基于多比特全同态加密的安全多方计算

本文中,我们首先证明了李增鹏等人提出的多比特多密钥全同态加密方案(MFHE)满足密钥同态性质,利用此性质,可以通过门限解密得到最终解密结果.使用该方案,我们设计了一个在CRS模型下和半恶意攻击者模型下安全的三轮多方计算协议(MPC).该安全多方计算协议的安全性是基于容错学习问题(LWE)的两个变种问题Ferr-LWE和...     

Round efficient privacy-preserving federated learning based on MKFHE

Federated learning (FL) was created with the intention of enabling collaborative training of models without the need for direct data exchange. However, data leakage remains an issue in FL. Multi-Key Fully Homomorphic Encryption (MKFHE) is a promising technique that allows computations on ciphertexts encrypted by different parties. MKFHE’s aptitude to handle multi-party data makes it an ideal tool for implementing privacy-preserving federated learning.We present a multi-hop MKFHE with compact ciphertext. MKFHE allows computations on data encrypted by different parties. In MKFHE, the compact ciphertext means that the size of the ciphertext is independent of the number of parties. The multi-hop property means that parties can dynamically join the homomorphic computation at any time. Prior MKFHE schemes were limited by their inability to combine these desirable properties. To address this limitation, we propose a multi-hop MKFHE scheme with compact ciphertext based on the random sample common reference string(CRS). We construct our scheme based on the residue number system (RNS) variant CKKS17 scheme, which enables efficient homomorphic computation over complex numbers due to the RNS representations of numbers.We construct a round efficient privacy-preserving federated learning based on our multi-hop MKFHE. In FL, there is always the possibility that some clients may drop out during the computation. Previous HE-based FL methods did not address this issue. However, our approach takes advantage of multi-hop MKFHE that users can join dynamically and constructs an efficient federated learning scheme that reduces interactions between parties. Compared to other HE-based methods, our approach reduces the number of interactions during a round from 3 to 2. Furthermore, in situations where some users fail, we are able to reduce the number of interactions from 3 to just 1.     

Threshold public key encryption scheme resilient against continual leakage without random oracles

Threshold public key encryption allows a set of servers to decrypt a ciphertext if a given threshold of authorized servers cooperate. In the setting of threshold public key encryption, we consider the question of how to correctly decrypt a ciphertext where all servers continually leak information about their secret keys to an external attacker. Dodis et al. and Akavia et al. show two concrete schemes on how to store secrets on continually leaky servers. However, their constructions are only interactive between two servers. To achieve continual leakage security among more than two servers, we give the first threshold public key encryption scheme against adaptively chosen ciphertext attack in the continual leakage model under three static assumptions. In our model, the servers update their keys individually and asynchronously, without any communication between two servers. Moreover, the update procedure is re-randomized and the randomness can leak as well.     

云加密数据安全重复删除方法

在云环境存储模式中,采用用户端数据加密虽然能够有效降低数据的存储安全风险,但同时会使云服务商丧失重复数据鉴别能力,导致存储开销随数据量增大而不断攀升.加密数据重复删除技术是解决该问题的方法之一,现有方案通常基于可信第三方设计,安全性假设过强,执行效率较低.基于椭圆曲线与密文策略属性加密两种高安全密码学原语,构造了重复加密数据识别与离线密钥共享两种安全算法,进而实现一种无需初始数据上传用户与可信第三方实时在线的加密数据重复删除方法.详细的安全性与仿真实验分析,证明该方法不仅实现数据的语义安全,同时能够保证系统的高效率运行.     

一种多认证机构可验证的属性基加密方案*

针对属性基加密中中央认证机构所带来的安全隐患问题,提出了一种新型的多认证机构可验证的属性基加密方案。该方案采用由各个认证机构独立生成系统主私钥份额和各自公私钥的方法,去除了中央认证机构,避免了因中央认证机构一旦遭破坏将会导致整个系统崩溃的问题,提高了属性基加密的安全性,同时对密文和密钥的正确性进行了验证。最后,给出了可验证性和安全性分析。     

Group key agreement for secure group communication in dynamic peer systems

Self-organizing group key agreement protocols without a centralized administrator are essential to secure group communication in dynamic peer systems. In this paper, we propose a generic construction of a one-round self-organizing group key agreement protocol based on the Chinese Remainder Theorem. In the proposed construction, all group members contribute their own public keys to negotiate a shared encryption public key, which corresponds to all different decryption keys. Using his/her own secret key, each group member is able to decrypt any ciphertext encrypted by the shared encryption key. Following the generic construction, we instantiate a one-round self-organizing group key agreement protocol using the efficient and computationally inexpensive public key cryptosystem NTRU. Both the public key and the message in this protocol are secure against the known lattice attacks. Furthermore, we also briefly describe another concrete scheme with our generic idea, based on the ElGamal public key cryptosystem.     

公开信道下多服务器多关键词多用户可搜索加密方案

可搜索加密服务中,为了避免服务器集中检索从而推测出密文关键词信息,数据属主希望将不同的数据密文与关键词索引分别存储在不同的服务器上。结合多用户可搜索加密方案和多服务器特性设计了一种公开信道下多服务器多关键词多用户可搜索加密方案。数据属主和数据用户利用服务器的公钥生成密文索引与陷门搜索凭证,满足在公开信道中传输。分析结果表明,新方案具有较低的通信代价,并且在随机预言机模型下基于判定性Diffie-Hellman问题假设证明了新方案在适应性选择关键词攻击下密文索引不可区分。     

云计算多授权中心CP-ABE代理重加密方案

代理重加密技术可使代理在不知道明文的条件下实现密文访问策略转换,这使代理重加密成为用户之间进行数据分享的重要技术。然而,代理重加密方案大多数是在单授权中心下构建的,存在授权机构权限大、易出现性能瓶颈和用户的计算开销大等问题。同时,大多数方案不满足代理重加密应具备的5个基本特性：单向性、可控性、非交互性、可重复性与可验证性。为解决以上问题,提出支持重复可控特性的云计算多授权中心CP-ABE(ciphertext-policy attribute-based encryption)代理重加密方案。在密文策略属性加密方案的基础上,引入代理加密和代理解密服务器从而减小用户客户端的计算开销,设置多个属性授权中心来分散中央机构权限。对代理重加密技术进行改进：在重加密密钥中设置随机因子和密文子项来实现单向性和可控性;设置的重加密密钥由客户端独立生成,不需要其他服务器参与,可实现非交互性,即可在数据拥有者为不在线状态时也可以进行数据分享;在初始密文中设置密文子项,对其多次加密即可实现重复性;在初始密文中设置验证子项,用户可验证外包以及重加密结果正确与否。通过与其他方案对比发现,所提方案的用户客户端计算...     

基于动态bloom filter的云存储安全去重方案

现有的所有权证明去重方案容易遭受诚实但好奇服务器的威胁影响,借助可信第三方解决该问题将导致开销过大。基于动态bloom filter提出一种改进的、无须可信第三方的所有权证明安全去重方案,采用收敛加密算法抵抗诚实但好奇的服务器,并通过服务器检查数据块密文和标签的一致性来防止数据污染攻击。此外,采用密钥链机制对收敛密钥进行管理,解决了现有方案中收敛密钥占用过多存储空间的问题。分析与比较表明,该方案具有较小的密钥存储开销和传输开销。     

移动医疗系统中的可撤销无证书代理重签名方案

代理重签名在保证委托双方私钥安全的前提下, 通过半可信代理实现了双方签名的转换, 在本文方案中, 通过代理重签名实现了在通信过程中终端用户对于身份的隐私要求。移动医疗服务系统因为其有限的计算和存储能力, 需要借助云服务器来对医疗数据进行计算和存储。然而, 在将医疗数据外包给云服务器后, 数据便脱离了用户的控制, 这给用户隐私带来了极大地安全隐患。现有的无证书代理重签名方案大多都不具有撤销功能, 存在着密钥泄露等安全性问题。为了解决这一问题, 本文提出了一种可撤销的无证书代理重签名方案, 在不相互信任的移动医疗服务系统中, 实现了医疗数据传输过程以及云存储过程中的用户匿名性, 同时, 本文方案具有单向性和非交互性, 更适合在大规模的移动医疗系统中使用。此外, 当用户私钥泄露时, 本文利用 KUNode 算法实现了对用户的高效撤销, 并利用移动边缘计算技术将更新密钥和撤销列表的管理外包给移动边缘计算设备,降低了第三方的计算成本, 使其具有较低的延迟。最后, 在随机谕言机模型下证明了所构造的方案在自适应选择消息攻击下的不可伪造性, 并利用 JPBC 库与其他方案进行计算与通信开销的对比。其结果表明, 本方案在具备更优越的功能的同时, 具有较小的计算成本、通信成本和撤销成本。     

Revocable attribute-based encryption from standard lattices

Attribute-based encryption (ABE) is an attractive extension of public key encryption, which provides fine-grained and role-based access to encrypted data. In its key-policy flavor, the secret key is associated with an access policy and the ciphertext is marked with a set of attributes. In many practical applications, and in order to address scenarios where users become malicious or their secret keys are compromised, it is necessary to design an efficient revocation mechanism for ABE. However, prior works on revocable key-policy ABE schemes are based on classical number-theoretic assumptions, which are vulnerable to quantum attacks. In this work, we propose the first revocable key-policy ABE scheme that offers an efficient revocation mechanism while maintaining fine-grained access control to encrypted data. Our scheme is based on the learning with errors (LWE) problem, which is widely believed to be quantum-resistant. Our scheme supports polynomial-depth policy function and has short secret keys, where the size of the keys depends only on the depth of the supported policy function. Furthermore, we prove that our scheme satisfies selective revocation list security in the standard model under the LWE assumption.     

Quantum-safe Anonymous Hierarchical Identity-Based Encryption with Traceable Identities

Anonymous Identity Based Encryption (AIBET) scheme allows a tracer to use the tracing key to reveal the recipient’s identity from the ciphertext while keeping other data anonymous. This special feature makes AIBET a promising solution to distributed IoT data security since it can preserve both the privacy and the anonymity of a communication network but still give the server the ability to revoke the anonymity of some specific users in necessary situations (such as when their illegal behavior are detected). In this paper, we construct an efficient quantum-safe Hierarchical Identity-Based cryptosystem with Traceable Identities (AHIBET) with fully anonymous ciphertexts. We prove the security of our AHIBET scheme under the Learning with Errors (LWE) problem in the standard model.     

前向安全的格上基于身份签密方案

针对目前基于格的签密方案尚不能满足前向安全性,提出一个具有前向安全的基于身份的签密方案。首先,该方案利用格基授权算法对用户和发送者的公私钥对进行更新;其次,结合基于格上错误学习问题的原像采样算法进行用户签名,并利用包含签名信息的哈希值对消息进行加密。在随机预言机模型下,证明该方案是适应性选择身份和选择密文攻击安全（IND-sID-CCA2）和强不可伪造选择消息攻击安全（sUF-CMA）的,同时证明了该方案具有前向安全性。相对于基于配对的签密方案,所提方案在计算速度和密文扩展率的优势都较为明显。     

Multi-key Fully Homomorphic Encryption without CRS from RLWE

Fully Homomorphic Encryption (FHE) is a powerful encryption system in cloud computing that allows homomorphic computations on encrypted data without decrypting them. Multi-key fully homomorphic encryption (MFHE), as an extension to FHE, allows homomorphic computations on ciphertexts encrypted under different keys. However, most MFHE schemes require a Common Random/Reference String (CRS), while the few that do not are based on the Learning With Errors (LWE) problem, which means that they can only deal with single bit plaintext. Consequently, MFHE schemes based on the Ring Learning With Errors (RLWE) problem are more desirable, as they can handle polynomial plaintext. Requiring the CRS seems to weaken the semantic definition of MFHE, where all users generate their own keys independently. In this paper, we study the RLWE-based MFHE in the CRS model and propose the first RLWE-based MFHE without a CRS. To this end, we remove the CRS by designing a relinearization algorithm without a CRS. Like previous MFHE schemes, our RLWE-based MFHE without CRS has a simple 1-round threshold decryption, which implies a 3-round secure MPC protocol in the plain model from the RLWE assumption.     

群组内基于区块链的匿名可搜索加密方案

公钥可搜索加密技术不仅可以保护云存储中用户的数据隐私,还可以提供数据在不解密的条件下进行密态数据搜索的功能。针对群组内用户进行密文安全搜索的需求,本文以群组为单位使用基于身份的广播加密进行数据的加密与密钥封装,以基于身份的可搜索加密构造关键词密文及关键词陷门,提出了一种群组内的公钥可搜索加密方案,保证了只有群组内的授权用户才可以进行安全搜索并解密数据。此外,为保护用户的身份隐私,通过构造匿名身份,避免了因云服务器好奇行为而造成的用户身份泄露问题。同时,在按需付费的云环境中,为了防止云服务器向用户返回部分或不正确的搜索结果,文章结合区块链技术,使用区块链作为可信第三方,利用智能合约的可信性,在用户验证搜索结果正确后向云服务器支付搜索费用,解决了用户与云服务器之间的公平支付问题。并加入了违规名单机制,防止恶意用户对系统可用性造成影响。在安全性方面,通过基于判定性双线性Diffie-Hellman问题与判定性Diffie-Hellman问题进行安全性分析,证明了在随机谕言机模型与标准模型下方案满足关键词密文与关键词陷门的不可区分性。最后,通过功能对比表明本方案有较强的实用性,利用Charm-crypto密码库对方案进行效率对比,其结果表明本方案与其他相关方案相比具有较低的计算以及通信开销。     

支持多比特加密的全同态加密体制设计

现有全同态加密体制普遍存在密文尺寸较大和采用单比特加密所导致的效率较低问题.在Gentry等人提出的全同态加密体制(简称GS W13体制)的基础上,通过修改其展开方式,利用近似特征向量技术,提出了一种新的全同态加密体制.在随机喻示模型下,将新体制的安全性归约到判定性容错学习问题(decisional lear-ning with errors,DLWE)的难解性,给出了其正确性和安全性的证明.又在不改变系统参数的条件下,采用多比特加密,对新体制进行优化.与GSW13体制相比,新体制的密文尺寸减小61.47％,加密运算量减少68.97％.新体制不仅减小密文扩张,而且减少同态运算计算次数,从而提高了体制效率.     

基于RLWE的生物特征认证密钥交换协议

在后量子密码学中,针对密钥交换协议存在口令容易丢失以及难以实现相互认证的安全缺陷,提出了一个新的基于环上误差学习的生物特征认证密钥交换协议。该协议根据环上误差学习问题构造的密码体制具有密钥及密文尺寸短、运行效率高等优势,并采用生物特征和口令作为长期密钥,同时通过Peikert式错误协调机制从各自的环元素中协调出随机均匀的会话密钥,实现了服务器对客户的显式认证。性能分析结果表明,该方案可抵抗用户假冒攻击,安全属性更高,提高了通信效率。     

混合式结构下基于网格的位置隐私保护方法

基于中心式和分布式结构的LBS隐私保护方案的特点,设计了一种混合式隐私保护结构以兼具两者优势,并在该结构下提出了一种基于网格的LBS隐私保护方案。该方案使用参数生成器定期向用户及LBS服务器更新偏移参数,通过结合K-匿名和随机偏移技术,在中心服务器生成匿名区域。在保证安全性的同时,避免了传统匿名中心服务器存在的安全隐患。同时,在查询结果的筛选过程中,采用网格化坐标对匿名区域进行表示,实现了高效的结果匹配,显著降低了中心服务器的计算开销。较之已有方案,该方案在通信开销方面亦具有较大优势。     

Efficient verifiably encrypted signatures from lattices

Verifiably encrypted signature schemes can convince a verifier that a given ciphertext is an encryption of an ordinary signature on a given message and the ordinary signature can be recovered by the third party, called adjudicator. In 2010, Rückert et al. proposed a general construction for the verifiably encrypted signatures, and then, they also showed that there exist the lattice-based verifiably encrypted signature schemes. Their constructions are very insightful, but their schemes need an extra adjudication setup phase and Merkle trees, so they have large parameters and keys, that is, they are inefficient. Also, their schemes provide only the limited signature capacity because the signing keys should be reissued after generating \(k\) th verifiably encrypted signatures. To overcome the weaknesses of Rückert et al.’s scheme, we construct a verifiably encrypted signature scheme based on the hard lattice problems. Our scheme provides the full functionality, i.e., the signatures can be generated without any limitations and does not need any extra adjudication setup phases. Moreover, the size of the secret keys in our scheme is constant. Our scheme provides unforgeability, opacity, extractability, and abuse-freeness in the random oracle model.     

Removing escrow from ciphertext policy attribute-based encryption

Attribute-based encryption (ABE) is a promising cryptographic primitive for fine-grained access control of distributed data. In ciphertext policy attribute-based encryption (CP-ABE), each user is associated with a set of attributes and data are encrypted with access policies on attributes. A user is able to decrypt a ciphertext if and only if his attributes satisfy the access policy embedded in the ciphertext. However, key escrow is inherent in ABE systems. A curious key generation center in that construction has the power to decrypt every ciphertext. We found that most of the existing ABE schemes depending on a single key authority suffer from the key escrow problem. In this study, we propose a novel CP-ABE key issuing architecture that solves the key escrow problem. The proposed scheme separates the power of issuing user keys into two parties: the key generation center and the attribute authority. In the proposed construction, the key generation center and the attribute authority issue different parts of secret key components to users through a secure two-party computation protocol such that none of them can determine the whole set of keys of users individually. We demonstrate how the proposed key issuing protocol can be applied in the existing CP-ABE scheme and resolve the key escrow problem.