Multi-authority Attribute-based Encryption Scheme Research Articles

Flexibly expressive and revocable multi-authority KP-ABE scheme from RLWE for Internet of Medical Things

The emergence of the Internet of Medical Things (IoMT) has presented numerous opportunities for the healthcare industry. It is anticipated to enhance the quality and efficiency of medical services, thus enhancing people’s overall quality of life. However, frequently occurring medical data leakage makes the protection of medical data and privacy in IoMT become a critical issue. Among the solutions, attribute-based encryption (ABE) has been a very promising solution due to its flexible and fine-grained access control to encrypted data. However, the majority of current ABE schemes are based on bilinear pairing and are vulnerable to quantum attacks. The available of multi-authority ABE schemes over lattice only support a single policy such as threshold or AND gate, and lack the ability to implement user or attribute revocation in a flexible manner. For the special algebra structure of the lattice based scheme, how to overcome them is still a challenge at present. Aiming at the above, we propose a novel multi-authority key-policy attribute based encryption (RM-KP-ABE) based on the Ring Learning With Errors (RLWE) assumption. It supports multi-valued attributes and {0,1}-LSSS access policy. This scheme allows multiple authorities to participate in key distribution and enables attribute revocation when dynamic users change their situation. {0,1}-LSSS access policy makes the proposal get highly expressive which supports any monotonic boolean formula. Security analysis and performance evaluations demonstrate that our scheme is secure and efficient.

A Secure Blockchain-Assisted Access Control Scheme for Smart Healthcare System in Fog Computing

IoT-based smart healthcare system allows doctors to monitor and diagnose patients remotely, which can greatly ease overcrowding in the hospitals and disequilibrium of medical resources, especially during the rage of COVID-19. However, the smart healthcare system generates enormous data which contains sensitive personal information. To protect patients’ privacy, we propose a secure blockchain-assisted access control scheme for smart healthcare system in fog computing. All the operations of users are recorded on the blockchain by smart contract in order to ensure transparency and reliability of the system. We present a blockchain-assisted Multi-Authority Attribute-Based Encryption (MA-ABE) scheme with keyword search to ensure the confidentiality of the data, avoid single point of failure and implement fine-grained access control of the system. IoT devices are limited in resources, therefore it is not practical to apply the blockchain-assisted MA-ABE scheme directly. To reduce the burdens of IoT devices, We outsource most of the computational tasks to fog nodes. Finally, the security and performance analysis demonstrate that the proposed system is reliable, practical, and efficient.

An Efficient Revocable and Searchable MA-ABE Scheme With Blockchain Assistance for C-IoT

Internet of Things (IoT) devices usually stores data on clouds for computational overhead offloading and easy data sharing. The data owners, as a result, usually have concerns about the security and privacy of their data stored in such cloud-assisted IoT (C-IoT) systems. Traditional encryption and search primitives, including attribute-based encryption (ABE) and public-key encryption with keyword search (PEKS), however, suffer from high overheads in decryption and revocation, and privacy leakage in search. To address these issues, we propose an efficient revocable and searchable multiauthority ABE (MA-ABE) scheme named ERS-ABE, which utilizes blockchain (BC) technology to implement keyword-based search and dynamic user management. ERS-ABE also adopts cloud-assisted decryption to improve the efficiency of IoT devices. It has been proven to be secure against the selective replayable chosen-ciphertext attacks and the chosen-keyword attacks under the random oracle model. The feasibility and efficiency of ERS-ABE have been evaluated through theoretical analysis and extensive simulation studies. The results indicate that EAR-ABE performs better over the state-of-the-art in both storage and computational overheads. Particularly, the operations that are usually done by a central server but taken by a BC in EAR-ABE cost only a few seconds.

A Survey of State-of-the-Art Multi-Authority Attribute Based Encryption Schemes in Cloud Environment

A Survey of State-of-the-Art Multi-Authority Attribute Based Encryption Schemes in Cloud Environment

An Anonymous and Outsourcing-Supported Multiauthority Access Control Scheme With Revocation for Edge-Enabled IIoT System

With the application of the Internet of Things and intelligent technologies in industrial systems, the manufacturing efficiency and product quality have been improved, leading to the development of the Industrial Internet of Things (IIoT). Uploading private data to the cloud may lead to data leakage without security protection. Thus, attribute-based encryption (ABE) is widely used to ensure data security and implement data access control, and some multiauthority ABE schemes are proposed to meet the requirement of attributes from different authorities, such as factory and government, which is more suitable for the IIoT system. However, the current multiauthority ABE schemes are with privacy leakage problems on attributes and low-efficiency issues. To address these problems, we propose a multiauthority ABE scheme, which protects users’ privacy by anonymizing attributes in authentication, reduces the computing burden of IIoT devices by adapting online/offline technique and outsourcing decryption to edge devices, and realizes effective attribute revocation. A formal security proof is presented that our scheme is replayable chosen ciphertext attack secure. Finally, we implement the proposed scheme, and experimental results show that our scheme is more efficient than the existing schemes.

Multiauthority Attribute-Based Encryption With Dynamic Membership From Lattices

Attribute-based encryption is useful for one-to-many encrypted message sending. However, most attribute-based encryption schemes authorize and issue attributes to users by a single authority. Such a scenario conflicts with practical requirements and may cause the key-escrow problem. Hence, decentralization of authority is a critical issue in attribute-based encryption. Besides, dynamic membership management is another important issue in attribute-based encryption. With dynamic membership management, a system may update the user’s attributes without affecting other users, making the system more flexible and practical. On the other hand, with the rapid development of quantum computers nowadays, encryption schemes based on traditional mathematical problems are at the risk of quantum attacks. Among the existing quantum-resistant mathematical architectures, lattice-based cryptography is the most widely studied. Thus, we propose a multi-authority attribute-based encryption scheme with dynamic membership from lattices to solve the above problems. Moreover, we also formally prove the security of the proposed scheme under the decisional learning with errors assumption.

Scalable, Confidential and Survivable Software Updates

Software update systems must guarantee high availability, integrity and security even in presence of cyber attacks. We propose the first survivable software update framework for the secure distribution of confidential updates that is based on a distributed infrastructure with no single points of failure. Previous works guarantee either survivability or confidentiality of software updates but do not ensure both properties. Our proposal is based on an original application of a multi-authority attribute-based encryption scheme in the context of decentralized access control management that avoids single-point-of-vulnerability. We describe the original framework, propose the protocols to implement it, and demonstrate its feasibility through a security and performance evaluation.

A Novel User Collusion-Resistant Decentralized Multi-Authority Attribute-Based Encryption Scheme Using the Deposit on a Blockchain

Recently, the concept of a decentralized data marketplace is getting much attention to exchange user data. Multi-authority attribute-based encryption (ABE), which can provide flexibility and user-centric access control, is previously widely used in decentralized data sharing applications and also becoming a foundation to build decentralized data trading applications. It is known that users in a multi-authority ABE system can collude by sharing their secret information for malicious purposes. To address this issue, the collusion-resistant multi-authority ABE model was introduced in which a unique global identifier (GID) is issued by the central authority (CA) to each user. Unfortunately, such approach cannot be used directly to build a decentralized data marketplace as (a) such intervention of the CA is directly against the main motivation of the decentralized trading platform and, mostly importantly, (b) the CA can exploit its full knowledge on users’ GID to launch various attacks against users. Motivated by these observations, this paper introduces a novel user collusion-resistant decentralized multi-authority ABE scheme for privacy preserving data trading systems. In the existing multi-authority ABE systems, users utilize his/her GID that is solely assigned by the CA to generate his/her secret keys throughout the collaboration with authorities and a user can compute multi-authority keys by combining the secret keys (stem from the same GID) in various ways. In the proposed system, the CA only has a partial knowledge of users’ GIDs, and thus, users’ privacy can be protected. On the other hand, we set the user’s own partial GID as a secret which can be used to withdraw his/her deposit to discourage any possible collusion among users.

A revocable and outsourced multi-authority attribute-based encryption scheme in fog computing

Fog computing is a revolutionary technology for the next generation to bridge the gap between cloud data centers and end-users. Fog computing is not a counterfeit for cloud computing but a persuasive counterpart. It also accredits by utilizing the network edge while still rendering the possibility to interact with the cloud. Nevertheless, the features of fog computing are encountering several security challenges. The security of end-users and/or fog servers brings a significant dilemma in implementing fog computing. Moreover, in conventional cloud computing, the attribute-based encryption (ABE) technology is not appropriate for end-users due to restricted computing resources, i.e., limited resources, high end-to-end delay, and transmission capability. Hence, the revocation and outsourcing mechanisms become inappropriate between end-users and cloud servers. In this regard, this paper recommends a multi-authority attribute-based encryption (MA-ABE) technique to support revocation and outsource the attributes to fog computation. We present an attribute revocation scheme based on cipher-text attribute-based encryption by introducing the attribute group keys. In this process, the secret keys are dynamically altered and realized the requirement of immediate attribute revocations. Hence, we provide the complete encryption and decryption process for end-users and fog servers based on multi-authority, attribute revocation, and outsourcing computation, while most of the existing scheme lack to incorporate all these parameters. Our scheme also outsources the complicated encryption and decryption tasks to the fog server that significantly improves the overall computation efficiency compared to the state-of-the-art work.

Traceable Multiauthority Attribute-Based Encryption with Outsourced Decryption and Hidden Policy for CIoT

Cloud-assisted Internet of Things (IoT) significantly facilitate IoT devices to outsource their data for high efficient management. Unfortunately, some unsettled security issues dramatically impact the popularity of IoT, such as illegal access and key escrow problem. Traditional public-key encryption can be used to guarantees data confidentiality, while it cannot achieve efficient data sharing. The attribute-based encryption (ABE) is the most promising way to ensure data security and to realize one-to-many fine-grained data sharing simultaneously. However, it cannot be well applied in the cloud-assisted IoT due to the complexity of its decryption and the decryption key leakage problem. To prevent the abuse of decryption rights, we propose a multiauthority ABE scheme with white-box traceability in this paper. Moreover, our scheme greatly lightens the overhead on devices by outsourcing the most decryption work to the cloud server. Besides, fully hidden policy is implemented to protect the privacy of the access policy. Our scheme is proved to be selectively secure against replayable chosen ciphertext attack (RCCA) under the random oracle model. Some theory analysis and simulation are described in the end.

A survey on multi-authority and decentralized attribute-based encryption

The introduction of attribute-based encryption (ABE) targets to achieve the implementation of single-to-numerous encryption; however, the sole authority challenge and the issue of distributed management of attributes are bottlenecks to its realization. Multi-authority attribute-based encryption (MA-ABE) where various attribute authorities (which may be independent of each other) control different attribute universe and are involved in the administration of attribute keys for decryption provides the necessary platform to undertake the implementation of fine-grained access regulation over shared data while achieving single-to-numerous encryption. In recent years, research into MA-ABE has seen rapid advancement, and we believe that it is a suitable solution to thwarting the key escrow problem as well as the problem of distributed management of attributes. This paper offers a thorough survey and examines the state-of-the-art of some traditional ABE as well as multi-authority attribute-based encryption schemes over the past decade. Furthermore, the survey gives detailed insights on some essential techniques as well as some classic concretely constructed algorithms. Moreover, we discuss an extension (the different directions) of MA-ABE and its progress since its inception. We also provide design principles of MA-ABE and also show comparisons between existing works on areas as security, performance, and functionality. This paper also discusses several interesting open problems. As far as we can tell, no comparable survey on MA-ABE exists in literature so far.

PCS-ABE (t, n): a secure threshold multi authority CP-ABE scheme based efficient access control systems for cloud environment

Cloud computing is a current phrase in marketing for an idea that has been recognized for years: Outsourcing. Cloud computing provides a large number of gratuities for each customer and enterprise agency. ‘Cloud model’ is more of a notion in which the data are hosted online and accessed at anytime-anywhere manner, on a pay-per-use model. However, the users may not fully trust the cloud service providers (CSPs) in that environment. So, it is hard to decide whether the cloud service provider (CSP) meets their expectations to provide the proper secrecy to users' shared data and privacy. Several access control schemes that allow, deny, or restrict users to have access to data have been proposed. Among these, the Attribute-Based Encryption (ABE) scheme has generally used to provide security efficiently in public managed cloud scheme storage. The earlier Attribute-Based Encryption (ABE) schemes have a single authority maintaining the whole attribute set and suffer from a single-point bottleneck problem. To resolve this issue, some Multi-Authority Attribute-Based Encryption (MA-ABE) schemes have proposed in which disjoint attribute sets are maintained separately, but the bottleneck problem still occurs. This paper involves multi-authority (MA) models, where multiple authorities mutually handle a uniform attribute set. It uses an efficient (t, n) threshold secret sharing scheme, in which n multiple authorities share the master key, and a legitimate user selects any t—out of n—authorities compute his/her secret_key. The results of security and performance analysis show that the proposed methodology is not only computationally secure whenever it is compromised by less than t—number of authorities, but still robust whenever at least t—number of authorities are active in the model. This paper uses an efficient encryption scheme to encrypt the plaintext message, which encrypts one byte at a time. It performs faster execution of encryption and reduces the hardware complexity.

Efficient Revocable Multi-Authority Attribute-Based Encryption for Cloud Storage

As is known, attribute-based encryption (ABE) is usually adopted for cloud storage, both for its achievement of fine-grained access control over data, and for its guarantee of data confidentiality. Nevertheless, single-authority attribute-based encryption (SA-ABE) has its obvious drawback in that only one attribute authority can assign the users' attributes, enabling the data to be shared only within the management domain of the attribute authority, while rendering multiple attribute authorities unable to share the data. On the other hand, multi-authority attribute-based encryption (MA-ABE) has its advantages over SA-ABE. It can not only satisfy the need for the fine-grained access control and confidentiality of data, but also make the data shared among different multiple attribute authorities. However, existing MA-ABE schemes are unsuitable for the devices with resources-constraint, because these schemes are all based on expensive bilinear pairing. Moreover, the major challenge of MA-ABE scheme is attribute revocation. So far, many solutions in this respect are not efficient enough. In this paper, on the basis of the elliptic curves cryptography, we propose an efficient revocable multi-authority attribute-based encryption (RMA-ABE) scheme for cloud storage. The security analysis indicates that the proposed scheme satisfies indistinguishable under adaptive chosen plaintext attack assuming hardness of the decisional Diffie-Hellman problem. Compared with the other schemes, the proposed scheme gets its advantages in that it is more economical in computation and storage.

Accountable and Revocable Large Universe Decentralized Multi-Authority Attribute-Based Encryption for Cloud-Aided IoT

The data collected, stored, shared, and accessed across different platforms in the dynamic IoT is mostly confidential and privacy-sensitive. Data security and access control issues urgently need to be addressed. Multi-authority attribute-based encryption (MA-ABE) is seen as a potential solution for addressing data access control security concerns in the dynamic IoT since it allows for dynamic access control over encrypted data. However, the existing key abuse problem is severely destroying the security access control of MA-ABE. The existing accountable attribute-based encryption schemes only support small attributes (users) universe and single authority. Moreover, they do not support revocation. Some schemes are inefficient since they are constructed in the composite order bilinear group. In this article, the author proposes the first accountable and revocable large universe decentralized multi-authority attribute-based encryption scheme with outsourcing decryption based on prime order bilinear groups. The proposed scheme allows for the dynamic capacity expansion of attributes, users, and authorities. An audit mechanism is given to judge if the suspicious key was leaked by a malicious user or by authorities and to determine the identity of the leaker. The malicious user who divulges key can be punished by user-attribute revocation. The revocation mechanism is resistant to collusion attacks undertaken by revoked users and non-revoked users. Meanwhile, it satisfies the requirements of forward and backward security. The proposed scheme is static security in the random oracle model under the q-DPBDHE2 assumption. To save resources, the outsourced decryption module is optional for users with restricted resources. According to the results of the performance analysis, it is suited for large-scale cross-domain cooperation in the dynamic cloud-aided IoT.

A Traceable and Revocable Multiauthority Attribute-Based Encryption Scheme with Fast Access

Multiauthority ciphertext-policy attribute-based encryption (MA-CP-ABE) is a promising technique for secure data sharing in cloud storage. As multiple users with same attributes have same decryption privilege in MA-CP-ABE, the identity of the decryption key owner cannot be accurately traced by the exposed decryption key. This will lead to the key abuse problem, for example, the malicious users may sell their decryption keys to others. In this paper, we first present a traceable MA-CP-ABE scheme supporting fast access and malicious users’ accountability. Then, we prove that the proposed scheme is adaptively secure under the symmetric external Diffie–Hellman assumption and fully traceable under the q -Strong Diffie–Hellman assumption. Finally, we design a traceable and revocable MA-CP-ABE system for secure and efficient cloud storage from the proposed scheme. When a malicious user leaks his decryption key, our proposed system can not only confirm his identity but also revoke his decryption privilege. Extensive efficiency analysis results indicate that our system requires only constant number of pairing operations for ciphertext data access.

On the Blockchain-Based Decentralized Data Sharing for Event Based Encryption to Combat Adversarial Attacks

It is human nature to anticipate events in the future and plan accordingly. As such, the possibility of letting future events trigger the decryption of a message is a form of an encryption mechanism we deem to be significant in today's information age. In this paper, we propose a variant of Attribute-Based Encryption (ABE), called Event-Based Encryption (EBE), that will help avoid adversarial attacks. In EBE, we attempt to decrypt the messages in the future after an event is confirmed. We illustrate how EBE can be employed by presenting a scenario where a will is decrypted when an individual has been confirmed dead. To achieve this, we introduce a decentralized data sharing network powered by the blockchain technology that ensures data undergoes a thorough vetting process before it is accepted to the network. This vetted data is useful in determining the facts needed for the confirmation of the occurrence of events and is also helpful in restricting adversarial attacks. Our approach utilizes multi-authority ABE schemes, Natural Language Processing (NLP) techniques, and a decentralized data-sharing platform to achieve our goal. The main contribution of this research is the enabling of multiple parties, each with thoroughly vetted proprietary data, to collaborate to confirm the occurrence of an event. This event confirmation should trigger the decryption of a message. We highlight the various applications of our approach and illustrate the practical and secure nature of EBE using numerical results.

Decentralized Attribute-Based Encryption and Signatures

This paper presents decentralized multi-authority attribute-based encryption and signature (DMA-ABE and DMA-ABS) schemes, in which no central authority exists and no global coordination is required except for the setting of a parameter for a prime order bilinear group and a hash function, which can be available from public documents, e.g., ISO and FIPS official documents. In the proposed DMA-ABE and DMA-ABS schemes, every process can be executed in a fully decentralized manner; any party can become an authority and issue a piece for a secret key to a user without interacting with any other party, and each user obtains a piece of his/her secret key from the associated authority without interacting with any other party. While enjoying such fully decentralized processes, the proposed schemes are still secure against collusion attacks, i.e., multiple pieces issued to a user by different authorities can form a collusion resistant secret key, composed of these pieces, of the user. The proposed ABE scheme is the first DMA-ABE for non-monotone relations (and more general relations), which is adaptively secure under the decisional linear (DLIN) assumption in the random oracle model. This paper also proposes the first DMA-ABS scheme for non-monotone relations (and more general relations), which is fully secure, adaptive-predicate unforgeable and perfect private, under the DLIN assumption in the random oracle model. DMA-ABS is a generalized notion of ring signatures. The efficiency of the proposed DMA-ABE and DMA-ABS schemes is comparable to those of the existing practical ABE and ABS schemes with comparable relations and security.

Decentralized ciphertext-policy attribute-based encryption schemes for lightweight devices

In a traditional attribute-based encryption (ABE) system, there is only one central authority who generates and hence knows the secret keys of all users, this problem is known as the key escrow problem. An ABE scheme which can deal with the aforementioned problem is so-called a decentralized (or multi-authority) ABE scheme. There have been several efforts to propose decentralized ABE schemes in the literature, and these schemes can enjoy some interesting properties such as fine-grained access control and full security. However, all of them suffer from two main weaknesses that are large secret key size and slow decryption time. These weaknesses are obviously not desirable for lightweight device applications such as Internet of Things applications.In this paper, we propose two decentralized ciphertext-policy attribute-based encryption schemes. Our proposed schemes have some nice properties such as constant-size secret key, fast decryption, optimized ciphertext size and fine-grained access control. Our schemes, as a result, could be seen as a solution for lightweight device applications. For completeness, we implement our schemes and give some concrete benchmarks.

A decentralized multi-authority ciphertext-policy attribute-based encryption with mediated obfuscation

To ensure security and obtain fine-grained data access control policies in many management domains, multi-authority attribute-based encryption (MA-ABE) schemes were presented and have been applied in cloud storage system. There exist certain scenes where the application domains managed by different attribute authorities ($$ AAs $$) often change, and hence domain managements require more autonomous and independent. However, most of existing schemes do not support flexible managements. In order to support dynamic managements, we propose a new decentralized ciphertext-policy MA-ABE scheme with mediated obfuscation (MA-DCP-ABE-WMO) where each of $$ AAs $$ works independently without any interaction with other $$ AAs $$. When issuing a secret key to a user, each of $$ AAs $$ uses his secret to compute a share of the system master secret. Data are encrypted under the public keys of attribute management domains. To resist collusion attack, a common pseudorandom function $$ PRF( \cdot ) $$ is shared among $$ AAs $$ and is used to randomize each user’s global identifier $$ Gid $$. The randomized $$ Gid $$ is adopted to unify all target messages which need to be reconstructed from different management domains. We first introduce the mediated obfuscation (MO) model into MA-ABE scheme to provide online service and the interaction works among data owner, data user and the mediator. In the MO model, we define a special functional encryption scheme where the function program can be coded into an element of the multiplicative cyclic group. We obfuscate the function by randomly selecting a blinding factor to conduct exponent arithmetic with the base of the function. A special input of the function is constructed to cancel the blinding factor when calling the obfuscated function. It makes other participants know nothing about the inner function program but can evaluate the function program. Furthermore, the MA-DCP-ABE-WMO scheme is proved to be secure. Compared with related schemes, our scheme is suitable to dynamic domain managements. When the management domains are added or removed, the workload to update original ciphertexts and private keys is dramatically reduced.

A REVIEW PAPER ON ATTRIBUTE-BASED ENCRYPTION FOR MESSAGE PRIVACY IN CLOUD

The notion of attribute-based encryption (ABE)was proposed as an economical alternative to public-keyinfrastructures. It is the set of descriptive attributes, used as anidentity to generate a secret key, as well as serving as theaccess structure that performs access control. ABE is also auseful building block in various cryptographic primitives suchas searchable encryption. . It successfully integratesEncryption and Access Control and is ideal for sharing secretsamong groups, especially in a Cloud environment. Mostdeveloped ABE schemes support key-policy or ciphertextpolicyaccess control in addition to other features such asdecentralized authority, efficient revocation and keydelegation. This paper surveys mainstream papers, analyzesmain features for desired ABE systems, and classifies theminto different categories. With this high-level guidance, futureresearchers can treat these features as individual modules andselect related ones to build their ABE systems on demand.For ABE, it is not realistic to trust a single authority tomonitor all attributes and hence distributing control over manyattribute-authorities is desirable.A multi-authority ABE scheme can be realized with a trustedcentral authority (CA) which issues part of the decryption keyaccording to a user's global identifier (GID). However, this CAmay have the power to decrypt every cipher text, and the useof a consistent GID allowed the attribute-authorities tocollectively build user's attributes. Decentralized ABE schemecan eliminate the burden of heavy communication andcollaborative computation. It is observed that privacypreservingdecentralized key-policy ABE scheme has claimedto achieve better privacy for users and is provably secure inthe standard model