In light of the existing security vulnerabilities within IoT publish–subscribe systems, our study introduces an improved end-to-end encryption approach using conditional proxy re-encryption. This method not only overcomes limitations associated with the reliance on a trusted authority and the challenge of reliably revoking users in previous proxy re-encryption frameworks, but also strengthens data privacy against potential collusion between the broker and subscribers. Through our innovative encryption protocol, unauthorized re-encryption by brokers is effectively prevented, enhancing secure communication between publisher and subscriber. Implemented on HiveMQ, an open-source MQTT platform, our prototype system demonstrates significant enhancements. Comparison to the state-of-the-art end-to-end encryption work, encryption overhead of our scheme is comparable to it, and the decryption cost is approximately half of it. Moreover, our solution significantly improves overall security without compromising the asynchronous communication and decentralized authorization foundational to the publish–subscribe model.

Existing reversible data hiding in encrypted images (RDH-EI) methods face limitations in embedding layers, capacity, and quantum resistance, making them unsuitable for hierarchical multiparty scenarios. This paper proposes a novel multi-layer RDH-EI scheme based on Ring Learning with Errors (RLWE), leveraging RLWE's additive homomorphism and designing a polynomial coefficient partitioning strategy. The content owner first encrypts the original image using RLWE, and multiple data hiders sequentially embed secret messages into the ciphertext through homomorphic addition. The receiver can decrypt the marked ciphertext to extract all embedded messages and recover the original image losslessly. Experimental results demonstrate that the proposed method supports up to n-1 embedding layers with security parameter n and achieves an embedding rate (ER) of 8 to 2040 bits per pixel (bpp). Compared to state-of-the-art RDH-EI approaches, this scheme offers significant advantages in embedding layers, capacity, and quantum resilience, providing a practical solution for secure hierarchical multiparty communication.

The publish-subscribe paradigm has become the mainstream communication model for large-scale Internet of Things (IoT) systems. However, existing end-to-end encryption solutions based on Conditional Proxy Re-Encryption (CPRE) suffer from limitations in supporting dynamic and fine-grained access control policies. This paper proposes a dynamic policy-aware CPRE system that extends traditional CPRE with multi-dimensional condition support and policy hiding capabilities. Our system introduces a JSON-based policy language to define complex access control rules incorporating temporal, spatial, role-based, and device status conditions. We design a policy matching engine that enables fine-grained authorization while preserving policy privacy. The proposed scheme is implemented as an extension to the HiveMQ MQTT broker and evaluated comprehensively. Experimental results demonstrate that our system achieves enhanced security with acceptable performance overhead, providing only 5–15% increase in encryption time while supporting rich dynamic policies compared to the original CPRE scheme.