Informatica

In recent years, as data has significantly grown, there is an increasing inclination among people to store data in cloud servers. Cloud computing (Sun, 2020; Alouffi et al., 2021), viewed as an efficient way of data storage and processing, is gradually becoming an indispensable infrastructure in various industry applications. However, data transmitting and storing in the cloud have also raised security concerns about data confidentiality. Therefore, to enhance the demand for data privacy protection is a significant issue. To ensure the security of data transmission in the cloud, encryption technology has become an essential topic in order to prevent unauthorized individuals from accessing sensitive information. Public key encryption (Lee et al., 2019; Deverajan et al., 2021; Zhou et al., 2021) is a well-known technique employed to ensure data confidentiality.

Since data in a cloud environment is encrypted for confidentiality, it becomes a challenge to find a specific data in cloud effectively. To address this issue, the concept of public key encryption with keyword search (PKEKS) (Boneh et al., 2004) has been proposed to achieve an effective search functionality for encrypted data. However, a PKEKS scheme has a limitation in the sense that it can only search for ciphertexts encrypted under identical receiver (entity) with the same public key. To overcome this limitation, the concept of public key encryption with equality test (PKEET) (Yang et al., 2010) has been introduced. A PKEET scheme allows users to perform comparative searches on ciphertexts encrypted under different public keys without revealing sensitive data.

Recently, a new type of attack has been actively discussed, known as side-channel attacks (Kubota et al., 2021; Ngo et al., 2021). A side-channel attack refers to a situation that attackers do not attempt to directly break the cryptographic algorithm in a security system, but exploit side-channel information, such as power consumption or timing, to gain access to critical system information. For example, as shown in Fig. 1, a user employs her/his secret key $\mathit{SK}$ to perform the decryption algorithm by inputting the ciphertext $\mathit{CT}$ at the device. Upon the completion of the decryption, the plaintext M is obtained. During the decryption process, an attacker could launch side-channel attacks to obtain crucial partial information about the user’s secret key $\mathit{SK}$. By doing so, the attacker can acquire partial information of the user’s secret key in every decryption process. After several rounds, the attacker may potentially reconstruct the complete sensitive data or the user’s secret key $\mathit{SK}$ by analysing these side-channel signals.

It is worth noting that a cryptographic mechanism known as leakage-resilient public key encryption (LR-PKE) (Akavia et al., 2009) has indeed been studied and published. It can withstand such side-channel attacks mentioned above. However, this mechanism’s application in diverse cloud computing environments remains constrained due to the absence of the property of equality test of ciphertext. Furthermore, to ensure the authenticity and integrity of information is also an important issue. Simultaneously, the development of cryptographic mechanisms that can efficiently merge digital signature and encryption has emerged as a pivotal topic in this field. In light of these challenges, this paper endeavours to propose a novel scheme, called leakage-resilient public key signcryption with equality test (LR-PKSCET), which not only offers robust security against side-channel attacks but also seamlessly integrates the processes of digital signing and encryption. In light of the increasing incidence of fraudulent activities, we will leverage the proposed LR-PKSCET as the foundation for developing an anti-scam system application. Our specific contributions include the following.

The remaining sections of this paper include the following parts. Section 2 introduces related work. Preliminaries are given in Section 3. Section 4 shows the LR-PKSCET framework and its associated security definitions. The concrete LR-PKSCET scheme is presented in Section 5. Formal proofs of ensuring the security of the LR-PKSCET scheme are given in Section 6. Performance analysis is carried out in Section 7. Section 8 introduces an application. Lastly, Section 9 offers the concluding remarks.

The concept of the PKEET scheme was first introduced by Yang et al. (2010) as an extension of the existing public key encryption with keyword search (Boneh et al., 2004). The primary goal of their research was to enable the comparison of encrypted data, or ciphertexts, generated under different public keys. Based on the Yang et al.’s work (2010), a significant amount of related research on PKEET has been continuously conducted and published. Tang (2011) designed a PKEET scheme with a proxy, where the proxy can obtain tokens from different users and use them to perform equality test of associated ciphertexts. Based on this authorization concept, Tang (2012a) introduced a PKEET scheme that incorporated user-specified authorization. Subsequently, Tang (2012b) further extended the PKEET scheme (Tang, 2012a) to offer the support for fine-grained authorization. Huang et al. (2014) introduced a novel PKEET scheme which enables the comparison of ciphertexts without requiring decryption. As a result, their scheme achieves the verification of equivalence among ciphertexts encrypted using the PKEET scheme. Building on this foundation, Huang et al. (2015) expanded Huang et al.’s scheme (2014) to propose a public key encryption with authorized equality test that allowed authorized proxy to perform equality test on selected ciphertexts. This enhancement augmented the versatility and functionality of the PKEET scheme. Another significant advancement in this field was made by Ma et al. (2015). They introduced a PKEET scheme with four distinct authorization policies, thereby increasing the adaptability of PKEET. However, these proposed PKEET schemes were all shown to be secure only under the random oracle model. To overcome this limitation, Lee et al. (2020) presented a generic construction of a PKEET scheme in the standard model which provides enhanced security guarantees. Additionally, for the lattice-based cryptography, Duong et al. (2019) introduced a PKEET scheme in the standard model which was built on lattice concepts from an identity-based encryption scheme (Agrawal et al., 2010). On the other hand, to simultaneously ensure the confidentiality, authenticity, and integrity of messages, Le et al. (2021) proposed a lattice-based signcryption with equality test in the standard model.

In the real-world scenarios of public key systems, the significance of secret keys is widely acknowledged. However, it is worth noting that the secret keys are often stored in the devices, making them susceptible to potential side-channel attacks (Kubota et al., 2021; Ngo et al., 2021). To avoid the scenario that secret keys can be computed when facing such attacks, the leakage-resilient cryptography (Dziembowski and Pietrzak, 2008; Faust et al., 2010) has emerged as a crucial topic. The core ambition of leakage-resilient cryptography was the formulation of algorithms with the capability to effectively counteract side-channel attacks. For data confidentiality, Akavia et al. (2009) introduced a leakage-resilient public key encryption (LR-PKE) scheme that effectively safeguards sensitive information even in the presence of potential side-channel threats. Subsequently, several studies (Naor and Segev, 2009, 2012; Li et al., 2013) related to LR-PKE have also been published to enhance both security and efficiency. However, the aforementioned LR-PKE schemes are specifically designed to provide security only in a bounded leakage model. To overcome this limitation, Kiltz and Pietrzak (2010) proposed the first LR-PKE scheme to provide security in continuous leakage models. Furthermore, Galindo et al. (2016) also presented a LR-PKE that drew inspiration from ElGamal and offered security in the continuous leakage model. For addressing the issue of ensuring the security of public key encryption when the randomness of ciphertexts becomes non-uniform due to faulty implementations or adversarial actions, Huang et al. (2022) introduced the concept of leakage-resilient hedged public-key encryption that offered a heightened level of comprehensive security. On the other hand, Tseng et al. (2022) introduced a leakage-resilient signcryption to achieve the objectives of message confidentiality, authenticity, and integrity.

We illustrate the framework of our LR-PKSCET scheme in Fig. 2, which includes a cloud server and two entities (also works more than two member entities). The two member entities ${\mathit{ME}_{\zeta }}$ and ${\mathit{ME}_{\eta }}$ can respectively generate their own entity secret keys denoted by $({\textit{ESK}_{\zeta }^{I}},{\textit{ESK}_{\zeta }^{II}})$ and $({\textit{ESK}_{\eta }^{I}},{\textit{ESK}_{\eta }^{II}})$ and entity public keys denoted by $({\textit{EPK}_{\zeta }^{I}},{\textit{EPK}_{\zeta }^{II}})$ and $({\textit{EPK}_{\eta }^{I}},{\textit{EPK}_{\eta }^{II}})$. The entity ${\mathit{ME}_{\zeta }}$ utilizes her/his entity secret keys $({\textit{ESK}_{\zeta }^{I}},{\textit{ESK}_{\zeta }^{II}})$ along with the entity public keys $({\textit{EPK}_{\eta }^{I}},{\textit{EPK}_{\eta }^{II}})$ of the entity ${\mathit{ME}_{\eta }}$ to perform the process of signing and encryption on the message $\mathit{msg}$ using the Signcryption algorithm. The output ciphertext ${\mathit{CT}_{\eta }}$ will be sent to the entity ${\mathit{ME}_{\eta }}$. Upon receiving ${\mathit{CT}_{\eta }}$, the entity ${\mathit{ME}_{\eta }}$ can utilize her/his entity secret keys $({\textit{ESK}_{\eta }^{I}},{\textit{ESK}_{\eta }^{II}})$ along with the entity public keys $({\textit{EPK}_{\zeta }^{I}},{\textit{EPK}_{\zeta }^{II}})$ of the entity ${\mathit{ME}_{\zeta }}$ to perform a decryption and verification process using the Unsigncryption algorithm. The process above allows the entity ${\mathit{ME}_{\zeta }}$ to obtain the message $\mathit{msg}$. On the other hand, the entities ${\mathit{ME}_{\zeta }}$ and ${\mathit{ME}_{\eta }}$ can respectively transmit their ciphertexts ${\mathit{CT}_{\zeta }}$, ${\mathit{CT}_{\eta }}$, and trapdoors ${\mathit{TD}_{\zeta }}$, ${\mathit{TD}_{\eta }}$ to the cloud server. The cloud server is capable of testing whether the two ciphertexts contain the same plaintext.

In this section, we show a leakage-resilient public key signcryption with equality test (LR-PKSCET) scheme that includes the following six algorithms. The following describes how to obtain the message $\mathit{msg}$ and verify the signature σ in the Unsigncryption algorithm. Next, we present the equation derivation process used in the $Test$ algorithm.

In this section, we will prove three theorems to establish the security of the proposed LR-PKSCET scheme in terms of indistinguishable security, one-way security and existential unforgeability, while ensuring that the proposed scheme possesses leakage resilience to withstand side-channel attacks.

We compare the proposed LR-PKSCET scheme with the existing PKEET scheme (Ma et al., 2015), PKSCET scheme (Le et al., 2021), LR-PKE scheme (Galindo et al., 2016), and LR-PKSC scheme (Tseng et al., 2022). Table 2 summarizes these comparisons on three properties: possession of signature and encryption, permission of secret keys leakage, and with the property of equality test. Firstly, let’s consider the PKEET scheme (Ma et al., 2015), which focuses on the equality test functionality, but falls short in the other two properties. On the other hand, the PKSCET scheme (Le et al., 2021) possesses the property of performing both signature and encryption, along with the desirable equality test functionality. Unfortunately, it does not allow secret keys leakage. Conversely, the LR-PKE scheme (Galindo et al., 2016) addresses the issue of secret keys leakage, but does so without possessing both signature and encryption capabilities or the equality test functionality. In contrast, the LR-PKSC scheme (Tseng et al., 2022) combines the advantage of possessing both signature and encryption capabilities along with the ability to allow secret keys leakage. However, it falls short in providing the equality test functionality. In conclusion, the proposed LR-PKSCET emerges as a versatile solution that includes all three properties – having signature and encryption capabilities, permission of secret key leakage, and with the equality test functionality.

Next, we introduce a pair of symbols aimed at evaluating the computational effort of the algorithms of our LR-PKSCET scheme:

We derive the pertinent result from simulations (Xiong and Qin, 2015) to obtain an approximate 20 ms for $C{E_{bp}}$ and 7 ms for $C{E_{exp}}$. These simulations are conducted under a computer environment of an Intel Core i7 CPU with 1.80 GHz. The input of simulations encompasses a finite field denoted as ${F_{q}}$, along with the groups G and ${G_{T}}$. Here, q denotes a prime number with 512 bits, and it concurrently serves as the order of the two groups G and ${G_{T}}$. The simulations involve a mobile device environment that employs an Intel 624-MHz PXA270 CPU. We obtain $C{E_{bp}}$ and $C{E_{exp}}$ to be approximately 96 ms and 31 ms, respectively. For a more comprehensive understanding, Table 3 presents an overview of the computational effort of our LR-PKSCET scheme linked to distinct algorithmic processes, including Initialization, EntityKeyGen, Signcryption, Unsigncryption, Authorization and Test on a mobile device MD and a PC.

As mentioned in Section 1, our LR-PKSCET scheme can be applied to anti-scam systems. As depicted in Fig. 3, we present a situation that exemplifies the utilization of the LR-PKSCET scheme to counteract telephone scams. The scenario encompasses four key roles: anti-scam centre, interlocutor, user, and cloud server. Now, we provide a breakdown of the responsibilities and functions associated with each role within the presented scenario.

According to the scenario described above, the proposed LR-PKSCET scheme demonstrates a collaborative approach to counter telephone scams effectively. The synergy among the $\textit{ASC}$, interlocutor, user, and $\mathit{CS}$ displays the potential to enhance security measures in the realm of telecommunication.

In this paper, we have presented a novel solution to the critical challenge of enhancing the security of PKSCET against side-channel attacks. Our proposed leakage-resilient public key signcryption with equality test (LR-PKSCET) scheme not only successfully combines the benefits of public key signcryption and equality test properties but also offers robust resistance against side-channel attacks. Through rigorous analysis and security proofs, we have demonstrated that the LR-PKSCET scheme achieves several essential security attributes, including leakage resilience, indistinguishability, one-wayness, and existential unforgeability. By incorporating the proposed LR-PKSCET scheme into an anti-scam system, we offer a practical application that addresses a pressing societal concern. The integration of our scheme into such a system has the potential to significantly reduce the frequency and impact of scam cases, thereby safeguarding users from financial and personal losses. While our proposed scheme is based on classical bilinear pairing and achieves indistinguishable chosen-ciphertext attacks (IND-CCA) security, we recognize the increasing importance of post-quantum cryptography (PQC). Although some research efforts have been made in designing PQC-based public key signcryption with equality test (PKSCET), these schemes still lack the functionality to side-channel attacks. As part of our future work, we aim to design a PQC-based LR-PKSCET scheme that maintains IND-CCA security and addresses the challenges posed by the quantum era.