Efficient Authenticated Fine-Grained Access Engine for Encrypted Data in Mobile Edge Cloud

Privacy-preserving secure data sharing in edge-cloud collaborative environments

In cloud computing environments, data sharing serves as a foundational enabler of collaborative operations across heterogeneous terminals. However, such sharing introduces critical challenges–including privacy leakage, inadequate data security, inflexible access control policies, and substantial computational latency. To address these limitations, this paper proposes a privacy-preserving, secure data-sharing framework tailored for edge-cloud collaborative architectures. Relative to conventional approaches, the proposed framework delivers three principal advancements: (1) User Privacy Protection: We design a secure query-matching algorithm that protects plaintext query keywords during data access. The Cloud Server (CS) performs matching over encrypted trapdoors without directly learning the queried keywords. (2) Computational Efficiency Improvement: Edge Servers (ESs) perform outsourced ciphertext transformation using user-specific transformation keys. The terminal only performs a lightweight local operation to recover the resource. This approach minimizes the computational overhead on the terminal side while safeguarding user privacy, and effectively reduces the overhead associated with user joining and revocation within the same group. (3) Fine-Grained, Policy-Driven Access Control: A cryptographically enforced, attribute- and keyword-aware access control mechanism is implemented, supporting precise, context-sensitive authorization decisions via encrypted keyword search and semantic matching–thereby enhancing both the security posture and operational flexibility of data access control.

An efficient lattice-based identity-based proxy Re-encryption scheme with direct revocation for cloud storage

As cloud storage becomes increasingly commonplace alongside the expansion of data sharing practices, how to achieve secure data sharing and user revocation while ensuring data confidentiality has become a key issue. Proxy re-encryption enables ciphertext originally designated for one user to be transformed by a semi-trusted proxy for another user, while identity-based encryption offers a simplified approach to key administration. However, most existing frameworks employ bilinear pairings, which suffer from susceptibility to quantum threats, and generally lack efficient revocation mechanisms. To tackle these challenges, we present an identity-based directly revocable proxy re-encryption scheme (IBPRE-DR) based on the Learning With Errors (LWE) assumption. This scheme enables data owners to directly revoke user permissions without requiring a key generation center (KGC) to frequently update user keys, supporting immediate and dynamic access control. The mechanism uses a complete subtree algorithm to achieve efficient revocation. Additionally, a dual-key mechanism distinguishes re-encryption keys from decryption keys, effectively resisting collusion attacks and further enhancing data security. Furthermore, the private key length for each user remains fixed, supporting multi-bit encryption. We present a formal definition of IBPRE-DR’s security, along with a standard-model security proof. To the best of our knowledge, this is the first lattice-based identity-based proxy re-encryption scheme that integrates direct user revocation under the standard LWE assumption. Both experimental results and theoretical analysis confirm the scheme’s effectiveness and feasibility.

SC-DAC: a robust partially and fully access control mechanism for secure cloud data in outsourced environments

Cloud computing has revolutionized data storage and processing, yet it poses significant security challenges, necessitating robust access control mechanisms. This study proposes a novel approach to secure cloud data access control called the Robust Mechanism for Secure Cloud Data Access Control (SC-DAC), which combines advanced cryptographic techniques such as Ciphertext-Policy Attribute-Based Encryption (CP-ABE) and Hybrid Public Key Encryption. By enabling fine-grained access control based on user attributes and policies, and ensuring data confidentiality and integrity during transmission, SC-DAC addresses critical security challenges in cloud environments. It features two innovative protocols: Partially Outsourced Access Control Protocol (PO-ACP), which allows for partial delegation of access control tasks while retaining oversight of critical functions, and Fully Outsourced Access Control Protocol (FO-ACP), which streamlines operations by fully outsourcing challenge generation and resource accounting to the cloud provider. The mechanism’s effectiveness is rigorously validated through formal verification with the ProVerif tool, mathematical proofs, and informal security analyses, demonstrating resilience against replay attacks, man-in-the-middle attacks, and denial-of-service (DoS) attacks. This comprehensive approach significantly advances cloud security by providing a robust solution to unauthorized access and data breaches. Simulation results further show that SC-DAC achieves superior performance in computation and communication costs, significantly advancing cloud security.

Verifiable multi-keyword searchable encryption with fine-grained access control for cloud data security

SDAP-K: A Kerberos-Assisted Secure Data Auditing Protocol for Cloud Storage

Cloud storage services have become a fundamental component of modern computing infrastructures, enabling scalable and cost-effective data management. However, outsourcing data to remote cloud servers introduces significant security challenges, particularly in ensuring data integrity, secure access control, and efficient auditing of stored information. Existing cloud auditing schemes primarily focus on integrity verification and often rely on trusted third-party auditors, leading to additional trust assumptions, communication overhead, and metadata management complexity. To address these limitations, this research presents a Kerberos-Assisted Secure Data Auditing Protocol (SDAP-K) that integrates authenticated service exchange with lightweight integrity verification for outsourced cloud storage. The proposed framework employs Kerberos-based mutual authentication and ticket-driven access control to establish secure communication among the Data Owner, Authentication Server, Metadata Server, and Cloud Data Server. To verify storage correctness, an N-ary hash tree with the Modified Murmur hash algorithm is used to enable efficient file- and block-level auditing without requiring a trusted third-party auditor. The framework further incorporates metadata-assisted auditing, dynamic data operations, and an error localization and recovery mechanism that identifies and restores corrupted data blocks. Security analysis demonstrates that the proposed protocol mitigates unauthorized access, replay attacks, impersonation attempts, and malicious data modification. Experimental results indicate that SDAP-K reduces storage execution time by 18.6%, retrieval time by 24.3%, update time by 21.8%, file-level auditing overhead by 31.5%, and block-level auditing latency by 36.2% compared with state-of-the-art research, while eliminating the need for a trusted third-party auditor. The results indicate that the proposed framework offers a practical, lightweight, and reliable solution for secure cloud data auditing in enterprise cloud storage environments.

Practical Verifiable Multi-Key Searchable Encryption with Optimal Overhead

Multi-Key Searchable Encryption (MKSE) enables data owners (DOs) to outsource their data to a cloud server (CS) while supporting fine-grained data sharing with other authorized users. Most existing MKSE schemes can protect data users’ (DUs’) search query privacy against collusion attacks between malicious DOs and the CS. However, the CS is not fully trusted and may maliciously return forged or incomplete search results. To address this issue, Verifiable MKSE (VMKSE) is proposed by leveraging Garbled Bloom Filter (GBF), which can support verifiability even when the search results are empty. Unfortunately, due to the massive native storage redundancy of GBF, the storage and computational overhead of verification evidence generated in the sharing phase increases as the number of shared documents grows. Therefore, in this paper, we present a novel VMKSE scheme (VMKSE-BFF) by adopting BFF, which can simultaneously support verifiability of and secure data sharing in a multi-user setting. We provide a comparison with the existing VMKSE schemes. Experimental results on a real-world dataset show a significant performance improvement of VMKSE-BFF.