Key-policy Attribute-based Encryption Research Articles

Comparison of attribute-based encryption schemes in securing healthcare systems

E-health has become a top priority for healthcare organizations focused on advancing healthcare services. Thus, medical organizations have been widely adopting cloud services, resulting in the effective storage of sensitive data. To prevent privacy and security issues associated with the data, attribute-based encryption (ABE) has been a popular choice for encrypting private data. Likewise, the attribute-based access control (ABAC) technique has been widely adopted for controlling data access. Researchers have proposed electronic health record (EHR) systems using ABE techniques like ciphertext policy attribute-based encryption (CP-ABE), key policy attribute-based encryption (KP-ABE), and multi authority attribute-based encryption (MA-ABE). However, there is a lack of rigorous comparison among the various ABE schemes used in healthcare systems. To better understand the usability of ABE techniques in medical systems, we performed a comprehensive review and evaluation of the three popular ABE techniques by developing EHR systems using knowledge graphs with the same data but different encryption mechanisms. We have used the MIMIC-III dataset with varying record sizes for this study. This paper can help healthcare organizations or researchers using ABE in their systems to comprehend the correct usage scenario and the prospect of ABE deployment in the most recent technological evolution.

An Efficient Secure Sharing of Electronic Health Records Using IoT-Based Hyperledger Blockchain

Electronic Health Record (EHR) systems are a valuable and effective tool for exchanging medical information about patients between hospitals and other significant healthcare sector stakeholders in order to improve patient diagnosis and treatment around the world. Nevertheless, the majority of the hospital infrastructures that are now in place lack the proper security, trusted access control, and management of privacy and confidentiality concerns that the current EHR systems are supposed to provide. Goal. For various EHR systems, this research proposes a Blockchain-enabled Hyperledger Fabric Architecture as a solution to this delicate issue. The three steps of the suggested system are the secure upload phase, the secure download phase, and authentication. Patient registration, login, and verification make up the authentication step. The administrator grants authorization to read, edit, delete, or revoke the files following user details verification. In the secure upload phase, feature extraction is carried out first, and then a hashed access policy is created from the extracted feature. Next, the hash value is stored in an IoT-based Hyperledger blockchain. The uploaded EHR files are additionally encrypted before being stored on the cloud server. In the secure download step, the physician uses a hashed access policy to send the request to the cloud and decrypts the corresponding files. The experimental findings demonstrate that the system outperformed cutting-edge techniques. The proposed Modified Key Policy Attribute-Based Encryption performs better for the remaining 10 to 25 mb file sizes. This IoT framework compares MKP-ABE with certain efficiency indicators, such as encryption, decryption period, protection level analysis and encrypted memory use, resource use on decryption, upload time, and transfer time, which are present in the KP-ABE, the ECC, RSA, and AES. Here, the IoT device suggested requires 4008 ms for data encryption and 4138 ms for the data decryption.

Hierarchal attribute based cryptographic model to handle security services in cloud environment: a new model

The sharing of information in the cloud is a unique element of the environment, but there is a risk that the information may land with the wrong people. To counterattack this problem, security-associated methodologies were used to secure the information that was readily available to clients. Despite the lack of benefits, this provides productive/adaptability and dependability in access control strategies between clients in the sharing of information. The novel hierarchal attribute-based cryptographic security model (NHACSM) is being proposed to provide adaptability, versatility, and access control in sharing information in the appropriate climate. This model allows clients to share information in a hierarchal way, allowing for a productive assessment of access control strategy and improved security. The NHACSM method is used to reduce the total time values for different user instances compared to conventional approaches, for example, attribute-set-based encryption (ASBE), key-policy attribute-based encryption (KP-ABE), and ciphertext-policy attribute-based encryption (CP-ABE). With respect to 10 instances existing methods achieve 2.7, 2.5, and 2.3 respectively, and also compared to 20, 30, 40, and 50 instances, our proposed method is low. The encryption and decryption time evaluation values and performance evaluation of different approaches, ASBE, CP-ABE, were taken into account when increasing the user instance.

An Improved Integrity-Based Hybrid Multi-User Data Access Control for Cloud Heterogeneous Supply Chain Databases

Cloud-based supply chain applications play a vital role in the multi-user data security framework for heterogeneous data types. The majority of the existing security models work effectively on small to medium-sized datasets with a homogenous data structure. In contrast, Supply Chain Management (SCM) systems in the real world utilize heterogeneous databases. The heterogeneous databases include a massive quantity of raw SCM data and a scanned image of a purchase quotation. In addition, as the size of the database grows, it becomes more challenging to provide data security on multi-user SCM databases. Multi-user datatypes are heterogeneous in structure, and it is complex to apply integrity and confidentiality models due to high computational time and resources. Traditional multi-user integrity algorithms are difficult to process heterogeneous datatypes due to computational time and variation in hash bit size. Conventional attribute-based encryption models such as "Key-policy attribute-based encryption" (KP-ABE), "Ciphertext-Policy Attribute-Based Encryption" (CP-ABE) etc., are used to provide strong data confidentiality on large textual data. Providing security for heterogeneous databases in a multi-user SCM system requires a significant computational runtime for these conventional models. An enhanced integrity-based multi-user access control security model is created for heterogeneous databases in the cloud infrastructure to address the problems with heterogeneous SCM databases. A non-linear integrity model is developed to provide strong integrity verification in the multi-user communication process. A multi-user based access control model is implemented by integrating the multi-user hash values in the encoding and decoding process. Practical results proved that the multi-user non-linear integrity-based multi-access control framework has better runtime and hash bit variation compared to the conventional models on large cloud-based SCM databases.

IoT-friendly, pre-computed and outsourced attribute based encryption

The Internet of Things (IoT) and its applications are growing at an unprecedented rate. In such a complex network with an enormous number of nodes, an important challenge is how to securely handle the access control problem. Attribute Based Encryption (ABE) is a powerful and flexible cryptographic primitive to address the challenge of realizing fine-grained access control in many systems. However, using ABE in IoT systems is often problematic due to the heavy computational overhead originating from the bilinear pairing operations and the relatively large key sizes of ABE schemes.This paper deals with this challenge by proposing some solutions to overcome the limitations of using ABE in IoT systems. The contributions of this paper are divided into three parts. In the first part, we propose modified fuzzy identity-based encryption (FIBE) schemes that use fewer optimal ate pairing operations compared to the original FIBE. FIBE is a special case of ABE, in which the access structure simplifies to a threshold gate. We also introduce a new security notion named the Conditional Chosen Ciphertext Attack-2 (Conditional CCA-2) selective security which is stronger than the CPA selective security notion. We prove that the proposed FIBE schemes have Conditional CCA-2 selective security, under the Asymmetric Decisional Modified Bilinear Diffie–Hellman (ADMBDH) assumption. In the second part, we proposed Key Policy Attribute Based Encryption (KP-ABE) schemes that use fewer pairing operations compared to the previous KP-ABE schemes. Our FIBE and KP-ABE schemes use elliptic curve groups which ensure shorter keys. In the third part of our contribution, we propose secure methods to outsource the heavy operations in FIBE and KP-ABE schemes (i.e. scalar multiplication by a curve point, exponentiation, and pairing) such that IoT devices can cope with the complexity.

OO-MA-KP-ABE-CRF: Online/Offline Multi-Authority Key-Policy Attribute-Based Encryption with Cryptographic Reverse Firewall for Physical Ability Data

In many universities, students’ physical ability data are collected and stored in the cloud through various sensing devices to save computational and storage costs. Therefore, how to effectively access data while ensuring data security has become an urgent issue. Key-policy attribute-based encryption (KP-ABE) not only enables secure one-to-many communication and fine-grained access control but also adapts to data sharing in static scenarios, making it more suitable for the cloud sharing of physical ability data. In this paper, we construct an online/offline multi-authority key-policy attribute-based encryption with a cryptographic reverse firewall for physical ability data. This scheme uses multi-authority to avoid the single point of failure crisis of a single authority, and is combined with a cryptographic reverse firewall to resist backdoor attacks. In addition, the scheme uses outsourcing decryption to save users’ computing costs, and utilizes offline/online technology to move a large amount of computing offline, reducing the online burden. Finally, the experiment shows the feasibility of the scheme.

A controllable delegation scheme for the subscription to multimedia platforms

With the development of the Internet, various multimedia platforms have sprung up like mushrooms after rain. Through subscription, people can enjoy the rich resources provided by the multimedia platform. To attract more subscribers, the multimedia platform will give users the ability to delegate access rights. Because in this way, the subscriber can share resources with his/her family or friends. However, the delegation ability should be controllable. Otherwise, there will be a risk of delegation abuse and damage to the interests of the multimedia platform. Therefore, we propose a new Key-Policy Attribute-Based Encryption (KP-ABE) scheme supporting key delegation ability, traceability, and single-layer delegation, which can work as a controllable delegation scheme for the subscription to multimedia platforms. Firstly, KP-ABE can realize access control to resources and protect the security of resources through encryption. Secondly, the key delegation ability can meet the requirement of users to share their access rights. Lastly, traceability and single-layer delegation can limit the key delegation ability of users, so as to resist key delegation abuse. In addition, the proposed scheme supports large universe and tree access structures and is established on prime-order groups, which makes it scalable, expressive, and efficient.

A Comprehensive Study on Crypto-Algorithms.

In the field of computer network and security, cryptography plays a vital role for secure data transmission as it follows the principle of data confidentiality, integrity, non-repudiation, authentication. By using several cryptographic algorithms, a user can deliver and receive the message in more convenient way. In this paper, we have collaborated on various cryptographic algorithms, several types of cryptographic techniques along with different types of security attacks prevailing in case of cryptography. During the exchanging of any sort of information, the key generation, encryption and decryption processes are examined in more details in the current paper. We have discussed regarding RSA (Ron Rives, Adi Shamir and Len Adelman), which is one of the most secure algorithm in the context of data and information sharing, that has been analysed clearly in our work along with the basic concepts of DES(Data Encryption Standard) , conventional encryption model, ECC(Elliptic curve cryptography), Digital signature, ABE(Attribute based Encryption), KP-ABE(Key policy Attribute based encryption), CP-ABE(Ciphertext policy attribute based encryption), IBE(Identity based Encryption). We have elaborated various cryptograhic concepts for keeping the message confidential and secure while considering secured data communication in case of networks.

Secured healthcare monitoring for remote patient using energy-efficient IoT sensors

The Internet of Things (IoT) and cloud computing are found to be effective in providing on-time medical support for patients by storing and accessing their clinical data on servers. There are some issues, such as communication delay, security, and energy loss in IoT sensors, that affect the quality of the service. In this research, a remote patient monitoring system using energy-efficient IoT sensors is proposed to meet security demands. The optimization of network clustering and cluster head selection is performed based on trust, inter- and intra-cluster distance, and energy level by the proposed SS-ROW algorithm, which is formulated by integrating the characteristics of the squirrel and sparrow with Ciphertext Key 2 Policy (CK2P) encryption on data. Further, an effective trust mechanism based on CP-ABE (Ciphertext-Policy Attribute-Based Encryption) and KP-ABE (Key-Policy Attribute-Based Encryption) is established to attain better results in terms of the number of alive nodes, energy left, and throughput.

A Robust Security Scheme Based on Enhanced Symmetric Algorithm for MQTT in the Internet of Things

Message Queuing Telemetry Transport (MQTT) is expected to be the de facto messaging IoT standard. Therefore, MQTT must achieve efficient security. Nevertheless, the most significant drawback of the MQTT is its lack of protection mechanisms. Meanwhile, the existing approaches have added processing overhead to the devices and are still vulnerable to various attacks. Therefore, this research work presented an integrated scheme known as the Robust Security Scheme (RSS) to protect the MQTT against any exploitations that might result in sophisticated cyberattacks. The proposed RSS employs two cryptosystems: (1) a dynamic variant of the Advanced Encryption Standard (D-AES) and (2) Key-Policy Attribute-Based Encryption (KP-ABE). RSS introduces a new design architecture of the symmetric AES algorithm to encrypt the MQTT payload called D-AES. Additionally, the second part of the proposed hybrid cryptosystem is KP-ABE, which is utilized to cipher the private key of the proposed D-AES to avoid the computation overhead of bilinear maps. The performance of the proposed RSS is measured in terms of processing time and traffic overhead. Additionally, the security aspects are evaluated in terms of balance, avalanche effect, and hamming distance and compared to the existing works in a testbed environment. Results revealed that the proposed D-AES is more promising with improvements than the standard AES algorithm. The proposed scheme achieves polymorphism while maintaining interoperability. RSS exhibited improvements over the standard AES algorithm by 8.75%, 10.45%, and 6.81% in terms of balance, avalanche effect, and hamming distance, respectively.

Fine-grained flexible access control: ciphertext policy attribute based encryption for arithmetic circuits

Applying access structure to encrypted sensitive data is one of the challenges in communication networks and cloud computing. Various methods have been proposed to achieve this goal, one of which is attribute-based encryption (ABE). In ABE schemes, the access structure, a.k.a policy, can be applied to the key or ciphertext. Thus, if the policy is applied to the key, the ABE scheme is called the key policy attribute-based encryption (KP-ABE), and if it is applied to the ciphertext, the scheme is called the ciphertext policy attribute-based encryption (CP-ABE). Since in the KP-ABE, the policy is selected once by a trusted entity and is fixed then, they are not suitable for applications where the policy needs to change repeatedly. This problem is solved in CP-ABE, where the policy is selected by the sender and can be changed for each message encryption. Furthermore, it is desired in the ABE schemes that a strong fine-grained access control can be realized. While most of the existing access structures are of Boolean type, an arithmetic access structure can support a stronger fine-grained access structure. We present the first CP-ABE scheme with an arithmetic circuit access policy based on the multilinear maps. First, we outline a basic design and then two improved versions of this scheme, with or without the property of hidden attributes, are introduced. We also define the concept of hidden result attribute based encryption (HR-ABE) which means that the result of the arithmetic function will not be revealed to the users. We define a new hardness assumption, called the \((k-1)\)-distance decisional Diffie–Hellman assumption, which is at least as hard as the k-multilinear decisional Diffie–Hellman assumption. Under this assumption, we prove the adaptive security of the proposed scheme.

Blockchain Based Multi-Authority Fine-Grained Access Control System With Flexible Revocation

Traditional data sharing systems are facing new challenges when implementing access control with more and more complex data sharing requirements. Flexibility of user revocation in completely decentralized environments needs to be taken into account. In this article, we propose a Key-Policy Attribute-Based Encryption scheme with Multiple and Flexible Revocation (MAFR-KP-ABE) to achieve the features of decentralized authorization and flexible revocation. We prove the security of our MAFR-KP-ABE scheme in the standard model and provide the comparison with relevant schemes to demonstrate its efficiency. Then we propose a fine-grained access control system based on MAFR-KP-ABE scheme and blockchain that matches the need of paid data sharing services with several security properties enhanced. Security analysis and system implementation are given subsequently to demonstrate our system efficient and secure.

Revocable attribute-based encryption from standard lattices

Attribute-based encryption (ABE) is an attractive extension of public key encryption, which provides fine-grained and role-based access to encrypted data. In its key-policy flavor, the secret key is associated with an access policy and the ciphertext is marked with a set of attributes. In many practical applications, and in order to address scenarios where users become malicious or their secret keys are compromised, it is necessary to design an efficient revocation mechanism for ABE. However, prior works on revocable key-policy ABE schemes are based on classical number-theoretic assumptions, which are vulnerable to quantum attacks. In this work, we propose the first revocable key-policy ABE scheme that offers an efficient revocation mechanism while maintaining fine-grained access control to encrypted data. Our scheme is based on the learning with errors (LWE) problem, which is widely believed to be quantum-resistant. Our scheme supports polynomial-depth policy function and has short secret keys, where the size of the keys depends only on the depth of the supported policy function. Furthermore, we prove that our scheme satisfies selective revocation list security in the standard model under the LWE assumption.

A survey on attribute-based encryption for Internet of Things

The Internet of Things (IoT) is a new technology that has drawn interest from both industry and academia in the modern digital era. The IoT provides a platform for any device to connect and share data over the Internet. Because of the diverse IoT environment and resource-constrained IoT devices, this nascent technology has numerous security challenges. Due to the lack of fine-grained access control and flexibility, traditional cryptographic algorithms such as private key encryption and public-key encryption are not suitable for providing access control mechanisms. ABE (Attribute-Based Encryption) is a new cryptographic approach that not only provides security but also fine-grained access control. This paper provides a comprehensive survey of ABE and its various forms, such as key policy ABE and ciphertext policy ABE, based on access structure, multi-authority, and hierarchy features. Further access structures used in ABE and applications of the ABE technique in IoT are also discussed. A comparison of different ABE schemes is presented regarding features, efficiency, and security. In addition, numerous schemes are analyzed to uncover obstacles, issues, and gaps that need to be investigated further.

Fast keyword search over encrypted data with short ciphertext in clouds

Nowadays, it is convenient for people to store their data on clouds. To protect the privacy, people tend to encrypt their data before uploading them to clouds. Due to the widespread use of cloud services, public key searchable encryption is necessary for users to search the encrypted files efficiently and correctly. However, the existing public key searchable encryption schemes supporting monotonic queries suffer from either infeasibility in keyword testing or inefficiency such as heavy computing cost of testing, large size of ciphertext or trapdoor, and so on. In this work, we first propose a novel and efficient anonymous key-policy attribute-based encryption (KP-ABE). Then by applying Shen et al.’s generic construction to the proposed anonymous KP-ABE, we obtain an efficient and expressive public key searchable encryption, which to the best of our knowledge achieves the best performance in testing among the existing such schemes. Only 2 pairings are needed in testing. By applying our searchable encryption, one is able to expressively and efficiently search their encrypted data on clouds, without leaking the keyword information. Besides, we also implement our scheme and others with Python for comparing the performance. From the implementation results, our scheme owns the best performance on testing, and the size of ciphertexts and trapdoors are smaller than most of the existing schemes.

Policy-Based Broadcast Access Authorization for Flexible Data Sharing in Clouds

Cloud storage services allow data owners to outsource their potentially sensitive data (e.g., private genome data) to remote cloud servers in a ciphertext form. To enable data owners to further share the data encrypted in ciphertexts, many proxy re-encryption (PRE) schemes are proposed. However, most schemes only support single-recipient or coarse-grained re-encryption, which may limit the flexibility for data sharing. To address this issue, we propose a Policy-based Broadcast Access Authorization (PBAA) scheme by introducing the well-established identity-based broadcast encryption (IBBE) and key-policy attribute-based encryption into PRE. In our PBAA scheme, a data owner can apply IBBE to encrypt his data to a group of recipients. More importantly, the data owner can generate a delegation key with an access policy, and send this key to the cloud such that it can convert any initial ciphertext satisfying the access policy into a new ciphertext for a new group of recipients. With these features, cloud users can share their remote data in a secure and flexible way. Security analysis and performance evaluation show that the PBAA scheme is secure and efficient, respectively.

Hierarchical and non-monotonic key-policy attribute-based encryption and its application

Hierarchical-authority attribute-based encryption (HABE) can resolve the performance bottleneck of the key generation center in the traditional attribute-based encryption (ABE) system. HABE has numerous applications, such as cloud computing and smart grid systems. Nevertheless, almost all of the existing HABE schemes are in the ciphertext-policy setting and do not support non-monotonic access structures. In this work, we propose the first key-policy hierarchical-authority ABE with non-monotonic access structures, dubbed KP-HABE-NMaCS, which supports the authority key delegation, constant size ciphertexts and the large universe simultaneously. We further define the security model of KP-HABE-NMaCS and prove the selective security of it in the standard model. Then we optimize our scheme to realize the outsourced decryption. Subsequently, we present the detailed theoretical analysis of our constructions and the existing HABE constructions in computation and storage costs, and meanwhile implement ours and conduct a series of experiments. Both results indicate that our KP-HABE-NMaCS construction makes improvements in expressiveness and features, and achieves efficiency comparable to the previous HABE constructions. Furthermore, they also show that our extension construction is suitable for resource-limited applications. Eventually, we explore how to apply our KP-HABE-NMaCS to build an ABE with equality test and time-based authorization.

SCD2: Secure Content Delivery and Deduplication With Multiple Content Providers in Information Centric Networking

As one of the promising next generation network architectures, information centric networking (ICN) is highly anticipated to improve the bandwidth usage of the Internet and reduce duplicate traffic. Since contents in ICN are disseminated in the whole network, ICN is much more vulnerable and the issue of how to deliver contents securely has been intensively discussed. However, the scalability of the existing schemes is limited. A scalable scheme is expected to be able to achieve fine-grained access control and at the same time also support multiple content providers scenario with efficient key management at user side. Besides, different content providers may publish some identical contents and these contents may be cached in the same intermediate routers, which causes high data redundancy and in turn exerts an adverse impact on the performance of ICN. In this paper, we propose a Secure Content Delivery and Deduplication scheme, called SCD2, to achieve secure and efficient fine-grained access control in ICN with multiple content providers. We first propose a scalable key-policy attribute-based encryption (SKP-ABE) to provide fine-grained access control and allow different attribute authorities to share some public attributes to simplify the key management. Furthermore, based on SKP-ABE, we design a simple but effective mechanism to conduct content deduplication. Finally, we implement a prototype of SCD2 to test its performance and compare it with some existing schemes. The results show that SCD2 has lower storage overhead, a higher degree of deduplication, and better retrieval efficiency.

An SKP-ABE Scheme for Secure and Efficient Data Sharing in Cloud Environments

Security threats such as data forgery and leakage may occur when sharing data in cloud environments. Therefore, it is important to encrypt your data and securely access it when sharing it with other users via a cloud server. Of the various security technologies, research on secure data sharing commonly employs Key Policy Attribute-Based Encryption (KP-ABE). However, existing KP-ABE schemes generally lack ciphertext search features. Furthermore, even if a KP-ABE scheme incorporates it, the number of searches required increases markedly by the number of attributes used in the search. It in turn proportionally increases the ciphertext size. In addition, the attribute authority (AA) could be attacked, which can result in the leakage of users’ decryption keys. AA is a server that manages user attributes and decryption keys when using attribute-based encryption in a cloud environment. If the AA is curious, it can cause problems with the key escrow with the attributes and decryption (secret) key information of the users it knows. In this paper, to solve all these problems, we present a new scheme called Searchable Key-Policy Attribute-Based Encryption (SKP-ABE) for secure and efficient data sharing in the cloud. This proposed SKP-ABE scheme allows fast ciphertext search and keeps the ciphertext of constant size. The key escrow problem is solved via user key generation.

Puncturable identity-based and attribute-based encryption from lattices

The concept of puncturable encryption (PE) was introduced by Green and Miers at IEEE S&P, 2015. PE allows recipients to update their decryption keys to revoke decryption capability for selected messages without communicating with senders. From the first instantiation, PE shows its essence for many interesting applications, such as asynchronous messaging systems, group messaging systems, public-key watermarking schemes, secure cloud emails, and many more. To eliminate the necessity of having a costly certificate verification process, Wei et al. introduced puncturable identity-based encryption (PIBE) at ESORICS, 2019. Unfortunately, till today, there is no PIBE, which can withstand quantum attack. In this paper, we aim to fill this gap in the literature by presenting the first constructions of PIBE, for both selective and adaptive identity, which are secure in the standard model based on the hardness of learning with errors problem. Finally, we extend the design idea of selectively secure PIBE to provide the first construction of lattice-based puncturable key-policy attribute-based encryption (KP-PABE), which can facilitate fine-grained access mechanism with decryption revocation. Design ideas of proposed constructions can, also, be useful to construct other lattice-based expressive PE.