Cloud storage faces significant security and access control challenges due to reduced user oversight and the emerging threat of quantum computing to traditional cryptographic methods. Existing revocable Identity-Based Encryption (IBE) schemes are limited by their lack of post quantum security, inefficient revocation mechanisms that require re-encryption of data, and cumbersome key update procedures. We propose a post-quantum secure Ring-LWE IBE scheme with dynamic time-based revocation tailored for cloud environments. Our solution is built on the hardness of the Ring Learning with Errors (RLWE) problem to ensure quantum resistance and introduces a novel time-based revocation framework. In our approach, user access is bound to discrete periods and managed through a hierarchical binary tree structured over identities and time. This design eliminates the need to re-encrypt stored data upon user revocation. Instead, a trusted authority periodically distributes lightweight key updates exclusively to non-revoked users. Thanks to the binary tree structure, non-revoked users can compute updated decryption keys with only O (log Nₘₐₓ) overhead in both computation and communication, where Nₘₐₓ is the maximum number of users or periods. Revoked users, having no access to future updates, lose decryption capabilities. We provide formal security proofs showing the schemes resistance against adaptive identity and time-period-based attacks, grounded in the RLWE assumption. Overall, our scheme offers an effective combination of post-quantum security, efficient access control, and simplified key management, making it suitable for secure cloud data sharing in the quantum era.
Cloud storage faces significant security and access control challenges due to reduced user oversight and the emerging threat of quantum computing to traditional cryptographic methods. Existing revocable Identity-Based Encryption (IBE) schemes are limited by their lack of post quantum security, inefficient revocation mechanisms that require re-encryption of data, and cumbersome key update procedures. We propose a post-quantum secure Ring-LWE IBE scheme with dynamic time-based revocation tailored for cloud environments. Our solution is built on the hardness of the Ring Learning with Errors (RLWE) problem to ensure quantum resistance and introduces a novel time-based revocation framework. In our approach, user access is bound to discrete periods and managed through a hierarchical binary tree structured over identities and time. This design eliminates the need to re-encrypt stored data upon user revocation. Instead, a trusted authority periodically distributes lightweight key updates exclusively to non-revoked users. Thanks to the binary tree structure, non-revoked users can compute updated decryption keys with only O (log Nₘₐₓ) overhead in both computation and communication, where Nₘₐₓ is the maximum number of users or periods. Revoked users, having no access to future updates, lose decryption capabilities. We provide formal security proofs showing the schemes resistance against adaptive identity and time-period-based attacks, grounded in the RLWE assumption. Overall, our scheme offers an effective combination of post-quantum security, efficient access control, and simplified key management, making it suitable for secure cloud data sharing in the quantum era.
Cloud computing offers abundant computing resources and scalable storage, but data leakage in the cloud storage environment is a common and critical concern due to inadequate protection measures. Revocable-attribute-based encryption (RABE) is introduced as an advanced form of identity-based encryption (IBE), which encrypts sensitive data while providing fine-grained access control and an effective user revocation mechanism. However, most existing RABE schemes are not resistant to quantum attacks and are limited in their application scenarios due to the revocation model. In this paper, we propose a RABE scheme constructed from lattices. Our scheme has several advantages, including a near-zero periodic workload for the key generation center (KGC), ensuring scalability as the number of users increases. Additionally, the encryptor is relieved from managing a revocation list. Moreover, our scheme guarantees the confidentiality and privacy of other ciphertexts even if the decryption key for a specific period is compromised. We validated the correctness of our scheme and demonstrated its security under the assumption of learning with errors (LWE), which is widely believed to be resistant to quantum attacks. Finally, we provide an application example of our RABE scheme in the electronic healthcare scenario.
The rapid expansion of the Internet of Things (IoT) has led to an unprecedented scale of data exchange across heterogeneous and resource-constrained devices. Ensuring confidentiality and secure key management in such environments is challenging. Traditional public-key infrastructures require heavy certificate-handling overhead. Identity-Based Encryption (IBE) offers a lightweight alternative by deriving public keys directly from device identities, making it attractive for IoT deployments. However, IoT devices are highly vulnerable to side-channel and key-extraction attacks, motivating the need for Forward-Secure IBE(FS-IBE), where the compromise of a current secret key does not threaten past communications. Existing FS-IBE constructions based on classical hardness assumptions are not secure in the era of post-quantum, while the lattice-based (LWE-based) forward-secure scheme suffer from large key and ciphertext sizes, limiting their suitability for constrained IoT systems. Here, we propose a new lattice-based fs-IBE scheme in the ring setting, relying on the RLWE assumption to achieve post-quantum security and significant efficiency gains. Our design uses trapdoor delegation with a minimal-cover mechanism over a binary tree. It results in compact public parameters and efficient per-epoch key updates. Compared to prior LWE-based constructions, our scheme reduces public key, secret key, and ciphertext sizes, and thus, making it better suited for practical IoT environments.
Abstract. In this paper, we present an identity-based encryption (IBE) scheme from lattices with efficient key revocation. We adopt multiple trapdoors from the Agrawal-Boneh-Boyen and Gentry-Peikerty-Vaikuntanathan lattice IBE schemes to realize key revocation, which in turn, makes use of binary-tree data structure. Using our scheme, key update requires logarithmic complexity in the maximal number of users and linear in the number of revoked users for the relevant key authority. We prove that our scheme is selective secure in the standard model and under the LWE assumption, which is as hard as the worst-case approximating short vectors on arbitrary lattices. Moreover, our key revocation techniques from lattices can be applied to obtain revocable functional encryption schemes in the similar setting.
Revocable Identity-Based Encryption (RIBE) can dynamically revoke users whose secret keys have been compromised, ensuring a system's backward security. An RIBE scheme with decryption key exposure resistance (DKER) guarantees the confidentiality of ciphertext during any time period where the decryption key remains undisclosed. Existing RIBE schemes with DKER generate O(rlog(N/r)) ciphertexts for each plaintext message. Redundant ciphertexts impose significant computational burdens on users and substantial communication overhead on the system. To reduce high computation and communication overhead in existing schemes, this paper proposes a dual-key combination trapdoor generation method. Based on the proposed method, an indirect RIBE scheme with DKER is constructed, reducing ciphertext redundancy and obtaining computation and communication efficiency. Firstly, this paper proposes a dual-key combination trapdoor generation mechanism. By constructing an Inhomogeneous Small Integer Solution (ISIS) instance, the Key Generation Center (KGC) generates and distributes short bases to users as their identity keys. Subsequently, based on the constructed ISIS instance, a new inverse ISIS instance is derived. Furthermore, during each time period, KGC generates short bases for all non-revoked users as their time keys. By linearly combining their identity key with the corresponding time key, every non-revoked user can derive a re-randomized decryption key, achieving controlled key derivation. Secondly, based on the proposed method, a Post-Quantum Secure, Lightweight RIBE scheme with DKER (PQS-LRIBE-DKER) is constructed. For every non-revoked user, their identity key and time key serve as their own user secret key and key update, respectively. Controllable key derivation enables indirect revocation of the scheme. By adopting an indirect revocation, the PQS-LRIBE-DKER scheme achieves a single ciphertext per plaintext message, significantly reducing the sender's computational load and the system's communication overhead. Finally, under the hardness assumptions of the Learning with Errors (LWE) and ISIS problems, we prove that the proposed scheme achieves selective identity security in the standard model.
A revocable identity-based encryption (IBE) scheme under learning with error (LWE) assumption from lattice is proposed; compared with the existing IBE schemes from lattices, two improvements are available in the new scheme. First, the revocation mechanism for identity of user (or thing) is added in the new scheme to manage the dynamic user (or thing) identity in the system, and making the IBE scheme from lattice becomes more practical than ever before. Second, the security of the new scheme is based on the LWE assumption from lattice, so our construction has a solid secure foundation. The scheme is proved to be secured against adaptive-ID attacks under LWE assumption from lattice in the standard model.
With the rapid development of quantum computing technology, data sharing systems in cloud storage may suffer from quantum computing attacks. Recently, many researchers have proposed encryption schemes to achieve quantum attack resistance and fine-grained data access control. However, single point of failure and secure attribute revocation are two critical problems for quantum-resistant encryption scheme in cloud storage environments. In order to deal with these problems, in this paper, we propose a revocable multi-authority attribute-based encryption from lattice (RMA-ABE-L) in cloud storage. Firstly, RMA-ABE-L scheme can achieve fine-grained data access control with quantum computing attack resistance. We design efficient anti-quantum algorithms based on R-LWE problem and merge them with ciphertext-policy attribute-based encryption (CP-ABE) structure. Secondly, RMA-ABE-L scheme can solve the single point of failure problem. We design the multi-authority structure to so that the compromise of some authorities does not affect the functioning of the whole data sharing system. Moreover, RMA-ABE-L scheme can realize secure attribute revocation. We design a secure attribute revocation mechanism and set special identity construction. The performance analysis shows that RMA-ABE-L scheme is more efficient than other related schemes.