Multi-authority Ciphertext-policy Attribute-based Encryption Scheme Research Articles

A decentralized multi-authority CP-ABE scheme from LWE

As a cryptographic primitive supporting finer and richer access control, attribute-based encryption can provide more efficient, concise, secure and highly adaptive access control policies for cloud data, which has attracted the attention of many researchers. However, in a standard ABE scheme, the key can only be generated and issued by a central authority. The single authorization center has a heavy load and is vulnerable to attack. Once the center is paralyzed, it will bring serious security consequences. Multi-authorization center attribute encryption (MA-ABE) allows multiple parties to play an authoritative role, which can solve this problem.In this paper, we propose a MA-ABE scheme, which combines a global ID model, a two-stage sampling technique on a lattice and a monotonous linear secret sharing schemes (M-LSSS) to achieve a static security against arbitrary collusion in the random oracle model, in which the access policy of the scheme is expressed by DNF formula. Technically, our scheme is an improvement on the work of Datta et al. (2021), through this improvement, we can get shorter ciphertext and smaller key size.

Fine-grained access control of files stored in cloud storage with traceable and revocable multi-authority CP-ABE scheme

Fine-grained access control of files stored in cloud storage with traceable and revocable multi-authority CP-ABE scheme

Fine-grained access control of files stored in cloud storage with traceable and revocable multi-authority CP-ABE scheme

Fine-grained access control of files stored in cloud storage with traceable and revocable multi-authority CP-ABE scheme

RMA-CPABE : A multi-authority CPABE scheme with reduced ciphertext size for IoT devices

Internet of Things (IoT) generates a massive amount of data, which can be prone to huge data and privacy leaks unless given a proper access control. Ciphertext-policy attribute-based encryption (CP-ABE) is a well-known cryptographic mechanism that provides confidentiality and fine-grained access to stored data. In CP-ABE, a single trusted authority primarily handles attribute management and its revocation. However, in an environment like IoT, due to its heterogeneous nature, the attributes from multiple domains are evidently inherited by IoT devices and hence develop a need for a multi-authority scheme. Therefore, this paper proposes a novel multi-authority CP-ABE scheme with reduced-size ciphertext (RMA-CPABE) to provide secure access in fog-enabled IoT applications with attributes from multiple domains. This scheme considers the resource-constrained nature of IoT devices and reduces the ciphertext size in the sense that the ciphertext size does not increase linearly with the number of attributes; instead, it increases linearly with the number of multi-domain attribute authorities involved in the policy building. RMA-CPABE supports highly required functionalities like attribute update and outsourced decryption to reduce the computation load on the end devices. Further, the proposed scheme is the first to eliminate the most expensive ciphertext update operation during attribute revocation and addition, which is the biggest drawback of most of the existing schemes. The end-user in RMA-CPABE requires holding only a constant size key to access the ciphertexts securely. The security analysis proves that the proposed scheme is secure against Chosen-Ciphertext Attack (CCA) under multiple augmented Multi-Sequence of Exponents Decisional Diffie Hellman (maMSE-DDH) assumptions. The performance analysis shows that RMA-CPABE is suitable for IoT applications.

Toward Secure and Privacy-Preserving Cloud Data Sharing: Online/Offline Multiauthority CP-ABE With Hidden Policy

The continuous development of cloud storage service technology, secure access control, and privacy issues have attracted more and more attention. The previous ciphertext policy attribute-based encryption (CP-ABE) schemes with the function of hidden policy are only suitable for a single authority, and the existing multiauthority CP-ABE schemes do not realize the hidden policy. In addition, a large number of schemes utilize AND gate access policies so that expressiveness is weak. In this article, a scheme of online/offline multiauthority CP-ABE supporting the policy hiding function is proposed. The proposed scheme uses a combination of multiple attribute authorities (AAs) and one central authority (CA). Each AA, respectively, controls different attribute sets and distributes attribute private keys to users. Moreover, the AA can also relieve the computation overhead of the CA. In order to enhance the expressiveness than that of the existing schemes, we adopt the access policy of the linear secret sharing scheme. In the previous schemes, the access policy is used as the ciphertext component and uploaded directly to the cloud server. Especially, in the scenario of medical cloud data sharing, access policy may contain sensitive information. Therefore, the proposed scheme preserves privacy information by realizing the technology of the hidden policy. To improve the performance, our scheme utilizes the online/offline encryption to achieve a low computation cost in the online phase. Additionally, we also proved that the proposed scheme is secure based on the standard model.

Revocable and Privacy-Preserving Decentralized Data Sharing Framework for Fog-Assisted Internet of Things

Fog-assisted Internet of Things (IoT) can outsource the massive data of resource-constraint IoT devices to cloud and fog nodes (FNs). Meanwhile, it enables convenient and low time-delay data-sharing services, which relies heavily on high security of data confidentiality and fine-grained access control. Many efforts have been focused on this urgent requirement by leveraging ciphertext-policy attribute-based encryption (CP-ABE). However, when deployed in fog-assisted IoT systems for secure data sharing, it remains a challenging problem of how to preserve attribute privacy of access policy, and trace-then-revoke traitors (i.e., malicious users intending to leak decryption keys for illegal profits) efficiently and securely in such a large scale and decentralized environment with resource-constraint user devices, especially in consideration of misbehaving cloud and FNs. Therefore, in this article, we propose a revocable and privacy-preserving decentralized data-sharing framework (RPDDSF) by designing a large universe and multiauthority CP-ABE scheme with fully hidden access policy for secure data sharing in IoT systems to achieve user attribute privacy preserving with unbounded attribute universe and key escrow resistance suitable for large scale and decentralized environment. Based on this, with RPDDSF, anyone can efficiently expose the traitors and punish them by forward/backward secure revocation. Besides, RPDDSF is able to guarantee data integrity for both data owners (DOs) and users to resist misbehaving cloud and FNs, alongwith low computation overhead for resource-constraint devices. Finally, RPDDSF is proven to be secure with detailed security proofs, and its high efficiency and feasibility are demonstrated by extensive performance evaluations.

Practical revocable and multi-authority CP-ABE scheme from RLWE for Cloud Computing

Cloud computing provides enterprises and individuals with unlimited computing resources and expandable storage space. However, data leakage occurs frequently due to the lack of protection measures in the cloud storage environment. Consequently, how to protect data security in the cloud has become a critical issue. Attribute-based encryption (ABE) is an emerging encryption technique, which protects sensitive information and provides access control for data stored in the cloud. However, most of existing ABE schemes cannot resist quantum attacks and lack the capability of implementing flexible revocation on user or attribute when the attributes of a user change, which hinders the practical application of ABE. In this research, we present a Revocable and Multi-authority ciphertext-policy attribute-based encryption (RM-CP-ABE) from the ring learning with errors (RLWE) assumption, which supports multi-authority and multi-valued attributes. The scheme allows multiple authorities to involve in key distribution, and achieves the attribute revocation when the user’s access rights change. Also, the scheme enjoys reasonable computational cost and storage overhead, and is proven selectively secure under the RLWE assumption. The simulation results indicate that the performance of the proposed scheme is acceptable for practical applications.

MACFI: A multi-authority access control scheme with efficient ciphertext and secret key size for fog-enhanced IoT

With the rapid development of Internet of things (IoT), the number of connected devices and the data generated by them are increasing dramatically. This led to the development of paradigm fog computing, which facilitates data analysis and processing at the edge. Along with fog, cloud co-exists to provide massive storage, processing resources, etc. However, data storage and computation at multiple levels raise the risk of data security. Ciphertext-policy attribute-based encryption (CP-ABE) is a well-known cryptographic technique for providing fine-grained access control. Unfortunately, the existing multi-authority CP-ABE schemes are incompatible with resource-limited IoT devices as the ciphertext and secret key size grow linearly with the number of attributes. Therefore, we propose a multi-authority CP-ABE scheme named MACFI, where the ciphertext and secret key size are efficient. The size of the secret key held by the user is constant irrespective of the number of attributes. And, the ciphertext size increases linearly with the number of authorities rather than the number of attributes. Further, expensive decryption operations are outsourced to fog, which reduces the computation overhead of data users. Additionally, the overall encryption and decryption time are highly efficient. According to security and performance analysis, MACFI is secure and suitable for IoT applications.

Multiauthority Attribute-Based Encryption with Traceable and Dynamic Policy Updating

Ciphertext policy attribute-based encryption (CP-ABE) is an encryption mechanism that can provide fine-grained access control and adequate cloud storage security for Internet of Things (IoTs). In this field, the original CP-ABE scheme usually has only a single trusted authority, which will become a bottleneck in IoTs. In addition, different users may illegally share their private keys to obtain improper benefits. Besides, the data owners also require the flexibility to change their access policy. In this paper, we construct a multiauthority CP-ABE scheme on prime order groups over a large attribute universe. Our scheme can support white-box traceability along with policy updates to solve the abovementioned three problems and, thus, can fix the potential requirements of IoTs. More precisely, the proposed scheme supports multiple authority, white box traceability, large attribute domains, access policy updates, and high expressiveness. We prove that our designed scheme is static secure and traceable secure based on the state-of-the-art security models. Moreover, by theoretical comparison, our scheme has better performance than other schemes. Finally, extensive experimental comparisons show that our proposed algorithm can be better than the baseline algorithms.

A Blockchain-based access control scheme with multiple attribute authorities for secure cloud data sharing

Abstract Ciphertext-policy attribute-based encryption(CP-ABE) has been widely studied and used in access control schemes for secure data sharing. Since in most of the existing attribute-based encryption methods, all user attributes are managed by a single central authority, it is easy to cause a single point of failure. Therefore, several multi-authority CP-ABE schemes are proposed to manage user attributes by multiple authorities. However, these schemes still do not eliminate the single point of failure in essence or suffer from high computation and communication overhead on data users. In this paper, we propose a Blockchain-based Multi-authority Access Control scheme called BMAC for sharing data securely. Shamir secret sharing scheme and permissioned blockchain (Hyperledger Fabric) are introduced to implement that each attribute is jointly managed by multiple authorities to avoid single point of failure. In addition, we take advantage of blockchain technology to establish trust among multiple authorities and exploit smart contracts to compute tokens for attributes managed across multiple management domains, which reduces communication and computation overhead on the data user side. Moreover, blockchain helps to record the access control process in a secure and auditable way. Finally, we analyze the security of the proposed algorithm. Further analysis and comparison show the performance of the proposed method.

Practical traceable multi-authority CP-ABE with outsourcing decryption and access policy updation

Multi-authority ciphertext policy attribute-based encryption (CP-ABE) is one of the promising approaches where multiple authorities issue and manage various attributes to achieve fine-grained access control on stored data in cloud platforms. However, the practical use of multi-authority CP-ABE (MCP-ABE) requires satisfaction of different features. Firstly, in MCP-ABE, users having the same set of attributes must share the same decryption privileges. This may potentially lead to exposure of decryption keys by some malicious users. Thus, there is a need of designing MCP-ABE with traceability to overcome this problem. Secondly, as the cost of decryption increases with the complexity of access policy, it is preferred to provide the functionality of outsourcing decryption to reduce the computational burden on the user. Finally, the data owners must have flexibility to change the access policy. Hence, policy updation must be an integral part of MCP-ABE scheme. In this paper, we construct a new multi-authority CP-ABE scheme over large attribute universe with decentralization of authorities that supports white-box traceability along with policy updation and outsourcing decryption. Our proposed cryptosystem is built on prime order groups and supports monotonic access structures. These features improve efficiency and expressiveness of our system. We implemented our proposed cryptosystem in Charm cryptographic framework and analyzed its performance with a diverse set of test cases.

Decentralized, Revocable and Verifiable Attribute-Based Encryption in Hybrid Cloud System

Cloud can provide storage space and services for data owners to host their data, where data privacy and confidentiality become critical issues. Ciphertext policy attribute-based encryption (CP-ABE) is one of the most suitable methods to protect data privacy and provide structured access control. In this paper, we propose a multi-authority CP-ABE scheme with a direct attribute revocation mechanism, cause revocation is an inevitable problem in the application process. Under our proposed revocation mechanism, the remaining users need not to update their secret keys when revocation happens. It relies on the matching of public keys’ version and ciphertext’ version. In a cloud storage model, the update of ciphertext is executed by public cloud, which cannot be fully trusted by data owners. In this case, we propose a hybrid CP-ABE cloud storage model aiming at solving the public cloud trust management problem. The data owners can authorize private cloud to verify whether their ciphertexts have been updated to the newest version. In addition, we prove our construction secure in selective-CPA model. Finally, we compare our scheme with similar multi-authority CP-ABE schemes from functionality, communication overhead and computation cost. The simulation results show that our scheme is more efficient than similar works in encryption, decryption and revocation stages.

Secure and Efficient Attribute-Based Access Control for Multiauthority Cloud Storage

Cloud storage facilitates both individuals and enterprises to cost effectively share their data over the Internet. However, this also brings difficult challenges to the access control of shared data since few cloud servers can be fully trusted. Ciphertext-policy attribute-based encryption (CP-ABE) is a promising approach that enables the data owners themselves to place fine-grained and cryptographically-enforced access control over outsourced data. In this paper, we present secure and cost-effective attribute-based data access control for cloud storage systems. Specifically, we construct a multiauthority CP-ABE scheme that features: 1) the system does not need a fully trusted central authority, and all attribute authorities independently issue secret keys for users; 2) each attribute authority can dynamically remove any user from its domain such that those revoked users cannot access subsequently outsourced data; 3) cloud servers can update the encrypted data from the current time period to the next one such that the revoked users cannot access those previously available data; and 4) the update of secret keys and ciphertext is performed in a public way. We show the merits of our scheme by comparing it with the related works, and further implement it to demonstrate its practicality. In addition, the proposed scheme is proven secure in the random oracle model.

Achieving Collaborative Cloud Data Storage by Key-Escrow-Free Multi-Authority CP-ABE Scheme with Dual-Revocation

Nowadays, more and more users store their data in cloud storage servers for great convenience and real benefits offered by the service, so cloud data storage becomes one of the desirable services provided by cloud service providers. Multi-Authority Ciphertext-Policy Attribute-Based Encryption (MA-CP-ABE) is an emerging cryptographic solution to data access control for large-scale collaborative cloud storage service, which allows any data owner to outsource the data to cloud data storage in order to enable users from collaborating domains or organizations to access the outsourced data. However, the existing MA-CP-ABE schemes cannot be directly applied to collaborative cloud storage services as data access control due to the key escrow problem and the absence of dual revocation mechanism (user revocation and attribute revocation). By addressing these issues, this paper presents a Key-Escrow- Free Multi-Authority Ciphertext-Policy Attribute-Based Encryption Scheme with Dual-Revocation by introducing ＂the essential attribute＂ and making use of a certificate authority apart from attribute authorities. Compared with the existing MA-CP-ABE schemes, the proposed scheme is the most suitable one to enable data access control for collaborative cloud storage systems. Furthermore, the security and performance analysis indicates that our scheme is more secure and reasonably efficient to be applied to practical scenarios as collaborative cloud storage systems.

Efficient large-universe multi-authority ciphertext-policy attribute-based encryption with white-box traceability

Traceable multi-authority ciphertext-policy attribute-based encryption (CP-ABE) is a practical encryption method that can achieve user traceability and fine-grained access control simultaneously. However, existing traceable multi-authority CP-ABE schemes have two main limitations that prevent them from practical applications. First, these schemes only support small universe: the attributes must be fixed at system setup and the attribute space is restricted to polynomial size. Second, the schemes are either less expressive (the access policy is limited to “AND gates with wildcard) or inefficient (the system is constructed in composite order bilinear groups). To address these limitations, we present a traceable large universe multi-authority CP-ABE scheme, and further prove that it is statically secure in the random oracle model. Compared with existing traceable multi-authority CP-ABE schemes, the proposed scheme has four advantages. First, the attributes are not fixed at setup and the attribute universe is not bounded to polynomial size. Second, the ciphertext polices can be expressed as any monotone access structures. Third, the proposed scheme is constructed in prime order groups, which makes this scheme more efficient than those in composite order bilinear groups. Finally, the proposed scheme requires neither a central authority nor an identity table for tracing.

Securing Outsourced Data in the Multi-Authority Cloud with Fine-Grained Access Control and Efficient Attribute Revocation

Data outsourcing is a promising service for data owners, where their data are stored on a cloud storage provider. Since the cloud is not fully trusted, data access control has become a challenging issue in the Cloud Storage System (CSS). Ciphertext-Policy Attribute-Based Encryption (CP-ABE) is a feasible technique for ensuring access control in the CSS, where an attribute authority is responsible to manage attributes and distribute keys. In this paper, we propose a novel revocable Multi-Authority CP-ABE scheme, in which the access policy can be constructed as an arbitrary tree rather than a matrix used by existing schemes. The tree-like policy makes our scheme more flexible. Consequently, the encryption, decryption and attribute revocation operations are also more efficient. Our scheme is also proved to be secure under the standard assumption. It can resist user collusion attack, while the attribute revocation operation also achieves both forward security and backward security. Simulation results show that our scheme is highly efficient

Mobile edge computing and field trial results for 5G low latency scenario

In most existing CP-ABE schemes, there is only one authority in the system and all the public keys and private keys are issued by this authority, which incurs ciphertext size and computation costs in the encryption and decryption operations that depend at least linearly on the number of attributes involved in the access policy. We propose an efficient multi-authority CP-ABE scheme in which the authorities need not interact to generate public information during the system initialization phase. Our scheme has constant ciphertext length and a constant number of pairing computations. Our scheme can be proven CPA-secure in random oracle model under the decision q-BDHE assumption. When user's attributes revocation occurs, the scheme transfers most re-encryption work to the cloud service provider, reducing the data owner's computational cost on the premise of security. Finally the analysis and simulation result show that the schemes proposed in this thesis ensure the privacy and secure access of sensitive data stored in the cloud server, and be able to cope with the dynamic changes of users' access privileges in large-scale systems. Besides, the multi-authority ABE eliminates the key escrow problem, achieves the length of ciphertext optimization and enhances the efficiency of the encryption and decryption operations.

Expressive, Efficient, and Revocable Data Access Control for Multi-Authority Cloud Storage

Data access control is an effective way to ensure the data security in the cloud. Due to data outsourcing and untrusted cloud servers, the data access control becomes a challenging issue in cloud storage systems. Ciphertext-Policy Attribute-based Encryption (CP-ABE) is regarded as one of the most suitable technologies for data access control in cloud storage, because it gives data owners more direct control on access policies. However, it is difficult to directly apply existing CP-ABE schemes to data access control for cloud storage systems because of the attribute revocation problem. In this paper, we design an expressive, efficient and revocable data access control scheme for multi-authority cloud storage systems, where there are multiple authorities co-exist and each authority is able to issue attributes independently. Specifically, we propose a revocable multi-authority CP-ABE scheme, and apply it as the underlying techniques to design the data access control scheme. Our attribute revocation method can efficiently achieve both forward security and backward security. The analysis and simulation results show that our proposed data access control scheme is secure in the random oracle model and is more efficient than previous works.

DAC-MACS: Effective Data Access Control for Multiauthority Cloud Storage Systems

Data access control is an effective way to ensure data security in the cloud. However, due to data outsourcing and untrusted cloud servers, the data access control becomes a challenging issue in cloud storage systems. Existing access control schemes are no longer applicable to cloud storage systems, because they either produce multiple encrypted copies of the same data or require a fully trusted cloud server. Ciphertext-policy attribute-based encryption (CP-ABE) is a promising technique for access control of encrypted data. However, due to the inefficiency of decryption and revocation, existing CP-ABE schemes cannot be directly applied to construct a data access control scheme for multiauthority cloud storage systems, where users may hold attributes from multiple authorities. In this paper, we propose data access control for multiauthority cloud storage (DAC-MACS), an effective and secure data access control scheme with efficient decryption and revocation. Specifically, we construct a new multiauthority CP-ABE scheme with efficient decryption, and also design an efficient attribute revocation method that can achieve both forward security and backward security. We further propose an extensive data access control scheme (EDAC-MACS), which is secure under weaker security assumptions.

AGREE: exploiting energy harvesting to support data-centric access control in WSNs

This work is motivated by a general question: can energy harvesting capabilities embedded in modern sensor nodes be exploited so as to support security mechanisms which otherwise would be too demanding and hardly viable? More specifically, in this work we focus on the support of extremely powerful, but complex, fine-grained data-centric access control mechanisms based on multi-authority Ciphertext Policy Attribute Based Encryption (CP-ABE). By integrating access control policies into the (encrypted) data, such mechanisms do not require any server-based access control infrastructure and are thus highly desirable in many wireless sensor network scenarios. However, as concretely shown by a proof-of-concept implementation first carried out in this paper on TelosB and MicaZ motes, computational complexity and energy toll of state-of-the-art multi-authority CP-ABE schemes is still critical. We thus show how to mitigate the relatively large energy consumption of the CP-ABE cryptographic operations by proposing AGREE (Access control for GREEn wireless sensor networks), a framework that exploits energy harvesting opportunities to pre-compute and cache suitably chosen CP-ABE-encrypted keys, so as to minimize the need to perform CP-ABE encryptions when no energy from harvesting is available. We assess the performance of AGREE by means of simulation and actual implementation, validating its operation with real-world energy-harvesting traces collected indoors by TelosB motes equipped with photovoltaic cells, as well as public available traces of radiant light energy. Our results show that complex security mechanisms may become significantly less demanding when implemented so as to take advantage of energy harvesting opportunities.