Abstract:Cloud data sharing service, which allows a group of people to access and modify the shared data, is one of the most popular and efficient working styles in enterprises. Recently, there is an uprising trend that enterprises tend to move their IT service from local to cloud to ease the management and reduce the cost. Under the new cloud environment, the cloud users require the data integrity verification to inspect the data service at the cloud side. Several recent studies have focused on this application scenario. In these studies, each user within a group is required to sign a data block created or modified by him. While a user is revoked, all the data previously signed by him should be resigned. In the existing research, the resigning process is dependent on the revoked user. However, cloud users are autonomous. They may exit the system at any time without notifying the system admin and even are revoked due to misbehaviors. As the developers in the cloud-based software development platform, they are voluntary and not strictly controlled by the system. Due to this feature, cloud users may not always follow the cloud service protocol. They may not participate in generating the resigning key and may even expose their secret keys after being revoked. If the signature is not resigned in time, the subsequent verification will be affected. And if the secret key is exposed, the shared data will be maliciously modified by the attacker who grasps the key. Therefore, forcing a revoked user to participate in the revocation process will lead to efficiency and security problems. As a result, designing a practical and efficient integrity verification scheme that supports this scenario is highly desirable. In this paper, we identify this challenging problem as the asynchronous revocation, in which the revocation operations (i.e., re-signing key generation and resigning process) and the user's revocation are asynchronous. All the revocation operations must be able to be performed without the participation of the revoked user. Even more ambitiously, the revocation process should not rely on any special entity, such as the data owner or a trusted agency. To address this problem, we propose a novel public data integrity verification mechanism in which the data blocks signed by the revoked user will be resigned by another valid user. From the perspectives of security and practicality, the revoked user does not participate in the resigning process and the re-signing key generation. Our scheme allows anyone in the cloud computing system to act as the verifier to publicly and efficiently verify the integrity of the shared data using Homomorphic Verifiable Tags (HVTs). Moreover, the proposed scheme resists the collusion attack between the cloud server and the malicious revoked users. The numerical analysis and experimental results further validate the high efficiency and scalability of the proposed scheme. The experimental results manifest that re-signing 10,000 data blocks only takes 3.815 s and a user can finish the verification in 300 ms with a 99% error detection probability.

Privacy-preserving Revocation of Verifiable Credentials with Verifiable Random Functions

A new Privacy Preserving and Scalable Revocation Method for Self Sovereign Identity -- The Perfect Revocation Method does not exist yet

Distributed Attestation Revocation in Self-Sovereign Identity

SD-BLS: Privacy Preserving Selective Disclosure of Verifiable Credentials with Unlinkable Threshold Revocation

Supervised and Revocable Decentralized Identity Privacy Protection Scheme

VCTP: A Verifiable Credential-based Trust Propagation Protocol for Personal Issuers in Self-Sovereign Identity Platforms

Auditable Credential Anonymity Revocation Based on Privacy-Preserving Smart Contracts

A Survey on Decentralized Identifiers and Verifiable Credentials

Group Signatures with Probabilistic Revocation

S-Cred: An accountable anonymous credential scheme with decentralized verification and flexible revocation

On Cryptographic Mechanisms for the Selective Disclosure of Verifiable Credentials

Revocable Identity-Based Access Control for Big Data with Verifiable Outsourced Computing

Attribute-Based Threshold Issuance Anonymous Counting Tokens and Its Application to Sybil-Resistant Self-Sovereign Identity

VC-Vault: A User-Friendly, Secure, Privacy-Enhancing Verifiable Credentials Wallet

Efficient User Revocation for Privacy-Aware PKI

Public Integrity Verification for Data Sharing in Cloud with Asynchronous Revocation

Private Status Retrieval for Blockchain-Based Certificate Revocation System

AASSI: A Self-Sovereign Identity Protocol With Anonymity and Accountability

Flexible revocation and verifiability for outsourced Private Set Intersection computation

Privacy and Integrity Preserving Computations with CRISP

Identity-Based Privacy Preserving Remote Data Integrity Checking With a Designated Verifier