TSA-IPFE: A Secure Solution for Authorization Revocation and Dynamic Identity Assignment in IoT

Inner product functional encryption (IPFE) offers strong privacy protection for smart devices by outputting only the results of function computations, minimizing data leakage. This makes it well-suited for privacy-preserving operations in edge cloud environments, however, the edge cloud increases the complexity of the information authorization system, and traditional static authorization methods hinder collaboration between smart devices. Moreover, existing IPFE schemes fail to revoke computational authorizations when a smart device switches edge clouds. To address these challenges, we propose the two-step authentication IPFE scheme (TSA-IPFE), specifically designed for the three-tier “cloud-edge cloud-smart device” architecture. TSA-IPFE enables dynamic authorization management through a two-step identity-matching process. This process revokes computational authorizations as devices move between edge clouds. It also facilitates dynamic authorization by setting up identity validation processes at different network locations, enabling seamless collaboration between smart devices from different vendors within the same cloud architecture. Finally, we prove the semantic security and anonymity of TSA-IPFE through a simulation-based proof, utilizing indistinguishable transformations in the dual system, a comparison with other algorithms demonstrates the efficiency of TSA-IPFE on a common platform.