Attribute-based Authentication Research Articles

One-Round Attribute-Based Key Exchange in the Multi-Party Setting

Attribute-based authenticated key exchange (AB-AKE) is a useful primitive that allows a group of users to establish a shared secret key and at the same time enables fine-grained access control. A straightforward approach to design an AB-AKE protocol is to extend a key exchange protocol using an attribute-based authentication technique. However, insider security is a challenge security issue for AB-AKE in the multi-party setting and cannot be solved using the straightforward approach. In addtion, many existing key exchange protocols for the multi-party setting (e.g., the well-known Burmester-Desmedt protocol) require multiple broadcast rounds to complete the protocol. In this paper, we propose a novel one-round attribute-based key exchange (OAKE) protocol in the multi-party setting. We define the formal security models, including session key security, insider security and user privacy, for OAKE, and prove the security of the proposed protocol under some standard assumptions in the random oracle model.

Attribute-based authentication on the cloud for thin clients

We propose two new authentication schemes for the cloud that support private attribute-based authentication services. The basic scheme is non-anonymous attribute-based authentication scheme. The extended scheme of the basic scheme is fully anonymous attribute-based authentication scheme to realize full anonymity and unlinkability services. In the proposed schemes, a user is authenticated by the remote server if the intersection of the set of his/her assigned attributes and the server’s required attributes exceeds a satisfactory predefined level. Unlike existing attribute-based encryption and signature schemes that require the user to perform significant amount of elliptic curve bilinear pairings and modular exponentiations, and require the user to hold a significantly long decryption/signature key, in our schemes the user is not required to perform any bilinear pairings. With a fixed length private key, independent of the number of attributes, the cloud user performs only few exponentiations by which he/she is able to authenticate himself/herself to the remote server and establish a session key with the server with the condition that he/she satisfies a predefined level of the server’s attributes requirement. Therefore, our schemes are suitable for implementation on devices with limited resources. We provide the rigorous security of the proposed schemes and complexity analysis of our schemes. Finally, the security and performance comparisons of our schemes with the existing related schemes show that our schemes outperform other existing schemes.

A Pre-Authentication Approach to Proxy Re-encryption in Big Data Context

With the growing amount of data, the demand of big data storage significantly increases. Through the cloud center, data providers can conveniently share data stored in the center with others. However, one practically important problem in big data storage is privacy. During the sharing process, data is encrypted to be confidential and anonymous. Such operation can protect privacy from being leaked out. To satisfy the practical conditions, data tranmission with multi receivers is also considered. Furthermore, this paper proposes the notion of pre-authentication for the first time, i.e., only users with certain attributes that have already been authenticated can participate in the data transmission. The pre-authentication mechanism combines the advantages of proxy conditional re-encryption multi-sharing mechanism with the attribute-based authentication technique, thus achieving attributes authentication before re-encryption, and ensuring the security of the attributes and data. Finally this paper proves that the system can resist several attacks and the proposed pre-authentication mechanism could significantly enhance the system security level.

Securing Healthcare Records in the Cloud Using Attribute-Based Encryption

<p>Cloud Computing has attracted interest as an efficient system for storing and access of data. Sharing of personal electronic health record is an arising concept of exchanging health information for research and other purposes. Cconfidentiality except for authorized users, and access auditability are strong security requirements for health record. This study will examine these requirements and propose a framework for healthcare cloud providers that will assist in securely storing and sharing of patient’ data they host. It should also allow only legitimate users to access portion of the records' data they are permitted to. The focus will be on these precise security issues of cloud computing healthcare and how attribute-based encryption can assist in addressing healthcare regulatory requirements. The proposed attribute-based encryption guarantees authentication, data confidentiality, availability, and integrity in a multi-level hierarchical order. This will allow the healthcare provider to easily add/delete any access rule in any order, which is considered beneficial particularly in medical research field.</p>

클라우드 컴퓨팅을 위한 안전한 속성기반 인증 기법

클라우드 컴퓨팅 서비스는 개별 사용자가 자원을 서로 공유하고 가상화 기술 등을 적용하여 기존의 컴퓨팅 환경과는 다른 특성을 가지고 있다. 이러한 특성으로 인해 클라우드 컴퓨팅 환경에 적합한 사용자 식별·접근제어 기술 및 보안 통제 사항 등이 요구된다. 최근 Yoo는 안전한 클라우드 컴퓨팅을 위한 속성기반 접근제어를 이용한 새로운 인증 기법을 제안하였다. 해당 기법은 속성이라는 개념을 이용하여 클라우드 자원에 대한 안전한 접근을 제공한다. 그러나 Yoo의 기법은 악의적인 서비스 제공자에 의해 인증서버의 비밀키 해시 값이 유출될 수 있는 취약점을 가지고 있으며 이를 이용한 서비스 제공자 공격을 통해 인증 요청 메시지 공격이 가능하다. 본 논문에서는 Yoo가 제안한 기법이 가진 취약점을 개선하여 클라우드 컴퓨팅을 위한 안전하고 효율적인 속성기반 인증 기법을 제안하고자 한다.

A fine-grained attribute-based authentication for sensitive data stored in cloud computing

A fine-grained attribute-based authentication for sensitive data stored in cloud computing

A fine-grained attribute-based authentication for sensitive data stored in cloud computing

Attribute-Based Signature ABS is one of the important security primitives to realise anonymous authentication. In ABS, users cannot forge a signature with attributes they do not have even if they collude. In addition, a legitimate signer remains anonymous among all the users whose attributes satisfy the predicate specified in the signature. However, one of the challenges to implement ABS is the efficiency problem. Cloud computing is a promising and new computing model in which resources of the computing infrastructure can be rented and provided to the users via the internet. In this paper, the issue of outsourcing ABS is addressed, which enables users largely to eliminate the computational costs of ABS generation. We propose an efficient and secure outsourcing ABS scheme. Extensive analysis shows that our scheme is secure in the proposed model and efficient at the user side.

ATTRIBUTE-BASED AUTHENTICATION SCHEMES: A SURVEY

Attribute-based authentication (ABA) is a way to authenticate users via attributes which are the properties of those to be authenticated, for example, resources, contextual information (time, location, etc.) or their combination. In ABA schemes, attributes instead of identity are requested to be presented or even evidence showing that users own the required attributes is enough, so it is more flexible and privacy-preserving compared with traditional identity-based authentication. In this paper, we first explain the general structure and security requirements of ABA schemes, and then give an example to demonstrate their cryptographic construction. Next, we analyze recent work and discuss future research topics on the construction of ABA schemes, including attribute tree building, cryptographic construction, security models, hierarchy, traceability and revocation.

Server-aided anonymous attribute-based authentication in cloud computing

The notion of attribute-based signature is one of the important security primitives to realize anonymous authentication. In an attribute based signature (ABS), users can generate a signature on a message with their attributes. With this signature, any verifier will be convinced that such a signature is generated from a signer with these attributes. However, the identity of the signers will be hidden from the verifier. ABS are useful to design anonymous authentication and attribute-based messaging system. However, existing work of attribute-based authentication usually requires huge computation during signing, which grows linearly with the size of the attributes. Thus, these methods result in heavy computation overhead on the users and are not suitable for devices with only small computation ability.Cloud computing is an emerging computing paradigm in which resources of the computing infrastructure are provided as outsourcing services over the Internet. In this paper, we first address the challenging issue of securely outsourcing ABS, which enables users to largely eliminate the computational costs of ABS generation. The security model is formally defined to protect the privacy of users’ signing key while outsourcing the computation of signing. An efficient and secure outsourcing algorithm of ABS is also proposed. Extensive analysis shows that our scheme is secure in the proposed model and saves more than 90% computation overhead on the user side.

New attribute-based authentication and its application in anonymous cloud access service

Secure access control service in cloud computing has attracted much attention recently. Attribute–based signature (ABS for simplicity) is one of important cryptographic notions which can be utilised to realise anonymous authentication and access control in cloud computing. In this paper, we propose an efficient ABS with multiple authorities that can be proved with strong signer privacy and unforgeability. Signer privacy is enhanced due to the anonymous key–issuing protocol used in our scheme, that is, (a) the identity of signer is kept anonymous without revocation among all users whose attributes satisfying the predicate given in the signature; (b) the user can get the attribute private key while preventing the authorities from linking attributes of the user. In addition, our scheme supports batch verification, which greatly improves the verification efficiency.

Concepts and languages for privacy-preserving attribute-based authentication

Existing cryptographic realizations of privacy-friendly authentication mechanisms such as anonymous credentials, minimal disclosure tokens, self-blindable credentials, and group signatures vary largely in the features they offer and in how these features are realized. Some features such as revocation or de-anonymization even require the combination of several cryptographic protocols. The variety and complexity of the cryptographic protocols hinder the understanding and hence the adoption of these mechanisms in practical applications. They also make it almost impossible to change the underlying cryptographic algorithms once the application has been designed. In this paper, we aim to overcome these issues and simplify both the design and deployment of privacy-friendly authentication mechanisms. We define and unify the concepts and features of privacy-preserving attribute-based credentials (Privacy-ABCs), provide a language framework in XML schema, and present the API of a Privacy-ABC system that supports all the features we describe. Our language framework and API enable application developers to use Privacy-ABCs with all their features without having to consider the specifics of the underlying cryptographic algorithms—similar to as they do today for digital signatures, where they do not need to worry about the particulars of the RSA and DSA algorithms either.

A Survey of Payment Approaches for Identity Federations in Focus of the SAML Technology

Identity Federations are increasingly being used to establish convenient and secure attribute-based authentication and authorization systems. Whilst this process began mainly in the academic sector, it is assumed that over the next few years more and more commercial Service Providers will join Identity Federations in order to offer their services and products to federated customers. However, the introduction of commercial Service Providers demands a solution for payment, which has not been deployed during the early years of Identity Federations. Thus, Service Providers have to implement not only the federation application, but also additional payment solutions; a problem, by which the federation may appear unattractive for Service Providers, especially semi-commercial or those requiring micropayments. Even for large commercial providers entering a federation, the lack of payment support is a major disadvantage that may lead to either customer or profit loss. Thus, although a combination of electronic Payment solutions and Identity Federation approaches would provide several benefits to its participants, there has not been much investigation of such combinations. Therefore, this paper analyses electronic payment approaches as well as Identity Federation mechanisms and focuses on a solution to bridge these two aspects. Besides early stages of identity-based payments, final full integrated SAML-based payment approaches, which merge payments and Identity Federation into a powerful business solution, are also highlighted. However, since security is a major concern when focusing on payment solutions, several approaches have been investigated, including security and privacy evaluations, and, within this survey, only those solutions providing a sufficient level of security and privacy have been taken into consideration.

Attribute-based authentication for multi-agent systems with dynamic groups

In a multi-agent system, agents are required to interact in order to exchange information. To achieve a reliable information exchange, a sound security protection must be in place. Unfortunately, security and privacy in multi-agent systems have not drawn adequate attention. They have been actually ignored or mistreated in most proposed multi-agent protocols. We observe that security and privacy issues are indeed not trivial and cannot be resolved with traditional security mechanisms, if agents are not trusted each other and their privacy must be protected. In this paper, we propose a secure multi-agent protocol that captures several most important security properties including agent privacy, data confidentiality, and agent authenticity. Intuitionally, we allow each agent in a group to hold a set of policy attributes. To access a protected data set, an agent must hold a correct policy attribute. In other words, the private information between two agents can be exchanged, if and only if the policy attribute embedded in the transmitted message matches that held by the receiver. In case of mismatching attributes, the private information of the corresponding agent will not be revealed to their counterpart. The proposed scheme is formalized with a sound cryptographic algorithm with a rigorous security proof.

IPTV 방송 시스템에서의 속성기반 사용자 인증 기법

IPTV(Internet Protocol Television)기술은 통신과 방송의 새로운 융합 기술로 다양한 양방향 TV 서비스를 제공한다. 이러한 서비스를 제공받기 위해서는 TV에 연결된 셋톱박스 (STB, Set-Top Box)와 정당한 가입자의 스마트카드 간의 상호 인증이 이루어져야 한다. 본 논문에서는 한 조직 내에서 직위나 부서 등과 같은 특성(속성) 값들에 따라, IPTV 서비스를 이용할 수 있도록 하는 속성기반 인증 기법을 제안하고, 제안하는 기법이 안전함을 보인다. 제안하는 기법에서 사용자는 자신의 아이디, 패스워드와 스마트카드를 이용하여 인증 메시지를 생성하는데, 이 때 자신에게 속한 다양한 속성을 이용할 수 있기 때문에 가입자는 한 번의 등록으로 속성에 따라 다양한 서비스를 제공받을 수 있다는 장점이 있다. 우리가 아는 한도 내에서는, 본 논문에서 제안하는 기법이 IPTV 환경이 조성된 어떤 조직에도 적용할 수 있는 최초의 속성인증 기법이다. An IPTV (Internet Protocol Television) technology is the new convergence technology of the telecommunication and broadcasting which provides various bidirectional TV services. To provide these services only to legal subscribers, mutual authentication between set-top box connected with TV set and the smart card owned by a subscriber is needed. In this paper, we propose an attribute-based mutual authentication scheme that only someone who is satisfied with some attributes, such as titles or departments, can access the contents provided by the IPTV service in an organization. We also show that the proposed scheme is secure. Our proposed scheme has a virtue that user can access various services, provided by an organization where he/she belongs to, according to their attributes with only one time registration. As far as we know, this is the first attribute-based authentication scheme which can be applied to any organizations in IPTV environments.