• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.13 no.2
• /
• pp.41-47
• /
• 2003

Revocation scheme is a re-keying scheme for dynamically changing group in multicast environment. In this paper, we propose two variants of the previously proposed revocation scheme, on the purpose of reducing the amount of computations group members should perform. Also proposed is a method of allowing unlimited number of member revocations.

• Journal of Korea Multimedia Society
• /
• v.18 no.4
• /
• pp.499-505
• /
• 2015

Security supports are a significant factor in the design of mobile ad hoc networks. In the dynamic topology where the node changes frequently, private key generation and revocation for newly joining and leaving nodes must be considered. In addition, the identities of individual nodes must be protected as well in mobile networks to avoid personal privacy concerns. This paper proposes ID-based private key revocation scheme and non-interactive key agreement scheme in anonymous MANETs. The proposed scheme provides the user privacy using pseudonyms and private key generation and revocation schemes with consideration of dynamic user changes. Therefore, our schemes can be applied in dynamic and privacy-preserving MANETs which are helpful to share multimedia data.

• The KIPS Transactions:PartC
• /
• v.14C no.7
• /
• pp.553-558
• /
• 2007

In this paper, we introduce a set of structures and algorithms for communication efficient public key revocation in wireless sensor networks. Unlike the traditional networks, wireless sensor network is subjected to resources constraints. Thus, traditional public key revocation mechanisms such like the ordinary certificate revocation list is unsuitable to be used. This unsuitability is due to the huge size of required representation space for the different keys' identifiers and the revocation communication as the set of revoked keys grow. In this work, we introduce two communication-efficient schemes for the certificate revocation. In the first scheme, we utilize the complete subtree mechanism for the identifiers representation which is widely used in the broadcast encryption/user revocation. In the second scheme, we introduce a novel bit vector representation BVS which uses vector of relative identifiers occurrence representation. We introduce different revocation policies and present corresponding modifications of our scheme. Finally, we show how the encoding could reduce the communication overhead as well. Simulation results and comparisons are provided to show the value of our work.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.26 no.1
• /
• pp.17-30
• /
• 2016

In this paper, we propose an efficient public key trace and revoke scheme. An trace and revoke scheme is a broadcast encryption scheme which has a tracing and revocation algorithm. It would maintain security of the scheme to revoke pirate keys which are colluded by malicious users. In addition, property of revocation can be applied to various circumstances because it can help cipher text delivered to certain users who are supposed to. In this paper, we would change the scheme[Augmented broadcast encryption scheme] based on the bilinear groups of the composite order into that of prime order and we can improve the size of public key, secret key, ciphertext considerably. Furthermore, we define property of revocation precisely, so we can obtain the result that the scheme with limited revocation can be expanded to have a full revocation. This paper can be easily applied to the organization such as government, military, which has a hierarchical structure.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.16 no.5
• /
• pp.1634-1652
• /
• 2022

Due to the increasing need for data sharing in the age of big data, how to achieve data access control and implement user permission revocation in the blockchain environment becomes an urgent problem. To solve the above problems, we propose a novel blockchain-based data sharing scheme (BDSS) with fine-grained access control and permission revocation in this paper, which regards the medical environment as the application scenario. In this scheme, we separate the public part and private part of the electronic medical record (EMR). Then, we use symmetric searchable encryption (SSE) technology to encrypt these two parts separately, and use attribute-based encryption (ABE) technology to encrypt symmetric keys which used in SSE technology separately. This guarantees better fine-grained access control and makes patients to share data at ease. In addition, we design a mechanism for EMR permission grant and revocation so that hospital can verify attribute set to determine whether to grant and revoke access permission through blockchain, so it is no longer necessary for ciphertext re-encryption and key update. Finally, security analysis, security proof and performance evaluation demonstrate that the proposed scheme is safe and effective in practical applications.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.10 no.1
• /
• pp.414-430
• /
• 2016

Verifier-local revocation (VLR) seems to be the most flexible revocation approaches for any group signature scheme, because it just only requires the verifiers to possess some up-to-date revocation information, but not the signers. Langlois et al. (PKC 2014) proposed the first VLR group signature based on lattice assumptions in the random oracle model. Their scheme has at least Õ(n²) ⋅ log N bit group public key and Õ(n) ⋅ log N bit signature, respectively. Here, n is the security parameter and N is the maximum number of group members. In this paper, we present a simpler lattice-based VLR group signature, which is more efficient by a O(log N) factor in both the group public key and the signature size. The security of our VLR group signature can be reduced to the hardness of learning with errors (LWE) and small integer solution (SIS) in the random oracle model.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.17 no.7
• /
• pp.1935-1950
• /
• 2023

The arrival of the Internet of Things and 5G technology enables users to rely on edge computing platforms to process massive data. Data sharing based on edge computing refines the efficiency of data collection and analysis, saves the communication cost of data transmission back and forth, but also causes the privacy leakage of a lot of user data. Based on attribute-based encryption and blockchain technology, we design a fine-grained access control scheme for data in edge computing, which has the characteristics of verifiability, support for outsourcing decryption and user attribute revocation. User attributes are authorized by multi-attribute authorization, and the calculation of outsourcing decryption in attribute encryption is completed by edge server, which reduces the computing cost of end users. Meanwhile, We implemented the user's attribute revocation process through the dual encryption process of attribute authority and blockchain. Compared with other schemes, our scheme can manage users' attributes more flexibly. Blockchain technology also ensures the verifiability in the process of outsourcing decryption, which reduces the space occupied by ciphertext compared with other schemes. Meanwhile, the user attribute revocation scheme realizes the dynamic management of user attribute and protects the privacy of user attribute.

• Journal of the Korea Society of Computer and Information
• /
• v.21 no.10
• /
• pp.77-83
• /
• 2016

To verify the trustworthiness of messages, public key certificates and certificate revocation list(CRL) has been standardized for vehicular networks. However, timely distribution of large CRLs to vehicles should be more elaborated with low bandwidth utilization from a practical point of view. To address this concern, we propose a CRL distribution scheme using long term evolution(LTE) point-to-multicast transmission, namely the enhanced multimedia broadcast multicast service(eMBMS). The schem is much more resource efficient than the existing unicast CRL distribution schemes for vehicular networks and it allows realizing the regional CRL distribution schemes efficiently in LTE network. By means of ns-3 simulation, we analyze the performance, latency, and execution time of the scheme in terms of varying coverage of the multimedia broadcast multicast service over single frequency network (MBFSN).

• Journal of the Korea Society of Computer and Information
• /
• v.22 no.12
• /
• pp.109-116
• /
• 2017

Short-lived pseudonym certificates as vehicle identities could satisfy both security and privacy requirements. However, to remove revoked certificates especially in vehicle communications, pseudonym certificate revocation list (CRL) should be distributed resource-efficiently from a practical deployment point of view and in a timely manner. In this paper, we propose a novel CRL distribution scheme capable of CRL multicast to only activated vehicles registered to the CRL multicast group using the group communication system enabler, namely, the GCSE which is being standardized. The scheme is resource efficient by using CRL distribution paths instead of paging processes to find out multicast vehicle(s) within a certain region. The analyzed results show that the proposed scheme outperforms in terms of paging cost, packets transmission cost, and the processing cost at the respective entities compared to the existing four schemes in the literature.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.8 no.11
• /
• pp.4028-4049
• /
• 2014

Attribute-based encryption (ABE) is a promising cryptographic primitive for implementing fine-grained data sharing in cloud computing. However, before ABE can be widely deployed in practical cloud storage systems, a challenging issue with regard to attributes and user revocation has to be addressed. To our knowledge, most of the existing ABE schemes fail to support flexible and direct revocation owing to the burdensome update of attribute secret keys and all the ciphertexts. Aiming at tackling the challenge above, we formalize the notion of ciphertext-policy ABE supporting flexible and direct revocation (FDR-CP-ABE), and present a concrete construction. The proposed scheme supports direct attribute and user revocation. To achieve this goal, we introduce an auxiliary function to determine the ciphertexts involved in revocation events, and then only update these involved ciphertexts by adopting the technique of broadcast encryption. Furthermore, our construction is proven secure in the standard model. Theoretical analysis and experimental results indicate that FDR-CP-ABE outperforms the previous revocation-related methods.