CP-ABE Scheme Research Articles

Extended File Hierarchy Access Control Scheme with Attribute-Based Encryption in Cloud Computing

In cloud computing, attribute based encryption (ABE) is often used to solve the challenging issue in secure data storage. In order to lighten the burden of authority center, hierarchical ABE schemes is a very effective way. File hierarchy attribute based encryption (FH-CP-ABE) is a scheme, which both saves storage space of ciphertext and reduces the computation overhead of encryption. However, it's impossible to encrypt multiple files on the same access level in existing FH-CP-ABE scheme. The scheme is obviously not practical. In this paper, an efficient extended file hierarchy CP-ABE scheme (EFH-CP-ABE) is proposed, which can encrypt multiple files on the same access level. Our scheme is very practical especially for those big institutions or companies which have many hierarchical sectors, since it greatly saves storage space and computation cost for them on the cloud servers. Furthermore, our solution also achieves secure and flexible access control for users in cloud storage. We formally prove the security for our new scheme under the standard model. Finally, we implement the corresponding experiment for EFH-CP-ABE scheme and achieve desirable experimental results.

A CP-ABE scheme based on multi-authority in hybrid clouds for mobile devices

With the rapid development of cloud computing, the ensuing security issues have become increasingly prominent. In this context, attribute-based encryption (ABE) has gradually attracted widespread attentions due to its unique attribute matching mechanism. At the same time, mobile devices have put forward higher requirements for the design and deployment of ABE schemes. Therefore, in this paper, we propose an original hybrid cloud multi-authority ciphertext-policy attribute-based encryption (HCMACP-ABE) scheme. Specifically, we utilize the LSSS (Linear Secret-Sharing Schemes) access structure to realize secure access control, while the private cloud is responsible for maintaining the user’s authorization list and verifying the user. Finally, we prove that our proposal achieves IND-CCA secure and is efficient in a mobile hybrid cloud environment.

Blockchain-Based Fine-Grained Data Sharing for Multiple Groups in Internet of Things

Cloud-based Internet of Things, which is considered as a promising paradigm these days, can provide various applications for our society. However, as massive sensitive and private data in IoT devices are collected and outsourced to cloud for data storage, processing, or sharing for cost saving, the data security has become a bottleneck for its further development. Moreover, in many large-scale IoT systems, multiple group data sharing is practical for users. Thus, how to ensure data security in multiple group data sharing remains an open problem, especially the fine-grained access control and data integrity verification with public auditing. Therefore, in this paper, we propose a blockchain-based fine-grained data sharing scheme for multiple groups in cloud-based IoT systems. In particular, we design a novel multiauthority large universe CP-ABE scheme to guarantee the fine-grained access control and data integrity across multiple groups by integrating group signature into our scheme. Moreover, to ease the need for a trusted third auditor in traditional data public auditing schemes, we introduce blockchain technique to enable a distributed data public auditing. In addition, with the group signature, our scheme also realizes anonymity and traitor tracing. The security analysis and performance evaluation show that our scheme is practical for large-scale IoT systems.

PCS-ABE (t, n): a secure threshold multi authority CP-ABE scheme based efficient access control systems for cloud environment

Cloud computing is a current phrase in marketing for an idea that has been recognized for years: Outsourcing. Cloud computing provides a large number of gratuities for each customer and enterprise agency. ‘Cloud model’ is more of a notion in which the data are hosted online and accessed at anytime-anywhere manner, on a pay-per-use model. However, the users may not fully trust the cloud service providers (CSPs) in that environment. So, it is hard to decide whether the cloud service provider (CSP) meets their expectations to provide the proper secrecy to users' shared data and privacy. Several access control schemes that allow, deny, or restrict users to have access to data have been proposed. Among these, the Attribute-Based Encryption (ABE) scheme has generally used to provide security efficiently in public managed cloud scheme storage. The earlier Attribute-Based Encryption (ABE) schemes have a single authority maintaining the whole attribute set and suffer from a single-point bottleneck problem. To resolve this issue, some Multi-Authority Attribute-Based Encryption (MA-ABE) schemes have proposed in which disjoint attribute sets are maintained separately, but the bottleneck problem still occurs. This paper involves multi-authority (MA) models, where multiple authorities mutually handle a uniform attribute set. It uses an efficient (t, n) threshold secret sharing scheme, in which n multiple authorities share the master key, and a legitimate user selects any t—out of n—authorities compute his/her secret_key. The results of security and performance analysis show that the proposed methodology is not only computationally secure whenever it is compromised by less than t—number of authorities, but still robust whenever at least t—number of authorities are active in the model. This paper uses an efficient encryption scheme to encrypt the plaintext message, which encrypts one byte at a time. It performs faster execution of encryption and reduces the hardware complexity.

An efficient attribute-based access control system with break-glass capability for cloud-assisted industrial control system.

In the era of Industry4.0, cloud-assisted industrial control system (ICS) is considered to be the most promising technology for industrial processing automation systems. However, the emerging attack techniques targeted at ICS underlines the importance of data security. To protect the data from the unauthorized accesses, attribute-based encryption is utilized to meet the requirement of confidentiality and access control demand of an open network environment. In ICS scenarios, it is critically important to offer the timely and efficient service, especially in the emergency situations. This paper proposes an efficient access control strategy that enables two access modes: attribute-based access and emergency break-glass access. Normally, users can access the encrypted data as long as their attributes satisfy the access policy specified by the data owner. In emergency cases, emergency situation handlers can override the access control policy of the encrypted data by the break-glass access capability. To eliminate the overhead for data consumers, the scheme outsources the data decryption and policy updating to the semi-trusted fog and cloud. The scheme also implements the CP-ABE scheme in terms of an asymmetric Type-3 pairings instead of the symmetric Type-1 pairings, which are inefficient and have security issues. Finally, the paper analyses the security of the scheme, evaluates its performance, and compares it with related works.

Efficient attribute-based encryption with repeated attributes optimization

Internet of Things (IoT) is an integration of various technologies to provide technological enhancements. To enforce access control on low power operated battery constrained devices is a challenging issue in IoT scenarios. Attribute-based encryption (ABE) has emerged as an access control mechanism to allow users to encrypt and decrypt data based on an attributes policy. However, to accommodate the expressiveness of policy for practical application scenarios, attributes may be repeated in a policy. For certain policies, the attributes repetition cannot be avoided even after applying the boolean optimization techniques to attain an equivalent smaller length boolean formula. For such policies, the evaluated secret shares are also multiple for repeated attributes; hence, the ciphertext computed for those irreducible policies is long and computational effort is more. To address this issue, a new CP-ABE scheme is proposed which employs our Repeated Attributes Optimization algorithm by which the Linear Secret Sharing Scheme matrix sent along with ciphertext will contain the access structure of policy including attributes appearing multiple times, but the ciphertext will only be evaluated for unique non-repeated attributes. Security and performance analysis show that the proposed construction fulfils its goals of achieving desired security with low communication overhead and computational cost for resource-constrained devices.

A Traceable and Revocable Ciphertext-Policy Attribute-based Encryption Scheme Based on Privacy Protection

Considered as a promising fine-grained access control mechanism for data sharing without a centralized trusted third-party, the access policy in a plaintext form may reveal sensitive information in the traditional CP-ABE method. To address this issue, a hidden policy needs to be applied to the CP-ABE scheme, as the identity of a user cannot be accurately confirmed when the decryption key is leaked, so the malicious user is traced and revoked as demanded. In this article, a CP-ABE scheme that realizes revocation, white-box traceability, and the application of hidden policy is proposed, and such ciphertext is composed of two parts. One is related to the access policy encrypted by the attribute value, and only the attribute name is evident in the access policy. Another is related to the revocation information and updated when revoking, where the revocation information is generated by the binary tree related to users. The leaf node value of a binary tree in the decryption key is used to trace the malicious user. From experimental results, it is shown that the proposed scheme is proven to be IND-CPA secure under the chosen plaintext attacks and selective access policy based on the decisional q-BDHE assumption in the standard model, efficient, and promising.

A Hybrid Secure Storage Scheme to Avoid EDOS Attacks in Cloud Computing

In advent of cloud environment, cloud operator is not a completely trusted to put on private information, because of lack of consumer to cloud control. To assurance privacy, documents sharer deploy their encipher documents. Encipher documents dispense to among consumers using CP-ABE scheme. But it is not completely safe in opposition to different assaults. The prior knowledge cannot offer any verification ability to cloud operator whether the user can decipher or not. Various invaders may obtain lot of document by initiate EDoS assaults. The consumer of cloud abides cost. To handle above issues, this article suggests a problem solving plan to safe encipher cloud repository from EDoS assaults and maintain supply utilization. It utilizes CP-ABE tactics in a black-box method furthermore accomplish impulsive entryway contract epithetical CP-ABE. We tend to present 2 mechanisms for various styles, observed via achievement and shield research.

Smart offloading technique for CP-ABE encryption schemes in constrained devices

Nowadays, we are attending to the wide proliferation of IoT devices in various computing environments. Actually, this trend is the natural way to extend the M2M communication. However, these devices are facing serious resource constraints. To mitigate this problem, the huge amount of the exchanged data is collected from these devices for being stored and processed by the Cloud. Furthermore, since the Cloud is honest but curious, it may reveal personal information about users’ habits owning these devices and can even lead to user profiling. Consequently, security mechanisms should be deployed at different levels to preserve data privacy so that only authorized users can gain access to the smallest piece of data according to the collection purpose. By assuming that the Cloud-is-honest-but-curious, we can not provide full or similar access to different untrusted Cloud services. Therefore, we should define the relevant privacy level implementing the data access control for each Cloud service according to some criteria. In this context, CP-ABE is a promising solution addressing this problem. This novel attribute-based public key encryption system provides a flexible fine-grained access control to data for any data requestor. However, performing all the related cryptographic operations on such devices is practically infeasible because of the resource constraints. For alleviating all the computation burden on these resource-limited devices, several schemes have been proposed. In this work, we propose a smart offloading technique that switches dynamically from full encryption to partial encryption according to a wise decision strategy considering the available resources and some crucial parameters like the number of attributes and the size of the data being encrypted. The relevant decision is based on a machine learning algorithm. To the best of our knowledge, this is the first paper proposing an adaptive CP-ABE scheme for constrained device optimizing the overall available resources.

Data security sharing method based on CP-ABE and blockchain

Although the data trading platform has accelerated the flow of data, the current data trading platform still has many problems. According to the characteristics of the blockchain technology, from the aspects of the attack behavior in the blockchain and the security application of the blockchain technology in power transactions, this paper studies the security of the blockchain. Moreover, this article focuses on the privacy protection of the ciphertext strategy in the CP-ABE scheme, and protects the privacy information of the access strategy by designing appropriate ciphertext and key structures and access structure forms. In addition, the system efficiency is improved by computing outsourcing, and solutions to problems in outsourcing computing are proposed. Meanwhile, two efficient and flexible support policy hidden multi-authorization center access control schemes are constructed. Finally, this study analyzes the performance of the model through controlled experiments. The research results show that this scheme has excellent performance.

Simplified Ciphertext Policy Attribute Based Encryption for Multimedia Applications

Abstract In this modern age we generate data from various sophisticated systems and technologies for our personal use, the security and privacy of the data becomes a major concern while sharing it over the cloud platform. The conventional CP-ABE scheme is used to secure different types of data.The CP-ABE uses the access policy in the form of access tree for generating keys to encrypt and decrypt data. However using an explicit access structure with several nodes requires more computational requirements and consumes significant amount of time to process every node of access structure and to encrypt the data. In this paper, to overcome these challenges, we proposed a simplified Ciphertext Policy Attribute Based Encryption for multimedia applications scheme without an access structure, which is more practical to secure the data with less overhead. In this proposed work, the owner of the data carefully frames the attribute string in a prescribed manner that can be used for encryption and decryption process. The performance measurement of the proposed scheme demonstrate that our system has high level of security with less computational requirements.

Performance Evaluation of CP-ABE Schemes under Constrained Devices

Recently, Internet of Things devices (IoT) have become a hot spot for researchers. Their industrial importance is growing exponentially day after day. Statistics show that the number of IoT devices will reach fifty billions by 2020. In addition, IoT applications are backed through the Cloud where data is stored and processed by gigantic processing systems. However, since the Cloud is honest but curious, sensitive information belonging to the IoT devices owners might be accessed and used beyond the intended purpose. Therefore, data privacy on Cloud servers should be preserved, which means that they should not reveal any piece of personally identifiable information (PII). Attribute Based Encryption (ABE) is a new form of public key encryption. ABE is a good candidate to achieve privacy and fine-grained access control for IoT applications running on Cloud servers. However, performing all the related cryptographic operations on such devices is practically infeasible because of their resource constraints. For alleviating all the computation burden on these resource-limited devices, several schemes have been proposed. In this paper, we investigate different ABE schemes, we implement and provide a performance evaluation in order to compare two relevant CP-ABE schemes: a fully encryption Vs a delegation based alternative.

Multi-Authority-Based File Hierarchy Hidden CP-ABE Scheme for Cloud Security

Cloud technology is emerging as a widely accepted technology in the recent years due to its robust nature. Cloud computation is basically developed on the fact that the resources can be shared between numerous devices to achieve efficient network operation among devices with minimized computation expenses. However, the sharing nature poses a security risk for the devices whose resources are being shared. Almost in all the existing works on cloud security, a single trusted third party (TTP) is used for key issue and authorization. However, using a single TTP may results in single-point failure and security risks. Most of the previous works on cloud security focus on storage security rather than considering the computation security. In order to solve these issues, in this paper, multi-authority-based file hierarchy hidden CP-ABE scheme for cloud security is proposed. In this scheme, the files are arranged in hierarchical order based on their attribute weights. Then when a cloud user needs certain resources, it requests the cloud service provider (CSP). The CSP links with the cloud owner to provide the requested file after encrypting it. The cloud server encrypts and places the encrypted file in CSP, which is later retrieved by cloud user. In this way, all the files that are being used are encrypted along with strict authentication to ensure cloud security.

Ciphertext retrieval via attribute-based FHE in cloud computing

In order to ensure the security of users’ information effectively, this paper investigates ciphertext-based attribute encryption. Homomorphic encryption can settle the problems of data privacy in cloud environments, in the way that can be operated directly to achieve the same result as for plaintext operations. In this paper, on the premise of attribute encryption, we propose an attribute-based fully homomorphism encryption scheme with LSSS matrix and a ciphertext-based retrieval scheme on this basis. Firstly, the retrieval scheme supports fine-grained cum flexible access control along with “Query-Response” mechanism to enable users to efficiently retrieve desired data from cloud servers. Secondly, the scheme supports considerable flexibility to revoke system privileges from users without updating the key client, which reduces the burden of the client greatly. Security analysis shows that the scheme can resist collusion attack. A comparison of the performance with existing CP-ABE schemes indicates that our scheme reduces the computation cost greatly for users and guarantees only the owners of the evaluation keys can perform ciphertext retrieval, which is also one of the main advantages of the proposed scheme.

An efficient and revocable storage CP-ABE scheme in the cloud computing

As a special kind of public-key encryption, attribute-based encryption (ABE) is able to achieve fine-grained access control mechanism by offering one-to-many encryption. Due to such unique characteristic, this primitive is widely employed in the cloud computing environment to provide flexible and secure data sharing. However, how to revoke the access privilege of a user to access encrypted data stored in cloud servers is challenging. Furthermore, the complex operation of ABE may cause a huge computational cost and is usually considered to be a heavy burden for system users. Motivated by the practical needs, an ABE scheme called efficient and revocable storage CP-ABE scheme with outsourced decryption and constant-size ciphertexts and secret keys is proposed in this paper. Our scheme offers the following features: In addition, the scheme is provably secure against selectively chosen-ciphertext attack. At the end, we describe how to deploy the scheme in cloud computing environment.

A scheme of hidden-structure attribute-based encryption with multiple authorities

In the most of the CP-ABE schemes with hidden access structure, both all the user attributes and the key generation are managed by only one authority. The key generation efficiency will decrease as the number of user increases, and the data will encounter security issues as the only authority is attacked. We proposed a scheme of hidden-structure attribute-based encryption with multiple authorities, which introduces multiple semi-trusted attribute authorities, avoiding the threat even though one or more authorities are attacked. We also realized user revocation by managing a revocation list. Based on DBDH assumption, we proved that our scheme is of IND-CMA security. The analysis shows that our scheme improves the key generation efficiency.

GO-CP-ABE: group-oriented ciphertext-policy attribute-based encryption

We introduce a variant of ciphertext-policy attribute-based encryption called group-oriented ciphertext-policy attribute-based encryption (GO-CP-ABE). In the new notion, message is encrypted under an access structure over attributes and users are described by their attributes. In addition, users are divided into different groups and each user belongs to only one group. Users within the same group can merge their attributes to decrypt successfully, if the union of their attributes satisfies the access structure embedded in the ciphertext. But users from different groups cannot realise this cooperative decryption. We define the security model of GO-CP-ABE and present an efficient design by revising an existing CP-ABE scheme.

Achieving Collaborative Cloud Data Storage by Key-Escrow-Free Multi-Authority CP-ABE Scheme with Dual-Revocation

Nowadays, more and more users store their data in cloud storage servers for great convenience and real benefits offered by the service, so cloud data storage becomes one of the desirable services provided by cloud service providers. Multi-Authority Ciphertext-Policy Attribute-Based Encryption (MA-CP-ABE) is an emerging cryptographic solution to data access control for large-scale collaborative cloud storage service, which allows any data owner to outsource the data to cloud data storage in order to enable users from collaborating domains or organizations to access the outsourced data. However, the existing MA-CP-ABE schemes cannot be directly applied to collaborative cloud storage services as data access control due to the key escrow problem and the absence of dual revocation mechanism (user revocation and attribute revocation). By addressing these issues, this paper presents a Key-Escrow- Free Multi-Authority Ciphertext-Policy Attribute-Based Encryption Scheme with Dual-Revocation by introducing ＂the essential attribute＂ and making use of a certificate authority apart from attribute authorities. Compared with the existing MA-CP-ABE schemes, the proposed scheme is the most suitable one to enable data access control for collaborative cloud storage systems. Furthermore, the security and performance analysis indicates that our scheme is more secure and reasonably efficient to be applied to practical scenarios as collaborative cloud storage systems.

Accountable CP-ABE with Public Verifiability: How to Effectively Protect the Outsourced Data in Cloud

Ciphertext-policy attribute-based encryption, denoted by CP-ABE, extends identity based encryption by taking a set of attributes as users’ public key which enables scalable access control over outsourced data in cloud storage services. However, a decryption key corresponding to an attribute set may be owned by multiple users. Then, malicious users are subjectively willing to share their decryption keys for profits. In addition, the authority who issues decryption keys in CP-ABE system is able to generate arbitrary decryption key for any (including unauthorized) user. Key abuses of both malicious users and the authority have been regarded as one of the major obstacles to deploy CP-ABE system in real-world commercial applications. In this paper, we try to solve these two kinds of key abuses in CP-ABE system, and propose two accountable CP-ABE schemes supporting any LSSS realizable access structures. Two proposed accountable CP-ABE schemes allow any third party (with the help of authorities if necessary) to publicly verify the identity of an exposed decryption key, allow an auditor to publicly audit whether a malicious user or authorities should be responsible for an exposed decryption key, and the key abuser can’t deny it. At last, we prove the two schemes can achieve publicly verifiable traceability and accountability.

Fuzzy matching and direct revocation: a new CP-ABE scheme from multilinear maps

In the attribute-based encryption (ABE) systems, users could encrypt and decrypt messages based on some attributes or access policies. Due to the functionality and flexibility of ABE, it is considered to be very suitable for secure data sharing in cloud storage environment. However, in the real world, users’ access rights are often dynamic; therefore, we need ABE schemes to support revocation to meet this requirement. In this work, we construct a novel directly revocable ciphertext-policy ABE (DR-CP-ABE) scheme based on the multilinear maps and prove its selective security under \((d+3)\)-multilinear decisional Diffie–Hellman assumption in the random oracle model. In addition, we extend our DR-CP-ABE scheme to support verifiable ciphertext delegation property.