Privacy-preserving composite modular exponentiation outsourcing with optimal checkability in single untrusted cloud server

Abstract

Outsourcing computing allows users with resource-constrained devices to outsource their complex computation workloads to cloud servers, which is more economical for cloud customers. However, since users lose direct control of the computation task, possible threats need to be addressed, such as data privacy and the correctness of results. Modular exponentiation is one of the most basic and time-consuming operations but widely applied in the field of cryptography. In this paper, we propose two new and efficient algorithms for secure outsourcing of single and multiple composite modular exponentiations. Unlike the algorithms based on two untrusted servers, we outsource modular exponentiation operation to only a single server, eliminating the possible collusion attack with two servers. Moreover, we put forward a new mathematical division method, which hides the base and exponent of the outsourced data, without exposing sensitive information to the cloud server. In addition, compared with other state-of-the-art algorithms, our scheme shows a remarkable improvement in checkability, enabling the user to detect any misbehavior with the optimal probability close to 1. Finally, we use our proposed algorithms as a subroutine to realize Shamir's Identity-Based Signature Scheme and Identity-Based Multi-Signatures Scheme.

Introduction

Cloud computing, a service for enabling convenient, on-demand network access to a shared pool of configurable computing resources, can be instantly deployed and released with minimal management effort. With the rapid development of cloud computing (Ren et al., 2012; Fu et al., 2018), a new paradigm has emerged: so-called outsourcing computing. It allows users with resource-constrained devices (such as smart phones and tablets) to outsource their complex computational tasks to cloud servers and enjoy unlimited computing resources in a convenient pay-per-use manner. In particular, due to mathematical and technological developments, cryptographic key sizes have been steadily increasing with the aim to ensure the data security. However, it becomes a big computational obstacle for the computationally limited devices. Therefore, the existing resource-constrained devices may be unable to ensure the desired level of security (Kuppusamy et al., 2016; Kiraz and Uzunkol, 2016). One solution is to update these devices with more powerful ones, which is costly and impractical. But outsourcing computation provides a better solution: more feasible, secure, and pragmatic.

Although outsourcing computation has enormous attractions for users with computationally-limited devices, it inevitably brings about two new security concerns and challenges (Liu et al., 2016a; Singh et al., 2016; Mollah et al., 2017; Yu, 2016; Li et al., 2017a). Firstly, outsourced computation tasks often contain sensitive information, such as personal medical records, personal income status and family member information, which should not be exposed to cloud servers. Therefore, how to protect users' sensitive input/output information is one of the biggest challenges with the progress of outsourcing data (Liu et al., 2016b, 2017; Gennaro et al., 2010; He et al., 2017; Wang et al., 2017). Secondly, since cloud servers are not fully trusted (Wang et al., 2015; Huang et al., 2017; Shen et al., 2017; Zhou et al., 2012), they may return incorrect results. For example, outsourcing calculations often need copious computing resources: if users cannot check the correctness of cloud servers’ outputs, cloud servers may be too “lazy” to save resources (Esiner and Datta, 2016; Wang, 2015; Yu et al., 2016; Fu et al., 2017). Besides, there may be software bugs and malicious attacks from adversaries, which may affect the correctness of calculation results. As a result, how to efficiently verify the outsourced computation results is another important security challenge with the progress of outsourcing data.

Faced with such problems, plenty of work has been done for secure outsourcing computing. As one of the basic time-consuming computations, securely outsource modular exponentiation has become a hot topic. The relevant schemes are divided into two classes: the Two-Untrusted-Server Algorithms and the Single-Untrusted-Server Algorithms. In 2005, based on two untrusted servers, the first secure outsourcing algorithm for modular exponentiation was introduced by Hohenberger et al. (Hohenberger et al., 2005). Then, more researches (Chen et al., 2014a; Ye et al., 2015, 2016; Ren et al., 2016; Kuppusamy et al., 2016) are proposed to solve the modular exponentiation problem based on two servers. These schemes definitely reduce the computational cost of resource-constrained users with privacy protection and verifiability, but they all have the same security hypothesis that there is no collusion between servers, which makes it impossible for the schemes to resist collusion attacks. Dijk et al. (2006) proposed the first single server based outsourcing scheme for modular exponentiation to avoid collusion attacks. Other researches (Ma et al., 2013; Wang et al., 2014; Chevalier et al., 2016; Kiraz and Uzunkol, 2016; Xiang and Tang, 2015) are also committed to handle the modular exponentiation outsourcing based on a single server with a higher checkability.

The existing algorithms in (Hohenberger et al., 2005; Chen et al., 2014a; Ye et al., 2015, 2016; Ren et al., 2016; Kuppusamy et al., 2016; Dijk et al., 2006; Ma et al., 2013; Wang et al., 2014; Chevalier et al., 2016; Kiraz and Uzunkol, 2016; Xiang and Tang, 2015) solve the need for secure outsourcing for prime modular exponentiations, but few algorithms offer a secure outsourcing algorithm for composite modular exponentiation. Though prime modular exponentiation has broad applications in engineering tasks, it is defenceless in the face of some encryptions and signatures such as RSA-based cryptographic protocols, where composite modular exponentiation plays an important role. Liu et al. (2013) proposed the only existing outsourcing protocol for composite modular exponentiation. However, Kiraz et al. (Kiraz and Uzunkol, 2016) pointed out that the checkability property of Liu et al.’s scheme fails. By using their notation, a malicious server can always tamper with the output without being detected by the client. Therefore, in this paper, we propose two new algorithms, named CMExp and MCMExp, for secure outsourcing of composite modular exponentiation and multiple composite modular exponentiations, based on a single untrusted program. Our main contributions are summarized as follows:

• We propose two new and efficient algorithms for secure outsourcing of composite modular exponentiation (CMExp) and multiple composite modular exponentiations (MCMExp) respectively. Importantly, they are both based on only one untrusted server. Compared to those based on two servers, our algorithms avoid the unrealistic assumption that servers will not collude.

• We utilize a new mathematical division method to protect the privacy of the data. With this method, the original data is logically split into random looking pieces, which hides the base and exponent of the outsourced data. Therefore, not only can it prevent the server from obtaining any privacy information about the client's outsourcing task, but also can make the scheme easier to implement.

• The checkability of the computing results shows a great improvement; the proposed algorithms CMExp and MCMExp enable the outsourcer to verify the results returned by the server with the probability close to 1. In the real world, this is desirable and practical, because the client almost can detect any misbehavior of the server.

• For multiple modular exponentiations, our algorithm MCMExp has a stable checkability. For outsourcing $\prod _{i=1}^n{u}_i^{d_i}\text{,}$ the checkability probability of (Wang et al., 2014) will decrease as the increase of n. For example, if n is larger than 2000, the checkability probability of (Wang et al., 2014) will be less than 1/2000. Instead, that of MCMExp is still close to 1, which is more efficient and practical.

The remainder of this paper is organized as follows: In Section 2 we discuss related work in detail. Section 3 introduces the system model and the security definition. The proposed algorithms of modular exponentiations are shown in Section 4. We provide the security analysis on the proposed algorithms in Section 5 and evaluate the performance of our algorithms in Section 6. Section 7 gives the applications of CMExp and MCMExp. Finally, this paper is concluded in Section 8.