity for the storage of data in the cloud while supporting the sharing of the encrypted data among authorized users.

Efficient personalized search over encrypted data for mobile edge-assisted cloud storage

Proxy re-encryption (PRE) allows a proxy to transform one ciphertext to another under different encryption keys while keeping the underlying plaintext secret. Because of the ciphertext transformability of PRE, there are many potential private communicating applications of this feature. However, existing PRE schemes are not as full-fledged as expected. The lack of necessary features makes them hard to apply in real-world scenarios. So far, there does not exist a unidirectional multihop PRE scheme with constant decryption efficiency and constant ciphertext size without extensions. Impractical performance and weak scalability also hinder PRE from most real-world applications. In this work, we present a new PRE scheme with secure hardware enclave named <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">hPRESS</monospace> (hardware-enhanced PRE scheme using secure enclave). To the best of our knowledge, <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">hPRESS</monospace> is the first unidirectional multihop PRE scheme which achieves both constant decryption efficiency and constant ciphertext size without extensions. A detailed security analysis demonstrates that our proposal is CCA secure based on the security of the underlying encryption schemes and the secure enclave. We also implement a prototype based on Intel SGX, one of the most popular secure enclave techniques in recent years, and evaluate its performance. The experimental results show that, compared with previous PRE schemes, our <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">hPRESS</monospace> is almost one order of magnitude faster in terms of the decryption and transformation.

Storage is a promising application for permission-less blockchains. Before blockchain, cloud storage was hosted by a trusted service provider. The centralized system controls the permission of the data access. In web3, users own their data. Data must be encrypted in a permission-less decentralized storage network, and the permission control should be pure cryptographic. Proxy re-encryption (PRE) is ideal for cryptographic access control, which allows a proxy to transfer Alice’s ciphertext to Bob with Alice’s authorization. The encrypted data are stored in several copies for redundancy in a permission-less decentralized storage network. The redundancy suffers from the outsourcing attack. The malicious resource provider may fetch the content from others and respond to the verifiers. This harms data integrity security. Thus, proof-of-replication (PoRep) must be applied to convince the user that the storage provider is using dedicated storage. PoRep is an expensive operation that encodes the original content into a replication. Existing PRE schemes cannot satisfy PoRep, as the cryptographic permission granting generates an extra ciphertext. A new ciphertext would result in several expensive replication operations. We searched most of the PRE schemes for the combination of the cryptographic methods to avoid transforming the ciphertext. Therefore, we propose a new PRE scheme. The proposed scheme does not require the proxy to transfer the ciphertext into a new one. It reduces the computation and operation time when allowing a new user to access a file. Furthermore, the PRE scheme is CCA (chosen-ciphertext attack) security and only needs one key pair.

Outsourcing private data and heavy computation tasks to the cloud may lead to privacy breach as attackers (e.g., malicious outsiders or cloud administrators) may correlate any relevant information to penetrate information of their interests. Therefore, how to preserve cloud users' privacy has been a top concern when adopting cloud solutions. In this paper, we investigate the identity privacy problem for the proxy re-encryption, which allows any third party (e.g., cloud) to re-encrypt ciphertexts in order to delegate the decryption right from one to another user. The relevant identity information, e.g., whose ciphertext was re-encrypted to the ciphertext under whose public key, may leak because re-encryption keys and ciphertexts (before and after re-encryption) are known to the third party. We review prior anonymity (identity privacy) notions, and find that these notions are either impractical or too weak. To address this problem thoroughly, we rigorously define the anonymity notion that not only embraces the prior anonymity notions but also captures the necessary anonymity requirement for practical applications. In addition, we propose a new and efficient proxy re-encryption scheme. The scheme satisfies the proposed anonymity notion under the Squared Decisional Bilinear Diffie-Hellman assumption and achieves security against chosen ciphertext attack under the Decisional Bilinear Diffie-Hellman assumption in the random oracle model. To the best of our knowledge, it is the first proxy re-encryption scheme attaining both chosen-ciphertext security and anonymity simultaneously.We implement a prototype based on the proposed proxy re-encryption scheme and the performance study shows that it is efficient.

Due to the limited computational capability of mobile devices, the research organization and academia are working on computationally secure schemes that have capability for offloading the computational intensive data access operations on the cloud/trusted entity for execution. Most of the existing security schemes, such as proxy re-encryption, manager-based re-encryption, and cloud-based re-encryption, are based on El-Gamal cryptosystem for offloading the computational intensive data access operation on the cloud/trusted entity. However, the resource hungry pairing-based cryptographic operations, such as encryption and decryption, are executed using the limited computational power of mobile device. Similarly, if the data owner wants to modify the encrypted file uploaded on the cloud storage, after modification the data owner must encrypt and upload the entire file on the cloud storage without considering the altered portion(s) of the file. In this paper, we have proposed an incremental version of proxy re-encryption scheme for improving the file modification operation and compared with the original version of the proxy re-encryption scheme on the basis of turnaround time, energy consumption, CPU utilization, and memory consumption while executing the security operations on mobile device. The incremental version of proxy re-encryption scheme shows significant improvement in results while performing file modification operations using limited processing capability of mobile devices.

In a proxy re-encryption (PRE) scheme, a semi-trusted proxy is given special information that allows it to transform cipher texts encrypted under Alice's public key into the different cipher texts that can be decrypted by Bob's secret key. In 2006, Green and Ateniese proposed identity-based proxy re-encryption schemes, in which cipher texts are transformed from one identity to another. Based on this, we propose a new construction for certificate less proxy re-encryption scheme and the corresponding security model in this paper. The scheme is proved secure against chosen-plaintext attack in the random oracle model assuming that an underlying problem related to the Decisional Bilinear Diffie-Hellman problem is computationally hard.

Explosive growth in the number of passwords for web based applications and encryption keys for outsourced data storage well exceeds the management limit of users. Therefore, outsourcing keys (including passwords and data encryption keys) to professional password managers (honest-but-curious service providers) is attracting the attention of many users. However, existing solutions in a traditional data outsourcing scenario are unable to simultaneously meet the following three security requirements for keys outsourcing: 1) Confidentiality and privacy of keys; 2) Search privacy on identity attributes tied to keys; 3) Owner controllable authorization over his/her shared keys. In this paper, we propose CloudKeyBank, the first unified key management framework that addresses all the three goals above. Under our framework, the key owner can perform privacy and controllable authorization enforced encryption with minimum information leakage. To implement CloudKeyBank efficiently, we propose a new cryptographic primitive named Searchable Conditional Proxy Re-Encryption (SC-PRE) which combines the techniques of Hidden Vector Encryption (HVE) and Proxy Re-Encryption (PRE) seamlessly, and propose a concrete SC-PRE scheme based on existing HVE and PRE schemes. Our experimental results and security analysis show the efficiency and security goals are well achieved.

Recently, blockchain technology has attracted much attention of the research community in several domains requiring transparency of data accountability, due to the removal of intermediate trust assumptions from third parties. One such application is enabling file sharing in blockchain enabled distributed cloud storage. Proxy re-encryption is a cryptographic primitive that allows such file sharing by re-encrypting ciphertexts towards legitimate users via semi-trusted proxies, without them learning any information about the underlying message. To facilitate secure data sharing in the distributed cloud, it is essential to construct efficient proxy re-encryption protocols. In this paper, we introduce the notion of proxy self re-encryption (SE-PRE) that is highly efficient, as compared to the existing PRE schemes in the literature. We show that our self encryption scheme is provably CCA secure based on the DLP assumption and our proxy re-encryption scheme with self encryption is CCA secure under the hardness of the Computational Diffie Hellman (CDH) and Discrete Logarithm (DLP) assumption. Our novel encryption scheme, called self encryption, has no exponentiation or costly pairing operation. Even the re-encryption in SE-PRE does not have such operations and this facilitates the service provider with efficiency gain.

Mobile cloud storage provides benefits for educational institutions. Several researchers have researched cloud computing adoption, but only a few studies related to how users experience using Personal Cloud Storage Services. This research aims to investigate the adoption of the mobile cloud storage factors following the theory, as well as research that has been previously proven related to user interest in using mobile cloud storage among higher education students. This quantitative research uses data analysis techniques using GSCA to prove the theory and achieve the research goals. The research methodology consists of five main stages, namely the stage of model development and research design, the stage of preparing the instrument and its measurement, the stage of testing the instrument, the stage of survey and results, as well as the stages of analysis and discussion as well as conclusions. Five variables are investigated in this research: knowledge sharing, perceived usefulness, attitude toward using a system, trust, and intention to use. The results of hypothesis testing were conducted using GSCA; three proposed hypotheses were accepted, and one was rejected. The variables the research model can explain are 68%, and the remaining 32% are other variables not used in this study. The characteristics of respondents can provide several ways to increase the adoption of mobile cloud computing by linking research results from inferential analysis and descriptive analysis. Future research can focus on extracting these variables through user interviews regarding students' intentions to use mobile cloud computing.

Multi-use and unidirectional identity-based proxy re-encryption schemes

Users share a group key to decrypt encryptions for the group using a group key management scheme. In this paper, we propose a re-encryption-based group key management scheme, which uses a unidirectional proxy re-encryption scheme with special properties to enable group members share the updated group key with minimum storage and computation overhead. In particular, we propose a proxy re-encryption scheme that supports direct re-encryption key derivation using intermediate re-encryption keys. Unlike multi-hop re-encryption, the proposed proxy re-encryption scheme does not involve repeated re-encryption of the message. All the computations are done on the re-encryption key level and only one re-encryption is sufficient for making the group key available to the users. The proposed scheme is the first for group key management based on proxy re-encryption that is secure against collusion. The individual users store just one individual secret key with group key derivation requiring O\((\log N)\) computation steps for a group of N users. Size of the public bulletin maintained to facilitate access to the most recent group key for off-line members is O(N) and remains constant with respect to the number of group updates. The proposed group key management scheme confronts attacks by a non-member and even a collusion attack under standard cryptographic assumptions.

Proxy re-encryption is an efficient solution to ciphertext delegation and distribution, which also enables the sender to carry out fine-grained control on his ciphertext. This paper summarizes the progress on the proxy re-encryption schemes and their practical applications. Universal models for proxy re-encryption and its security are also induced for detailed investigation on different types of PRE schemes.