In the fog computing architecture, a fog is a node closer to clients and responsible for responding to users’ requests as well as forwarding messages to clouds. In some medical applications such as the remote healthcare, a sensor of patients will first send encrypted data of sensed information to a nearby fog such that the fog acting as a re-encryption proxy could generate a re-encrypted ciphertext designated for requested data users in the cloud. Specifically, a data user can request access to cloud ciphertexts by sending a query to the fog node that will forward this query to the corresponding data owner who preserves the right to grant or deny the permission to access his/her data. When the access request is granted, the fog node will obtain a unique re-encryption key for carrying out the re-encryption process. Although some previous concepts have been proposed to fulfill these application requirements, they either have known security flaws or incur higher computational complexity. In this work, we present an identity-based proxy re-encryption scheme on the basis of the fog computing architecture. Our identity-based mechanism uses public channels for key distribution and avoids the troublesome problem of key escrow. We also formally prove that the proposed protocol is secure in the IND-PrID-CPA notion. Furthermore, we show that our work exhibits better performance in terms of computational complexity.

Certificate-based public key cryptography (CB-PKC) removes the problem of certificate management in traditional public key systems and avoids the key escrow problem in identity-based public key systems. In the past, many authenticated key exchange (AKE) protocols based on CB-PKC systems, called CB-AKE, were proposed to be applied to secure communications between two remote participants. However, these existing CB-AKE protocols become insecure since attackers could compute and obtain the whole secret key from some partial leaked information of the secret key by side channel attacks. In this paper, our goal is to propose the $first$ CB-AKE protocol with the property to resist side channel attacks, called leakage-resilient CB-AKE (LR-CB-AKE). The proposed LR-CB-AKE protocol is formally proven to be secure in the generic bilinear group (GBG) model under the discrete logarithm (DL) and computational Diffie-Hellman (CDH) assumptions.

Typically, for the system transformation from an original public-key cryptographic system (PKCS) setting to another PKCS setting, the relevant cryptographic schemes must be rewritten for such heterogeneous PKCS settings. Therefore, it is important to ensure that the old entities who have not yet converted to the new PKCS setting can still use the original functionalities of these cryptographic schemes. In the past, numerous anonymous multirecipient encryption (AMRE) schemes based on various PKCS settings have been proposed, but the existing AMRE schemes are only applicable to single PKCS setting and unsuitable for heterogeneous PKCS settings. In this article, we propose a novel and the first anonymous heterogeneous multirecipient encryption (MRE) scheme with the seamlessly compatible system transformation, named as an AHMRE-SCST scheme. The proposed scheme possesses the functionalities of the AMRE schemes while providing the seamlessly compatible system transformation from a public key infrastructure (PKI)-based PKCS (PKI-PKCS) setting to a certificateless (CL)-based PKCS (CL-PKCS) setting. Also, security theorems show that the proposed scheme is secure against the three kinds of attackers in both the PKI-PKCS and the CL-PKCS settings. When compared with the existing AMRE schemes, our scheme has four merits as follows: 1) it is the first AHMRE-SCST scheme; 2) It is well-suitable for the two heterogeneous PKCS settings, namely the PKI-PKCS and the CL-PKCS settings; 3) Its decryption complexity is constant; and 4) By performance analysis, it is well-suitable for the Internet of Things (IoT) devices with the limited resources.

In a fog-enabled IoT environment, a fog node is regarded as the proxy between end users and cloud servers to reduce the latency of data transmission, so as to fulfill the requirement of more real-time applications. A data storage scheme utilizing fog computing architecture allows a user to share cloud data with other users via the assistance of fog nodes. In particular, a fog node obtaining a re-encryption key of the data owner is able to convert a cloud ciphertext into the one which is decryptable by another designated user. In such a scheme, a proxy should not learn any information about the plaintext during the transmission and re-encryption processes. In 2020, an ID-based data storage scheme utilizing anonymous key generation in fog computing was proposed by some researchers. Although their protocol is provably secure in a proof model of random oracles, we will point out that there are some security flaws inherited in their protocol. On the basis of their work, we further present an improved variant, which not only eliminates their security weaknesses, but also preserves the functionalities of anonymous key generation and user revocation mechanism. Additionally, under the Decisional Bilinear Diffie–Hellman (DBDH) assumption, we demonstrate that our enhanced construction is also provably secure in the security notion of IND-PrID-CPA.

In the realm of consumer Internet of Things environments, data related to personal health and medical records can be collected. However, as this healthcare data falls under personal privacy, it must undergo encryption procedures before being uploaded to the cloud to ensure data confidentiality. Additionally, there is a desire for the encrypted data uploaded to the cloud to be compared, enabling the timely detection of anomalous data. If there are issues with healthcare data, the cloud system can issue alerts. Indeed, there already exists a mechanism, namely identity-based signcryption with equality test (IBSCET), which can accomplish the desire by comparing whether two encrypted data contain the same message. However, IBSCET does not address the issue of user revocation, which is crucial in any system. To address this problem, we enhance the existing IBSCET to propose the first outsourced revocable IBSCET (OR-IBSCET) scheme. Under the bilinear Diffie-Hellman and the computational Diffie-Hellman assumptions, we also demonstrate that the proposed scheme possesses security of the indistinguishability under chosen ciphertext attacks, the existential unforgeability under chosen message attacks, and one-wayness under chosen ciphertext attacks.

Quite recently, Tseng and Tsai proposed a revocable identity (ID)-based encryption (RIBE) with a public channel, in which the private key generator (PKG) can efficiently revoke misbehaving/compromised users by using a public channel. Considering the problem where a sender would like to encrypt an identical message for n receivers, the sender must re-encrypt the message n times using Tseng and Tsai’s RIBE scheme. In such a case, n expensive pairing operations are required for the re-encrypting procedure. In this paper, for reducing the pairing operations, we extend Tseng and Tsai’s RIBE to propose an efficient revocable multi-receiver ID-based encryption (RMIBE) scheme. Our scheme only needs one pairing operation to encrypt an identical message for n receivers while remaining the merit of user revocability in Tseng and Tsai’s RIBE scheme. We demonstrate that the RMIBE scheme is semantically secure against adaptive chosen ciphertext attacks (CCA) in the random oracle model.DOI: http://dx.doi.org/10.5755/j01.itc.42.2.2244