Ciphertext-policy Attribute-based Encryption Research Articles

Traitor Traceable and Revocation-oriented Attribute Based Encryption with Proxy Decryption for Cloud Devices

Cloud storage environment permits the data holders to store their private data on remote cloud computers. Ciphertext Policy Attribute Based Encryption (CP-ABE) is an advanced method that assigns fine-grained access control and provides data confidentiality for accessing the cloud data. CP-ABE methods with small attribute universe limit the practical application of CP-ABE as the public parameter length linearly increases with the number of attributes. Further, it is necessary to provide a way to perform complex calculations during decryption on outsourced devices. In addition, the state-of-art techniques found it difficult to trace the traitor as well as revoke their attribute due to the complexity of ciphertext updation. In this paper, a concrete construction of CP-ABE technique has been provided to address the above limitations. The proposed technique supports large attribute universe, proxy decryption, traitor traceability, attribute revocation and ciphertext updation. The proposed scheme is proven to be secure under random oracle model. Moreover, the experimental outcomes reveal that our scheme is more time efficient than the existing schemes in terms of computation cost.

Lattice-based multi-authority ciphertext-policy attribute-based searchable encryption with attribute revocation for cloud storage

Multi-authority attribute-based searchable encryption (MABSE) is an flexible and efficient way to securely share and search encrypted data. Compared with single-authority systems, MABSE has more complex access control policies and key management mechanism. However, most existing MABSE schemes rely on traditional number-theoretic assumptions, which maybe vulnerable to attack in the era of quantum-computers. Besides, the effective revocation of user attributes is also crucial in searchable encryption. To overcome these challenges, this paper proposes a new multi-authority ciphertext-policy attribute-based searchable encryption scheme for securely sharing encrypted data in the cloud. By calling Shamir’s threshold secret-sharing technology twice, we achieve co-management of the master key by attribute authorities and interactive generation of user private keys. Furthermore, the KUNodes algorithm is employed for attribute revocation, offering a mechanism to update private keys for non-revoked users. Compared to other schemes, MCP-ABSE-AR introduces multiple attribute authorities responsible for managing user attributes collectively. Additionally, it provides functionalities for keyword searching and attribute revocation. Finally, the proposed scheme is proved to be semantically secure under the decision learning with errors problem in the standard model.

BDAE: A Blockchain-Based and Decentralized Attribute-Based Encryption Scheme for Secure Data Sharing

Ciphertext-policy attribute-based encryption (CP-ABE) is widely employed for secure data sharing and access control. However, its dependence on a single authority introduces security and performance challenges. Despite the existence of multi-authority CP-ABE approaches, persistent issues such as single points of failure and high computation cost on the user side remain. This study proposes a novel solution named blockchain-based and decentralized attribute-based encryption (BDAE) for data sharing. BDAE enhances traditional scheme by integrating blockchain and distributed key generation technology. The scheme employs an (n, t) threshold secret sharing algorithm, coupled with the Pedersen verifiable secret sharing method, for attribute key generation. This combination ensures key credibility, facilitates joint attribute management, and addresses single bottleneck and key verification issues. Integrated into a blockchain system, the scheme utilizes smart contracts for fine-grained access control and outsourced computing. Blockchain's decentralization and access logs make data sharing tamper-resistant and auditable. Moreover, simulation comparisons demonstrate that the scheme effectively reduces decryption overhead on the user side, meeting practical application requirements.

Blockchain-assisted Revocable Hierarchical Attribute-based Encryption Electronic Medical Record Sharing Scheme

The integration of modern medical systems with the internet of things has significantly improved medical services. Nevertheless, the widespread outsourcing of electronic medical records to third-party cloud storage introduces numerous security challenges, including privacy breaches, data tampering, unauthorized access, and storage limitations. To mitigate these issues, this paper introduces a novel blockchain-assisted revocable hierarchical attribute-based encryption scheme for electronic medical record sharing. This scheme leverages a decentralized blockchain system to manage user revocation and key management tasks, thereby alleviating the need for user ciphertext re-encryption. Additionally, employing ciphertext policy attribute-based encryption enhances access control granularity and safeguards user privacy by concealing access policies. Performance analysis indicates superior performance of the proposed scheme.

Authorized Keyword Search over Outsourced Encrypted Data in Cloud Environment

This project focuses on developing a secure and efficient mechanism for authorized keyword search over encrypted data outsourced to a cloud environment. With the increasing popularity of cloud computing, data owners are often required to outsource their data to cloud servers for storage and processing. However, the security of outsourced data is a major concern due to the possibility of unauthorized access by cloud providers or malicious attackers. To address this problem, the proposed system introduced a novel expressive authorized keyword search scheme relying on the concept of ciphertext-policy attribute-based encryption. The mechanism also incorporates access control policies to ensure that only authorized users can perform the search operation. Experimental results demonstrate that the proposed mechanism can achieve high search efficiency while maintaining strong security guarantees

A blockchain-enabled decentralized access control scheme using multi-authority attribute-based encryption for edge-assisted Internet of Things

More edge users opt to use Internet of Things (IoT) devices to collect their data (e.g., health data, social data, e-governance data, etc.), which are stored in central cloud service providers (CSPs). However, this compromises data privacy and creates issues with collusion attacks. Current ciphertext-policy attribute-based encryption (CP-ABE) schemes with and without blockchain have only partially addressed these issues. Ongoing challenges remain to be resolved, including large-universe attribute management, secret key verification, and malicious attribute authorities (AAs) tracking. Therefore, we propose a decentralized access control scheme (namely BLUMA-CPABE) integrating blockchain with multi-authority ciphertext-policy attribute-based encryption (MA-CP-ABE). The scheme not only supports large-universe, policy hiding, and AAs tracking, but it also utilizes on- and off-chain mechanisms to alleviate the computation burden of the blockchain. In addition, we develop a verifiable key distribution approach in which AAs are configured as blockchain consensus nodes capable of issuing, signing, validating, and disseminating secret keys as transactions on-chain. It guarantees the keys’ security and reliability. To incentivize authorities to control newly added attributes proactively for large-universe, we enhance the Proof-of-Authority (called PoA＋) consensus mechanism in multi-authority scenarios. It allows authorities to take turns proposing and confirming new blocks based on three contribution indicators: attribute management contribution, data decryption contribution, and block validation gain. The proposed scheme is proven statically secure while resisting collusion attacks. The experimental results demonstrate the feasibility and efficiency of our scheme.

Protection of Personal Privacy Data with Enhanced Encryption & Revocation (PEER)

Abstract: In light of frequent non-public statistics breaches, safeguarding such facts is now greater crucial than ever. By combining Ciphertext-Policy Attribute-Based Encryption (CP-ABE) with blockchain, stable facts storage and sharing are facilitated. However, in excessive-dimensional characteristic domains, existing schemes stumble upon issues like compromised safety, excessive computational overhead, and steeply-priced attribute revocation. This paper proposes a novel scheme to address those demanding situations. It includes 3 components: Fast High-dimensional Attribute Domain-based totally Message Encryption (HAD-FME) for more desirable protection and reduced computational charges, an Attribute Revocation Mechanism Based on Sentry Mode (SM-ARM) using clever contracts for green revocation, and a Blockchain-based totally Model for Personal Privacy Data Protection (BC-PPDP) integrating HAD-FME with SM-ARM. Security analysis confirms the effectiveness of HAD-FME beneath the DLIN assumption and the pride of forward and backward safety for attribute revocation. Experiments show advanced computational performance for HAD-FME and decrease revocation costs for SM-ARM as compared to present methods, with smart contracts and blockchain proving effective in making sure information safety and privateness.

A secure and lightweight cloud data deduplication scheme with efficient access control and key management

Data deduplication technology is extensively employed to enhance the storage efficiency of cloud servers by eliminating redundant files. Cloud users commonly encrypt their data prior to uploading it to the server. Conventional encryption algorithms, however, lead to the encryption of duplicated data from different users into distinct ciphertexts. Consequently, these ciphertexts must be stored in the cloud since the cloud server cannot identify such duplicated data. In this paper, we introduce a hybrid cloud-based secure deduplication scheme tailored for implementation on large-scale data systems. Specifically, our approach leverages ciphertext-policy attribute-based encryption (CP-ABE), which enables us to establish access control and key management via a private cloud server. Simultaneously, we leverage a public cloud server to cater to enterprises and groups seeking secure data storage. Notably, our approach ensures mutual zero-interaction verification between both public and private cloud servers through ElGamal encryption, thereby guaranteeing data unforgeability. The security assessment illustrates that our proposed approach ensures both data privacy and integrity. We also show that the approach resists brute-force attacks on the dictionary, prevents malicious users from deceiving cloud servers to return incorrect ciphertext, and achieves secure and efficient access control and key management. Furthermore, functional and performance evaluation underscores the superiority of our method over five other classical data deduplication schemes. Under the premise of having more comprehensive security settings, the performance of the scheme still maintains a good level at every stage.

Efficient and fine-grained access control with fully-hidden policies for cloud-enabled IoT

Ciphertext-Policy Attribute-Based Encryption (CP-ABE) enables fine-grained access control on ciphertexts, making it a promising approach for managing data stored in the cloud-enabled Internet of Things. But existing schemes often suffer from privacy breaches due to explicit attachment of access policies or partial hiding of critical attribute content. Additionally, resource-constrained IoT devices, especially those adopting wireless communication, frequently encounter affordability issues regarding decryption costs. In this paper, we propose an efficient and fine-grained access control scheme with fully hidden policies (named FHAC). FHAC conceals all attributes in the policy and utilizes bloom filters to efficiently locate them. A test phase before decryption is applied to assist authorized users in finding matches between their attributes and the access policy. Dictionary attacks are thwarted by providing unauthorized users with invalid values. The heavy computational overhead of both the test phase and most of the decryption phase is outsourced to two cloud servers. Additionally, users can verify the correctness of multiple outsourced decryption results simultaneously. Security analysis and performance comparisons demonstrate FHAC's effectiveness in protecting policy privacy and achieving efficient decryption.

End to End secure data exchange in value chains with dynamic policy updates

Data exchange among value chain partners offers a competitive advantage, but it also exposes sensitive data to increasing risks of compromise. To protect this data, securing it during storage and transmission is essential, allowing only the data producer and final consumer to access or modify it. This can be particularly challenging for Industrial Internet of Things (IIoT) devices, which often have limited processing and memory capabilities. To address these challenges, End-to-End (E2E) security mechanisms are needed to prevent data breaches resulting from value chain attacks. Additionally, value chain environments are dynamic and involve multiple data generation and consumption entities, requiring the ability to update access policies as needed. This paper presents a Ciphertext-Policy Attribute-Based Encryption (CP-ABE) data exchange system that provides E2E security for value chains, considering the most relevant security and industrial requirements. The proposed solution can protect data according to access policies while also allowing those policies to be updated without breaking E2E security or overloading field devices. The experimental evaluation demonstrates the feasibility of the proposed solution for IIoT platforms.

Enhancing online health consultations through fuzzy logic-integrated attribute-based encryption system

Online health consultations are becoming more popular as a result of technological improvements. Patients routinely look for information about medical disorders online, which could jeopardize the privacy of medical records and increase the workload of healthcare professionals. Nonetheless, academics continue to be extremely concerned about issues related to the quality characteristics that relate to the current architectural models, such as energy consumption, latency, resource utilization, scalability, and packet loss. This method, however, also results in a significant strain being placed on medical experts who must sort through vast amounts of medical records to extract certain information. This paper presents a novel ciphertext policy attribute-based encryption method coupled with fuzzy logic to overcome these issues. This solution uses a hybrid structure of IPFS and blockchain to store data and enables complex bidirectional access control. Before being added to IPFS, medical records are encrypted. To ensure data integrity, related IPFS hash indexes are then added to the blockchain. Utilizing attribute-based technology, users’ data is encrypted to give them fine-grained bidirectional access control. A thorough security analysis proves the system’s resilience, especially when faced with chosen plaintext assaults inside the random oracle model. Tests for this study were conducted using 10–50 attribute sets. This paper’s technique solely makes use of a hash operation. All things considered; the study demonstrates that the proposed design is more efficient than earlier schemes. Thus, from the comparison study above, it can be concluded that the system presented in this work is more efficient. Results from simulations provide additional support for the suggested methodology by highlighting the improved computing efficiency of users as compared to baseline conventional systems. This study demonstrates how technological advancement and healthcare requirements can coexist harmoniously, paving the way for secure and effective online medical consultations that are powered by fuzzy logic.

Attribute-based key management for patient-centric and trusted data access in blockchain-enabled IoMT

Internet of Medical Things (IoMT) provides real-time data collection and access services to medical entities by connecting their devices to Internet. However, within such a complex architecture, achieving patient-centric data access still presents trustworthiness challenges of transmission security and usage reliability. Ciphertext-policy attribute-based encryption (CP-ABE) and blockchain are both the promising primitives that support patients with secure access control over their data. Nevertheless, both have their unique key management issues. In this paper, we propose a novel patient-centric and trusted data access (PCT-DA) system in blockchain-enabled IoMT. Firstly, we develop an online/offline encryption and verifiable outsourced decryption CP-ABE scheme to relieve the computation pressure on patients and users. Secondly, we design a flexible attribute-based key management mechanism to overcome the security drawbacks of encryption and attribute keys, such as single point of failure, key escrow and privacy leakage. Finally, we build a trusted integrity audit contract to guarantee the incentive fairness between patients and users in access services. Moreover, theoretical analyses prove that the PCT-DA system not only achieves confidentiality, integrity, traceability and forward/backward security, but also guarantees static security under random oracles. Simulation experiments indicate that our proposal reduces the time cost by approximately 14.10 seconds over state-of-the-art and is more practical in blockchain-enabled IoMT system.

Enhancing Data Privacy Protection in Cloud Computing Through Ciphertext-Policy Attribute-Based Encryption

The paper highlights the significance of Ciphertext-Policy ABE in enabling broadcast, secure transmission, and effective control over data access within cloud computing systems. However, the existing implementation of Ciphertext-Policy ABE presents a vulnerability, as plaintext access policies transmitted alongside ciphertexts may unintentionally expose sensitive user and data privacy information. To address this issue, a novel technique is proposed, which leverages hashing techniques to conceal access policies and strengthens protection against potential attacks through signature validation methods. Comparative analysis with existing techniques emphasizes the effectiveness of the proposed scheme in enhancing privacy and security within cloud computing environments. By addressing vulnerabilities in Ciphertext-Policy ABE and introducing innovative methods for access policy concealment and security enhancement, this study contributes to advancing secure data management practices and promoting greater confidence in cloud computing systems.

A dynamic data access control scheme for hierarchical structures in big data

Ciphertext-Policy Attribute-Based Encryption (CP-ABE) is a promising solution to address the issues of data leakage and sharing in big data. When multiple files are shared, they often have hierarchical access relationships. However, existing hierarchical data CP-ABE schemes can only support simple hierarchical access structures. The limitation arises, necessitating the generation of multiple access structures to meet hierarchical access requirements, resulting in the wastage of computational and storage resources. Therefore, in this paper, we carefully design a dynamic hierarchy access control that allows its level nodes to flexibly participate in the decryption of other nodes, enabling the realization of complex hierarchical data relationships. Building upon this, we construct the Attribute-based Dynamic Hierarchical data Access Control (ADHAC) scheme, achieving efficient and dynamic access control for multiple datasets. Subsequently, we apply our scheme in distributed computing, which enables efficient access control for individuals and institutions over multiple data sets and fine-grained computation. Security analysis indicates that our scheme can resist chosen plaintext attack (CPA). Both theoretical and experimental analyses demonstrate that our scheme has impressive advantages in terms of computational efficiency and storage costs compared to existing schemes.

Comparison of attribute-based encryption schemes in securing healthcare systems

E-health has become a top priority for healthcare organizations focused on advancing healthcare services. Thus, medical organizations have been widely adopting cloud services, resulting in the effective storage of sensitive data. To prevent privacy and security issues associated with the data, attribute-based encryption (ABE) has been a popular choice for encrypting private data. Likewise, the attribute-based access control (ABAC) technique has been widely adopted for controlling data access. Researchers have proposed electronic health record (EHR) systems using ABE techniques like ciphertext policy attribute-based encryption (CP-ABE), key policy attribute-based encryption (KP-ABE), and multi authority attribute-based encryption (MA-ABE). However, there is a lack of rigorous comparison among the various ABE schemes used in healthcare systems. To better understand the usability of ABE techniques in medical systems, we performed a comprehensive review and evaluation of the three popular ABE techniques by developing EHR systems using knowledge graphs with the same data but different encryption mechanisms. We have used the MIMIC-III dataset with varying record sizes for this study. This paper can help healthcare organizations or researchers using ABE in their systems to comprehend the correct usage scenario and the prospect of ABE deployment in the most recent technological evolution.

Cloud-based secure data storage and access control for internet of medical things using federated learning

PurposeThe purpose of this paper Computing is a recent emerging cloud model that affords clients limitless facilities, lowers the rate of customer storing and computation and progresses the ease of use, leading to a surge in the number of enterprises and individuals storing data in the cloud. Cloud services are used by various organizations (education, medical and commercial) to store their data. In the health-care industry, for example, patient medical data is outsourced to a cloud server. Instead of relying onmedical service providers, clients can access theirmedical data over the cloud.Design/methodology/approachThis section explains the proposed cloud-based health-care system for secure data storage and access control called hash-based ciphertext policy attribute-based encryption with signature (hCP-ABES). It provides access control with finer granularity, security, authentication and user confidentiality of medical data. It enhances ciphertext-policy attribute-based encryption (CP-ABE) with hashing, encryption and signature. The proposed architecture includes protection mechanisms to guarantee that health-care and medical information can be securely exchanged between health systems via the cloud. Figure 2 depicts the proposed work's architectural design.FindingsFor health-care-related applications, safe contact with common documents hosted on a cloud server is becoming increasingly important. However, there are numerous constraints to designing an effective and safe data access method, including cloud server performance, a high number of data users and various security requirements. This work adds hashing and signature to the classic CP-ABE technique. It protects the confidentiality of health-care data while also allowing for fine-grained access control. According to an analysis of security needs, this work fulfills the privacy and integrity of health information using federated learning.Originality/valueThe Internet of Things (IoT) technology and smart diagnostic implants have enhanced health-care systems by allowing for remote access and screening of patients’ health issues at any time and from any location. Medical IoT devices monitor patients’ health status and combine this information into medical records, which are then transferred to the cloud and viewed by health providers for decision-making. However, when it comes to information transfer, the security and secrecy of electronic health records become a major concern. This work offers effective data storage and access control for a smart healthcare system to protect confidentiality. CP-ABE ensures data confidentiality and also allows control on data access at a finer level. Furthermore, it allows owners to set up a dynamic patients health data sharing policy under the cloud layer. hCP-ABES proposed fine-grained data access, security, authentication and user privacy of medical data. This paper enhances CP-ABE with hashing, encryption and signature. The proposed method has been evaluated, and the results signify that the proposed hCP-ABES is feasible compared to other access control schemes using federated learning.

Multi-Authority Attribute Based Keyword Search Over Encrypted Cloud Data

To guarantee data security and usability in the cloud simultaneously, Searchable Encryption (SE) is an important technique. Using Ciphertext-Policy Attribute-Based Encryption (CP-ABE), the Ciphertext-Policy Attribute-Based Keyword Search (CP-ABKS) scheme can achieve keyword-based retrieval and fine-grained access control at a time. However, the single attribute authority in existing CP-ABKS schemes is done with costly user certificate verification and secret key distribution. In addition, this results in a single-point performance bottleneck in distributed cloud systems. Thus, in this paper, we present a secure Multi-authority CP-ABKS (MABKS) system to address such limitations and minimize the computation and storage burden on resource-limited devices in cloud systems. In addition, the MABKS system is extended to support malicious attribute authority tracing and attribute update. Our meticulous security analysis shows that the MABKS system is selectively secure in both selective-matrix and selective-attribute models. Our experimental results using real-world datasets demonstrate the efficiency and utility of the MABKS system in practical applications. Keywords: Searchable encryption, attribute-based encryption, multi-authority, access control, selective-matrix model, selective-attribute model.

Traceable Attribute-Based Encryption Scheme Using BIM Collaborative Design

BIM collaborative design involves numerous participants from various specialties who create and share vast amounts of design data at different design stages to ensure the efficient transmission of design data between these specialties. It is imperative for the BIM collaborative design platform to guarantee the security of design data and effectively trace any instances of malicious leakage or tampering. Therefore, this paper proposes a traceable ciphertext-policy attribute-based encryption scheme (TCP-ABE) that formulates a dynamic data access control mechanism based on different participants and effectively tracks malicious users in the event of risks such as tampering, theft, and unauthorized access to BIM data. In this scheme, the user’s identity information is embedded into their private key as a key component, ensuring that only users who satisfy the access policy can decrypt it. The compromised private key allows for tracing of the user’s identity. Additionally, Linear Secret Sharing Scheme (LSSS) is employed as the access structure with the user’s attribute set divided into an attribute name set and an attribute value set to protect privacy by concealing the latter within the access policy. Furthermore, the scheme integrates blockchain with cloud storage as a trusted third-party storage mechanism to ensure data integrity. Finally, the TCP-ABE scheme is comprehensively evaluated by comparing its strengths and weaknesses with other algorithms. This evaluation includes a theoretical analysis of functional and computational time overhead aspects, as well as an experimental analysis of initialization time, data encryption time, and data decryption time. The scheme exhibits excellent performance across all stages and encompasses the most comprehensive functionalities, as demonstrated by the comparative analysis and experimental results.

TRE-DSP: A traceable and revocable CP-ABE based data sharing scheme for IoV with partially hidden policy

With the popularity of the Internet of Vehicles (IoV), a large amount of data is being generated every day. How to securely share data between the IoV operator and various value-added service providers becomes one of the critical issues. Due to its flexible and efficient fine-grained access control feature, Ciphertext-Policy Attribute-Based Encryption (CP-ABE) is suitable for data sharing in IoV. However, there are many flaws in most existing CP-ABE schemes, such as attribute privacy leakage and key misuse. This paper proposes a traceable and revocable CP-ABE-based data sharing with partially hidden policy for IoV (TRE-DSP). A partially hidden access structure is adopted to hide sensitive user attribute values, and attribute categories are sent along with the ciphertext to effectively avoid privacy exposure. In addition, key tracking and malicious user revocation are introduced with broadcast encryption to prevent key misuse. Since the main computation task is outsourced to the cloud, the burden of the user side is relatively low. Analysis of security and performance demonstrates that TRE-DSP is more secure and practical for data sharing in IoV.

Design of access control framework for big data as a service platform

<span>Big data as a service (BDaaS) platform is widely used by various organizations for handling and processing the high volume of data generated from different internet of things (IoT) devices. Data generated from these IoT devices are kept in the form of big data with the help of cloud computing technology. Researchers are putting efforts into providing a more secure and protected access environment for the data available on the cloud. In order to create a safe, distributed, and decentralised environment in the cloud, blockchain technology has emerged as a useful tool. In this research paper, we have proposed a system that uses blockchain technology as a tool to regulate data access that is provided by BDaaS platforms. We are securing the access policy of data by using a modified form of ciphertext policy-attribute based encryption (CP-ABE) technique with the help of blockchain technology. For secure data access in BDaaS, algorithms have been created using a mix of CP-ABE with blockchain technology. Proposed smart contract algorithms are implemented using Eclipse 7.0 IDE and the cloud environment has been simulated on CloudSim tool. Results of key generation time, encryption time, and decryption time has been calculated and compared with access control mechanism without blockchain technology.</span>