Abstract:Proxy re-encryption (PRE), as a promising cryptographic primitive for secure data sharing in clouds, has been widely studied for decades. PRE allows the proxies to use the re-encryption keys to convert ciphertexts computed under the delegator's public key into ones that can be decrypted using the delegatees' secret keys, without knowing anything about the underlying plaintext. This delegable property of decryption rights enables flexible cloud data sharing, but it raises an important issue: if some proxies reveal their re-encryption keys, or collude with some delegatees to create a pirate decoder, then anyone who gains access to the pirate decoder can decrypt all ciphertexts computed under the delegator's public key without the delegator's permission. This paper opens up a potentially new avenue of research to address the above (re-encryption) key abuse problem by proposing the first public trace-and-revoke PRE system, where the malicious delegatees and proxies involved in the generation of a pirate decoder can be identified by anyone who gains access to the pirate decoder, and their decryption capabilities can subsequently be revoked by the content distributor. Our construction is multi-hop, supports user revocation and public (black-box) traceability, and achieves significant efficiency advantages over previous constructions. Technically, our construction is a generic transformation from inner-product functional PRE (IPFPRE) that we introduce to trace-and-revoke PRE. In addition, we instantiate our generic construction of trace-and-revoke PRE from the Learning with Errors (LWE) assumption, which was widely believed to be quantum-resistant. This is achieved by proposing the first LWE-based IPFPRE scheme, which may be of independent interest. Finally, we conduct a comprehensive performance evaluation of our LWE-based trace-and-revoke PRE scheme, and the experimental results show that the proposed LWE-based trace-and-revoke PRE scheme is practical and outperforms current state-of-the-art traceable PRE schemes.

A Limited Proxy Re-encryption with Keyword Search for Data Access Control in Cloud Computing.

A Restricted Proxy Re‐encryption with Keyword Search for Fine‐grained Data Access Control in Cloud Storage

Proxy Re-encryption with Keyword Search from Anonymous Conditional Proxy Re-encryption

A Novel Proxy Re-Encryption with Keyword Search

A Key-insulated Proxy Re-encryption Scheme for Data Sharing in a Cloud Environment.

Multi-Keyword Searchable Identity-Based Proxy Re-Encryption from Lattices

A lattice‐based searchable encryption scheme with multi‐user authorization for the certificateless cloud computing environment

Public Trace-and-Revoke Proxy Re-Encryption for Secure Data Sharing in Clouds

Designated server proxy re-encryption with boolean keyword search for E-Health Clouds

Provable secure dual-server public key encryption with keyword search

Public Key Encryption with Keyword Search in Cloud: A Survey

CloudKeyBank: Privacy and owner authorization enforced key management framework

Certificateless Public Key Authenticated Encryption with Keyword Search Achieving Stronger Security.

Quantum-Resistant Multi-Feature Attribute-Based Proxy Re-Encryption Scheme for Cloud Services

An Identity-Based Conditional Proxy Re-Encryption in Cloud Computing Environments

Multi-user search on the encrypted multimedia database: lattice-based searchable encryption scheme with time-controlled proxy re-encryption

Keyword Search with Access Control over Encrypted Data in Cloud Computing

K-times Proxy Re-encryption

Efficient public-key searchable encryption against inside keyword guessing attacks for cloud storage

Blockchain-Assisted Public-Key Encryption with Keyword Search Against Keyword Guessing Attacks for Cloud Storage

On the Security of Secure Keyword Search and Data Sharing Mechanism for Cloud Computing