Source-linked AI summary
Achieving Efficient and Secure Data Acquisition for Cloud-supported Internet of Things in Smart Grid
Zhitao Guan, Jing Li, Longfei Wu, Yue Zhang, Jun Wu, Xiaojiang Du
TL;DR
Cloud-IoT smart grids need efficient acquisition and secure handling of large volumes of sensitive data. The paper proposes a CP-ABE scheme using block partitioning, parallel encryption and transmission, and dual secret sharing. Its analyses and experiments report that the scheme meets security requirements and reduces time costs compared with other approaches.
Problem
Large volumes of sensitive smart-grid data make secure and efficient acquisition and transmission challenging.
Method
The scheme partitions data into blocks for parallel encryption and transmission, while dual secret sharing protects access-tree information and filters unauthorized attributes.
Results
Security analysis indicates the scheme meets the required security properties, while experiments report reduced time costs and lower system response and user waiting times.
Takeaways & Limitations
The proposed design combines data confidentiality, privacy preservation, integrity checking, and attribute verification with more efficient block-based processing.
Abstract
from arXiv · showhide
Cloud-supported Internet of Things (Cloud-IoT) has been broadly deployed in smart grid systems. The IoT front-ends are responsible for data acquisition and status supervision, while the substantial amount of data is stored and managed in the cloud server. Achieving data security and system efficiency in the data acquisition and transmission process are of great significance and challenging, because the power grid-related data is sensitive and in huge amount. In this paper, we present an efficient and secure data acquisition scheme based on CP-ABE (Ciphertext Policy Attribute Based Encryption). Data acquired from the terminals will be partitioned into blocks and encrypted with its corresponding access sub-tree in sequence, thereby the data encryption and data transmission can be processed in parallel. Furthermore, we protect the information about the access tree with threshold secret sharing method, which can preserve the data privacy and integrity from users with the unauthorized sets of attributes. The formal analysis demonstrates that the proposed scheme can fulfill the security requirements of the Cloud-supported IoT in smart grid. The numerical analysis and experimental results indicate that our scheme can effectively reduce the time cost compared with other popular approaches.
I. INTRODUCTION
Cloud-IoT smart grids must efficiently acquire and protect large volumes of sensitive data. The paper proposes CP-ABE-based parallel processing and dual secret sharing to address these requirements.
- Motivation: Cloud-IoT collects and stores massive smart-grid data from distributed IoT terminals, creating efficiency, security, and privacy challenges.Data acquisition must handle encryption, decryption, and transmission at acceptable time costs while protecting sensitive grid data.
- Proposed approach: The proposed scheme uses CP-ABE to provide secure data acquisition for cloud-supported smart grids.The approach targets the two stated challenges of efficient acquisition and data security simultaneously.
- Proposed approach: Data is partitioned into blocks and encrypted with corresponding access sub-trees, allowing encryption and transmission to proceed in parallel.The decryption process follows a similar block-oriented process.
- Security design: Dual secret sharing protects access-tree information and supports privacy preservation, integrity checking, and attribute verification.The secret is recovered only after the required shares are combined, while unauthorized attribute sets are filtered out.
- Evaluation: Security analysis and performance evaluation indicate security no weaker than the traditional scheme and notably lower response and waiting times.The paper reports both formal evaluation and reduced system delays.
B. Discrete Logarithm (DL) Problem:
This section defines the discrete-logarithm assumption and introduces the access-control and system foundations used by the scheme. It specifies threshold-based access trees, secret sharing, system entities, and trust assumptions.
- Discrete Logarithm Problem: The DL assumption states that no probabilistic polynomial-time algorithm can recover x from a randomly generated tuple involving g and g^x with non-negligible advantage.The probability is taken over the generator, random exponent, and adversary randomness.
- Access structures: The access structure defines authorized and unauthorized participant sets, with monotonicity requiring supersets of authorized sets to remain authorized.This formalizes which attribute sets can satisfy an access policy.
- Ciphertext-policy ABE: CP-ABE represents access structures as trees whose leaves are attributes and whose interior nodes are threshold gates such as AND, OR, and n of m.The scheme uses Bethencourt’s access-tree formulation for fine-grained access control.
- Tree processing: Encryption assigns polynomials from the root downward, while decryption proceeds in reverse order using node relationships and Lagrange coefficients.The functions parent, att, and index support tree navigation and attribute association.
- System model: The system contains data owners, cloud servers, an attribute authority, and data requesters, with the authority trusted and cloud servers not trusted by owners.Requesters may collude, while cloud servers are assumed not to collude with requesters.
B.Definition of Our system
The scheme is organized around setup, key generation, encryption, and decryption algorithms. Its encryption partitions and protects data blocks, while decryption checks attributes and integrity before recovering plaintext.
- Algorithms: Setup takes security parameter λ as input and outputs the public key and master key.These keys initialize the scheme for subsequent key generation and encryption.
- Algorithms: Key_Gen uses the public key, master key, and a user attribute set to output the corresponding secret key.The secret key is generated for the user’s attributes.
- Encryption: Encryption partitions the message according to the access structure and encrypts the resulting blocks with corresponding sub-access-structures.The number of encrypted blocks is determined by the threshold function.
- Decryption: Decryption comprises attribute checking, ciphertext-block integrity checking, tree and leaf-node decryption, and two ciphertext-block decryption routines.The listed subroutines combine access verification, integrity validation, and block recovery.
- Decryption: The final ciphertext block and user attributes are checked first, and successful verification exposes access-tree information for subsequent processing.The integrity routine uses ciphertext-block identifiers and the output of the attribute check.
C.Definition of Security Model
The security model defines a CP-ABE challenge game in which an adversary may request keys that cannot directly decrypt the challenge access structure. It also describes parallel encryption-transmission and transmission-decryption as efficiency mechanisms.
- The security game uses an adversary and challenger, with the challenger generating challenge ciphertexts and secret keys under an access structure.
- Security game: During setup, the challenger gives public parameters PK to the adversary while retaining the master key MK.
- Security game: In Phase 1, the adversary may request keys for attribute sets that do not satisfy the challenge access structure, then submits attributes and a ciphertext to obtain the corresponding message.
- Security game: The challenge encrypts one of two equal-length messages under the challenge access structure, and the adversary wins by correctly guessing which message was encrypted.
- Efficiency: The scheme partitions data and access trees into blocks so encryption or decryption can overlap with transmission, reducing server response and data recipient waiting times.
- Setup: The setup algorithm selects a bilinear group and random exponents, then outputs public and master keys.
2) Key_Gen
Key generation uses a trusted server to evaluate users’ attributes and produce corresponding secret keys. Encryption partitions data and access trees into subtrees, protects access information with secret sharing, and supports parallel processing.
- Key generation: A trusted server registers legal data recipients, evaluates their attribute sets, and generates corresponding secret keys.
- Key generation: The key-generation algorithm takes an attribute set, public parameters, and master keys as inputs, producing a corresponding secret key.
- Encryption: Data_Partition divides the original data into blocks, while DB_Encryption encrypts them sequentially so encryption and transmission proceed in parallel.
- Encryption: Each data block is encrypted under a two-level access subtree consisting of one root node and its child nodes.
- Access-tree protection: The complete access-tree information is protected using secret sharing across ciphertext blocks, with the final share additionally protected by another secret-sharing scheme.
- Access-tree protection: For a root threshold of k out of t, at least k satisfied branches are required to recover the secret; unauthorized attribute sets are eliminated.
4) Decryption
Decryption first checks recipient attributes and ciphertext integrity, then processes ciphertext blocks through leaf and interior subtree routines. Secret sharing and block-level recovery determine whether the message can be reconstructed.
- Checks: Decryption begins by checking the recipient’s attributes and the integrity and availability of all ciphertext blocks.
- Secret recovery: The secret-sharing recovery obtains pairs from attribute processing and recovers R_n+1 only when at least k pairs are available.
- Transmission-decryption: After the checks pass, ciphertext blocks enter transmission-decryption mode using the ciphertext block and secret key as inputs.
- Subtree decryption: Each two-level subtree is processed without recursion through leaf-node and interior-node decryption algorithms.
- Block decryption: If a subtree is satisfied, related ciphertext blocks can be decrypted through their parent-node values; otherwise, the relevant computation returns ⊥.
- Message recovery: The recovered data blocks are concatenated as M = M_1 || M_2 || M_3 || ... || M_n to output the message.
VI. SECURITY ANALYSIS
The paper analyzes its security properties using the security model defined earlier.
- The system’s security properties are analyzed according to the security model introduced in Section 4.
A. System Security
The scheme preserves security relative to the traditional scheme while using partitioned access-tree processing to reduce response and waiting times.
- A. System Security: The proposed scheme is designed to parallelize transmission and computation by partitioning data and access-tree information into chunks.This design supports concurrent processing of different blocks.
- A. System Security: The scheme reduces server response time and the data requester’s waiting time, while the encryption and decryption procedures remain relevant to system security.The paper links the efficiency design to concurrent processing and treats cryptographic processing as part of the security discussion.
- A. System Security: Theorem 1 states that the security of the proposed system is no weaker than that of the traditional CP-ABE scheme.The proof is formulated as a security game based on the CP-ABE security model.
- A. System Security: The security game gives the adversary public parameters, permits constrained private-key queries, and provides ciphertext blocks for a randomly selected challenge message.The adversary wins by correctly guessing the challenge bit.
- A. System Security: An adversary attacking the proposed scheme with non-negligible advantage would thereby attack the underlying CP-ABE scheme.This reduction supports the claimed security relation.
B. Partition
The partition method divides the file and access tree into sub-trees, enabling independent block processing while preserving the scheme’s security properties.
- B. Partition: The complete access tree is partitioned into sub-trees, and each data block is encrypted with CP-ABE under a two-level sub-tree.Each sub-tree contains one root node and its child nodes.
- B. Partition: Partitioning allows data blocks to be encrypted and decrypted independently and in parallel with transmission and computation.The design is intended to reduce server response time and the requester’s waiting time.
- B. Partition: Theorem 2 states that partitioning does not impact the security of the proposed scheme.The partitioned tree contains partial access policies without inserted additional information.
- B. Partition: Access to the first data block requires satisfying its access policy; without it, the remaining blocks cannot be retrieved.This preserves the security role of the first block in the partitioned message.
- B. Partition: Theorem 3 states that the scheme is secure against adversaries running in polynomial time in the length of the access-tree information.The access-tree information is protected using threshold secret sharing across n+1 parties.
- B. Partition: Recovering the protected secret requires n valid ciphertext blocks together with the recovered n+1-th share.Unknown attribute strings prevent adversaries from efficiently guessing the underlying attribute information.
IV. PERFORMANCE EVALUATION
The performance analysis models encryption-transmission and transmission-decryption overlap under a no-delay assumption, showing a positive time difference in either case for the proposed scheme.
- IV. PERFORMANCE EVALUATION: The evaluation analyzes concurrent encryption, decryption, and transmission of partitioned data blocks, with stepwise costs reported in Table II.The analysis follows the processes illustrated in Figures 2 and 3.
- IV. PERFORMANCE EVALUATION: Under the stated assumption of no delay between consecutive block operations, the proposed scheme has a positive time difference in both analyzed cases.The paper states 0 < ΔT for both encryption-transmission and transmission-decryption analyses.
- IV. PERFORMANCE EVALUATION: The analysis assumes ideally that M transmission times exceed n computation times in the relevant comparison.This condition is stated as M·D_T > n·T_T.
B. Experimental results
The experiments evaluate encryption, transmission, and decryption time for the proposed scheme against CP-ABE under varying message sizes, access-tree leaf counts, and block counts. Results show reduced total time, with only slight growth or decline under the tested access-tree and block configurations.
- Encryption and transmission can be performed concurrently across data blocks, reducing total time compared with.The testing environment used the cpabe-toolkit, with comparative tests using a ten-level access tree containing 100 leaf nodes.
- Transmission and decryption are concurrently performed across data blocks, reducing their total time compared with.The decryption experiment used the same key to control decryption-time overhead.
- As the number of leaf nodes grows, total encryption time rises for both schemes, but the proposed scheme grows at a much smaller rate and remains significantly faster than.The comparison fixes the number of interior nodes, and therefore the number of blocks.
- With the number of leaf nodes fixed, the proposed scheme’s total time decreases slightly as the number of blocks increases.This result is reported for the encryption and transmission comparison in Fig. 4(d).
- The proposed scheme meets the stated smart-grid data-acquisition security requirements while significantly reducing response-time overhead compared with other popular schemes.The conclusion also identifies offline preprocessing before encryption as a scope boundary for the reported system.