Ciphertext-policy Attribute-based Encryption System Research Articles

Disabling Tracing in Black-Box-Traceable CP-ABE System: Alert Decryption Black Box

In application scenarios such as cloud storage, a symmetric algorithm can be used to encrypt massive data. However, using the symmetric operation and keys in encryption and decryption, it is very difficult to realize an efficient access control system. The asymmetric encryption algorithm ciphertext-policy attribute-based encryption (CP-ABE), as a versatile one-to-many encryption algorithm, is considered an ideal access control tool to solve the user’s distrust of the service provider of cloud storage. However, in a traditional CP-ABE system, the malicious users may deliberately leak their attribute keys to others or build a decryption black box (DB) to provide illegal decryption services for benefits, while no one can determine their identities. To deal with the problems, especially the problem of tracing the DB builder, CP-ABE schemes with black-box traceability have been proposed in the past few years. But in this paper, we point out that for now, the tracing algorithms in all existing schemes actually work on an impractical assumption. That is, whenever a DB receives a decryption request, it always performs the decryption algorithm honestlycorrectly. We argue that if a DB finds the decryption request comes from the tracing algorithm, it may intentionally output incorrect decryption results to counter the tracing. Thus, we present the structural defect of the tracing algorithm applied to all known traceable CP-ABE schemes. We describe the construction of an alert decryption black box (ADB) that is capable of distinguishing a tracing ciphertext from a normal one. We also show how an ADB frustrates the tracing algorithm, and furthermore, malicious users can even apply an ADB to frame innocent users.

An enhanced traceable CP-ABE scheme against various types of privilege leakage in cloud storage

Cloud storage can save not only local storage costs but also provide data-sharing services. Ciphertext-policy attribute-based encryption (CP-ABE) can work as the underlying engine for cloud storage since it supports one-to-many encryption and fine-grained access control. To prevent users from disclosing their access permissions, we can apply traceable CP-ABE systems. There are two kinds of traceability: white-box traceability and black-box traceability. White-box traceability is simple and efficient, but it cannot support black-box tracing; black-box traceability supports white-box tracing, but its operations are usually cumbersome. So, these two kinds of traceability are unable (or unsuitable) to solve each other’s problems. However, in cloud storage applications, users may leak their privileges in various ways, which means the underlying CP-ABE system should have multiple traceability. Unfortunately, the current traceable CP-ABE schemes only support single traceability. Therefore, we propose a novel CP-ABE scheme with enhanced traceability. It intertwines white-box and black-box traceability together securely and efficiently, which makes it more targeted and simpler to solve distinct tracing problems than previous schemes. Moreover, the proposed scheme has scalability, flexible policy expressiveness, and certain advantages in computing performance.

Multiauthority CP-ABE-based Access Control Model for IoT-enabled Healthcare Infrastructure

The exponential growth of the Internet of Things (IoT) technologies requires high data security. Here, data security is very critical as all IoT devices transfer data over the Internet. The fine-grained access control provided by the ciphertext policy attribute-based encryption (CP-ABE) technique can be considered as a potential solution to this issue. However, most of the CP-ABE schemes use bilinear pairing operations for its internal working, which is expensive for any resource constraint device. An elliptic curve cryptography (ECC) based CP-ABE scheme can be well suited for resource constraint IoT framework because ECC takes less computational time. This article proposes a novel CP-ABE technique based on ECC to achieve fine-grained access control over data or resources. The proposed technique includes multiple attribute authorities to manage attributes and key generation, which can reduce the work overhead of having a single authority in traditional CP-ABE systems. In addition, the proposed scheme outsources the decryption process to a user assistant entity to reduce the decryption overhead of the end-users. To prove the efficiency of the proposed scheme, both formal security analysis and performance comparisons are presented in this article. The result and findings prove the effectiveness of the proposed scheme over some well-known schemes.

Reliable Policy Updating Under Efficient Policy Hidden Fine-Grained Access Control Framework for Cloud Data Sharing

Ciphertext-Policy Attribute-Based Encryption (CP-ABE) is one of the potent encryption paradigms in protecting data confidentiality in the cloud data sharing scenario. However, the access policy of the traditional CP-ABE is in plaintext form that reveals significant sensitive information of data owners and data visitors. To mitigate this problem, two approaches have been proposed in the literature. One is partially hidden, where the attributes in the access policy are divided into two parts: the plaintext attribute names and the hidden attribute values. The other approach fully hides the attributes in the access policy which, unfortunately, hinders efficient and correct decryption as well as dynamic policy-updating. In this article, we design a security-enhanced Attribute Cuckoo Filter (se-ACF) to hide the access policy and propose a new CP-ABE system, called Privacy-Preserving Policy Updating ABE (3PU-ABE), which effectively integrates policy hiding and policy updating. We conduct rigorous security analysis and performance evaluation of 3PU-ABE. The results indicate that 3PU-ABE completely hides the access policy without affecting the decryption, and entails better policy-updating efficiency than similar works.

An Efficient Blockchain Based Data Access with Modified Hierarchical Attribute Access Structure with CP-ABE Using ECC Scheme for Patient Health Record

Secure patient health record (PHR) information exchange via cloud computing is a considerable security risk to user privacy. The fundamental reason of this issue is cloud computing’s reliance on trustworthy third parties to share data across it. To exchange data securely, many conventional cryptographic algorithms employ various keying approaches. However, relying on a trusted third party compromises the privacy of consumers’ data. To offer secure communication without the involvement of a third party, a distributed blockchain based (DBC) ciphertext–policy attribute-based encryption (CP-ABE) approach is employed in this study. Because of bilinear paring and simple scalar multiplication factors, the proposed CP-ABE system is entirely dependent on elliptic curve cryptography to reduce complexity. Furthermore, the data requester provides dynamic attributes, and a user-centric access policy is created, allowing multiple authorities to manage the attributes and provide data access. Data confidentiality, data authentication, user authentication, and tamper-proof data are all guaranteed by the suggested method. The DBC-CP-ABE method is used to provide user-centric access policies and effective key management.

Accountable Attribute-based Encryption with Public Auditing and User Revocation in the Personal Health Record System

In the system of ciphertext policy attribute-based encryption (CP-ABE), only when the attributes of data user meets the access structure established by the encrypter, the data user can perform decryption operation. So CP-ABE has been widely used in personal health record system (PHR). However, the problem of key abuse consists in the CP-ABE system. The semi-trusted authority or the authorized user to access the system may disclose the key because of personal interests, resulting in illegal users accessing the system. Consequently, aiming at two kinds of existing key abuse problems: (1) semi-trusted authority redistributes keys to unauthorized users, (2) authorized users disclose keys to unauthorized users, we put forward a CP-ABE scheme that has authority accountability, user traceability and supports arbitrary monotonous access structures. Specifically, we employ an auditor to make a fair ruling on the malicious behavior of users. Besides, to solve the problem of user leaving from the system, we use an indirect revocation method based on trust tree to implement user revocation. Compared with other existing schemes, we found that our solution achieved user revocation at an acceptable time cost. In addition, our scheme is proved to be fully secure in the standard model.

Efficient Data Access Control for Cloud Computing With Large Universe and Traceable Attribute-Based Encryption

Ciphertext-policy attribute-based encryption (CP-ABE) schemes provide fine-grained access control for the data stored in cloud computers. However, commercial CP-ABE applications need a new encryption scheme for providing two properties such as: supporting large universe attribute and traceability. First, a large universe attribute allows the attribute authority to use any number of attributes in the system. i.e., the attribute universe is dynamic, and it is not fixed at the setup phase. Second, traceable CP-ABE systems trace the dishonest users who intentionally leak the private key for their profit. In this article, a large universe CP-ABE system with white box traceability has been proposed. The attribute universe of the proposed technique is exponentially larger, and it is polynomially unbound. Further, this technique will trace the identity of users who involve in malicious activities. In addition, the proposed scheme can express any kind of monotonic tree access policies into linear secret sharing structure (LSSS). Compared with the existing schemes that are presented to achieve the same property, proposed scheme has achieved better experimental results and so it is applicable for commercial applications.

Blockchain-Based Secure Storage and Access Scheme For Electronic Medical Records in IPFS

Electronic medical records can help people prevent diseases, improve cure rates, provide a significant basis for medical institutions and pharmaceutical companies, and provide legal evidence for medical negligence and medical disputes. However, the integrity and security problems of electronic medical data still intractable. In this paper, based on the ciphertext policy attribute-based encryption system and IPFS storage environment, combined with blockchain technology, we constructed an attribute-based encryption scheme for secure storage and efficient sharing of electronic medical records in IPFS storage environment. Our scheme is based on ciphertext policy attribute encryption, which effectively controls the access of electronic medical data without affecting efficient retrieval. Meanwhile, we store the encrypted electronic medical data in the decentralized InterPlanetary File System (IPFS), which not only ensures the security of the storage platform but also solves the problem of the single point of failure. Besides, we leverage the non-tamperable and traceable nature of blockchain technology to achieve secure storage and search for medical data. The security proof shows that our scheme achieves selective security for the choose keyword attacks. Performance analysis and real data set simulation experiments shows that our scheme is efficient and feasible.

Black‐Box and Public Traceability in Multi‐authority Attribute Based Encryption

Ciphertext-policy Attribute-based encryption (CP-ABE) is a promising tool for implementing finegrained cryptographic access control. While the uniqueness of generating private keys brings extra security issues. The key escrow is inherent in CP-ABE systems because the trusted authority has the power to decrypt every ciphertext. The private keys are only associated with the attributes nor the user's identity. Some malicious users might be tempted to leak their decryption privileges for financial gain without the risk of being caught as the decryption privilege could be shared by multiple users who own the same set of attributes. We propose a new multiauthority CP-ABE with blackbox and public traceability, where the private keys are assigned by the cooperation between one central authority and multi-authorities. The performance and security analyses indicate that the proposed scheme is highly efficient and provably secure under the security model.

Non-Repudiation Storage and Access Control Scheme of Insurance Data Based on Blockchain in IPFS

The insurance business plays a quite significant role in people's lives, but in the process of claim settlement, there are still various frauds such that the insurance companies' refusal to compensate or customers' malicious fraud to obtain compensation. Therefore, it is very important to ensure fair and just claims. In this paper, by combining the blockchain technology and the ciphertext-policy attribute-based encryption system, we build a scheme for secure storage and update for insurance records under the InterPlanetary File System (IPFS) storage environment in the insurance system. In this scheme, we use the fog node to outsource encryption of insurance records to improve the efficiency of the staff; In addition, we store encrypted insurance records on IPFS to ensure the security of the storage platform and avoid the single point failure of the centralized mechanism. In addition, we use the immutability of the blockchain to achieve the non-repudiation of both insurance companies and the client. The security proof shows that the proposed scheme can achieve selective security against selected keyword attacks. Our scheme is efficient and feasible under performance analysis and real data set experiments.

A Fast CP-ABE System for Cyber-Physical Security and Privacy in Mobile Healthcare Network

A healthcare network as a new context-aware cyber-physical system (CPS) includes embedded sensors, Internet of Things technology, and cloud computing. With the intellectualization of mobile terminal devices, mobile healthcare networks are automatically generated and can provide convenient healthcare services and real-time communication. However, two problems in the CPS need to resolved. A solution to the first problem is to mitigate the computational and storage cost of a mobile terminal. A solution to the second problem is to provide the cyber-physical privacy and security for healthcare data. Ciphertext-policy attribute-based encryption (CP-ABE) can provide data privacy and secure sharing in an open environment. In this article, a fast CP-ABE scheme is provided in order to satisfy the use of mobile terminal devices with low computational and storage power. In the proposed scheme, the work of a system can deliver expensive computational tasks to semitrusted third parties, ensuring a constant number of simple local computations. The scheme can also verify the correctness of the decryption result by using a Boneh–Lynn–Shacham short signature scheme. The CP-ABE scheme not only ensures the cyber-physical security of healthcare data, but also reduces the local load from the efficiency analysis and experimental results.

Designing a trivial information relaying scheme for assuring safety in mobile cloud computing environment

Due to increased attraction in cloud computing, mobile devices could store or acquire private and confidential information from everywhere at any point in time. In parallel, the information safety issues over mobile computing become rigorous and retard increased advancements in the mobile cloud. Crucial analysis were performed to enhance the safety in cloud computing. Most of them are not appropriate for mobile cloud computing due to limited energy resource, thus mobile devices are unable to perform assessments and complex tasks. The crucial requirement of mobile cloud application is to provide solution with minimum computational overhead. Thus the aim of the research is to design a trivial information relaying scheme (TIRS) for mobile cloud computing. The proposed scheme implements Ciphertext Policy Attribute-based Encryption (CP-ABE) to alter the general framework of access governance hierarchy to make it appropriate for mobile cloud environment. The TIRS displaces immense segments of the assessment concentrated access governance hierarchy modifications in CP-ABE from smart devices to the peripheral proxy servers. Furthermore, TIRS initiates element portrayal field to plan indolent cancellation which is a thriving dispute for CP-ABE system. The experimental analysis depicts that TIRS successfully minimize the overheads during user relaying information over the mobile cloud environment.

Large universe multi-authority attribute-based PHR sharing with user revocation

In the patient-centric model of health information exchange, personal health record (PHR) is often outsourced to third parties, such as cloud service providers (CSPs). Attribute-based encryption (ABE) can be used to realise flexible access control on PHRs in cloud environment. Nevertheless, the issues of scalability in key management, user revocation and flexible attributes remain to be addressed. In this paper, we propose a large-universe multi-authority ciphertext-policy ABE system with user revocation. The proposed scheme achieves scalable and fine-grained access control on PHRs. In our scheme, there are a central authority (CA) and multiple attribute authorities (AAs). When a user is revoked, the system public key and the other users' secret keys need not be updated. Furthermore, because our scheme supports large attribute universe, the number of attributes is not polynomially bounded and the public parameter size does not linearly grow with the number of attributes. Our system is constructed on prime order groups and proven selectively secure in the standard model.

Traceable ciphertext-policy attribute-based encryption scheme with attribute level user revocation for cloud storage.

In a ciphertext-policy attribute-based encryption (CP-ABE) scheme, a user may have multiple attributes, and each attribute may be shared simultaneously by many users. The decryption key of an attribute can thus be shared by many users who all possess the attribute. For monetary gain, a malicious authorized user may reveal his/her decryption key to a third party, and it is difficult to trace the owner of primitive secret key from an exposed key. At the same time, this situation may also limit commercial applications of CP-ABE systems. To solve these problems and enable fine-grained access control for the encrypted data, we propose a traceable CP-ABE scheme with attribute-level user revocation for cloud storage (TUR-CPABE). Our scheme enjoys four advantages. First, it has the ability to trace malicious users who have leaked key information from the system. Second, it supports attribute-level user revocation for malicious users and allows ABE fine-grained access control. Third, it allows secret key updates and ciphertext updates to resist collusion attacks between users. Fourth, outsourcing encryption, decryption and attribute revocation are used to reduce the computational burden on data owners, data users and the trust authority, respectively. In addition, our scheme has been proven to be secure against chosen plaintext attacks under a selective access policy based on decisional q – BDHE assumption in the standard model.

White-Box Traceable CP-ABE for Cloud Storage Service: How to Catch People Leaking Their Access Credentials Effectively

Ciphertext-policy attribute-based encryption (CP-ABE) has been proposed to enable fine-grained access control on encrypted data for cloud storage service. In the context of CP-ABE, since the decryption privilege is shared by multiple users who have the same attributes, it is difficult to identify the original key owner when given an exposed key. This leaves the malicious cloud users a chance to leak their access credentials to outsourced data in clouds for profits without the risk of being caught, which severely damages data security. To address this problem, we add the property of traceability to the conventional CP-ABE. To catch people leaking their access credentials to outsourced data in clouds for profits effectively, in this paper, we first propose two kinds of non-interactive commitments for traitor tracing. Then we present a fully secure traceable CP-ABE system for cloud storage service from the proposed commitment. Our proposed commitments for traitor tracing may be of independent interest, as they are both pairing-friendly and homomorphic. We also provide extensive experimental results to confirm the feasibility and efficiency of the proposed solution.

Compulsory traceable ciphertext-policy attribute-based encryption against privilege abuse in fog computing

Due to the structure of fog systems, ciphertext-policy attribute-based encryption (CP-ABE) is regarded as a promising technique to address certain security problems present in the fog. Unfortunately, in most traditional CP-ABE systems, a user can deliberately leak his attribute keys to others or use his private key to build a decryption device and provide a decryption service with little risk of being caught (untraceable). We refer to this behavior as privilege abuse. The privilege abuse problem will seriously hinder the adoption of CP-ABE. To address the problem, we propose a novel black-box traceable CP-ABE scheme that is much simpler than the existing white-box traceable schemes. A malicioususer who builds a decryption black-box can be tracked and exposed by our scheme. Due to its scalability and relatively high efficiency, the scheme could be practical for fog systems. Furthermore, we point out that, if the adversary can distinguish the tracing ciphertext from the normal ciphertext, he can frustrate tracking by outputting incorrect decryption results. Thus, the traceability must be compulsory, so as to ensure that the adversary cannot distinguish between the tracing ciphertext and the normal ciphertext. Therefore, we present a formal definition of compulsory traceability with a new security game, and our scheme is proved to be secure and compulsory traceable under the generic group model.

A Ciphertext-Policy Attribute-Based Encryption Based on an Ordered Binary Decision Diagram

Ciphertext-policy attribute-based encryption (CP-ABE) is widely used in many cyber physical systems and the Internet of Things for guaranteeing information security. In order to improve the performance and efficiency of CP-ABE, this paper makes a change to the access structure of describing access polices in CP-ABE, and presents a new CP-ABE system based on the ordered binary decision diagram (OBDD). The new system makes full use of both the powerful description ability and the high calculating efficiency of OBDD. First, in the access structure, the new system allows multiple occurrences of the same attribute in a strategy, supports both positive attribute and negative attribute in the description of access polices, and can describe free-form access polices by using Boolean operations. Second, in the key generation stage, the size of secret keys generated by the new system is constant and not affected by the number of attributes; furthermore, time complexity of the key generation algorithm is O(1). Third, in the encryption stage, both the time complexity of the encryption algorithm and the size of generated ciphertext are determined by the number of valid paths contained in the OBDD instead of the number of attributes occurring in access polices. Finally, in the decryption stage, the new system supports fast decryption and the time complexity of the decryption algorithm is only O(1). As a result, compared with existing CP-ABE schemes, the new system has better performance and efficiency. It is proved that the new CP-ABE system can also resist collision attack and chosen-plaintext attack under the decisional bilinear Diffie Hellman assumption.

Cloud-aided online/offline ciphertext-policy attribute-based encryption in the standard model

Attribute-Based Encryption (ABE) is a useful encryption method that allows users to encrypt messages based on their attributes. However, the computational cost of ABE system is very high, because it often scales with the number of attributes. This makes ABE difficult to apply in practice. In this paper, we use the cloud computing technology as well as pre-computing technology to solve this problem, and introduce the cloud-aided online/offline ciphertext-policy ABE system. In this system, Private Key Generator (PKG) could per-compute intermediate keys offline before online key generation phase, encryptor could pre-compute intermediate ciphertexts offline before online encryption phase, and decryptor could call their cloud computing servers to transform the ciphertexts to the partially decrypted ciphertexts before decryption phase. This greatly reduces the local computational cost of these three phases. It is significant for mobile devices to use ABE. Then, we propose a specific scheme, and prove its adaptive security in the standard model. Finally, we introduce how to deploy our new scheme in the mobile cloud computing environment.

An efficient access control scheme with outsourcing capability and attribute update for fog computing

Fog computing as an extension of cloud computing provides computation, storage and application services to end users. Ciphertext-policy attribute-based encryption (CP-ABE) is a well-known cryptographic technology for guaranteeing data confidentiality and fine-grained data access control. It enables data owners to define flexible access policy for data sharing. However, in CP-ABE systems, the problems of the time required to encrypt, decrypt and attribute update are long-standing unsolved in the literature. In this paper, we propose the first access control (CP-ABE) scheme supporting outsourcing capability and attribute update for fog computing. Specifically, the heavy computation operations of encryption and decryption are outsourced to fog nodes, thus the computation operations for data owners to encrypt and users to decrypt are irrelevant to the number of attributes in the access structure and secret keys, respectively. The cost brought by attribute update is efficient in the sense that we only concentrate on the update of the ciphertext associated with the corresponding updated attribute. The security analysis shows that the proposed scheme is secure under the decisional bilinear Diffie–Hellman assumption. The proposed scheme is efficient, and the time of encryption for data owners and decryption for users are small and constant. The computational ability of fog nodes are fully utilizing during the access control, so the tiny computing cost is left to end users with resource-constrained devices.

Large Universe CP-ABE With Whitebox Traceability

In a ciphertext-policy attribute-based encryption (CP-ABE) system, decryption keys are defined over attributes shared by multiple users. Traceability is the ability of ABE to trace the malicious users or traitors who intentionally leak the partial or modified decryption keys for profits. Nevertheless, due to the nature of CP-ABE, it is difficult to identify the original key owner from an exposed key since the decryption privilege is shared by multiple users who have the same attributes. In this paper, we propose a new CPABE system that supportstraceability of malicious users who leaked their decryption privileges.Thistraceable CP-ABE does not weaken the expressivenessor efficiency when compared with the most efficient conventional(non-traceable) CP-ABE systems. In our newsystems attributes need not be fixed at system setup,the attributes’ size is not polynomially bounded and thepublic parameters’ size does not grow linearly with thenumber of attributes.