Abstract:Proxy re-encryption (PRE), as a promising cryptographic primitive for secure data sharing in clouds, has been widely studied for decades. PRE allows the proxies to use the re-encryption keys to convert ciphertexts computed under the delegator's public key into ones that can be decrypted using the delegatees' secret keys, without knowing anything about the underlying plaintext. This delegable property of decryption rights enables flexible cloud data sharing, but it raises an important issue: if some proxies reveal their re-encryption keys, or collude with some delegatees to create a pirate decoder, then anyone who gains access to the pirate decoder can decrypt all ciphertexts computed under the delegator's public key without the delegator's permission. This paper opens up a potentially new avenue of research to address the above (re-encryption) key abuse problem by proposing the first public trace-and-revoke PRE system, where the malicious delegatees and proxies involved in the generation of a pirate decoder can be identified by anyone who gains access to the pirate decoder, and their decryption capabilities can subsequently be revoked by the content distributor. Our construction is multi-hop, supports user revocation and public (black-box) traceability, and achieves significant efficiency advantages over previous constructions. Technically, our construction is a generic transformation from inner-product functional PRE (IPFPRE) that we introduce to trace-and-revoke PRE. In addition, we instantiate our generic construction of trace-and-revoke PRE from the Learning with Errors (LWE) assumption, which was widely believed to be quantum-resistant. This is achieved by proposing the first LWE-based IPFPRE scheme, which may be of independent interest. Finally, we conduct a comprehensive performance evaluation of our LWE-based trace-and-revoke PRE scheme, and the experimental results show that the proposed LWE-based trace-and-revoke PRE scheme is practical and outperforms current state-of-the-art traceable PRE schemes.

PrivRE: Regular Expression Matching for Encrypted Packet Inspection

P4rex: Accelerating Regular Expression Matching with Programmable Switches

Middlebox-Based Packet-Level Redundancy Elimination over Encrypted Network Traffic.

PrivDPI

CloudDPI: Cloud-Based Privacy-Preserving Deep Packet Inspection Via Reversible Sketch.

Strid(2)Fa: Scalable Regular Expression Matching For Deep Packet Inspection

StriD²FA: Scalable Regular Expression Matching for Deep Packet Inspection

PRI: Privacy Preserving Inspection of Encrypted Network Traffic

Hpress: A Hardware-Enhanced Proxy Re-Encryption Scheme Using Secure Enclave.

Proxy Re-encryption with Keyword Search from Anonymous Conditional Proxy Re-encryption

Public Trace-and-Revoke Proxy Re-Encryption for Secure Data Sharing in Clouds

Privacy-preserving Efficient Verifiable Deep Packet Inspection for Cloud-assisted Middlebox

DCDPI: Dynamic and Continuous Deep Packet Inspection in Secure Outsourced Middleboxes

Toward Proxy Re-encryption from Learning with Errors in the Exponent

A Survey of Privacy-Preserving Techniques for Encrypted Traffic Inspection over Network Middleboxes

DynPRE: Protocol Reverse Engineering Via Dynamic Inference

A Multiple Simple Regular Expression Matching Architecture and Coprocessor for Deep Packet Inspection

Towards Practical Encrypted Network Traffic Pattern Matching for Secure Middleboxes

Pine: Enabling Privacy Preserving Deep Packet Inspection on TLS with Rule Hiding and Fast Connection Establishment

An Efficient Public-Key Dual-Receiver Encryption Scheme

Pattern-unit based regular expression matching with reconfigurable function unit