Unmanned Aerial Vehicles (UAVs, also known as Drones) have been widely employed in military defense and civilian service. However, as UAVs communicate over insecure open wireless channels, the security challenges and privacy concerns are becoming increasingly prominent. Moreover, some existing schemes to achieve authentication and key agreement among UAVs are spliced with the assistance of two UAV-2-GCS mechanisms, which are not flexible enough to be applied in the Internet of Drones (IoD) scenarios. This paper proposes a Blockchain-assisted authentication and key agreement scheme for UAVs networks referred to as BAKAS-UAV, which addresses security and privacy concerns and overcomes high computational and communication costs in the IoD. A blockchain-based network model is presented in which the ground station acts as an edge node and manages the blockchain, which assists authentication and key agreement. Based on the network model, both types of authentication and key agreement mechanisms, UAV-2-GCS and UAV-2-UAV, are proposed, respectively. In particular, the ground control station (GCS) does not participate in the authentication and key agreement of UAV-2-UAV process; only upon the process is completed the two UAVs synchronize the updated information with GCS. We also implement a smart contract as the authentication service, and the experimental implementation demonstrates the availability of our scheme in IoD. Physical unclonable functions (PUFs) is introduced on the UAVs side to defend against physical capture attacks and also to implement authentication and key agreement mechanisms. The semantic security is proved formally based on the Real-Or-Random (ROR) model, and the informal analysis shows that the scheme satisfies the demanded security requirements. The scheme’s performance is evaluated by simulating the UAVs and GCS settings with Raspberry Pi 4B and MacOS platforms, respectively, with implementation of several cryptographic primitives. The experimental results show that BAKAS-UAV achieves high efficiency.

Cloud computing with massive storage and computing capabilities has become widespread in actual applications. It is critical to ensure secure data sharing in cloud-based applications. Currently, numerous identity-based broadcast proxy re-encryption (IB-BPRE) schemes have been proposed to resolve the privacy issue. However, the existing IB-BPRE schemes cannot reach the transformation of the decryption right for outsourced encrypted data between the broadcast receiver sets (data user sets) delegated by the data owner (Alice) because it is difficult for the IB-BPRE to hold the character of multi-hop. Consequently, a new cryptographic primitive called autonomous path identity-based broadcast proxy re-encryption (APIB-BPRE) is presented to address the above issue. In an APIB-BPRE scheme, the delegator establishes an autonomous path involving preferred multiple broadcast receiver sets and the proxy can convert the decryption right for the broadcast receiver set into the decryption right for the next broadcast receiver set by the re-encryption key from the delegator. This solution is convenient and flexible for cloud users and utilizes the benefits of cloud computing. The evaluation and comparison indicate that our APIB-BPRE system is effective and practical.

Cloud computing has become popular in data sharing mainly because it has huge storage capacity and computing power. Securing the privacy of sensitive data for cloud-based data sharing is vital. Currently, there are various conditional proxy re-encryption (UPRE) schemes that have been proposed to resolve the privacy issue. Nevertheless, the existing UPRE schemes cannot allow the proxy (e.g., the cloud server) to transfer the outsourced encrypted data under the data owner’s public key of any homomorphic encryption scheme into the encrypted data under the data user’s public key of a homomorphic encryption scheme (possibly different from the data owner). The transformation of outsourced encrypted data between homomorphic encryption schemes is more suitable for the real data sharing in clouds. Consequently, we present the notion of universal conditional proxy re-encryption (UCPRE) to solve the issue of flexible transformation of outsourced encrypted data between homomorphic encryption schemes in cloud-based data sharing. UCPRE is lightweight in the sense that it only requires the re-encrypted key generation and re-encryption algorithms. We give the definition of UCPRE and prove that it is HRA secure without random oracle. Finally, we show that our UCPRE is efficient and rational compared to other existing CPRE schemes by instantiating our UCPRE.

Cloud computing has witnessed widespread adoption across numerous sectors, primarily due to its substantial storage capacity and powerful computational resources. In this context, secure data sharing in cloud environments is critically important. Identity-based broadcast proxy re-encryption (IB-BPRE) has emerged as a promising solution; however, existing IB-BPRE schemes lack dynamic functionality—specifically, the ability to support user revocation and addition without updating re-encryption keys. Consequently, data owners must frequently reset and distribute these keys in response to user membership changes, leading to increased system complexity and communication overhead. In this paper, we propose an identity-based broadcast proxy re-encryption scheme with dynamic functionality (IB-BPRE-DF) to address this challenge. The proposed scheme utilizes a symmetric design of re-encryption keys to enable dynamic user updates while preserving a constant re-encryption key size. Furthermore, IB-BPRE-DF is constructed under the $(f,g,F)$-GDDHE assumption and achieves semantic security in the random oracle model. Performance evaluations demonstrate that IB-BPRE-DF significantly reduces both the communication overhead (by maintaining a constant size for the re-encryption key and re-encrypted ciphertext) and the computational burden (with near-zero computational cost for generating the re-encryption key) for resource-constrained users. This work provides a practical and scalable cryptographic solution for secure and efficient data sharing in dynamic cloud environments.