Attribute-based Encryption System Research Articles

Enhancing online health consultations through fuzzy logic-integrated attribute-based encryption system

Online health consultations are becoming more popular as a result of technological improvements. Patients routinely look for information about medical disorders online, which could jeopardize the privacy of medical records and increase the workload of healthcare professionals. Nonetheless, academics continue to be extremely concerned about issues related to the quality characteristics that relate to the current architectural models, such as energy consumption, latency, resource utilization, scalability, and packet loss. This method, however, also results in a significant strain being placed on medical experts who must sort through vast amounts of medical records to extract certain information. This paper presents a novel ciphertext policy attribute-based encryption method coupled with fuzzy logic to overcome these issues. This solution uses a hybrid structure of IPFS and blockchain to store data and enables complex bidirectional access control. Before being added to IPFS, medical records are encrypted. To ensure data integrity, related IPFS hash indexes are then added to the blockchain. Utilizing attribute-based technology, users’ data is encrypted to give them fine-grained bidirectional access control. A thorough security analysis proves the system’s resilience, especially when faced with chosen plaintext assaults inside the random oracle model. Tests for this study were conducted using 10–50 attribute sets. This paper’s technique solely makes use of a hash operation. All things considered; the study demonstrates that the proposed design is more efficient than earlier schemes. Thus, from the comparison study above, it can be concluded that the system presented in this work is more efficient. Results from simulations provide additional support for the suggested methodology by highlighting the improved computing efficiency of users as compared to baseline conventional systems. This study demonstrates how technological advancement and healthcare requirements can coexist harmoniously, paving the way for secure and effective online medical consultations that are powered by fuzzy logic.

Blockchain-based efficient verifiable outsourced attribute-based encryption in cloud

Attribute-based encryption (ABE) has been widely applied in cloud services for access control. However, a large number of pairing operations required for decryption affect the wide use of ABE on lightweight devices. A general solution is to outsource the heavy computation to the cloud service provider (CSP), leaving the lighter computation to the data user. Nevertheless, it is impractical to assume that the CSP will provide free services. A recent ABE scheme with payable outsourced decryption ABEPOD (TIFS’20) provides a solution for the above payment issue. The CSP is generally untrusted, however, ABEPOD does not offer a verification mechanism for the data user to verify the correctness of the message. Moreover, the use of dual key pairs in ABEPOD incurs a significant computational overhead for data users during the key generation phase. We address the above issues by presenting a new blockchain-based verifiable outsourced attribute-based encryption system that enables data users to verify the correctness of plaintexts. We implement batch verification using homomorphic technical to optimize the verification process. We use the technique of dichotomous search to accurately locate problematic plaintexts. Additionally, we optimize three key-generation algorithms to transfer the computational cost from the data user to the key generation center. We offer the formal security models and the instantiation system with security analysis. As compared to ABEPOD, we further optimize the key-generation algorithms such that the computational overhead of transformation-key and verification-key generation for data users is reduced from O(Ω) to O(1) and reduced by half respectively, where Ω is the number of attributes.

Attribute-Based Storage Supporting Secure Deduplication of Encrypted Data in Cloud

Abstract: Attribute-based encryption (ABE) has been widely used in cloud computing where a data provider outsources his/her encrypted data to a cloud service provider, and can share the data with users possessing specific credentials (or attributes). However, the standard ABE system does not support secure deduplication, which is crucial for eliminating duplicate copies of identical data in order to save storage space and network bandwidth. In this paper, we present an attribute-based storage system with secure deduplication in a hybrid cloud setting, where a private cloud is responsible for duplicate detection and a public cloud manages the storage. Compared with the prior data deduplication systems, our system has two advantages. First, it can be used to confidentially share data with users by specifying access policies rather than sharing decryption keys. Second, it achieves the standard notion of semantic security for data confidentiality while existing systems only achieve it by defining a weaker security notion. In addition, we put forth a methodology to modify a ciphertext over one access policy into ciphertexts of the same plaintext but under other access policies without revealing the underlying plaintext.

Heuristic Optimizations of Boolean Circuits with Application in Attribute-Based Encryption

We propose a method of optimizing monotone Boolean circuits by re-writing them in a simpler, equivalent form. We use in total six heuristics: Hill Climbing, Simulated Annealing, and variations of them, which operate on the representation of the circuit as a logical formula. Our main motivation is to improve performance in Attribute-Based Encryption (ABE) schemes for Boolean circuits. Therefore, we show how our heuristics improve ABE systems for Boolean circuits. Also, we run tests to evaluate the performance of our heuristics, both as a standalone optimization for Boolean circuits and also inside ABE systems.

Generic Construction of Black-Box Traceable Attribute-Based Encryption

Attribute-based encryption (ABE) has been widely used to provide fine-grained access control to encrypted data in cloud computing. However, in practice, since the attributes are shared by multiple users in the ABE system, it is difficult to identify malicious users which intentionally but implicitly reveal their own ABE secret keys for some purpose. In recent years, a substantial amount of work focused on designing efficient tracing mechanisms to identify such misbehaving users on ABE. In this paper, we propose an efficient generic construction of black-box traceable ABE to identify the traitors. Our construction supports (public) adaptive black-box traceability and has short keys and short ciphertexts that are independent of the number of users. Technically, our construction relies on a generic transformation from any attribute-based inner-product functional encryption (ABIPFE) scheme to black-box traceable ABE system. Furthermore, to instantiate our generic construction from standard lattices, we propose the first lattice-based ABIPFE scheme, which is proven weakly selective secure in the standard model.

Lattice‐based revocable attribute‐based encryption with decryption key exposure resistance

Attribute-based encryption (ABE) is a promising management method that enables fine-grained access control in large-scale systems. Revocable ABE (RABE) can support a key revocation mechanism in an ABE system. With the advent of the Internet of Things, users may need to delegate their decryption capacity to other devices, which requires that RABE meet a necessary feature called decryption key exposure resistance (DKER). Although many constructions about RABE from bilinear maps have been proposed, the situation of lattice-based constructions with DKER is less satisfactory. In order to narrow this gap, this paper propose the first lattice-based RABE with DKER. First, a formal description of RABE with DKER and the corresponding security models is proposed. Subsequently, a lattice-based RABE scheme without DKER is constructed and it is proved to be selective indistinguishability under chosen-plaintext attack (IND-CPA) security based on Learning with Errors (LWE). To achieve DKER, this paper construct a RABE scheme by using the RABE scheme without DKER and a key extension mechanism as its building blocks. Finally, this paper show that this scheme is selective IND-CPA security, with the DKER based on LWE.

Privacy-Preserving Distributed Data Access Control for CloudIoT

The Edge-Fog-Cloud interplay in the Internet-of-Things (IoT) leads to many exciting data-sharing applications that use access control systems as primary requirements. To ensure a fine-grained data access control for such data-sharings on untrusted storage (e.g., Cloud), Attribute-Based Encryption (ABE) is a promising tool. To address privacy concerns in such ABE-based access control systems, we propose a new Privacy-preserving Distributed data Access control (PDAC) in CloudIoT. Our PDAC improves the previous privacy-preserving distributed ABE systems in three aspects. The first introduces a new user's anonymity approach against the colluding untrusted (honest-but-curious) authorities. The second presents a novel policy-hiding mechanism that efficiently preserves the privacy of policy-forming attributes (metadata) against colluding parties. The third introduces an independent-authorities system for our privacy-preserving improvements, where an authority can join and leave the system without reinitializing other authorities. Moreover, our PDAC offloads the user's computations over the Cloud servers for efficiency enhancement. We prove the security of our PDAC through formal analysis. Then, we present empirical results on different classes of mobile devices, including a laptop and a smartphone.

A Novel User Collusion‐Resistant Decentralized Multi‐Authority Attribute‐Based Encryption Scheme Using the Deposit on a Blockchain

Recently, the concept of a decentralized data marketplace is getting much attention to exchange user data. Multi‐authority attribute‐based encryption (ABE), which can provide flexibility and user‐centric access control, is previously widely used in decentralized data sharing applications and also becoming a foundation to build decentralized data trading applications. It is known that users in a multi‐authority ABE system can collude by sharing their secret information for malicious purposes. To address this issue, the collusion‐resistant multi‐authority ABE model was introduced in which a unique global identifier (GID) is issued by the central authority (CA) to each user. Unfortunately, such approach cannot be used directly to build a decentralized data marketplace as (a) such intervention of the CA is directly against the main motivation of the decentralized trading platform and, mostly importantly, (b) the CA can exploit its full knowledge on users’ GID to launch various attacks against users. Motivated by these observations, this paper introduces a novel user collusion‐resistant decentralized multi‐authority ABE scheme for privacy preserving data trading systems. In the existing multi‐authority ABE systems, users utilize his/her GID that is solely assigned by the CA to generate his/her secret keys throughout the collaboration with authorities and a user can compute multi‐authority keys by combining the secret keys (stem from the same GID) in various ways. In the proposed system, the CA only has a partial knowledge of users’ GIDs, and thus, users’ privacy can be protected. On the other hand, we set the user’s own partial GID as a secret which can be used to withdraw his/her deposit to discourage any possible collusion among users.

A fully distributed hierarchical attribute-based encryption scheme

With the development of cloud computing, many enterprises have been interested in outsourcing their data to cloud servers to decrease IT costs and rise capabilities of provided services. To afford confidentiality and fine-grained data access control, attribute-based encryption (ABE) was proposed and used in several cloud storage systems. However, scalability and flexibility in key delegation and user revocation mechanisms are primary issues in ABE systems. In this paper, we introduce the concept of a fully distributed revocable ciphertext-policy hierarchical ABE (FDR-CP-HABE) and design the first FDR-CP-HABE scheme. Our scheme offers a high level of flexibility and scalability in the key delegation and user revocation phases. Moreover, our scheme is efficient and provides lightweight computation in the decryption phase. Indeed, by exploiting a computation outsourcing technique, most of the operations are executed by the powerful cloud server, and very few computations are left to the users. Also, the storage cost on the user side is significantly decreased as compared to similar schemes. Furthermore, using the hardness assumption of DBDH problem, we prove that our scheme is adaptively secure in the standard model. Our security analyses and implementation results indicate that our scheme is efficient, secure, and scalable.

Server-Aided Revocable Attribute-Based Encryption from Lattices

Attribute-based encryption (ABE) can support a fine-grained access control to encrypted data. When the user’s secret-key is compromised, the ABE system has to revoke its decryption privileges to prevent the leakage of encrypted data. Although there are many constructions about revocable ABE from bilinear maps, the situation with lattice-based constructions is less satisfactory, and a few efforts were made to close this gap. In this work, we propose the first lattice-based server-aided revocable attribute-based encryption (SR-ABE) scheme and thus the first such construction that is believed to be quantum resistant. In the standard model, our scheme is proved to be secure based on the hardness of the Learning With Errors (LWE) problem.

Non-Repudiation Storage and Access Control Scheme of Insurance Data Based on Blockchain in IPFS

The insurance business plays a quite significant role in people's lives, but in the process of claim settlement, there are still various frauds such that the insurance companies' refusal to compensate or customers' malicious fraud to obtain compensation. Therefore, it is very important to ensure fair and just claims. In this paper, by combining the blockchain technology and the ciphertext-policy attribute-based encryption system, we build a scheme for secure storage and update for insurance records under the InterPlanetary File System (IPFS) storage environment in the insurance system. In this scheme, we use the fog node to outsource encryption of insurance records to improve the efficiency of the staff; In addition, we store encrypted insurance records on IPFS to ensure the security of the storage platform and avoid the single point failure of the centralized mechanism. In addition, we use the immutability of the blockchain to achieve the non-repudiation of both insurance companies and the client. The security proof shows that the proposed scheme can achieve selective security against selected keyword attacks. Our scheme is efficient and feasible under performance analysis and real data set experiments.

Blockchain-Based Secure Storage and Access Scheme For Electronic Medical Records in IPFS

Electronic medical records can help people prevent diseases, improve cure rates, provide a significant basis for medical institutions and pharmaceutical companies, and provide legal evidence for medical negligence and medical disputes. However, the integrity and security problems of electronic medical data still intractable. In this paper, based on the ciphertext policy attribute-based encryption system and IPFS storage environment, combined with blockchain technology, we constructed an attribute-based encryption scheme for secure storage and efficient sharing of electronic medical records in IPFS storage environment. Our scheme is based on ciphertext policy attribute encryption, which effectively controls the access of electronic medical data without affecting efficient retrieval. Meanwhile, we store the encrypted electronic medical data in the decentralized InterPlanetary File System (IPFS), which not only ensures the security of the storage platform but also solves the problem of the single point of failure. Besides, we leverage the non-tamperable and traceable nature of blockchain technology to achieve secure storage and search for medical data. The security proof shows that our scheme achieves selective security for the choose keyword attacks. Performance analysis and real data set simulation experiments shows that our scheme is efficient and feasible.

Revisiting BGG + 14 ABE with weakness analysis

Attribute-based encryption (ABE) supports fine-grained sharing of encrypted data so that it can be used in a plenty of application scenarios, and many constructions of ABE scheme have been presented. The first arithmetic circuit ABE system was proposed by Boneh, Gentry, Gorbunov et al. (BGG+14) in Eurocrypt 2014. It is one of the major candidates for ABE, whose security is based on the learning with errors assumption. In this work, the authors analyse three different versions of BGG+14 ABE with weak attributes, weak variants, and weak modulus. First, they discuss weak attributes of BGG+14 ABE. A weak attribute is generated with corresponding decryption key, such that whenever a ciphertext is labelled with this weak attribute, 1 bit of the plaintext can be revealed. Second, they discuss the security of three variants of BGG+14 ABE with simplified pre-sampled matrices, and show that all of them are not secure under collusion attack. Third, they consider the composite modulus rather than prime modulus in BGG+14 ABE scheme. They show that, if a small factor of the modulus is known, the set of users able to decrypt is clearly expanded. These analyses give different perspectives on the security of BGG+14 ABE under different conditions.

A lightweight and scalable attribute-based encryption system for smart cities

In the near future, a technological revolution will involve our cities, where a variety of smart services based on the Internet of Things will be developed to facilitate the needs of the citizens. Sensing devices are already being deployed in urban environments, and they will generate huge amounts of data. Such data is typically outsourced to some cloud service in order to lower capital and operating expenses and guarantee high availability. However, cloud services may suffer from data breaches due to software and hardware vulnerabilities, or they may have incentives to release stored data to unauthorized entities. In this work we present ABE-Cities, an encryption system for urban sensing which solves the above problems while ensuring fine-grained access control on data by means of Attribute-Based Encryption (ABE). ABE-Cities senses data from the city and stores it on the cloud in an encrypted form. Then, it provides users with keys able to decrypt only data sensed from authorized paths or zones of the city. In ABE-Cities, sensors perform only lightweight symmetric-key encryption, thus we can employ constrained sensor devices such as battery powered motes. ABE-Cities allows us to plan an expiration date for each key, as well as to revoke a given key in an unplanned fashion. We prove that ABE-Cities scales well with the number of users and the number of streets by simulating it with 30 000 users on the Beijing street network, which consists of more than 30 000 streets. In addition to the “vanilla” ABE-Cities scheme, we propose an “advanced” one that leverages the presence of IoT gateways to reduce the computational load otherwise weighing on a single Trusted Third Party. We validate this by testing the advanced scheme on the simulated Houston and Beijing street networks.

Efficient Attribute-Based Encryption with Privacy-Preserving Key Generation and Its Application in Industrial Cloud

Due to the rapid development of new technologies such as cloud computing, Internet of Things (IoT), and mobile Internet, the data volumes are exploding. Particularly, in the industrial field, a large amount of data is generated every day. How to manage and use industrial Big Data primely is a thorny challenge for every industrial enterprise manager. As an emerging form of service, cloud computing technology provides a good solution. It receives more and more attention and support due to its flexible configuration, on-demand purchase, and easy maintenance. Using cloud technology, enterprises get rid of the heavy data management work and concentrate on their main business. Although cloud technology has many advantages, there are still many problems in terms of security and privacy. To protect the confidentiality of the data, the mainstream solution is encrypting data before uploading. In order to achieve flexible access control to encrypted data, attribute-based encryption (ABE) is an outstanding candidate. At present, more and more applications are using ABE to ensure data security. However, the privacy protection issues during the key generation phase are not considered in the current ABE systems. That is to say, the key generation center (KGC) knows both of attributes and corresponding keys of each user. This problem is especially serious in the industrial big data scenario, because it will cause great damage to the business secrets of industrial enterprises. In this paper, we design a new ABE scheme that protects user’s privacy during key issuing. In our new scheme, we separate the functionality of attribute auditing and key generating to ensure that the KGC cannot know user’s attributes and that the attribute auditing center (AAC) cannot obtain the user’s secret key. This is ideal for many privacy-sensitive scenarios, such as industrial big data scenario.

A REVIEW PAPER ON ATTRIBUTE-BASED ENCRYPTION FOR MESSAGE PRIVACY IN CLOUD

The notion of attribute-based encryption (ABE)was proposed as an economical alternative to public-keyinfrastructures. It is the set of descriptive attributes, used as anidentity to generate a secret key, as well as serving as theaccess structure that performs access control. ABE is also auseful building block in various cryptographic primitives suchas searchable encryption. . It successfully integratesEncryption and Access Control and is ideal for sharing secretsamong groups, especially in a Cloud environment. Mostdeveloped ABE schemes support key-policy or ciphertextpolicyaccess control in addition to other features such asdecentralized authority, efficient revocation and keydelegation. This paper surveys mainstream papers, analyzesmain features for desired ABE systems, and classifies theminto different categories. With this high-level guidance, futureresearchers can treat these features as individual modules andselect related ones to build their ABE systems on demand.For ABE, it is not realistic to trust a single authority tomonitor all attributes and hence distributing control over manyattribute-authorities is desirable.A multi-authority ABE scheme can be realized with a trustedcentral authority (CA) which issues part of the decryption keyaccording to a user's global identifier (GID). However, this CAmay have the power to decrypt every cipher text, and the useof a consistent GID allowed the attribute-authorities tocollectively build user's attributes. Decentralized ABE schemecan eliminate the burden of heavy communication andcollaborative computation. It is observed that privacypreservingdecentralized key-policy ABE scheme has claimedto achieve better privacy for users and is provably secure inthe standard model

Dual Authentication-Based Encryption with a Delegation System to Protect Medical Data in Cloud Computing

The increasing use of cloud computing, especially in commercial, government and healthcare institutions, started with the use of computerized clouds. Clouds store important data, which reduces the cost of management and ensures easy access. To protect this data, cryptographic methods are used to ensure confidentiality of the data, as well as to secure access to user data and increase trust in cloud technology. In our paper, we suggest a new scheme to support an attribute-based encryption system (ABE) that involves multiple parties such as data owners, data users, cloud servers and authority. A verified and authenticated decryption process for the cloud environment is the imperative feature of our proposed architecture. The data owner encrypts their data and sends it to the cloud. The cloud server performs partial decryption and the final decrypted data are shared for users as per their privileges. Thus, the data owner reduces complexity of productivity by delegating the decryption process to the cloud server. Analysis of the experimental results confirms that data access in the electronic cloud atmosphere is safer due to a controlled multiple-users-rights scheme. Our performance evaluation results show that the proposed model condensed the communication overhead and made Digital Imaging and Communications in Medicine (DICOM) more secure.

Security-level switchable attribute-based encryption under the strictly weaker assumption family

Attribute-Based Encryption (ABE), a special type of public key encryption, efficiently shares sensitive data with fine-grained access control. ABE can be classified into two types: Ciphertext-Policy ABE (CP-ABE) and Key-Policy ABE (KP-ABE). However, the securities of most presented ABE systems were reduced to the q-type DBDH (Dicisional Diffie-Hellman Assumption) assumptions, which are stronger than the DBDH assumption. So, the abovementioned ABE systems become insecure if DBDH is proved to be insecure. We propose a new ABE framework, called security-level switchable ABE (SLS-ABE). In SLS-ABE framework, a series of ABE systems can be generated and their securities are reduced to a k-BDH assumption family proposed by Benson et al. The k-BDH assumption family has the following properties: 1) any assumption in the k-BDH assumption family is associated with a parameter k, and the assumption becomes strictly weaker as the parameter k increases. 2) the 1-BDH assumption is proved to be equivalent to the DBDH assumption. So, all the k-BDH assumptions where k > 1 are weaker than DBDH assumption. We apply the technique of Benson et al. to construct ABE on k-BDH assumption, furthermore, we design a new framework to support the flexible switchable security-level for users. Concretely, the master public key, the master secret key and core keys issued by the system are constant. A User can generate different security-level public key/secret key pairs if it holds the core key. We propose a public key forgery attack model (PKFA) to capture the behaviors of adversary for generating a forged public key. We formally prove the selective-CPA security and PKFA security of our ABE systems. We compare the performances of our systems with Waters’ ABE systems.

Large universe multi-authority attribute-based PHR sharing with user revocation

In the patient-centric model of health information exchange, personal health record (PHR) is often outsourced to third parties, such as cloud service providers (CSPs). Attribute-based encryption (ABE) can be used to realise flexible access control on PHRs in cloud environment. Nevertheless, the issues of scalability in key management, user revocation and flexible attributes remain to be addressed. In this paper, we propose a large-universe multi-authority ciphertext-policy ABE system with user revocation. The proposed scheme achieves scalable and fine-grained access control on PHRs. In our scheme, there are a central authority (CA) and multiple attribute authorities (AAs). When a user is revoked, the system public key and the other users' secret keys need not be updated. Furthermore, because our scheme supports large attribute universe, the number of attributes is not polynomially bounded and the public parameter size does not linearly grow with the number of attributes. Our system is constructed on prime order groups and proven selectively secure in the standard model.

A Survey on Security Models for Data Privacy in Big Data Analytics

As emerging data world like Google and Wikipedia, volume of the data growing gradually for centralization and provide high availability. The storing and retrieval in large volume of data is specialized with the big data techniques. In addition to the data management, big data techniques should need more concentration on the security aspects and data privacy when the data deals with authorized and confidential. It is to provide secure encryption and access control in centralized data through Attribute Based Encryption (ABE) Algorithm. A set of most descriptive attributes is used as categorize to produce secret private key and performs access control. Several works proposed in existing based on the different access structures of ABE algorithms. Thus the algorithms and the proposed applications are literally surveyed and detailed explained and also discuss the functionalities and performance aspects comparison for desired ABE systems.