Existing Ciphertext-policy Attribute-based Encryption Schemes Research Articles

TRE-DSP: A traceable and revocable CP-ABE based data sharing scheme for IoV with partially hidden policy

With the popularity of the Internet of Vehicles (IoV), a large amount of data is being generated every day. How to securely share data between the IoV operator and various value-added service providers becomes one of the critical issues. Due to its flexible and efficient fine-grained access control feature, Ciphertext-Policy Attribute-Based Encryption (CP-ABE) is suitable for data sharing in IoV. However, there are many flaws in most existing CP-ABE schemes, such as attribute privacy leakage and key misuse. This paper proposes a traceable and revocable CP-ABE-based data sharing with partially hidden policy for IoV (TRE-DSP). A partially hidden access structure is adopted to hide sensitive user attribute values, and attribute categories are sent along with the ciphertext to effectively avoid privacy exposure. In addition, key tracking and malicious user revocation are introduced with broadcast encryption to prevent key misuse. Since the main computation task is outsourced to the cloud, the burden of the user side is relatively low. Analysis of security and performance demonstrates that TRE-DSP is more secure and practical for data sharing in IoV.

A cloud based enhanced CPABE framework for efficient user and attribute-level revocation

Outsourcing massive amounts of data to the cloud service provider (CSP) has raised various security concerns for data confidentiality and access control. The ciphertext policy attribute based encryption (CPABE) scheme allows data owners to impose access control on their cloud-resident sensitive data. This paper has studied the approaches adopted to revoke users by the existing bilinear pairing cryptography based CPABE schemes. The existing studies have suggested solutions to revocation either by updating the non-revoked users’ keys or updating the ciphertext. Such approaches increase computational overhead for resource-constrained devices. In addition, a few studies have discussed the possibility of the CSP becoming dishonest and colluding with the revoked users. The likelihood of a collusion attack caused by the CSP and the revoked users also needs extensive attention. The development of the proposed proxy-based framework aims to extend the existing CPABE scheme and simplify the revocation of access rights at the user and attribute level with scalability, dynamicity, collusion resistance, and forward/backward secrecy. The proposed framework uses bilinear pairing cryptography and LSSS as an access structure. Furthermore, the security and performance analysis of the proposed framework reflects that it is implementable, better, and more secure than the existing work.

CP-ABE Optimization via the Flexible Integration of Access Policies Containing Multiple Shared Subpolicies

Ciphertext-policy attribute-based encryption (CP-ABE) is a cryptographic scheme that is suitable for cloud storage and can realize secure data sharing. However, in most existing CP-ABE schemes, the encryption computational overhead is proportional to the number of attributes in the access policy. Therefore, reducing the computational overhead of the scheme’s encryption is an important consideration to improve its efficiency. Furthermore, in the scenario where the access control policies corresponding to different data shared by the same data owner have multiple shared subpolicies, there is still further optimizing space for encryption. This study proposes an optimization approach for CP-ABE via the flexible integration of access policies with multiple shared subpolicies. Regarding the root nodes of policies being both the same and different, we provide optimal policy integration methods to reduce the overall encryption computation cost of the data associated with these access policies. Under the premise of preserving the original security of the CP-ABE scheme, this scheme avoids repeated calculation related to the shared subpolicies during encryption, thus improving the scheme’s efficiency. Finally, the correctness and feasibility of the scheme are examined and verified by theoretical analysis and experiments.

Dynamic Time and Location Information in Ciphertext-Policy Attribute-Based Encryption with Multi-Authorization

Due to the mobility of users in an organization, inclusion of dynamic attributes such as time and location becomes the major challenge in Ciphertext-Policy Attribute-Based Encryption (CP-ABE). By considering this challenge; we focus to present dynamic time and location information in CP-ABE with multi-authorization. At first, along with the set of attributes of the users, their corresponding location is also embedded. Geohash is used to encode the latitude and longitude of the user’s position. Then, decrypt time period and access time period of users are defined using the new time tree (NTT) structure. The NTT sets the encrypted duration of the encrypted data and the valid access time of the private key on the data user’s private key. Besides, single authorization of attribute authority (AA) is extended as multi authorization for enhancing the effectiveness of key generation. Simulation results depict that the proposed CP-ABE achieves better encryption time, decryption time, security level and memory usage. Namely, encryption time and decryption time of the proposed CP-ABE are reduced to 19% and 16% than that of existing CP-ABE scheme.

A secure and efficient access control scheme with attribute revocation and merging capabilities for fog-enabled IoT

The current era’s technological innovation has accelerated the expansion of the Internet of things (IoT), leading to an exponential growth of the number of connected devices and the produced data. This inspired the emergence of fog computing paradigm that enables data processing and analysis near end-users. The cloud co-exists with fog to offer services like processing resources, huge storage, etc. But sending the data through multiple levels for analysis and storage poses a severe threat to data security in cloud-fog-IoT framework. Ciphertext-Policy Attribute-Based Encryption (CP-ABE) is a well-known cryptographic mechanism for providing fine-grained access control. However, the existing CP-ABE schemes are not suitable as they fail to address the issues of attribute merging, attribute revocation, outsourcing operations, and facilitating privileged access altogether. Hence, this paper proposes a CP-ABE scheme addressing all the aforementioned issues. Further, security and performance analyses show that the proposed scheme is secure and suitable for IoT devices.

Multiauthority Attribute-Based Keyword Search over Cloud-Edge-End Collaboration in IoV

The development of cloud computing and edge computing makes it possible to store and share Internet of Vehicles (IoV) data on a large scale, which greatly contributes to traffic intelligence, but outsourced data confidentiality and user privacy cannot be guaranteed. The Ciphertext Policy Attribute-Based Encryption (CP-ABE) scheme can achieve both fine-grained access control and secure data sharing. However, existing CP-ABE schemes owns high computational complexity, and the adopted single attribute authority mode is burdensome to resource-limited IoV. Thus, this paper proposes a Multiauthority Attribute-Based Keyword Search over Cloud-Edge-End Collaboration (CEABKS-MA) system, leveraging the benefits of edge and cloud resources and effectively combining with the multiauthority structure to minimize the computation and storage pressure on resource-limited parties in the system. In addition, fine-grained keyword search with support for attribute update and lightweight encryption/decryption is extended. Finally, this paper demonstrates the security and efficiency of the CEABKS-MA system through rigorous security analysis and simulation experiments.

TRAC: Traceable and Revocable Access Control Scheme for mHealth in 5G-Enabled IIoT

Mobile healthcare (mHealth) enables people to collect and share their personal health records (PHRs) and gain rapid medical treatment via mobile 5G-enabled Industrial Internet of Things (IIoT) devices, which also brings the challenge of keeping the PHRs confidentiality and preventing unauthorized access. By the emerging ciphertext-policy attribute-based encryption (CP-ABE), the PHR owner can encrypt his/her PHR data under self-defined access policies. However, existing CP-ABE schemes are suffering from either heavy computation cost and storage overhead or traitor tracing and direct revocation. In this article, we propose an efficient, traceable, and revocable access control scheme named TRAC for mHealth in 5G-enabled IIoT. In TRAC, the ciphertext is composed of the attribute-relevant ciphertext encrypted under an <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">and</small> -gate access structure and the identity-relevant ciphertext associated with some potential receivers. The malicious user who leaks his/her privilege to unauthorized entities will be precisely tracked and added in the revocation list, by which the cloud server can update the identity-relevant ciphertext by itself. The length of final ciphertext and the time of bilinear pairing operations used in decryption are constant. The security analysis and performance evaluation indicate the security, efficiency, and practicality of TRAC.

Ciphertext-Policy Attribute-Based Encryption for Cloud Storage: Toward Data Privacy and Authentication in AI-Enabled IoT System

People can store their data on servers in cloud computing and allow public users to access data via data centers. One of the most difficult tasks is to provide security for the access policy of data, which is also needed to be stored at cloud servers. The access structure (policy) itself may reveal partial information about what the ciphertext contains. To provide security for the access policy of data, a number of encryption schemes are available. Among these, CP-ABE (Ciphertext-Policy Attribute-Based Encryption) scheme is very significant because it helps to protect, broadcast, and control the access of information. The access policy that is sent as plaintext in the existing CP-ABE scheme along with a ciphertext may leak user privacy and data privacy. To resolve this problem, we hereby introduce a new technique, which hides the access policy using a hashing algorithm and provides security against insider attack using a signature verification scheme. The proposed system is compared with existing CP-ABE schemes in terms of computation and expressive policies. In addition, we can test the functioning of any access control that could be implemented in the Internet of Things (IoT). Additionally, security against indistinguishable adaptive chosen ciphertext attacks is also analyzed for the proposed work.

Granular Data Access Control with a Patient-Centric Policy Update for Healthcare.

Healthcare is a multi-actor environment that requires independent actors to have a different view of the same data, hence leading to different access rights. Ciphertext Policy-Attribute-based Encryption (CP-ABE) provides a one-to-many access control mechanism by defining an attribute’s policy over ciphertext. Although, all users satisfying the policy are given access to the same data, this limits its usage in the provision of hierarchical access control and in situations where different users/actors need to have granular access of the data. Moreover, most of the existing CP-ABE schemes either provide static access control or in certain cases the policy update is computationally intensive involving all non-revoked users to actively participate. Aiming to tackle both the challenges, this paper proposes a patient-centric multi message CP-ABE scheme with efficient policy update. Firstly, a general overview of the system architecture implementing the proposed access control mechanism is presented. Thereafter, for enforcing access control a concrete cryptographic construction is proposed and implemented/tested over the physiological data gathered from a healthcare sensor: shimmer sensor. The experiment results reveal that the proposed construction has constant computational cost in both encryption and decryption operations and generates constant size ciphertext for both the original policy and its update parameters. Moreover, the scheme is proven to be selectively secure in the random oracle model under the q-Bilinear Diffie Hellman Exponent (q-BDHE) assumption. Performance analysis of the scheme depicts promising results for practical real-world healthcare applications.

PAC-FIT: An efficient privacy preserving access control scheme for fog-enabled IoT

With the proliferation of data produced by IoT devices, a new paradigm called fog computing has developed that allows processing and analysis of data at the edge. Together with fog, cloud computing co-exists for purposes such as enormous storage, processing resources, etc. However, storage and computation of data at various levels increase the risk of data privacy. Therefore, an access control mechanism is necessary for the fog-cloud framework in an IoT environment. Ciphertext-policy attribute-based encryption (CP-ABE) is a well-known cryptographic mechanism that provides confidentiality and fine-grained access control. Unfortunately, the existing CP-ABE schemes are not well suited for the cloud-fog-IoT environment as they do not provide the following functionalities together: key-escrow resistance, attribute revocation, attribute addition, and outsourcing of expensive operations. Therefore, this paper proposes a CP-ABE scheme named PAC-FIT that supports key-escrow resistance, attribute revocation, and attribute addition features. Additionally, the expensive encryption and decryption operations are outsourced to fog nodes, which greatly reduces the computational overhead from resource-constrained IoT devices. Further, the tasks of attribute revocation and addition are also outsourced to third parties. The cost incurred during attribute revocation and addition are efficient as only those key components and ciphertexts are updated, which are associated with revoked or added attributes. Meanwhile, unlike existing CP-ABE schemes, the user holds a constant size secret key, which remains unchanged throughout. The security analysis proves that PAC-FIT is secure against Chosen-Plaintext Attack under Decisional Bilinear Diffie-Hellman assumption. The performance analysis shows that PAC-FIT is efficient and suitable for IoT devices.

Efficient Escrow-free CP-ABE with Constant Size Ciphertext and Secret Key for Big Data Storage in Cloud

Ciphertext-policy attribute-based encryption (CP-ABE) schemes are an appropriate cryptographic technique to enable privacy along with access control in the cloud, but the existing CP-ABE schemes do not directly apply for big data because they have the issue of long ciphertext and long secret key size (LC-LS). To address LC-LS, the constant size ciphertext and secret key (CSC-S) schemes proposed. However, the existing CSC-S schemes suffer from the key escrow security issue and efficiency issue. To address both simultaneously, the authors propose an efficient escrow-free CP-ABE with constant size ciphertext and secret key (EEF-CPABE) for big data storage in the Cloud. The EEF-CPABE scheme reduces the encryption and decryption computation overhead by designing CSC-S. Further, the data owner generates the decryption global key to decrypt the data along with user secret key which solves the key escrow issue. Security and performance analysis demonstrate that the EEF-CPABE scheme resists against authority, and chosen plain-text attacks and more efficient than CSC-S schemes.

Fine-grained data access control with attribute-hiding policy for cloud-based IoT

Ciphertext-policy attribute-based encryption (CP-ABE) is a promising approach to achieve fine-grained access control over the outsourced data in Internet of Things (IoT). However, in the existing CP-ABE schemes, the access policy is either appended to the ciphertext explicitly or only partially hidden against public visibility, which results in privacy leakage of the underlying ciphertext and potential recipients. In this paper, we propose a fine-grained data access control scheme supporting expressive access policy with fully attribute hidden for cloud-based IoT. Specifically, the attribute information is fully hidden in access policy by using randomizable technique, and a fuzzy attribute positioning mechanism based on garbled Bloom filter is developed to help the authorized recipients locate their attributes efficiently and decrypt the ciphertext successfully. Security analysis and performance evaluation demonstrate that the proposed scheme achieves effective policy privacy preservation with low storage and computation overhead. As a result, no valuable attribute information in the access policy will be disclosed to the unauthorized recipients.

An Improved Ciphertext-Policy Attribute-Based Encryption Scheme in Power Cloud Access Control

In power cloud environment, the existing Ciphertext-Policy Attribute-Based Encryption (CP-ABE) access control schemes, do not consider the generation of access structure and the existence of malicious users. To tackle these problems, a power cloud access control (PCAC) scheme is proposed, which improves the traditional CP-ABE access control model. Considering the heavy time consumption of CP-ABE, PCAC encrypts the symmetric key, instead of the raw data. PCAC combines the access tree and linear secret-sharing scheme (LSSS) to achieve the automatic generation and efficient operation of access structure. Additionally, an action audit phase, based on zero-knowledge verification was designed to defend against malicious users. The experiments proved that PCAC meets the requirement of fine-grained access control, in a power cloud. Compared with existing CP-ABE schemes, the PCAC scheme reduced about half of the time consumption, in the action audit phase and costs about one-third the time, in the data obtainment stage.

A new verifiable outsourced ciphertext-policy attribute based encryption for big data privacy and access control in cloud

The foremost security concerns for big data in the cloud are privacy and access control. Ciphertext-policy attribute based encryption (CP-ABE) is an effective cryptographic solution for above concerns, but the existing CP-ABE schemes are not suitable for big data in the cloud as they require huge computation time for encryption and decryption process. In this paper, we propose a new verifiable outsourced CP-ABE for big data privacy and access control in the cloud. Our scheme reduces the computational overhead of encryption and decryption by outsourcing the heavy computations to the proxy server. Our scheme also verifies the correctness of the data along with the outsourcing computations. Further, our scheme limits the data access for a set of users instead of providing an infinite number of times data access, which is essentially required for commercial applications. In security analysis, we prove that our scheme is secure against chosen plain-text attack, collusion and proxy attacks. Performance analysis proves that our scheme is efficient.

Multiple Attribute Authorities for Public Cloud Storge using a Robust Auditable Access Control

Data access control is a challenging issue in public cloud storage systems. Ciphertext-Policy Attribute-Based Encryption (CP-ABE) has been adopted as a promising technique to provide flexible, fine-grained and secure data access control for cloud storage with honest-but-curious cloud servers. However, in the existing CP-ABE schemes, the single attribute authority must execute the time-consuming user legitimacy verification and secret key distribution, and hence it results in a single-point performance bottleneck when a CP-ABE scheme is adopted in a large-scale cloud storage system. Users may be stuck in the waiting queue for a long period to obtain their secret keys, thereby resulting in low-efficiency of the system. Although multiauthority access control schemes have been proposed, these schemes still cannot overcome the drawbacks of single-point bottleneck and low efficiency, due to the fact that each of the authorities still independently manages a disjoint attribute set

Efficient and robust attribute-based encryption supporting access policy hiding in Internet of Things

The term of Internet of Things (IoT) remarkably increases the ubiquity of the internet by integrating smart object-based infrastructures. How to achieve efficient fine-grained data access control while preserving data privacy is a challenge task in the scenario of IoT. Despite ciphertext-policy attribute-based encryption (CP-ABE) can provide fine-grained data access control by allowing the specific users whose attributes match the access policy to decrypt ciphertexts. However, existing CP-ABE schemes will leak users’ attribute values to the attribute authority (AA) in the phase of key generation, which poses a significant threat to users’ privacy. To address this issue, we propose a new CP-ABE scheme which can successfully protect the user’s attribute values against the AA based on 1-out-of-n oblivious transfer technique. In addition, we use Attribute Bloom Filter to protect the attribute type of the access policy in the ciphertext. Finally, security and efficiency evaluations show that the proposed scheme can achieve the desired security goals, while keeping comparable computation overhead.

A Distributed Publisher-Driven Secure Data Sharing Scheme for Information-Centric IoT

In Information-Centric Internet of Things (ICIoT), Internet of Things (IoT) data can be cached throughout a network for close data copy retrievals. Such a distributed data caching environment, however, poses a challenge to flexible authorization in the network. To address this challenge, Ciphertext-Policy Attribute-Based Encryption (CP-ABE) has been identified as a promising approach. However, in the existing CP-ABE scheme, publishers need to retrieve attributes from a centralized server for encrypting data, which leads to high communication overhead. To solve this problem, we incorporate CP-ABE and propose a novel Distributed Publisher-Driven secure data sharing for ICIoT (DPD-ICIoT) to enable only authorized users to retrieve IoT data from distributed cache. In DPD-ICIoT, newly introduced attribute manifest is cached in the network, through which publishers can retrieve the attributes from nearby copy holders instead of a centralized attribute server. In addition, a key chain mechanism is utilized for efficient cryptographic operations, and an automatic attribute self-update mechanism is proposed to enable fast updates of attributes without querying centralized servers. According to the performance evaluation, DPD-ICIoT achieves lower bandwidth cost compared to the existing CP-ABE scheme.

Flexible ciphertext-policy attribute-based encryption supporting AND-gate and threshold with short ciphertexts

Ciphertext-policy attribute-based encryption (CP-ABE) is a very promising cryptographic primitive that allows a data owner to encrypt messages and manage access policies themselves. Most of the existing CP-ABE schemes suffer from efficiency drawbacks due to long ciphertexts, which impacts their adoption in applications where data are shared and stored. In this work, we aim to address this gap by proposing a CP-ABE which features constant-size ciphertext and supports access policies of an AND-gate and a threshold, which make ciphertext policies more expressive and applicable to many practical applications. Prior CP-ABE schemes with short ciphertexts such as that of Herranz et al. (in: Public key cryptography—PKC, Springer, 2010) only allow access policies to be a single AND-gate or a single threshold only. Combinations between these short CP-ABE constructions will result in systems insecure against collusion attacks, which makes the effort to enable access policies with an AND-gate and a threshold gate at the same time becomes very challenging. We present such a scheme that solves this drawback. Our scheme is efficient, expressive and secure. In our construction, the encryptor chooses two subsets of a certain universe of attributes $$S_1$$ , $$S_2$$ with a threshold value $$t_1$$ that only users who have at least $$t_1$$ attributes in $$S_1$$ and all attributes in $$S_2$$ can decrypt the ciphertext. The scheme is proven secure against selective chosen plaintext attacks in the standard model by reduction to the augmented multi-sequence of exponents decisional Diffie–Hellman (aMSE-DDH) problem.

RAAC: Robust and Auditable Access Control With Multiple Attribute Authorities for Public Cloud Storage

Data access control is a challenging issue in public cloud storage systems. Ciphertext-policy attribute-based encryption (CP-ABE) has been adopted as a promising technique to provide flexible, fine-grained, and secure data access control for cloud storage with honest-but-curious cloud servers. However, in the existing CP-ABE schemes, the single attribute authority must execute the time-consuming user legitimacy verification and secret key distribution, and hence, it results in a single-point performance bottleneck when a CP-ABE scheme is adopted in a large-scale cloud storage system. Users may be stuck in the waiting queue for a long period to obtain their secret keys, thereby resulting in low efficiency of the system. Although multi-authority access control schemes have been proposed, these schemes still cannot overcome the drawbacks of single-point bottleneck and low efficiency, due to the fact that each of the authorities still independently manages a disjoint attribute set. In this paper, we propose a novel heterogeneous framework to remove the problem of single-point performance bottleneck and provide a more efficient access control scheme with an auditing mechanism. Our framework employs multiple attribute authorities to share the load of user legitimacy verification. Meanwhile, in our scheme, a central authority is introduced to generate secret keys for legitimacy verified users. Unlike other multi-authority access control schemes, each of the authorities in our scheme manages the whole attribute set individually. To enhance security, we also propose an auditing mechanism to detect which attribute authority has incorrectly or maliciously performed the legitimacy verification procedure. Analysis shows that our system not only guarantees the security requirements but also makes great performance improvement on key generation.

A Ciphertext-Policy Attribute-Based Encryption Based on an Ordered Binary Decision Diagram

Ciphertext-policy attribute-based encryption (CP-ABE) is widely used in many cyber physical systems and the Internet of Things for guaranteeing information security. In order to improve the performance and efficiency of CP-ABE, this paper makes a change to the access structure of describing access polices in CP-ABE, and presents a new CP-ABE system based on the ordered binary decision diagram (OBDD). The new system makes full use of both the powerful description ability and the high calculating efficiency of OBDD. First, in the access structure, the new system allows multiple occurrences of the same attribute in a strategy, supports both positive attribute and negative attribute in the description of access polices, and can describe free-form access polices by using Boolean operations. Second, in the key generation stage, the size of secret keys generated by the new system is constant and not affected by the number of attributes; furthermore, time complexity of the key generation algorithm is O(1). Third, in the encryption stage, both the time complexity of the encryption algorithm and the size of generated ciphertext are determined by the number of valid paths contained in the OBDD instead of the number of attributes occurring in access polices. Finally, in the decryption stage, the new system supports fast decryption and the time complexity of the decryption algorithm is only O(1). As a result, compared with existing CP-ABE schemes, the new system has better performance and efficiency. It is proved that the new CP-ABE system can also resist collision attack and chosen-plaintext attack under the decisional bilinear Diffie Hellman assumption.