Verifiable Searchable Symmetric Encryption, as an important cloud security technique, allows users to retrieve the encrypted data from the cloud through keywords and verify the validity of the returned results. Dynamic update for cloud data is one of the most common and fundamental requirements for data owners in such schemes. To the best of our knowledge, the existing verifiable SSE schemes supporting data dynamic update are all based on asymmetric-key cryptography verification, which involves time-consuming operations. The overhead of verification may become a significant burden due to the sheer amount of cloud data. Therefore, how to achieve keyword search over dynamic encrypted cloud data with efficient verification is a critical unsolved problem. To address this problem, we explore achieving keyword search over dynamic encrypted cloud data with symmetric-key based verification and propose a practical scheme in this paper. In order to support the efficient verification of dynamic data, we design a novel Accumulative Authentication Tag (AAT) based on the symmetric-key cryptography to generate an authentication tag for each keyword. Benefiting from the accumulation property of our designed AAT, the authentication tag can be conveniently updated when dynamic operations on cloud data occur. In order to achieve efficient data update, we design a new secure index composed by a search table ST based on the orthogonal list and a verification list VL containing AATs. Owing to the connectivity and the flexibility of ST, the update efficiency can be significantly improved. The security analysis and the performance evaluation results show that the proposed scheme is secure and efficient.

However, most of the existing asymmetric-PAKE protocols either are based on traditional hash functions under random oracles or depend on non-quantum-secure hardness assumptions and remain insecure in the quantum era. To bridge the gap between the asymmetric-PAKE and quantum-safe, in this paper, we resort to smooth projective hash functions (SPHF) and commitment-based password-hashing schemes (PHS) over lattice-based cryptography, and we propose the construction of round-optimal asymmetric PAKE protocol secure against quantum attacks. Our construction eliminates the costly non-interactive zero-knowledge (NIZK) method, bypasses assumptions of the random oracle model, and achieves quantum resistance. We also show that our asymmetric-PAKE protocol can achieve balanced security and robustness under the Bellare-Pointcheval-Rogaway (BPR) model. Finally, we develop a prototype implementation of our instantiation and use it to evaluate its performance in realistic settings.

Password-based authenticated key exchange (PAKE) protocol allows protocol participants to establish a high entropy session key by pre-sharing a low-entropy password. Katz and Vaikuntanathan (ASIACRYPT'09) used a one-round smooth projective hash function (SPHF) over lattices to design a three-round PAKE protocol. Zhang and Yu (AISACRYPT'17) improved Katz-Vaikuntanatha's scheme by proposing a two-round PAKE with NIZK proofs, but how to construct a lattice-based simulation-sound NIZK remains an open research question. Benhamouda et al. followed the framework of Katz and Vaikuntananthan (TCC'11) and proposed a one-round PAKE via trapdoor-SPHF, but their scheme was based on conventional DDH assumption. In other words, how to design a one-round PAKE via an efficient lattice-based SPHF still remains a challenge. In this paper, we attempt to fill this gap by first proposing a new IND-CCA-secure lattice-based SPHF based on the work of Benhamouda et al. (PKC'18), and then using the proposed SPHF to construct a one-round PAKE protocol. We then prove the security of the proposed protocol. We also explore the possibilities of constructing two-round PAKE, three-round PAKE and universal composable security from our SPHF, and show the potential application of our PAKE in the Internet of Things where communication cost is the main consideration.

Insufficient parking space and traffic congestion are important usual suspects in our urban life. Organisation and managing available parking spaces have raised a lot of awareness. Traditional centralized parking approaches are with an insidious single point of failure and unsuitable for large organization because the manager is overburdened with authority and responsibility. The malicious service provider enables to (i) track the precise mobility patterns of citizens. (ii) collect the data to infer privacy-sensitive information, e.g., where the parking requester (i.e., driver) socialize, work, and live; (iii) analyze trajectories to monitor the location of the driver for entertainment (e.g., discovering one-night stands). To design a decentralized smart and practical parking platform without compromising the privacy of the entities is an urgent issue for the smart city. Blockchain (or distributed public ledger technology) is a near-ideal decentralized and distributed solution for centralized parking-space-recommendation systems. However, most of the existing parking recommendation solutions on top of blockchain ignore to protect the privacy of drivers during parking spot detection and matching phases while cannot maintain the property of anonymity of the drivers. In this paper, an efficient and privacy-preserving parking-space recommendation service platform, named as PriParkRec, along with the proof-of-concept solution to protect the requester's privacy in PriParkRec while maintaining most of the benefits of current parking-space sharing service, i.e., accountability, (anonymous) authentication, (anonymous) payment, and reputation ratings. Indeed, PriParkRec service relies on well-known privacy-enhancing cryptographic building blocks (e.g., oblivious PRF, private set intersection, anonymous credentials, anonymous payment, and smart-contract, etc), these building blocks are carefully integrated together to achieve privacy and security goals to revolutionize the existing car-parking service system coming with the private blockchain and industrial internet of things (IIoTs) technologies.

Identity-based proxy re-encryption (IBPRE) is a powerful cryptographic tool for various applications, such as access control system, secure data sharing, and secure e-mail forwarding. Most of the existing efficient IBPRE schemes are based on the Diffie-Hellman assumption, and they only focus on the single-hop construction. Based on the work of Chandran et al.'s lattice-based proxy re-encryption (PRE) scheme (PKC'14) and Yamada's lattice-based identity-based encryption (IBE) scheme (EUROCRYPT'16), in this paper, we first show the possibility of assembling lattice-based IBE into lattice-based PRE. Then, we present the construction of a new efficient single-hop homomorphic IBPRE from learning with errors (LWEs) via key homomorphic computation. Furthermore, using branching program (BP), we obtain an efficient multi-hop IBPRE scheme. To the best of our knowledge, our scheme is the first multi-hop homomorphic IBPRE scheme via BP. Our scheme supports homomorphic evaluation and is proved secure under the decisional LWE assumption.

Industrial Internet of Things (IIoT) brings together computers, devices, advanced analytics, and people in industries such as transportation, oil plant and power grid, that leads to major efficiency and productivity gains for almost any industrial procedures. Due to the interconnection of devices in IIoT, communication security has become a critical issue to address in many emerging industry standards which require the authentication and key exchange procedure to be done to guarantee the authorized machine access (e.g., from users) and secure the data transmission between machines. To overcome the shortcoming (i.e., low entropy) of the memorable password in user authentication, it is rightfully recommended by industry standards (such as IEC-62443 family) to use multi-factor authentication for higher security levels. Notably, latency is one of the main sources of inefficiency when a device is communicating with other machines on IIoT. To mitigate latency, smooth projective hash function (SPHF) built from wellstudied standard assumptions is used to achieve low-interactivity multi-factor authenticated key exchange protocol (MFAKE), because SPHF allows each party to prove to the others that he knows the right authentication factor(s). In this paper, we are therefore motivated to build a new MFAKE named “secure remote multifactor (SRMF)” to achieve the human involved “machine-to-machine” secure communication in IIoT. That is, SRMF leverages multiple user-centric authentication factors (such as password, biometric fingerprints, and PIN), and it can synergistically support multi-factor registration (MFR), multi-factor authentication (MFA) and multifactor key exchange (MFKE). Further, to prevent authentication factors stored at the server exposing to attackers, the password-harden service (i.e., Pythia-PRF, USENIX’15) inspires us to develop a multifactor hardening service (MFHS) utilizing an oblivious pseudorandom function (OPRF). The balanced security of the proposed protocol is proved under the model of Bellare-Pointcheval-Rogaway (EUROCRYPTO’ 00) along with theoretical and experimental evaluations.