In this article, we address the problem of secure sensitive data sharing for the specified recipients in Blockchain Internet of Things (BIoT). To do it, we present a cryptographic solution to meet the requirements of decentralization and convenience through key management and programmable ciphertext. First, we design a new ciphertext-policy decentralized-key attribute-based encryption (CP-DK-ABE) scheme. After the master secret key is shared into all full nodes in the form of threshold secret sharing, a decentralized multiparty computation protocol is used to generate the user’s private key in an interactive way. Meanwhile, the attribute subkeys associated with the private key can be reconstructed by obtaining a fragment from each of full nodes, so as to achieve the cooperative management of attribute key through all of full nodes. Furthermore, following the blockchain’s script system, we introduce five new opcodes to represent ciphertext in the programmable format. Such a mechanism provides flexible capability to represent the logical relationship of the access control policy among attribute subciphers in the CP-DK-ABE ciphertext by the scripting language. As a result, the processes of encryption and decryption are implemented entirely by the script interpreter on the blockchain node, thereby greatly improving the convenience of programming in BIoT devices. In addition, we prove that the proposed CP-DK-ABE scheme is key private and semantically secure for a limited number of corrupted full nodes under the decisional linear and bilinear Diffie–Hellman assumption, respectively.

The increasing popularity of remote Cloud File Sharing (CFS) has become a major concern for privacy breach of sensitive data. Aiming at this concern, we present a new resource sharing framework by integrating enterprise-side Attribute-Based Access Control/eXtensible Access Control Markup Language (ABAC/XACML) model, client-side Ciphertext-Policy Attribute-Based Encryption (CP-ABE) scheme, and cloud-side CFS service. The framework workflow is provided to support the encrypted-file writing and reading algorithms in accordance with ABAC/XACML-based access policy and attribute credentials. However, an actual problem of realizing this framework is that policy matrix, derived from access policy, seriously affects the performance of existing CP-ABE from Lattice (CP-ABE-L) schemes. To end it, we present an optimal generation algorithm of Small Policy Matrix (SPM), which only consists of small elements, and generates an all-one reconstruction vector. Based on SPM, the improved CP-ABE-L scheme is proposed to reduce the cumulative errors to the minimum. Furthermore, we give the optimal estimation of system parameters to implement a valid Error Proportion Allocation (EPA). Our experiments indicate that our scheme has short size of parameters and enjoys efficient computation and storage overloads. Thus, our new framework with optimization methods is conducive to enhancing the security and efficiency of remote work on CFS.

Ciphertext-policy attribute-based encryption (CP-ABE) is suited for securing electronic health records (EHRs), as it enables fine-grained access control over sensitive medical data while preserving interoperability. However, existing schemes face significant challenges in dynamic user revocation and efficient decryption, including privacy leakage during revocation and difficulties in tracing malicious users. To address these issues, we propose T-DRED, a traceable and dynamic revocation-enabled decryption scheme based on secure aggregation functions. T-DRED employs a secure aggregation function to dynamically insert revoked user identities into a revocation list, enabling selective ciphertext updates and reducing revocation overhead. To preserve privacy, revocation status is verified through membership determination without revealing user identities. To improve decryption efficiency, our scheme innovatively adopts a two-phase decryption process, separating user identity verification from policy verification. In the first phase, lightweight membership verification identifies valid users; in the second phase, attribute-policy matching is performed. Additionally, each user key contains a glass-box tracing identifier, allowing the system to trace and revoke malicious users upon key leakage. Revoked users are denied access to both new and historical ciphertexts via list updates, realizing integrated trace-and-revoke functionality. In terms of security, under the standard model and based on the $q$ -BDHE and $l$ -SDH assumptions, the IND-CPA, traceability, and membership verification security of our T-DRED scheme are formally proven. Experimental results show that T-DRED improves encryption and decryption efficiency over existing related schemes.