The growing reliance on cloud computing has brought significant attention to the security and privacy of outsourced data. Subset Predicate Encryption (SPE) provides fine-grained access control suitable for cloud environments, enabling selective decryption based on predicate evaluation. However, most existing SPE constructions are vulnerable to quantum attacks and fail to address the critical issue of key leakage or user collusion. In this work, we present a lattice-based SPE scheme that is post-quantum secure and augmented with traitor tracing functionality. By integrating fingerprinting codes into the encryption and key generation processes, our design enables the identification of malicious users responsible for leaked decryption capabilities. Our scheme offers strong resistance against quantum adversaries and practical traceability in cloud-based data sharing scenarios.
The growing reliance on cloud computing has brought significant attention to the security and privacy of outsourced data. Subset Predicate Encryption (SPE) provides fine-grained access control suitable for cloud environments, enabling selective decryption based on predicate evaluation. However, most existing SPE constructions are vulnerable to quantum attacks and fail to address the critical issue of key leakage or user collusion. In this work, we present a lattice-based SPE scheme that is post-quantum secure and augmented with traitor tracing functionality. By integrating fingerprinting codes into the encryption and key generation processes, our design enables the identification of malicious users responsible for leaked decryption capabilities. Our scheme offers strong resistance against quantum adversaries and practical traceability in cloud-based data sharing scenarios.
A traitor tracing scheme is a multi-receiver encryption scheme where malicious receiver coalitions aiming at building pirate decryption devices are deterred by the existence of a tracing algorithm: Using the pirate decryption device, the tracing algorithm can recover at least one member of the malicious coalition. All existing traitor tracing schemes rely either on rather inefficient generic constructions from arbitrary encryption schemes and collusion-secure fingerprinting codes, or on algebraic constructions exploiting the assumed hardness of variants of the Discrete Logarithm Problem. In this work, we present the first algebraic construction of a traitor tracing encryption scheme whose security relies on the assumed (quantum) worst-case hardness of standard lattice problems. The scheme is public-key, provably resists Chosen Plaintext Attacks and allows for minimal access black-box tracing (i.e., tracing works even if granted a very limited access to the pirate decryption device). It inherits the standard features of lattice-based cryptography, such as provable security under mild computational assumptions, conjectured resistance to quantum computers, and asymptotic efficiency. For proving the security, we introduce a Learning With Errors variant of the k-SIS problem from Boneh and Freeman [PKC'11], which we prove at least as hard as the standard LWE problem. We also describe a variant of our scheme with security based on the assumed hardness of the Ring Learning With Errors problem which achieves quasi-optimal asymptotic performance with respect to the security parameter.
Cloud-based services have powerful storage functions and can provide accurate computation. However, the question of how to guarantee cloud-based services access control and achieve data sharing security has always been a research highlight. Although the attribute-based proxy re-encryption (ABPRE) schemes based on number theory can solve this problem, it is still difficult to resist quantum attacks and have limited expression capabilities. To address these issues, we present a novel linear secret sharing schemes (LSSS) matrix-based ABPRE scheme with the fine-grained policy on the lattice in the research. Additionally, to detect the activities of illegal proxies, homomorphic signature (HS) technology is introduced to realize the verifiability of re-encryption. Moreover, the non-interactivity, unidirectionality, proxy transparency, multi-use, and anti-quantum attack characteristics of our system are all advantageous. Besides, it can efficiently prevent the loss of processing power brought on by repetitive authorisation and can enable precise and safe data sharing in the cloud. Furthermore, under the standard model, the proposed learning with errors (LWE)-based scheme was proven to be IND-sCPA secure.
As the internet becomes prevalent, plenty of sensitive data is being transferred in open networks environment. It is worth concerning how to achieve efficient data transfer in a privacy-preserving manner. Although attribute-based encryption (ABE) can achieve fine-grained access control over encrypted data, it still could not work for restricting unauthorised user to access. In this paper, we introduce a new cryptographic primitive called attribute-based encryption supporting data filtration (ABE-SDF), and formalise the security mode by incorporating the advantages into previous ABE. Finally, we present an efficient construction of the scheme over post-quantum assumptions our scheme is believed to be quantum-resistant owing to the special property of lattices. Based on the LWE assumption, we prove that the proposed scheme has the indistinguishability against selective chosen plaintext attacks and the authentication information security.
Abstract To meet the performance and scalability demands of current cloud systems, cryptographic systems should be resistant to both quantum and classical adversaries, especially considering the future potential provided by quantum computing. The presented manuscript provides an integrated, quantum-resistant, cloud-based encryption architecture built on the combination of post-quantum authentication, scalable, multi-tenant, key-management methods, and side-channel-conscious design in a cloud-native paradigm. The lattice-based post-quantum key-encapsulation scheme to derive the long-lived and tenant-specific cryptographic key is built into the system to remove all possible single-point failure sources. Long-lived and tenant-specific cryptographic keys are subsequently replicated in a threshold-based key-management service (KMS) cluster. Lightweight symmetric primitives are used to compute session keys thus reducing client-side latency on resource-constrained devices. The AES − 256-GCM or Ascon encryption schemes are deployed to guarantee confidentiality of data. Moreover, the architecture uses the symmetric message authentication codes and lattice-signature schemes produced using quantum-safe primitives to ensure the data integrity and authenticity. By distributing key computations across isolated KMS nodes and restricting direct use of long-lived secrets to bounded and infrequent operations, the implementation utilizes leakage-resilient techniques. The system, which is designed for elastic scalability, provides fine-grained access control through configurable lattice-based attribute-based encryption and dynamically allocates keys for new tenants. Experimental benchmarks show that the technique attains strong multi-tenant isolation and side-channel information leakage resistance while minimizing handshake latency by considerable amounts over per-session post-quantum exchanges. This model surmounts the shortcomings of current post-quantum, multi-tenant, and cloud-native security systems by integrating quantum-resistant cryptographical principles, distributed mechanisms for trust, and lightweight operational techniques and thus offers a practical and flexible solution for secure protection of sensitive cloud-hosted data in the future quantum era.
To meet the performance and scalability demands of current cloud systems, cryptographic systems should be resistant to both quantum and classical adversaries, especially considering the future potential provided by quantum computing. The presented manuscript provides an integrated, quantum-resistant, cloud-based encryption architecture built on the combination of post-quantum authentication, scalable, multi-tenant, key-management methods, and side-channel-conscious design in a cloud-native paradigm. The lattice-based post-quantum key-encapsulation scheme to derive the long-lived and tenant-specific cryptographic key is built into the system to remove all possible single-point failure sources. Long-lived and tenant-specific cryptographic keys are subsequently replicated in a threshold-based key-management service (KMS) cluster. Lightweight symmetric primitives are used to compute session keys thus reducing client-side latency on resource-constrained devices. The AES -256-GCM or Ascon encryption schemes are deployed to guarantee confidentiality of data. Moreover, the architecture uses the symmetric message authentication codes and lattice-signature schemes produced using quantum-safe primitives to ensure the data integrity and authenticity. By distributing key computations across isolated KMS nodes and restricting direct use of long-lived secrets to bounded and infrequent operations, the implementation utilizes leakage-resilient techniques. The system, which is designed for elastic scalability, provides fine-grained access control through configurable lattice-based attribute-based encryption and dynamically allocates keys for new tenants. Experimental benchmarks show that the technique attains strong multi-tenant isolation and side-channel information leakage resistance while minimizing handshake latency by considerable amounts over per-session post-quantum exchanges. This model surmounts the shortcomings of current post-quantum, multi-tenant, and cloud-native security systems by integrating quantum-resistant cryptographical principles, distributed mechanisms for trust, and lightweight operational techniques and thus offers a practical and flexible solution for secure protection of sensitive cloud-hosted data in the future quantum era.
The rise of cloud computing has transformed data storage and processing but introduced new vulnerabilities, especially with the impending threat of quantum computing. Traditional cryptographic methods, though currently effective, are at risk of being compromised by quantum attacks. This research aims to develop a quantum-resistant security framework for cloud environments, combining lattice-based cryptography with Quantum Key Distribution (QKD) protocols, particularly the E91 protocol, for secure key management. The framework also incorporates quantum authentication protocols to enhance user identity verification, protecting against unauthorized access and tampering. The proposed solution balances robust security with practical implementation, ensuring scalability and efficiency in real-world cloud environments. Performance evaluations indicate an encryption time of approximately 30 milliseconds, outperforming existing methods such as RSA and DES. This research contributes to the development of future-proof cryptographic standards, addressing both current security challenges and emerging quantum computing threats. By leveraging quantum mechanics, the framework strengthens cloud-based data protection, providing a resilient solution against evolving cyber risks. The results hold significant promise for advancing cloud security, laying the groundwork for next-generation encryption techniques that can withstand the threats posed by quantum computing.