An efficient lattice-based identity-based proxy Re-encryption scheme with direct revocation for cloud storage

As cloud storage becomes increasingly commonplace alongside the expansion of data sharing practices, how to achieve secure data sharing and user revocation while ensuring data confidentiality has become a key issue. Proxy re-encryption enables ciphertext originally designated for one user to be transformed by a semi-trusted proxy for another user, while identity-based encryption offers a simplified approach to key administration. However, most existing frameworks employ bilinear pairings, which suffer from susceptibility to quantum threats, and generally lack efficient revocation mechanisms. To tackle these challenges, we present an identity-based directly revocable proxy re-encryption scheme (IBPRE-DR) based on the Learning With Errors (LWE) assumption. This scheme enables data owners to directly revoke user permissions without requiring a key generation center (KGC) to frequently update user keys, supporting immediate and dynamic access control. The mechanism uses a complete subtree algorithm to achieve efficient revocation. Additionally, a dual-key mechanism distinguishes re-encryption keys from decryption keys, effectively resisting collusion attacks and further enhancing data security. Furthermore, the private key length for each user remains fixed, supporting multi-bit encryption. We present a formal definition of IBPRE-DR’s security, along with a standard-model security proof. To the best of our knowledge, this is the first lattice-based identity-based proxy re-encryption scheme that integrates direct user revocation under the standard LWE assumption. Both experimental results and theoretical analysis confirm the scheme’s effectiveness and feasibility.