Policy Attribute-based Encryption Scheme Research Articles

MRLWE-CP-ABE: A revocable CP-ABE for post-quantum cryptography

Abstract We address the problem of user fast revocation in the lattice-based Ciphertext Policy Attribute-Based Encryption (CP-ABE) by extending the scheme originally introduced by Zhang and Zhang [Zhang J, Zhang Z. A ciphertext policy attribute-based encryption scheme without pairings. In: International Conference on Information Security and Cryptology. Springer; 2011. p. 324–40. doi: https://doi.org/10.1007/978-3-642-34704-7_23.]. While a lot of work exists on the construction of revocable schemes for CP-ABE based on pairings, works based on lattices are not so common, and – to the best of our knowledge – we introduce the first server-aided revocation scheme in a lattice-based CP-ABE scheme, hence being embedded in a post-quantum secure environment. In particular, we rely on semi-trusted “mediators” to provide a multi-step decryption capable of handling mediation without re-encryption. We comment on the scheme and its application, and we provide performance experiments on a prototype implementation in the Attribute-Based Encryption spin-off library of Palisade to evaluate the overhead compared with the original scheme.

A Boolean circuit-based revocable ciphertext policy attribute-based encryption scheme

A Boolean circuit-based revocable ciphertext policy attribute-based encryption scheme

Revocable and Traceable Undeniable Attribute-Based Encryption in Cloud-Enabled E-Health Systems.

The emerging cloud storage technology has significantly improved efficiency and productivity in the traditional electronic healthcare field. However, it has also brought about many security concerns. Ciphertext policy attribute-based encryption (CP-ABE) holds immense potential in achieving fine-grained access control, providing robust security for electronic healthcare data in the cloud. However, current CP-ABE schemes still face issues such as inflexible attribute revocation, relatively lower computational capabilities, and key management. To address these issues, this paper introduces a revocable and traceable undeniable ciphertext policy attribute-based encryption scheme (MA-RUABE). MA-RUABE not only enables fast and accurate data traceability, effectively preventing malicious user key leakage, but also includes a direct revocation feature, significantly enhancing computational efficiency. Furthermore, the introduction of a multi-permission mechanism resolves the issue of centralization of power caused by single-attribute permissions. Furthermore, a security analysis demonstrates that our system ensures resilience against chosen plaintext attacks. Experimental results demonstrate that MA-RUABE incurs lower computational overhead, effectively enhancing system performance and ensuring data-sharing security in cloud-based electronic healthcare systems.

An Improved Pairing-Free Ciphertext Policy Framework for IoT

Internet of Things (IoT) enables devices to get connected to the internet. Once they are connected, they behave as smart devices thereby releasing sensitive data periodically. There is a necessity to preserve the confidentiality and integrity of this data during transmission in public communication channels and also permitting only legitimate users to access their data A key challenge of smart networks is to establish a secure end-to-end data communication architecture by addressing the security vulnerabilities of data users and smart devices. The objective of this research work is to create a framework encompassing Ciphertext policy Attribute-based Encryption scheme using block encryption and BLAKE hashing technique. An improved Pairing-Free-Ciphertext policy Attribute-based encryption algorithm has been developed to overcome the aforementioned challenges. Further, a comparative study has been performed between the proposed scheme and the different encryption algorithms. It is found that the proposed scheme scores well over the already existing schemes. The scheme is evaluated in terms of execution time and communication overhead. The robustness of the proposed scheme is also analyzed from the perspective of several security goals.

Offline/Online lattice-based ciphertext policy attribute-based encryption

Attribute Based Encryption (ABE) is a new public key encryption scheme which allows users to encrypt and decrypt messages based on user attributes, and it can enforce fine grained access control over the encrypted data. However, encryption and key generation computational costs grow with the complexity of the access policy or number of attributes, which makes it unsuitable for mobile device scenario.To address this problem, we propose an offline/online lattice-based ciphertext policy attribute-based encryption scheme under the Ring Learning with Errors (R-LWE) assumption where the computations for the algorithms are split into two phases: offline and online. In the process of generating the private key, the offline stage generates the intermediate private key before the attributes are known, and the online stage generates the corresponding private key based on the attributes. In the encryption process, the offline stage generates the intermediate ciphertext before the plaintext message and access policy are known, and preprocesses the complex computations required for encryption. After the online stage knows the plaintext message and access policy, it only needs to perform a small amount of simple computations to generate the final ciphertext. Compared with the Learning with Errors (LWE) based attribute-based encryption scheme, our scheme has better computational performance. Compared with the regular lattice based attribute based encryption scheme, our scheme is suitable for mobile devices. Compared with the attribute-based encryption schemes based on bilinear pairing, our scheme is resistant against quantum computing attacks.

An Expressive Fully Policy-Hidden Ciphertext Policy Attribute-Based Encryption Scheme With Credible Verification Based on Blockchain

As the public cloud becomes one of the leading ways in data-sharing nowadays, data confidentiality and user privacy are increasingly critical. Partially policy-hidden ciphertext policy attribute-based encryption (CP-ABE) can effectively protect data confidentiality while reducing privacy leakage by hiding part of the access structure. However, it cannot satisfy the need of data sharing in the public cloud with complex users and large amounts of data, both in terms of less expressive access structures and limited granularity of policy hiding. Moreover, the verification of access right to shared data and correctness of decryption are ignored or conducted by an untrusted third party, and the prime-order groups are seldom considered in the expressive policy-hidden schemes. This article proposes a fully policy-hidden CP-ABE scheme constructed on linear secret sharing scheme (LSSS) access structure and prime-order groups for public cloud data sharing. To help users decrypt, hidden vector encryption (HVE) with a “convert step” is applied, which is more compatible with CP-ABE. Meanwhile, decentralized credible verification of access right to shared data and correctness of decryption based on blockchain are also provided. We prove the security of our scheme rigorously and compare the scheme with others comprehensively. The results show that our scheme performs better.

Lightweight VANET Architecture for Efficient Secure Data Transmission using CPABE & IBOOS

Cloud computing is a network access concept that provides simple, on-demand network access to a shared pool of customizable computing resources (such as networks, servers, storage, applications, and services) that can be quickly provided and released with minimal administrative effort or service provider involvement. The idea of having a communication node on-board a vehicle that may make wireless connections with other adjacent communication nodes visible in the radio range is referred to as a Vehicular Adhoc Network (VANET). The main focus of this paper is to design lightweight Vehicular Adhoc Network architecture for efficient secure data transmission. An improved Ciphertext Policy Attribute Based Encryption scheme and Identity Based offline/online Signature scheme are proposed to reduce the computational cost, storage overhead and communication overhead in vehicular ad-hoc network. Finally, concluded that the proposed work yields high performance than the existing work.

Efficient access control with traceability and user revocation in IoT

With the universality and availability of Internet of Things (IoT), data privacy protection in IoT has become a hot issue. As a branch of attribute-based encryption (ABE), ciphertext policy attribute-based encryption (CP-ABE) is widely used in IoT to offer flexible one-to-many encryption. However, in IoT, different mobile devices share messages collected, transmission of large amounts of data brings huge burdens to mobile devices. Efficiency is a bottleneck which restricts the wide application and adoption of CP-ABE in Internet of things. Besides, the decryption key in CP-ABE is shared by multiple users with the same attribute, once the key disclosure occurs, it is non-trivial for the system to tell who maliciously leaked the key. Moreover, if the malicious mobile device is not revoked in time, more security threats will be brought to the system. These problems hinder the application of CP-ABE in IoT. Motivated by the actual need, a scheme called traceable and revocable ciphertext policy attribute-based encryption scheme with constant-size ciphertext and key is proposed in this paper. Compared with the existing schemes, our proposed scheme has the following advantages: (1) Malicious users can be traced; (2) Users exiting the system and misbehaving users are revoked in time, so that they no longer have access to the encrypted data stored in the cloud server; (3) Constant-size ciphertext and key not only improve the efficiency of transmission, but also greatly reduce the time spent on decryption operation; (4) The storage overhead for traceability is constant. Finally, the formal security proof and experiment has been conducted to demonstrate the feasibility of our scheme.

O3-R-CP-ABE: An Efficient and Revocable Attribute-Based Encryption Scheme in the Cloud-Assisted IoMT System

With the processes of collecting, analyzing, and transmitting the data in the Internet of Things (IoT), the Internet of Medical Things (IoMT) comprises the medical equipment and applications connected to the healthcare system and offers an entity with real time, remote measurement, and analysis of healthcare data. However, the IoMT ecosystem deals with some great challenges in terms of security, such as privacy leaking, eavesdropping, unauthorized access, delayed detection of life-threatening episodes, and so forth. All these negative effects seriously impede the implementation of the IoMT ecosystem. To overcome these obstacles, this article presents an efficient, outsourced online/offline revocable ciphertext policy attribute-based encryption scheme with the aid of cloud servers and blockchains in the IoMT ecosystem. Our proposal achieves the characteristics of fine-grained access control, fast encryption, outsourced decryption, user revocation, and ciphertext verification. It is noteworthy that based on the chameleon hash function, we construct the private key of the data user with collision resistance, semantically secure, and key-exposure free to achieve revocation. To the best of our knowledge, this is the first protocol for a revocation mechanism by means of the chameleon hash function. Through formal analysis, it is proven to be secure in a selectively replayable chosen-ciphertext attack (RCCA) game. Finally, this scheme is implemented with the Java pairing-based cryptography library, and the simulation results demonstrate that it enables high efficiency and practicality, as well as strong reliability for the IoMT ecosystem.

Cloud-based Secure Healthcare Framework by using Enhanced Ciphertext Policy Attribute-Based Encryption Scheme

Cloud computing is an emerging technology that has been used to provide better healthcare services to the users because of its convenient and economical features. Noted that the healthcare services required fast and reliable data sharing at anytime from anywhere for better monitoring and decision making in medical requirements. However, the privacy and integrity of electronic healthcare record become a significant issue during data sharing and outsourcing in Cloud. The data privacy of clients/patients is important in healthcare services where exposure of the data to unauthorized parties is unexceptional. In order to address this security loophole, this paper presents a Cloud-based Secure Healthcare Framework (SecHS) to offer safe access to healthcare and medical data. Specifically, this paper enhance the Ciphertext Policy Attribute-Based Encryption (CP-ABE) scheme by adding two more modules which aims to provide fine-grained access control and offer privacy and integrity of data. It facilitates encryption and hashing schemes. The proposed framework is compared with existing frameworks that used CP-ABE scheme. It shows the SecHS offers better features towards securing the healthcare services data. Optimistically, data security requirements such as privacy, integrity and fine-grained access control are required to effectively proposed for assuring data sharing in the Cloud environment.

A Multi-User Ciphertext Policy Attribute-Based Encryption Scheme with Keyword Search for Medical Cloud System

Population aging is currently a tough problem of many countries. How to utilize modern technologies (including both information and medical technologies) to improve the service quality of health information is an important issue. Personal Health Record (PHR) could be regarded as a kind of health information records of individuals. A ciphertext policy attribute-based encryption (CP-ABE) is a cryptographic primitive for fine-grained access control of outsourced data in clouds. In order to enable patients to effectively store his medical records and PHR data in medical clouds, we propose an improved multi-user CP-ABE scheme with the functionality of keyword search which enables data users to seek for specific ciphertext in the cloud server by using a specific keyword. Additionally, we adopt an independent proxy server in the proposed system architecture to isolate the communication between clients and the cloud server, so as to prevent cloud servers from suffering direct attacks and also reduce the computational loading of cloud servers. Compared with the previous approach, the proposed encryption algorithm takes less running time and the ciphertext length is also relatively short. Moreover, the procedures of re-encryption and pre-decryption only require one exponentiation computation, respectively.

An online/offline distributed attribute-based authentication scheme

Attribute-based authentication is an effective cryptography mechanism, which makes it possible for service providers to implement fine-grained access control on cloud resources. Although many attribute-based authentication schemes have been proposed, most of them only support single attribute authority and users have to perform a large amount of computation in the authentication phase. By extending the ciphertext policy attribute-based encryption scheme of Rouselakis et al, a distributed attribute-based authentication scheme was designed. The feature of the new scheme is to optimize the online computation efficiency of both service providers and users, i.e., by introducing the technique of online/offline attribute-based encryption, the online computational burden of semi trusted servers is greatly reduced. On the other hand, by introducing outsourcing decryption, users’ computation in the authentication stage is independent of the size of underlying access structures. Compared with previous schemes, the new scheme satisfies several ideal properties, that is, introducing distributed authorities, supporting outsourcing computation, satisfying anonymity and unlinkability, and so on.

Large universe attribute based access control with efficient decryption in cloud storage system

Ciphertext Policy Attribute Based Encryption scheme is a promising technique for access control in the cloud storage, since it allows the data owner to define access policy over the outsourced data. However, the existing attribute based access control mechanism in the cloud storage is based on small universe construction, where the attribute set is defined at setup, and the size of the public parameters scales with the number of attributes. A large number of new attributes need to be added to the system over time, small universe attribute based access control is no longer suitable for cloud storage, whereas large universe attribute based encryption where any string can be employed as an attribute and attributes are not required to be enumerated at system setup meets this requirement. Unfortunately, one of the main efficiency drawbacks of existing large universe attribute based encryption is that ciphertext size and decryption time scale with the complexity of the access structure. In this work, we propose large universe attribute based access control scheme with efficient decryption. The user provides the cloud computing server with a transformation key with which the cloud computing server transforms the ciphertext associated with the access structure satisfied by the attributes associated with the private key into a simple and short ciphertext; thus it significantly reduces the time for the user to decrypt the ciphertext without the cloud computing server knowing the underlying plaintext; the user can check whether the transformation done by the cloud computing server is correct to verify transformation correctness. Security analysis and performance evaluation show our scheme is secure and efficient.

Attribute-based fuzzy identity access control in multicloud computing environments

Firstly, we propose a multiauthority ciphertext policy attribute-based encryption scheme. It achieves fine-grained access control based upon fuzzy identity over encrypted data without any trusted center or extra interaction among multiple authorities. Moreover, it satisfies the collusion resistance requirement as long as at least one of the attribute authorities is honest. The security proof demonstrates that the proposed scheme is secure against chosen plaintext attacks in random oracle model under decisional multilinear Diffie–Hellman assumption. Secondly, we construct an attribute-based access control system for proxy-based multicloud environment to achieve distributed access control without any trusted center, manager, or additional secret keys. In our construction, the original secret keys are split into a control key, a decryption key and a set of transformation keys. It only takes the mobile device a lightweight decryption with a single decryption key. The overwhelming majority of decryption operations are outsourced to cloud via transformation keys. In addition, the attribute revocation can be realized by updating transformation keys using the control key, while ciphertexts and user’s decryption key still remain unchanged. Furthermore, proxies are helpful to promote the collaboration among multiple clouds in file access control system. Finally, the performance analysis shows that our construction is flexible and practical for mobile users in proxy-based multicloud environment.

A Survey on Attribute-based Encryption Schemes of Access Control in Cloud Environments

In Attribute-based Encryption (ABE) scheme, attributes play a very important role. Attributes have been exploited to generate a public key for encrypting data and have been used as an access policy to control users' access. The access policy can be categorized as either key-policy or ciphertext-policy. The key-policy is the access structure on the user's private key, and the ciphertext-policy is the access structure on the ciphertext. And the access structure can also be categorized as either monotonic or non-monotonic one. Using ABE schemes can have the advantages: (1) to reduce the communication overhead of the Internet, and (2) to provide a fine-grained access control. In this paper, we survey a basic attribute-based encryption scheme, two various access policy attribute-based encryption schemes, and two various access structures, which are analyzed for cloud environments. Finally, we list the comparisons of these schemes by some criteria for cloud environments.

Ciphertext policy Attribute based Encryption with anonymous access policy

In Ciphertext Policy Attribute based Encryption scheme, the encryptor can fix the policy, who can decrypt the encrypted message. The policy can be formed with the help of attributes. In CP-ABE, access policy is sent along with the ciphertext. We propose a method in which the access policy need not be sent along with the ciphertext, by which we are able to preserve the privacy of the encryptor. The proposed construction is provably secure under Decision Bilinear Diffe-Hellman assumption.