As smart education evolves, there is an increasing need for the cloud-centric management and sharing of student exercise physiological data gathered through wearable devices in the physical education domain. However, challenges arise in achieving authentication for data sources, ensuring the security of sensitive data, and implementing efficient dynamic access control. Traditional cryptographic schemes face limitations in resisting quantum attacks, authenticating data sources, protecting identity privacy, handling dynamic permission changes, and computational efficiency. To tackle these challenges, we put forward a lattice-based Online/Offline Identity-Based Matchmaking Proxy Re-Encryption (OO-IB-MPRE) scheme. The scheme offers post-quantum security assurances grounded in lattice cryptography (under the LWE/ISIS assumptions); incorporates Identity-Based matchmaking encryption (IB-ME) to realize bidirectional identity matching, which not only enables identity authentication for data sources but also safeguards the sender’s identity privacy from exposure to other entities; leverages Proxy Re-Encryption (PRE) to support dynamic management of access control; and combines online/offline encryption to adapt to resource constrained sensors. The security of the OO-IB-MPRE scheme is verified under standard lattice assumptions to meet the security requirements of semi-selective privacy and authenticity. Performance analysis and experimental validation demonstrate that in comparison to existing lattice-based PRE schemes, the devised scheme shows notable advantages in both space and computational overhead. Therefore, the proposed OO-IB-MPRE offers a secure, efficient, and scalable solution for the sensitive health data in smart physical education.
As smart education evolves, there is an increasing need for the cloud-centric management and sharing of student exercise physiological data gathered through wearable devices in the physical education domain. However, challenges arise in achieving authentication for data sources, ensuring the security of sensitive data, and implementing efficient dynamic access control. Traditional cryptographic schemes face limitations in resisting quantum attacks, authenticating data sources, protecting identity privacy, handling dynamic permission changes, and computational efficiency. To tackle these challenges, we put forward a lattice-based Online/Offline Identity-Based Matchmaking Proxy Re-Encryption (OO-IB-MPRE) scheme. The scheme offers post-quantum security assurances grounded in lattice cryptography (under the LWE/ISIS assumptions); incorporates Identity-Based matchmaking encryption (IB-ME) to realize bidirectional identity matching, which not only enables identity authentication for data sources but also safeguards the sender’s identity privacy from exposure to other entities; leverages Proxy Re-Encryption (PRE) to support dynamic management of access control; and combines online/offline encryption to adapt to resource constrained sensors. The security of the OO-IB-MPRE scheme is verified under standard lattice assumptions to meet the security requirements of semi-selective privacy and authenticity. Performance analysis and experimental validation demonstrate that in comparison to existing lattice-based PRE schemes, the devised scheme shows notable advantages in both space and computational overhead. Therefore, the proposed OO-IB-MPRE offers a secure, efficient, and scalable solution for the sensitive health data in smart physical education.
Matchmaking encryption constructed in the identity-based encryption setting, named identity-based matchmaking encryption (IB-ME), requires both sender and receiver to specify target identity simultaneously for each other for message decryption. The IB-ME schemes can not only ensure the privacy of the sender and the message but also provide authentication for the data source. In order to resist quantum-attacks, we put forward a post-quantum secure IB-ME scheme. Compared with Ateniese et al.'s scheme and Francati et al.'s scheme, our approach eliminates the use of functional encryption, predicate encryption and signature scheme, and only uses a more simple preimage sampling function and an IBE scheme in the way of non-black-box. Compared with post-quantum secure IB-MEs proposed currently, our scheme is the first non-black-box construction based on standard lattice assumptions such as LWE and ISIS.
Identity-based proxy re-encryption (IB-PRE) is a kind of public key cryptography that allows a proxy to convert the ciphertext based on Alice’s identity into another ciphertext of the same message for Bob. It has important applications in cloud computing, distributed systems and secure e-mail forwarding. So far, the existing lattice-based IB-PRE schemes are designed on the general lattice and their security is based on the learning with errors (LWE) assumption. In this paper, we propose an IB-PRE scheme over NTRU lattices with the desirable properties of anonymity, unidirectionality, backward collusion safeness and multi-hop. Our IB-PRE scheme is provable secure under adaptive chosen-plaintext and adaptive chosen-identity attacks. And, in the random oracle model, the security of our scheme is based on the decisional Ring-LWE assumption. Besides, the key and ciphertext sizes of our IB-PRE scheme are short, only one or two ring elements, and our scheme could encrypt n bits in each encryption process.
Revocable identity-based encryption (RIBE) enables data encryption without certificates and allows for the revocation of users, thereby offering a more streamlined and secure approach to dynamic member management. However, the existing revocation models lack strong scalability, rendering the RIBE scheme unsuitable for scenarios where the key generation center (KGC) experiences high workloads and users face heavy storage burdens. Therefore, this paper introduces an integrated revocation model that maintains both the workload for the KGC and the size of the secret keys at a constant level, while also relieving the encryptor of the burden of handling revocation information. By combining online and offline encryption, we construct an OO-IRIBE-EnDKER scheme from lattices, which possesses properties such as anonymity, decryption key exposure resistance (DKER), resistance to quantum computing attacks, and selective security. Finally, the effectiveness of the OO-IRIBE-EnDKER scheme is demonstrated through experimental results.
Under the usage of new technologies, Internet of Things (IoT) develops rapidly and provides a great convenience for our lives. It is critical for ensuring security to IoT systems as the tremendous growth of IoT applications. Although many cryptography tools (such as identity-based encryption) have been given to provide appropriate security in IoT covering various application fields such as smart home, how to guarantee data confidentiality, provide reasonable data source identification, and resist quantum attacks simultaneously has been a challenging problem. To address this problem, we propose a matchmaking encryption scheme named lattice-based matchmaking identity-based encryption (LMIBE) which can provide bilateral access control for both sender and receiver in IoT systems, and resist quantum attacks. Moreover, we give a formal definition and a security definition for our scheme. Security proof shows that our scheme is secure under the proposed security definition. Finally, by comparing the performance of our scheme with existing works, our proposed scheme has a broad application prospect in IoT environment.
With quantum computers, the quantum resistance of cryptographic systems has gradually attracted attention. To overcome the shortcoming of existing identity-based encryption (IBE) schemes in resisting quantum attacks, we introduce an IBE scheme based on learning with errors (LWE). In addition, devices with limited computing power are becoming increasingly common in practice, making it increasingly important to improve the efficiency of online computation of encryption algorithms. The classic solution is to directly improve the efficiency of the Gaussian sampling algorithm, thereby increasing the overall efficiency of the scheme. However, our scheme combines the efficient Gaussian sampling algorithm, G-trapdoor, with online/offline method to further improve the online encryption efficiency of the encryption algorithm. Our scheme completes partial computation before knowing the message and receiver’s identity, and once the message and receiver’s identity are obtained, the online part encryption can be efficiently completed. We construct an identity-based online/offline encryption (IBOOE) scheme from LWE with G-trapdoor, improve the efficiency of online encryption while achieving quantum resistant security. We prove the scheme’s security under the standard model for chosen-plaintext attack (CPA). By comparing with relevant schemes in terms of experiments and analysis, our scheme has improved efficiency by 65% to 80% compared to the classical LWE IBE scheme (increasing with LWE security parameters), and by 60% to 70% compared to the recent IBE scheme from LWE. This greatly improves the efficiency of online computing for low-power encryption devices while ensuring security.
To protect the privacy of cloud data, encryption before uploading provides a solution. However, searching for target data in ciphertext takes effort. Therefore, searchable encryption has become an important research topic. On the other hand, since the advancement of quantum computers will lead to the crisis of cracking traditional encryption algorithms, it is necessary to design encryption schemes that can resist quantum attacks. Therefore, we propose a multi-keyword searchable identity-based proxy re-encryption scheme from lattices. In addition to resisting quantum attacks, the proposed scheme uses several cryptographic techniques to improve encryption efficiency. First, identity-based encryption is used to reduce the computation and transmission costs caused by certificates. Second, the proposed scheme uses proxy re-encryption to achieve the purpose of outsourced computing, allowing the proxy server to reduce the computation and transmission costs of the users. Third, the proposed multi-keyword searchable encryption can provide AND and OR operators to increase the flexibility of searchability. Moreover, the access structure of the proposed scheme is not based on a linear secret sharing scheme (LSSS), avoiding the errors caused by an LSSS-based structure in decryption or search results. Finally, we also give formal security proof of the proposed scheme under the decisional learning with errors assumption.