The cyclical and continuous working characteristics of Internet of Things (IoT) devices make a large amount of the same or similar data, which can significantly consume storage space. To solve this problem, various secure data deduplication schemes have been proposed. However, existing deduplication schemes only perform deduplication based on data similarity, ignoring the internal connection among devices, making the existing schemes not directly applicable to parallel and distributed scenarios like IoT. Furthermore, since secure data deduplication leads to multiple users sharing same encryption key, which may lead to security issues. To this end, we propose a device relationship-based IoT data deduplication scheme that fully considers the IoT data characteristics and devices internal connections. Specifically, we propose a device relationship prediction approach, which can obtain device collaborative relationships by clustering the topology of their communication graph, and classifies the data types based on device relationships to achieve data deduplication with different security levels. Then, we design a similarity-preserving encryption algorithm, so that the security level of encryption key is determined by the data type, ensuring the security of the deduplicated data. In addition, two different data deduplication methods, identical deduplication and similar deduplication, have been designed to meet the privacy requirement of different data types, improving the efficiency of deduplication while ensuring data privacy as much as possible. We evaluate the performance of our scheme using five real datasets, and the results show that our scheme has favorable results in terms of both deduplication performance and computational cost.

Combining a fog layer to aggregate and process data for smart grids is a straightforward approach, yet it inevitably leads to trust issues and audition difficulty. Most existing data-sharing architectures did not consider the copious meter–fog communication and fog–cloud bulk data transmission simultaneously, or they relay the trustworthiness of the fog nodes on a single center. In this article, we design a meter–fog–cloud-blockchain data-sharing architecture for smart grids where the fog nodes are not only data relay stations but also semitrusted local data processing points, and the dual blockchains are responsible for device key management and data integrity audit, respectively. Moreover, a certificateless aggregate signcryption between fog and smart meters is designed, and the data sharing between servers is based on an authenticated key agreement mechanism to achieve optimal efficiency overall. Detailed security proofs are demonstrated and performance results show the practicality and efficiency of our data-sharing scheme.

Public key searchable encryption (PKSE) scheme allows data users to search over encrypted data. To identify illegal users, many traceable PKSE schemes have been proposed. However, existing schemes cannot trace the keywords which illegal users searched and protect users' privacy simultaneously. In some practical applications, tracing both illegal users' identities and the keywords which they searched is quite important to against the abuse of data. It is a challenge to bind users' identities and keywords while protecting their privacy. Moreover, existing traceable PKSE schemes do not consider the unforgeability and immutability of trapdoor query records, which can lead to the occurrence of frame-up and denying. In this paper, to solve these problems, we propose a blockchain-based privacy-preserving PKSE with strong traceability (BP3KSEST) scheme. Our scheme provides the following features: (1) authorized users can authenticate to trapdoor generation center and obtain trapdoors without releasing their identities and keywords; (2) when data users misbehave in the system, the trusted third party (TTP) can trace both their identities and the keywords which they searched; (3) trapdoor query records are unforgeable; (4) trapdoor query records are immutable because records are stored in blockchain. Notably, this scheme is suitable to the scenarios where privacy must be considered, e.g., electronic health record (EHR). We formalize both the definition and security model of our BP3KSEST scheme, and present a concrete construction. Furthermore, the security of the proposed scheme is formally proven. Finally, the implementation and evaluation are conducted to analyze its efficiency.

E-healthcare as a significant facet of the Internet of Things (IoT) relies on wearable devices to continuously monitor users’ vital signals for health-related purposes. The sensitive and vast nature of the collected data necessitate secure encryption and storage on the cloud. Simultaneously, there is a need to share these data for healthcare purposes. How to balance the privacy and usability of these data is a challenging problem in the e-healthcare applications. A central problem arose from the continuous data collection is how to effectively share the data collected in one specific time period when users are unwell. We formalize it as the sequential data sharing problem. This problem appears in various IoT applications apart from e-healthcare, such as video surveillance. In this paper, we explain why all existing solutions cannot address the above problem. Then, we propose a novel sequential data sharing system (SDSS), where the data encrypted at any specific time period can be efficiently shared. We first present a practical construction of SDSS that supports securely sharing data within one specific time period in a symmetric manner. The decryption key are retrieved sequentially by utilizing the shared key and hash function. All involved calculations in the system are lightweight. Data pertaining to other non-selected time periods remain unknown. We then extend the SDSS to a multiple-range version, enabling simultaneous sharing data for multiple specific time periods, and show an example. We formalize the definition of security models and analyze the security of our systems. Finally, we evaluate the performance of our systems using SHA-256 and AES-256. Experimental results demonstrate that our systems are highly efficient. It takes less than 1 millisecond to encrypt 100KB data and less than 0.4 milliseconds to decrypt the corresponding cipher data. Our proposed systems provide a solution to balance the privacy and usability in the context of sequentially collected data. We believe that this work will enhance the adoption and practicality of IoT applications.

Image steganography secures the transmission of secret information by covering it under routine multimedia transmission. During image generation based on Generative Adversarial Network (GAN), the embedding and recovery of secret bits can rely entirely on deep networks, relieving many manual design efforts. However, existing GAN-based methods always design deep networks by adapting generic deep learning structures to image steganography. These structures themselves lack the feature extraction that is effective for steganography, resulting in the low imperceptibility of these methods. To address the problem, we propose GAN-based image steganography by exploiting transform domain knowledge with deep networks, called EStegTGANs. Different from existing GAN-based methods, we explicitly introduce transform domain knowledge with Discrete Wavelet Transform (DWT) and its inverse (IDWT) in deep networks, ensuring that each network performs with DWT features. Specifically, the encoder embeds secrets and generates stego images with the explicit DWT and IDWT approaches. The decoder recovers secrets and the discriminator evaluates feature distribution with the explicit DWT approach. By utilizing traditional DWT and IDWT approaches, we propose EStegTGAN-coe, which directly adopts the DWT coefficients of pixels for embedding and recovering. To create more feature redundancy for secrets, we extract DWT features from the intermediate features in deep networks for embedding and recovering. We then propose EStegTGAN-DWT with traditional DWT and IDWT approaches. To entirely rely on deep networks without traditional filters, we design the convolutional DWT and IDWT approaches that conduct the same feature transformation on features as traditional approaches. We further replace the traditional approaches in EStegTGAN-DWT with our proposed convolutional approaches. Comprehensive experimental results demonstrate that our proposals significantly improve the imperceptibility and our designed convolutional DWT and IDWT approaches are more effective in distinguishing high-frequency characteristics of images for steganography than traditional DWT and IDWT approaches.

选择密文安全模型能有效刻画主动攻击,更接近现实环境.现有抵抗选择密文攻击的密码算法以国外算法为主,缺乏我国自主设计且能抵抗选择密文攻击的密码算法.虽然实现选择密文安全存在通用转化方法,代价是同时增加计算开销和通信开销.基于国密SM9 标识加密算法,提出一种具有选择密文安全的标识广播加密方案.方案的设计继承了SM9 标识加密算法结构,用户密钥和密文的大小都是固定的,其中用户密钥由一个群元素组成,密文由 3 个元素组成,与实际参与加密的接收者数量无关.借助随机谕言器,基于GDDHE困难问题可证明方案满足CCA安全.加密算法的设计引入虚设标识,通过该标识可成功回复密文解密询问,实现CCA的安全性.分析表明,所提方案与现有高效标识广播加密方案在计算效率和存储效率上相当.

Proposing novel cryptography schemes (e.g., encryption, signatures, and protocols) is one of the main research goals in modern cryptography. In this paper, based on more than 800 research papers since 1976 that we have surveyed, we introduce the research philosophy of cryptography behind these papers. We use “benefits” and “novelty” as the keywords to introduce the research philosophy of proposing new schemes, assuming that there is already one scheme proposed for a cryptography notion. Next, we introduce how benefits were explored in the literature and we have categorized the methodology into 3 ways for benefits, 6 types of benefits, and 17 benefit areas. As examples, we introduce 40 research strategies within these benefit areas that were invented in the literature. The introduced research strategies have covered most cryptography schemes published in top-tier cryptography conferences. *This work is based on our Chinese book (Cryptologic Research History of Digital Signatures: From 1976 to 2020) that was first published in November of 2022. The research philosophy has undergone a major revision. Fuchun Guo and Willy Susilo are from the University of Wollongong, Xiaofeng Chen and Zhen Zhao are from the Xidian University, Peng Jiang is from the Beijing Institute of Technology, and Jianchang Lai is from the Southeast University. Supported by ARC Future Fellowship FT220100046 (fuchun@uow.edu.au).

A confidential reporting system (CRS) allows reporters to report concerns or problems in confidence without the fear of blame or reprisals. Nevertheless, privacy has been the primary concern of reporters. In this paper, we propose a privacy-preserving confidential reporting system with designated reporters (PPCRS-DR) to protect the privacy of reporters and the confidentiality of reports. Our PPCRS-DR provides the following interesting features: (1) for an event, an auditor can designate a reporter to report; (2) an auditor can neither see the report nor know the reporter’s identity from an encrypted report if the reporter is not the designated one; (3) when an auditor is unavailable, he/she can temporarily designate a delegatee to collect and review reports on behalf of him/her. We formalize both the definition and security model of our PPCRS-DR, and propose a concrete construction. Furthermore, the security of the proposed PPCRS-DR is formally proven. The implementation shows that it is efficient. The novelty is to implement flexible decryption delegation of CRSs and protect reporters’ privacy.

广播加密允许数据拥有者通过不安全的公开信道将数据安全地发送给一组指定的用户,只有组内用户(授权用户)利用自身私钥才能正确解密密文,恢复出明文数据,不在组内的用户(非授权用户)即使合谋也无法获取数据内容.标识加密是一种非对称加密体制,可利用能够唯一标识用户身份的任意字符串作为用户的公钥,消除了传统公钥体制中用于绑定用户公钥的证书.匿名标识广播加密不仅能充分继承标识加密的优点实现多用户数据的安全共享,而且能有效保护接收者的身份信息.本文以国产商用标识密码算法SM9为基础,采用多项式技术构造了首个基于SM9的匿名广播加密方案.方案具有与SM9加密算法相同的私钥生成算法,用户私钥由一个群元素组成.方案的密文由(n+3)个元素组成,与接收者数量(n)线性相关,解密仅包含一次双线性对计算.基于q类型的GDDHE困难假设,在随机谕言器模型中证明方案在静态选择明文攻击下具有不可区分的安全性且满足接收者匿名性.比较分析表明本文方案的计算开销和通信代价与现有高效匿名标识广播加密方案是可比的.最后,对方案进行编程实验,在相同安全级别下,本文方案对比其他方案具有较优的密文长度,实验结果表明本文方案是可行的.

In the data era, to simultaneously relieve the heavy computational burden of mining data information from data owners and protecting data privacy, privacy-preserving frequent itemset mining (PPFIM) is presented and has attracted much attention. In PPFIM, data owners and miners outsource the complex task of data mining to the cloud server, which supports strong storage and computing power, and the cloud server cannot extract additional data privacy other than that which is shown by data owners or miners. However, most existing solutions assume that cloud servers will honestly perform the mining process and return the correct results, whereas cloud services are usually provided by a charging third party that may in practice return incorrect results due to computation errors, malicious or criminal activities, etc. To solve this problem, in this paper, we present a verifiable PPFIM protocol on vertically partitioned databases to support the verifiability of the integrity of the mining results, where data owners can authorize the cloud server to perform federated mining on vertically partitioned databases without leaking data information and detect dishonest behaviors in the cloud server from the returned results. We adopt a dual cloud setting to enable data owners to be offline after uploading their encrypted databases to the cloud server, which further relieves the burden on data owners. We implement our protocol and give a detailed analysis in terms of verification accuracy, which shows that the dishonest behaviors of the cloud server can be detected with a probability close to 1 and a sacrifice of only a 1% increase in database size.

Accountable identity-based encryption (A-IBE) was proposed to relieve the key escrow problem caused by the fully trustworthy private-key generator (PKG) in the IBE system, where the true generator of private keys or decoder boxes can be traced back to the PKG or related users. Retrievable A-IBE (RA-IBE) enhances the security of A-IBE by providing retrievability to the master secret key of the PKG when more than one private key of the same user are released. RA-IBE strengthens the deterrent effect of A-IBE against the PKG since disclosure of the master secret key could lead to the breakdown of the entire IBE system. However, current RA-IBE schemes only provide retrievability in a white-box model, which limits the ability to support traceability and retrievability on well-formed private keys only. This overlooks the fact that a malicious PKG can easily conceal a private key within a decoder box, making the inserted private key inaccessible. To overcome this limitation, we propose a full black-box RA-IBE scheme, where traceability and retrievability of decoder boxes are provided while the malicious PKG is allowed to access the decryption oracle in the security model simultaneously. We first give the formal definition and security models of full black-box RA-IBE and then present a concrete construction. In our construction, a user interacts with the PKG to obtain its private key and an additional commitment tuple with which the user can retrieve the master secret key of the PKG using a related decoder box generated by the PKG. Finally, we show that the proposed full black-box RA-IBE scheme is secure in the random oracle model.

CCA security is desirable when designing encryption schemes because it captures active attackers. One efficient approach for achieving CCA security is to use generic conversions. We first design a CPA secure scheme, and then transform it into a CCA secure scheme using the Fujisaki-Okamoto technique (CRYPTO ’99) in the random oracle model or the Canetti-Halevi-Katz technique (EUROCRYPT ’04) in the standard model if the CPA secure scheme satisfies some conditions. These transformations are generic so they can be applied to encryption primitives such as IBE and ABE . Nevertheless, both techniques result in an inevitable ciphertext expansion. Subsequent generic constructions mainly follow the idea surrounding these two techniques. The ciphertext expansion becomes a tradeoff in the existing conversions where it raises an inherently interesting question: do we have to sacrifice the size of the ciphertext during security transformation for all encryption primitives? In this work we will explore, for the first time, new generic conversions from CPA to CCA security without ciphertext expansion . By utilizing the properties of encryption in a novel way we will show that these generic conversions exist in the encryption primitive; they are called constant-size threshold ABE that satisfy verifiability or delegatability . Given a CPA secure threshold ABE that fulfills this requirement, we can convert it into a CCA secure threshold ABE without increasing the size of the ciphertext, albeit our conversions are restricted to the random oracle model. Our conversions are also applicable for transforming selective CPA to selective CCA security. We also show two instantiations of our conversions and obtain the shortest ciphertexts among all threshold ABE schemes with (selective) CCA security in the literature, even for other expressive access structures in the ABE setting. The ciphertext of the converted CCA secure scheme consists of three group elements only: two elements in group G 1 (or G in symmetric pairing) and one element in group G T .

SM9 is a Chinese cryptography standard, which includes a set of identity-based cryptographic schemes over pairings. SM9 identity-based signature scheme (SM9-IBS) was standardized by ISO/IEC and has been widely used in many real-world applications such as blockchain. Nevertheless, the signing algorithm of SM9-IBS suffers from several heavy calculations (e.g. pairings, scalar multiplications in groups), which might be a bottleneck for lightweight devices such as sensors. In this paper, we modify the SM9-IBS scheme slightly to support fast signing. In order to achieve this, we make the use of online/offline methodology and propose a new online/offline IBS scheme based on SM9. The proposed scheme is proved to be EUF-sID-CMA secure and is about 99% faster than SM9-IBS in terms of signature generation. Precisely, the time cost of online signing is <1 ms. Our scheme is appropriate for the Internet of Things. The theoretical analysis and demonstration show that the proposed scheme is comparable to existing efficient online/offline IBS schemes.

Public cloud data auditing allows any third party to check the integrity of data stored on untrusted cloud servers without retrieving the data. The challenge is how to audit the proof of storage with efficient communications. In ACM CCS 2007, Ateniese et al. described the first practical public cloud data auditing scheme based on RSA, in which the proof of storage consists of one RSA element and one hash value and the storage cost for generating the proof can be as short as 1% of the stored file. Soon after, in Asiacrypt 2008, Shacham and Waters gave another public cloud data auditing scheme based on bilinear pairing, in which the generated proof of storage can be as short as 320 bits for 80-bit security (71% less compared to Ateniese et al.'s scheme). However, Shacham and Waters' scheme must trade off the storage cost, where the storage overhead for generating the proof of storage must be 100% of the stored file. Surprisingly, until today, the tradeoff between the proof size (namely proof of storage) and the storage cost (namely storage overhead) in cloud data auditing remains an open problem. In this paper, we introduce a completely new public cloud data auditing mechanism. The proof of storage is not computed from block tags directly, but from evolution tags that are still unforgeable and evolved from bunch tags. We propose a concrete public cloud data auditing scheme based on this mechanism, in which the proof size is 240 bits for 80-bit security (25% less compared to Shacham and Waters' scheme) and the storage cost can be as efficient as Ateniese et al.'s scheme. The core of our technique is the feasibility of tag aggregations within this new mechanism. Our scheme is provably secure in the random oracle model.

近年来,随着网络带宽的不断增加,大数据、云计算、外包计算等新兴应用得到飞速发展,同时也带来了更多的安全挑战,传统的点对点安全传输已无法满足错综复杂的网络环境,一对多安全传输变得极为重要.广播加密允许数据拥有者向一组选定的接收者安全分享数据,仅需运行一次加密算法并将密文发布到广播信道,监听此信道的授权用户均可解密获取明文,未授权用户即使合谋也无法正确解密,极大地减少了计算和通信开销.公钥广播加密相比于对称广播加密具有灵活性高、应用范围广等优点,近年来受到广泛关注.文章回顾了公钥广播加密的相关研究历史,从公钥广播加密的应用场景出发,重点介绍了公钥广播加密的系统模型和典型方案,包括标识广播加密、匿名广播加密、叛逆者追踪广播加密和可撤销广播加密,并阐述了各类公钥广播加密的原理和特征.最后,讨论了公钥广播加密的应用场景和未来的研究方向,旨在促进公钥广播加密的研究与发展.

Broadcast encryption provides a promising technique of data access control for specified users in cloud computing. A data uploader can generate a ciphertext for a set of chosen users such that only the intended users are able to access the data. However, with the rapidly increasing of collaboration between users, it is desired to extend the receiver set to grant decryption right for more users. The existing broadcast encryption systems cannot support receiver extension. In this article, we for the first time take this problem into consideration and give a solution. We take the merits of identity-based cryptosystem and propose a notion of EIBBE: a flexible data access control with receiver extendable for cloud computing based on broadcast encryption. It allows the authorized user to extend the receiver set $S$ stated in the IBBE ciphertext by adding a new receiver set $S^{\prime }$ without re-encryption. Both the users in $S$ and $S^{\prime }$ can access the data successfully. Moreover, the data uploader determines the maximum number of extended receivers. We then give a concrete construction of EIBBE and provide a rigorous security analysis of our proposed scheme. Finally, we demonstrate the scheme's efficiency and feasibility.

Cloud computing is considered as one of the most prominent paradigms in the information technology industry, since it can significantly reduce the costs of hardware and software resources in computing infrastructure. This convenience has enabled corporations to efficiently use the cloud storage as a mechanism to share data among their employees. At the first sight, by merely storing the shared data as plaintext in the cloud storage and protect them using an appropriate access control would be a nice solution. This is assuming that the cloud is fully trusted for not leaking any information, which is impractical as the cloud is owned by a third party. Therefore, encryption is mandatory, and the shared data will need to be stored as a ciphertext using an appropriate access control. However, in practice, some of these employees may be malicious and may want to deviate from the required sharing policy. The existing protection in the literature has been explored to allow only legitimate recipients to decrypt the contents stored in the cloud storage, but unfortunately, no existing work deals with issues raised due to the presence of malicious data publishers. Malicious data publishers construct data following the given policy, but the ciphertexts can actually be decrypted by unauthorized users without valid keys, or simply, anyone else who is unauthorized. The impact of the involvement of malicious data publishers is detrimental, as it may damage intellectual properties from the corporations. Therefore, it remains an elusive research problem on how to enable a sound approach to resolve the issue when malicious data publishers are involved in the system, which is a very practical question. In this work, we present a new direction of research that can cope with the presence of malicious data publishers. We resolve the aforementioned problem by proposing the notion of Sanitizable Access Control System (SACS), which is designed for a secure cloud storage that can also resist against malicious data publishers. We define the threat model and its formal security model, as well as its design and scheme which is based on $q$q-Parallel Bilinear Diffie-Hellman Exponent Assumption. We provide the security proof of our construction as well as its performance analysis. We believe that this work has opened a new area of research which has never been explored before, even though it is very practical. Therefore, this work will enhance the adoption of secure cloud storage in practice.

Hierarchical identity-based encryption can efficiently reduce the workload of private key generation and key distribution of the private key generator in the identity-based cryptography. SM9 is an identity-based cryptosystem and has become a Chinese cryptographic standard and national standard. It plays a significant role in many applications, such as finance and government affairs. However, SM9 encryption algorithm does not support hierarchical encryption, which is undesirable for the large network and becomes a bottleneck for its deployments. In this paper, we proposed an efficient hierarchical identity-based encryption scheme SM9-HIBE based on SM9. Compared to SM9 encryption algorithm, the ciphertext in SM9-HIBE only requires an additional group element and the decryption overhead increases one pairing operation only, which is independent of the length of receiver’s identity. We prove that if the DBDHI assumption holds, our scheme is proved to be INDsCPA secure in the random oracle model. Finally, we theoretically analyze our scheme and make a comparison.The result shows that the SM9-HIBE is comparable to the existing HIBE schemes in terms of computational cost and communication overhead.

Tightly secure signature plays a significant role in the research of cryptography and has been studied extensively in the literature. In this paper, we present a generic construction for tightly-secure signatures from the discrete log (DL) assumption in the existential-unforgeability against key only attacks (EUF-KOA) security model, where the adversary is allowed to obtain only the public key, but not any sample signature. Moreover, the generic construction can also be extended into the multi-user setting with corruptions (MU-C) model. Roughly speaking, given any signature scheme, we can efficiently convert it into a signature scheme that features tight security under the DL assumption in the MU-EUF-KOA-C security model with random oracles. Our transformation shows it is easy to construct a DL-equivalent signature in the EUF-KOA security model, although many known DL-based signatures are not equivalent to DL. If the given signature scheme is key-re-randomizable, the transformed scheme is also key-re-randomizable. Hence, our result provides a supplement to Bader et al.'s work (EUROCRYPT 2016).