Multi-authority Attribute-based Encryption Research Articles

Lattice-based multi-authority ciphertext-policy attribute-based searchable encryption with attribute revocation for cloud storage

Multi-authority attribute-based searchable encryption (MABSE) is an flexible and efficient way to securely share and search encrypted data. Compared with single-authority systems, MABSE has more complex access control policies and key management mechanism. However, most existing MABSE schemes rely on traditional number-theoretic assumptions, which maybe vulnerable to attack in the era of quantum-computers. Besides, the effective revocation of user attributes is also crucial in searchable encryption. To overcome these challenges, this paper proposes a new multi-authority ciphertext-policy attribute-based searchable encryption scheme for securely sharing encrypted data in the cloud. By calling Shamir’s threshold secret-sharing technology twice, we achieve co-management of the master key by attribute authorities and interactive generation of user private keys. Furthermore, the KUNodes algorithm is employed for attribute revocation, offering a mechanism to update private keys for non-revoked users. Compared to other schemes, MCP-ABSE-AR introduces multiple attribute authorities responsible for managing user attributes collectively. Additionally, it provides functionalities for keyword searching and attribute revocation. Finally, the proposed scheme is proved to be semantically secure under the decision learning with errors problem in the standard model.

Flexibly expressive and revocable multi-authority KP-ABE scheme from RLWE for Internet of Medical Things

The emergence of the Internet of Medical Things (IoMT) has presented numerous opportunities for the healthcare industry. It is anticipated to enhance the quality and efficiency of medical services, thus enhancing people’s overall quality of life. However, frequently occurring medical data leakage makes the protection of medical data and privacy in IoMT become a critical issue. Among the solutions, attribute-based encryption (ABE) has been a very promising solution due to its flexible and fine-grained access control to encrypted data. However, the majority of current ABE schemes are based on bilinear pairing and are vulnerable to quantum attacks. The available of multi-authority ABE schemes over lattice only support a single policy such as threshold or AND gate, and lack the ability to implement user or attribute revocation in a flexible manner. For the special algebra structure of the lattice based scheme, how to overcome them is still a challenge at present. Aiming at the above, we propose a novel multi-authority key-policy attribute based encryption (RM-KP-ABE) based on the Ring Learning With Errors (RLWE) assumption. It supports multi-valued attributes and {0,1}-LSSS access policy. This scheme allows multiple authorities to participate in key distribution and enables attribute revocation when dynamic users change their situation. {0,1}-LSSS access policy makes the proposal get highly expressive which supports any monotonic boolean formula. Security analysis and performance evaluations demonstrate that our scheme is secure and efficient.

A blockchain-enabled decentralized access control scheme using multi-authority attribute-based encryption for edge-assisted Internet of Things

More edge users opt to use Internet of Things (IoT) devices to collect their data (e.g., health data, social data, e-governance data, etc.), which are stored in central cloud service providers (CSPs). However, this compromises data privacy and creates issues with collusion attacks. Current ciphertext-policy attribute-based encryption (CP-ABE) schemes with and without blockchain have only partially addressed these issues. Ongoing challenges remain to be resolved, including large-universe attribute management, secret key verification, and malicious attribute authorities (AAs) tracking. Therefore, we propose a decentralized access control scheme (namely BLUMA-CPABE) integrating blockchain with multi-authority ciphertext-policy attribute-based encryption (MA-CP-ABE). The scheme not only supports large-universe, policy hiding, and AAs tracking, but it also utilizes on- and off-chain mechanisms to alleviate the computation burden of the blockchain. In addition, we develop a verifiable key distribution approach in which AAs are configured as blockchain consensus nodes capable of issuing, signing, validating, and disseminating secret keys as transactions on-chain. It guarantees the keys’ security and reliability. To incentivize authorities to control newly added attributes proactively for large-universe, we enhance the Proof-of-Authority (called PoA＋) consensus mechanism in multi-authority scenarios. It allows authorities to take turns proposing and confirming new blocks based on three contribution indicators: attribute management contribution, data decryption contribution, and block validation gain. The proposed scheme is proven statically secure while resisting collusion attacks. The experimental results demonstrate the feasibility and efficiency of our scheme.

Comparison of attribute-based encryption schemes in securing healthcare systems

E-health has become a top priority for healthcare organizations focused on advancing healthcare services. Thus, medical organizations have been widely adopting cloud services, resulting in the effective storage of sensitive data. To prevent privacy and security issues associated with the data, attribute-based encryption (ABE) has been a popular choice for encrypting private data. Likewise, the attribute-based access control (ABAC) technique has been widely adopted for controlling data access. Researchers have proposed electronic health record (EHR) systems using ABE techniques like ciphertext policy attribute-based encryption (CP-ABE), key policy attribute-based encryption (KP-ABE), and multi authority attribute-based encryption (MA-ABE). However, there is a lack of rigorous comparison among the various ABE schemes used in healthcare systems. To better understand the usability of ABE techniques in medical systems, we performed a comprehensive review and evaluation of the three popular ABE techniques by developing EHR systems using knowledge graphs with the same data but different encryption mechanisms. We have used the MIMIC-III dataset with varying record sizes for this study. This paper can help healthcare organizations or researchers using ABE in their systems to comprehend the correct usage scenario and the prospect of ABE deployment in the most recent technological evolution.

Ethical Encrypted Search Scheme for Medical Database

E-medical records are highly sensitive and require secure storage, typically in encrypted form. However, encrypting the records can make them difficult to search and utilize within existing medical database systems. Additionally, managing access to these records, especially when multiple authorities are involved, presents challenges in ensuring security and scalability.To address these issues, we propose an authorized searchable encryption scheme designed for a multi-authority setting. This scheme utilizes the RSA (Rivest-Shamir-Adleman) function to enable each authority to control and limit search capabilities based on clients' privileges. Furthermore, to enhance scalability, we employ multi-authority attribute-based encryption, allowing the authorization process to be streamlined even across policies from multiple authorities.We have conducted thorough security and cost analyses, as well as experimental evaluations, demonstrating that our proposed scheme introduces only moderate overhead to existing searchable encrypted systems. Keywords--e-medical system, cloud storage, forward security.

Shared Access Control using Triple DES in Decentralized Cloud

Abstract: As Cloud computing is a new emergent technology despite having many beneficial factors, it faces many threats in various ways. To give the security with degrading the performance. In this project we propose an access control model featured with the efficient key update function in data outsourcing environment. Our access control is based on the combination of triple DES and role based access control (RBAC). The certificate is distributed in the form of token generated by the system and sent through the mail for secure transaction. In Our project a user’s key is incorporated into the token which will be used to decrypt the triple DES based on role based. This 3DES and RBAC together makes hybrid encryption and can be accessed using token generated key of that role user. This significantly reduces the overheads in updating and distributing keys of all users simultaneously compared to the existing 3DES based schemes. Decentralized Multi-Authority ABE (DMA), which is derived from 3DES that is resilient to these types of misbehaviour. Our system distinguishes between a data owner (DO) principal and attribute authorities (AAs): the DO owns the data but allows AAs to arbitrate access by providing attribute labels to users. The data is protected by policy encryption over these attributes. Finally our system is highly secured as hybrid encryption on 3DES and RBAC to secure the data and key to decrypt is token generated and shared in the distributed system. The decentralized system helps in the parallel computing the secure transaction between the users efficiently with high performance in cloud

Robust, revocable, forward and backward adaptively secure attribute-based encryption with outsourced decryption1

Attribute based encryption (ABE) is a cryptographic technique allowing fine-grained access control by enabling one-to-many encryption. Existing ABE constructions suffer from at least one of the following limitations. First, single point of failure on security meaning that, once an authority is compromised, an adversary can either easily break the confidentiality of the encrypted data or effortlessly prevent legitimate users from accessing data; second, the lack of user and/or attribute revocation mechanism achieving forward and backward secrecy; third, a heavy computation workload is placed on data user; last but not least, the lack of adaptive security in standard models. In this paper, we propose the first single-point-of-failure free multi-authority ciphertext-policy ABE that simultaneously (1) ensures robustness for both decryption key issuing and access revocation while achieving both backward and forward secrecy; (2) enables outsourced decryption to reduce the decryption overhead for data users that have limited computational resources; and (3) achieves adaptive (full) security in standard models. The provided theoretical complexity comparison as well as the conducted experiments show that our construction introduces linear storage and computation overheads that occurs only once during its setup phase, which we believe to be a reasonable price to pay to achieve all previous features.

Redactable consortium blockchain with access control: Leveraging chameleon hash and multi-authority attribute-based encryption

A redactable blockchain allows authorized individuals to remove or replace undesirable content, offering the ability to remove illegal or unwanted information. Access control is a mechanism that limits data visibility and ensures that only authorized users can decrypt and access encrypted information, playing a crucial role in addressing privacy concerns and securing the data stored on a blockchain. Redactability and access control are both essential components when implementing a regulated consortium blockchain in real-world situations to ensure the secure sharing of data while removing undesirable content. We propose a decentralized consortium blockchain system prototype that supports redactability and access control. Through the development of a prototype blockchain system, we investigate the feasibility of combining these approaches and demonstrate that it is possible to implement a redactable blockchain with access control in a consortium blockchain setting.

A Secure Blockchain-Assisted Access Control Scheme for Smart Healthcare System in Fog Computing

IoT-based smart healthcare system allows doctors to monitor and diagnose patients remotely, which can greatly ease overcrowding in the hospitals and disequilibrium of medical resources, especially during the rage of COVID-19. However, the smart healthcare system generates enormous data which contains sensitive personal information. To protect patients’ privacy, we propose a secure blockchain-assisted access control scheme for smart healthcare system in fog computing. All the operations of users are recorded on the blockchain by smart contract in order to ensure transparency and reliability of the system. We present a blockchain-assisted Multi-Authority Attribute-Based Encryption (MA-ABE) scheme with keyword search to ensure the confidentiality of the data, avoid single point of failure and implement fine-grained access control of the system. IoT devices are limited in resources, therefore it is not practical to apply the blockchain-assisted MA-ABE scheme directly. To reduce the burdens of IoT devices, We outsource most of the computational tasks to fog nodes. Finally, the security and performance analysis demonstrate that the proposed system is reliable, practical, and efficient.

Decentralized Policy-Hidden Fine-Grained Redaction in Blockchain-Based IoT Systems.

Currently, decentralized redactable blockchains have been widely applied in IoT systems for secure and controllable data management. Unfortunately, existing works ignore policy privacy (i.e., the content of users' redaction policies), causing severe privacy leakage threats to users since users' policies usually contain large amounts of private information (e.g., health conditions and geographical locations) and limiting the applications in IoT systems. To bridge this research gap, we propose PFRB, a policy-hidden fine-grained redactable blockchain in decentralized blockchain-based IoT systems. PFRB follows the decentralized settings and fine-grained chameleon hash-based redaction in existing redactable blockchains. In addition, PFRB hides users' policies during policy matching such that apart from successful policy matching, users' policy contents cannot be inferred and valid redactions cannot be executed. Some main technical challenges include determining how to hide policy contents and support policy matching. Inspired by Newton's interpolation formula-based secret sharing, PFRB converts policy contents into polynomial parameters and utilizes multi-authority attribute-based encryption to further hide these parameters. Theoretical analysis proves the correctness and security against the chosen-plaintext attack. Extensive experiments on the FISCO blockchain platform and IoT devices show that PFRB achieves competitive efficiency over current redactable blockchains.

Multiauthority Attribute-Based Encryption for Assuring Data Deletion

In order to alleviate key escrow issue, the notion of multiauthority attribute-based encryption (MA-ABE) was presented, which was widely applied in cloud storage environment. In data sharing environment, secure data deletion is very crucial and challenging issue. Hence, in this article, we concentrate on verification of data deletion operation, i.e., assuring data deletion. To solve this problem, we put forward a system model, formal definition and security model of MA-ABE for assuring data deletion. Furthermore, we design a MA-ABE scheme for assuring data deletion, which is more practicable than the single authority ABE scheme. The designed scheme not only overcomes key escrow issue, but also resists collusion attack between malicious user and unauthorized user. In addition, our scheme utilizes merkle hash tree to obtain verifiable data deletion. Based on decisional bilinear Diffie-Hellman (DBDH) assumption, the scheme is proven to be secure under the selective-policy model. The experimental result indicates that the designed scheme is efficient for practical application.

A Hybrid Blockchain-Edge Architecture for Electronic Health Record Management With Attribute-Based Cryptographic Mechanisms

This paper presents a hybrid blockchain-edge architecture for managing Electronic Health Records (EHRs) with attribute-based cryptographic mechanisms. The architecture introduces a novel attribute-based signature aggregation (ABSA) scheme and multi-authority attribute-based encryption (MA-ABE) integrated with Paillier homomorphic encryption (HE) to protect patients’ anonymity and safeguard their EHRs. All the EHR activities and access control events are recorded permanently as blockchain transactions. We develop the ABSA module on Hyperledger Ursa cryptography library, MA-ABE module on OpenABE toolset, and blockchain network on Hyperledger Fabric. We measure the execution time of ABSA’s signing and verification functions, MA-ABE with different access policies and homomorphic encryption schemes, and compare the results with other existing blockchain-based EHR systems. We validate the access activities and authentication events recorded in blockchain transactions and evaluate the transaction throughput and latency using Hyperledger Caliper. The results show that the performance meets real-world scenarios’ requirements while safeguarding EHR and is robust against unauthorized retrievals.

Adaptively secure multi-authority attribute-based broadcast encryption in fog computing

Fog computing is considered an important development in cloud computing, with shorter response times, less data transfer load and a more secure distributed service architecture that can be accessed by a wide range of end devices. As with cloud computing, it also faces the challenge of how to securely distribute sensitive data. Ciphertext-Policy Attribute-based Broadcast Encryption (CP-ABBE) can protect sensitive data and provide fine-grained access control with user revocation. However, existing CP-ABBE schemes suffer many limitations when implemented in a fog computing environment: a single authority performs poorly in handling requests or data from many IoT devices, leading to system delays or limited functionality; expensive decryption costs make the computation and storage overheads unfriendly to devices with limited resources; these schemes are only proven selectively secure, meaning that security was proven in a weaker model. In this paper, using threshold secret sharing and decryption delegation, we propose an adaptively secure attribute-based multi-authority broadcast encryption (MA-ABBE) scheme that breaks through these limitations. The comparison and analysis results show that our scheme is practical and achieves adaptive security, enables user-side fast decryption and low storage overhead, and provides a secure and efficient option for protecting sensitive data in fog computing environments.

Data Protection of Accounting Information Based on Big Data and Cloud Computing

With the rapid development of Internet technology, mankind has entered the era of big data. The Internet records all kinds of information, and the amount of information generated in the future is in a state of explosive growth. With the development of enterprises, the data of accounting information have grown, and its security has also been threatened. Once the accounting information is leaked, it will have a great impact on the company. Therefore, it is very necessary to protect accounting information data. This paper aims to study how to protect accounting information data based on big data and cloud computing. Based on this, this paper proposes an attribute-based encryption method based on big data and cloud computing and analyzes the ABE scheme of a single authority and multiple authorities. The multiauthority ABE scheme can effectively solve the problems of low computational efficiency, poor security performance, and high time overhead in the single-authority ABE scheme. The experimental results of this paper show that, under the single-authority ABE scheme in the information data protection of enterprise A, the confidentiality of data is 54% at the highest and 46% at the lowest, which is generally not very high. In the information data protection of the multiauthority ABE scheme in enterprise A, the highest data confidentiality is 86% and the lowest is 79%. The highest is 32% more than the single-authority ABE scheme. The lowest is also 33% more than that. Generally speaking, the confidentiality of its data is very high. In terms of reliability, integrity, and effectiveness, the single-authority ABE scheme is not as good as the multiauthority ABE scheme. It shows that the multiauthority ABE scheme proposed in this paper has a powerful information data security protection function and can be effectively applied to accounting information data protection.

Secured and Privacy-Preserving Multi-Authority Access Control System for Cloud-Based Healthcare Data Sharing

With continuous advancements in Internet technology and the increased use of cryptographic techniques, the cloud has become the obvious choice for data sharing. Generally, the data are outsourced to cloud storage servers in encrypted form. Access control methods can be used on encrypted outsourced data to facilitate and regulate access. Multi-authority attribute-based encryption is a propitious technique to control who can access encrypted data in inter-domain applications such as sharing data between organizations, sharing data in healthcare, etc. The data owner may require the flexibility to share the data with known and unknown users. The known or closed-domain users may be internal employees of the organization, and unknown or open-domain users may be outside agencies, third-party users, etc. In the case of closed-domain users, the data owner becomes the key issuing authority, and in the case of open-domain users, various established attribute authorities perform the task of key issuance. Privacy preservation is also a crucial requirement in cloud-based data-sharing systems. This work proposes the SP-MAACS scheme, a secure and privacy-preserving multi-authority access control system for cloud-based healthcare data sharing. Both open and closed domain users are considered, and policy privacy is ensured by only disclosing the names of policy attributes. The values of the attributes are kept hidden. Characteristic comparison with similar existing schemes shows that our scheme simultaneously provides features such as multi-authority setting, expressive and flexible access policy structure, privacy preservation, and scalability. The performance analysis carried out by us shows that the decryption cost is reasonable enough. Furthermore, the scheme is demonstrated to be adaptively secure under the standard model.

Decentralized Multi-authority ABE for $$\textsf{NC}^1$$ from BDH

Decentralized Multi-authority ABE for $$\textsf{NC}^1$$ from BDH

An Efficient Revocable and Searchable MA-ABE Scheme With Blockchain Assistance for C-IoT

Internet of Things (IoT) devices usually stores data on clouds for computational overhead offloading and easy data sharing. The data owners, as a result, usually have concerns about the security and privacy of their data stored in such cloud-assisted IoT (C-IoT) systems. Traditional encryption and search primitives, including attribute-based encryption (ABE) and public-key encryption with keyword search (PEKS), however, suffer from high overheads in decryption and revocation, and privacy leakage in search. To address these issues, we propose an efficient revocable and searchable multiauthority ABE (MA-ABE) scheme named ERS-ABE, which utilizes blockchain (BC) technology to implement keyword-based search and dynamic user management. ERS-ABE also adopts cloud-assisted decryption to improve the efficiency of IoT devices. It has been proven to be secure against the selective replayable chosen-ciphertext attacks and the chosen-keyword attacks under the random oracle model. The feasibility and efficiency of ERS-ABE have been evaluated through theoretical analysis and extensive simulation studies. The results indicate that EAR-ABE performs better over the state-of-the-art in both storage and computational overheads. Particularly, the operations that are usually done by a central server but taken by a BC in EAR-ABE cost only a few seconds.

Janus: Hierarchical Multi-Blockchain-Based Access Control (HMBAC) for Multi-Authority and Multi-Domain Environments

Although there are several access control systems in the literature for flexible policy management in multi-authority and multi-domain environments, achieving interoperability and scalability, without relying on strong trust assumptions, is still an open challenge. We present HMBAC, a distributed fine-grained access control model for shared and dynamic multi-authority and multi-domain environments, along with Janus, a practical system for HMBAC policy enforcement. The proposed HMBAC model supports: (a) dynamic trust management between different authorities; (b) flexible access control policy enforcement, defined at the domain and cross-domain level; (c) a global source of truth for all entities, supported by an immutable, audit-friendly mechanism. Janus implements the HMBAC model and relies on the effective fusion of two core components. First, a Hierarchical Multi-Blockchain architecture that acts as a single access point that cannot be bypassed by users or authorities. Second, a Multi-Authority Attribute-Based Encryption protocol that supports flexible shared multi-owner encryption, where attribute keys from different authorities are combined to decrypt data distributedly stored in different authorities. Our approach was implemented using Hyperledger Fabric as the underlying blockchain, with the system components placed in Kubernetes Docker container pods. We experimentally validated the effectiveness and efficiency of Janus, while fully reproducible artifacts of both our implementation and our measurements are provided.

An Anonymous and Outsourcing-Supported Multiauthority Access Control Scheme With Revocation for Edge-Enabled IIoT System

With the application of the Internet of Things and intelligent technologies in industrial systems, the manufacturing efficiency and product quality have been improved, leading to the development of the Industrial Internet of Things (IIoT). Uploading private data to the cloud may lead to data leakage without security protection. Thus, attribute-based encryption (ABE) is widely used to ensure data security and implement data access control, and some multiauthority ABE schemes are proposed to meet the requirement of attributes from different authorities, such as factory and government, which is more suitable for the IIoT system. However, the current multiauthority ABE schemes are with privacy leakage problems on attributes and low-efficiency issues. To address these problems, we propose a multiauthority ABE scheme, which protects users’ privacy by anonymizing attributes in authentication, reduces the computing burden of IIoT devices by adapting online/offline technique and outsourcing decryption to edge devices, and realizes effective attribute revocation. A formal security proof is presented that our scheme is replayable chosen ciphertext attack secure. Finally, we implement the proposed scheme, and experimental results show that our scheme is more efficient than the existing schemes.

Blockchain-Based Multiple Authorities Attribute-Based Encryption for EHR Access Control Scheme

The Internet of Medical Things (IOMT) is critical in improving electronic device precision, dependability, and productivity. Researchers are driving the development of digital healthcare systems by connecting available medical resources and healthcare services. However, there are concerns about the security of sharing patients’ electronic health records. In response to the prevailing problems such as difficulties in sharing medical records between different hospitals and patients’ inability to grasp the usage of their medical records, we propose a patient-controlled and cloud-chain collaborative multi-authority attribute-based encryption for EHR sharing with verifiable outsourcing decryption and hiding access policies (VO-PH-MAABE). This scheme uses blockchain to store the validation parameters by utilizing its immutable, which data users use to verify the correctness of third-party outsourcing decryption results. In addition, we use policy-hiding technology to protect data privacy so that data security is guaranteed. Moreover, we use blockchain technology to establish trust among multiple authorities and utilize Shamir secret sharing and smart contracts to compute keys or tokens for attributes managed across multiple administrative domains, which avoids a single point of failure and reduces communication and computation overhead on the data user side. Finally, the ciphertext indistinguishability security under the chosen plaintext attack is demonstrated under the stochastic prediction model and compared with other schemes in terms of functionality, communication overhead, and computation overhead. The experimental results show the effectiveness of this scheme.