Revocable Attribute-based Encryption Research Articles

BGNBA-OCO based privacy preserving attribute based access control with data duplication for secure storage in cloud

Cloud computing technology offers flexible and expedient services that carry a variety of profits for both societies as well as individuals. De-duplication techniques were developed to minimize redundant data in the cloud storage. But, one of the main challenges of cloud storage is data deduplication with secure data storage.To overcome the issue, we propose Boneh Goh Nissim Bilinear Attribute-based Optimal Cache Oblivious (BGNBA-OCO) access control and secure de-duplication for data storage in cloud computing in this paper. The proposed method achieves fne-grained access control with low computation consumption. We design Boneh Goh Nissim Privacy Preserving Revocable Attribute-based Encryption that reinforces attribute revocation and averts the discharge of sensitive information. Furthermore, we utilize Optimal Cache Oblivious algorithm to prevent disclosure of access patterns to hide the access patterns in cloud storage via rand pattern matching. We support updating both encrypted data and access control policies to minimize communication and computation overhead of data duplication and encryption processes concurrently. We perform secure data sharing to achieve higher data confidentiality and integrity. Finally, we conducted the extensive experiments in cloud and the results illustrated that our proposed BGNBA-OCO method is more efficient than related works.

Revocable-Attribute-Based Encryption with En-DKER from Lattices

Cloud computing offers abundant computing resources and scalable storage, but data leakage in the cloud storage environment is a common and critical concern due to inadequate protection measures. Revocable-attribute-based encryption (RABE) is introduced as an advanced form of identity-based encryption (IBE), which encrypts sensitive data while providing fine-grained access control and an effective user revocation mechanism. However, most existing RABE schemes are not resistant to quantum attacks and are limited in their application scenarios due to the revocation model. In this paper, we propose a RABE scheme constructed from lattices. Our scheme has several advantages, including a near-zero periodic workload for the key generation center (KGC), ensuring scalability as the number of users increases. Additionally, the encryptor is relieved from managing a revocation list. Moreover, our scheme guarantees the confidentiality and privacy of other ciphertexts even if the decryption key for a specific period is compromised. We validated the correctness of our scheme and demonstrated its security under the assumption of learning with errors (LWE), which is widely believed to be resistant to quantum attacks. Finally, we provide an application example of our RABE scheme in the electronic healthcare scenario.

Achieving Revocable Attribute Group-Based Encryption for Mobile Cloud Data: A Multi-Proxy Assisted Approach

Although proxy-assisted revocable attribute-based encryption provides fine-grained privacy protection and reduces the decryption cost of data users, it inherits several disadvantages in outsourcing decryption. The decryption capability in outsourcing decryption is divided into two parts: the outsourcing transformation key and the user decryption key. The proxy server utilizes transformation keys to transform the ciphertext which can only be decrypted by the users who generated the transformation key. When multiple users with the same attributes request outsourcing transformation, the proxy server must do numerous transformation operations, increasing the computing overhead of the proxy server and the user request response time. To address the aforementioned issues, we propose a multi-proxy assisted revocable attribute group-based encryption (MP-RAGBE) scheme. We form a user group out of users who have the same attributes and send the transformation keys directly to the proxy server. Users in the same group can decrypt the transformed ciphertext, and only a small number of transformation keys need to be updated when revocation occurs. The security and experimental analyses show that the proposed scheme meets the defined security requirements while significantly reducing user request response time, the overhead of transformation key generation, transmission, and ciphertext transformation.

Backward Compatible Identity-Based Encryption.

In this paper, we present a new identity-based encryption (IBE) system that is named Backward Compatible Identity-based Encryption (BC-IBE). Our BC-IBE is proposed to solve the problem caused by the out-of-synchronization between users' private keys and ciphertexts. Encryption systems such as revocable IBE or revocable Attribute-based Encryption (ABE) often require updating private keys to revoke users after a certain time period. However, in those schemes, an updated key can be used to decrypt the ciphertexts created only during the current time period. Once the key is updated and the previous keys are removed, the user, the owner of the updated key, will lose access to the past ciphertexts. In our paper, we propose BC-IBE that supports backward compatibility, to solve this problem. In our proposed system, user's private keys and ciphertexts can be updated periodically with time tags, and these processes can be used to revoke users who do not receive an updated key as the other revocable encryption does. However, in our proposed system, a private key newly issued to a user is backward compatible. This means that it decrypts not only the ciphertexts at the present time period but also all past ciphertexts. This implies that our proposed scheme guarantees the decryption of all encrypted data even if they are not synchronized. Compared to the existing revocable identity-based encryption system, our proposed BC-IBE has the advantage of simplifying key management and securely delegating ciphertext updates. Our proposed scheme only requires a single backward-compatible private key to decrypt all past ciphertexts created. Moreover, the ciphertext update process in our proposed scheme does not require any special privileges and does not require decryption. This means that this process can be securely delegated to a third-party server, such as a cloud server, and it prevents the potential leakage of secrets. For those reasons, BC-IBE is suitable for a system where users are more dynamic, such as the Internet-of-Things (IoT) network, or a system that regularly updates the data, like cloud data storage. In this paper, we provide the construction of BC-IBE and prove its formal security.

Scalable and Revocable Attribute-Based Data Sharing With Short Revocation List for IIoT

The cooperative works between connected smart devices in the Industrial Internet of Things (IIoT) have greatly made the growth in productivity and economics for the conventional industry. However, due to the introduction of the communication network, the budding IIoT also confronts the unprecedented cyber threats. To prevent the data from being intercepted by malicious intruders, we propose an efficient and fully secure data sharing work with a short revocation list (DS-SRL) for IIoT. The DS-SRL not only enables flexible access control to the massive data in IIoT but also provides a direct revocation approach for handling the potential issues of key disclosure and membership expiring in application scenarios. Particularly, compared with existing directly revocable ABE works, the revocation list in the DS-SRL scheme will keep constant size even with the increasing number of users. Thus, the consumption for computing and disseminating the revoke-related part of ciphertext are low. This resource-saving merit makes our DS-SRL scheme suitable for IIoT where the smart devices are weak in the ability of both processing and storage. The DS-SRL works without boundary such that the public parameters involved in the system require no predefinitions and can be dynamically adjusted after deployment. Furthermore, the proposed DS-SRL work is demonstrated to be fully secure under the decisional linear assumption. Hence, it owns high flexibility, scalability, and security, which are essential and desirable in real-life applications. Finally, the superior feasibility, efficiency, as well as effectiveness of our DS-SRL work are fairly confirmed by the detailed performance evaluation.

Efficient lattice-based revocable attribute-based encryption against decryption key exposure for cloud file sharing

Cloud file sharing (CFS) has become one of the important tools for enterprises to reduce technology operating costs and improve their competitiveness. Due to the untrustworthy cloud service provider, access control and security issues for sensitive data have been key problems to be addressed. Current solutions to these issues are largely related to the traditional public key cryptography, access control encryption or attribute-based encryption based on the bilinear mapping. The rapid technological advances in quantum algorithms and quantum computers make us consider the transition from the tradtional cryptographic primitives to the post-quantum counterparts. In response to these problems, we propose a lattice-based Ciphertext-Policy Attribute-Based Encryption(CP-ABE) scheme, which is designed based on the ring learing with error problem, so it is more efficient than that designed based on the learing with error problem. In our scheme, the indirect revocation and binary tree-based data structure are introduced to achieve efficient user revocation and dynamic management of user groups. At the same time, in order to further improve the efficiency of the scheme and realize file sharing across enterprises, the scheme also allows multiple authorities to jointly set up system parameters and manage distribute keys. Furthermore, by re-randomizing the user’s private key and update key, we achieve decryption key exposure resistance(DKER) in the scheme. We provide a formal security model and a series of security experiments, which show that our scheme is secure under chosen-plaintext attacks. Experimental simulations and evaluation analyses demonstrate the high efficiency and practicality of our scheme.

An Efficient Revocable and Searchable MA-ABE Scheme With Blockchain Assistance for C-IoT

Internet of Things (IoT) devices usually stores data on clouds for computational overhead offloading and easy data sharing. The data owners, as a result, usually have concerns about the security and privacy of their data stored in such cloud-assisted IoT (C-IoT) systems. Traditional encryption and search primitives, including attribute-based encryption (ABE) and public-key encryption with keyword search (PEKS), however, suffer from high overheads in decryption and revocation, and privacy leakage in search. To address these issues, we propose an efficient revocable and searchable multiauthority ABE (MA-ABE) scheme named ERS-ABE, which utilizes blockchain (BC) technology to implement keyword-based search and dynamic user management. ERS-ABE also adopts cloud-assisted decryption to improve the efficiency of IoT devices. It has been proven to be secure against the selective replayable chosen-ciphertext attacks and the chosen-keyword attacks under the random oracle model. The feasibility and efficiency of ERS-ABE have been evaluated through theoretical analysis and extensive simulation studies. The results indicate that EAR-ABE performs better over the state-of-the-art in both storage and computational overheads. Particularly, the operations that are usually done by a central server but taken by a BC in EAR-ABE cost only a few seconds.

A Secure EMR Sharing System With Tamper Resistance and Expressive Access Control

To reduce the cost of human and material resources and improve the collaborations among medical systems, research laboratories and insurance companies for healthcare researches and commercial activities, electronic medical records (EMRs) have been proposed to shift from paperwork to friendly shareable electronic records. To take advantage of EMRs efficiently and reduce the cost of local storage, EMRs are usually outsourced to the remote cloud for sharing medical data with authorized users. However, cloud service providers are untrustworthy. In this paper, we propose an efficient, secure, and flexible EMR sharing system by introducing a novel cryptosystem called dual-policy revocable attribute-based encryption and tamper resistance blockchain technology. Our proposed system enables EMRs to be shared at a fine-grained level and allows data users to detect any unauthorized manipulation. Moreover, the key generation center can revoke malicious users without affecting the honest users. We provide the formal security model as well as the concrete scheme with security analysis. The experimental simulation and experimental analysis of our proposed scheme demonstrate that our proposed system has superior performances to the most relevant solutions.

Revocable attribute-based encryption from standard lattices

Attribute-based encryption (ABE) is an attractive extension of public key encryption, which provides fine-grained and role-based access to encrypted data. In its key-policy flavor, the secret key is associated with an access policy and the ciphertext is marked with a set of attributes. In many practical applications, and in order to address scenarios where users become malicious or their secret keys are compromised, it is necessary to design an efficient revocation mechanism for ABE. However, prior works on revocable key-policy ABE schemes are based on classical number-theoretic assumptions, which are vulnerable to quantum attacks. In this work, we propose the first revocable key-policy ABE scheme that offers an efficient revocation mechanism while maintaining fine-grained access control to encrypted data. Our scheme is based on the learning with errors (LWE) problem, which is widely believed to be quantum-resistant. Our scheme supports polynomial-depth policy function and has short secret keys, where the size of the keys depends only on the depth of the supported policy function. Furthermore, we prove that our scheme satisfies selective revocation list security in the standard model under the LWE assumption.

A revocable attribute-based encryption EHR sharing scheme with multiple authorities in blockchain.

With the development of digital healthcare, sharing electronic medical record data has become an indispensable part of improving medical conditions. Aiming at the centralized power caused by the single attribute authority in current CP-ABE schemes and the problem that cloud servers are curious and even malicious, we design a revocable CP-ABE EHR sharing scheme with multiple authorities (MA-RABE) in blockchain. In this solution, a group of authorities complete user attribute distribution, key generation and user management through secret sharing and transactions. Besides, we innovatively implemented a distributed one-way anonymous key agreement so that other participants cannot obtain useful information from the fully hidden policy embedded in the ciphertext. Taking into account the computational overhead of a large number of bilinear operations in the decryption process, the solution also supports the cloud server to pre-decrypt the ciphertext, and the data user only needs to perform exponentiation operation once to obtain the plaintext from the pre-decryption result. Theoretical analysis and performance evaluation show that the scheme has reliable security and lower user revocation and ciphertext update overhead.

GAP-MM: 5G-Enabled Real-Time Autonomous Vehicle Platoon Membership Management Based on Blockchain

Autonomous Vehicle Platoon (AVP) is the most anticipated application of 5G ultrareliable and low latency communications. By joining the preexisting platoon to form the real-time AVP (RAVP), individual vehicles could gain benefits such as fuel consumption reduction and traffic safety enhancement. Unlike the scheduled AVP which only contains fixed vehicles, members in RAVP change frequently since individual vehicles would want to join or leave the platoon any time. Besides, malicious vehicles may attempt to sneak into the RAVP and try to manipulate the platoon. Public key cryptography and access control mechanisms can be adopted to create a relatively isolated area for communication inside the platoon. Nevertheless, there exist few works that take into account the regulation of the dynamic change members in RAVP. In this paper, we propose a membership management scheme for 5G-enabled RAVP by integrating revocable attribute-based encryption (RABE) and blockchain, namely, GAP-MM. It realizes fine-grained access control of key distribution and malicious vehicle’s key revocation efficiently. The sufficient evaluations and security analysis indicate that GAP-MM is practical for RAVP scenario in terms of both efficiency and security.

Unbounded and Efficient Revocable Attribute-Based Encryption With Adaptive Security for Cloud-Assisted Internet of Things

Existing attribute-based encryption (ABE) schemes with revocation to secure the cloud-assisted Internet of Things (IoTs) raise challenges, such as eliminating the need for predefined public parameters in system initialization, performing the encryption and decryption operations efficiently, and achieving adaptive security under standard security assumption. In this article, we address these challenges by proposing an unbounded and efficient revocable ABE scheme with adaptive security for cloud-assisted IoTs. Distinct from the previous approaches in this field, our scheme not only efficiently realizes access control over encrypted data in a fine-grained and revocable way but also is proved to be adaptively secure under standard decision linear assumption. Meanwhile, the parameters do not need to be predefined in the system initialization and thus, our scheme satisfies the unbounded property. Moreover, the monotonic span program (MSP) is elegantly utilized as the access structure to reduce the number of bilinear pairing and exponentiation operations for encryption and decryption. Theoretical performance analysis and experiment evaluation disclose that our proposed scheme owns outstanding feasibility, efficiency, and effectiveness.

Lattice‐based revocable attribute‐based encryption with decryption key exposure resistance

Attribute-based encryption (ABE) is a promising management method that enables fine-grained access control in large-scale systems. Revocable ABE (RABE) can support a key revocation mechanism in an ABE system. With the advent of the Internet of Things, users may need to delegate their decryption capacity to other devices, which requires that RABE meet a necessary feature called decryption key exposure resistance (DKER). Although many constructions about RABE from bilinear maps have been proposed, the situation of lattice-based constructions with DKER is less satisfactory. In order to narrow this gap, this paper propose the first lattice-based RABE with DKER. First, a formal description of RABE with DKER and the corresponding security models is proposed. Subsequently, a lattice-based RABE scheme without DKER is constructed and it is proved to be selective indistinguishability under chosen-plaintext attack (IND-CPA) security based on Learning with Errors (LWE). To achieve DKER, this paper construct a RABE scheme by using the RABE scheme without DKER and a key extension mechanism as its building blocks. Finally, this paper show that this scheme is selective IND-CPA security, with the DKER based on LWE.

Indirect Revocable KP-ABE With Revocation Undoing Resistance

Lately, many cloud-based applications proposed attribute-based encryption (ABE) as an all-in-one solution for achieving confidentiality and access control. Within this paradigm, data producers store the encrypted data on a semi-trusted cloud server, and users, holding decryption keys issued by a key authority, can decrypt data according to some access control policy. To be used in practical cases, any ABE scheme should implement a key revocation mechanism which assures that a compromised decryption key cannot be used anymore to decrypt data. Yu <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">et al.</i> (2010) introduced an ABE scheme with revocation capabilities that enjoys several unique advantages, such as reactivity and efficiency. In the scheme, the cloud server is entitled to update keys and ciphertexts in order to achieve revocation. Unfortunately, the cloud server retains the power to undo the revocation of a key (revocation undoing attack) so endangering confidentiality. In this article, we propose a revocable ABE scheme that still ensures the advantages of Yu <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">et al.</i> ’s scheme, but it also resists to the revocation undoing attack. We formally prove the security of our scheme and show through simulations that the user experiences a slightly higher computational cost with respect to Yu <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">et al.</i> ’s scheme.

Revocable Attribute-Based Encryption With Data Integrity in Clouds

Cloud computing enables enterprises and individuals to outsource and share their data. This way, cloud computing eliminates the heavy workload of local information infrastructure. Attribute-based encryption has become a promising solution for encrypted data access control in clouds due to the ability to achieve one-to-many encrypted data sharing. Revocation is a critical requirement for encrypted data access control systems. After outsourcing the encrypted attribute-based ciphertext to the cloud, the data owner may want to revoke some recipients that were authorized previously, which means that the outsourced attribute-based ciphertext needs to be updated to a new one that is under the revoked policy. The integrity issue arises when the revocation is executed. When a new ciphertext with the revoked access policy is generated by the cloud server, the data recipient cannot be sure that the newly generated ciphertext guarantees to be decrypted to the same plaintext as the originally encrypted data, since the cloud server is provided by a third party, which is not fully trusted. In this article, we consider a new security requirement for the revocable attribute-based encryption schemes: integrity. We introduce a formal definition and security model for the revocable attribute-based encryption with data integrity protection (RABE-DI). Then, we propose a concrete RABE-DI scheme and prove its confidentiality and integrity under the defined security model. Finally, we present an implementation result and provide performance evaluation which shows that our scheme is efficient and practical.

Dynamic fine-grained access control scheme for vehicular ad hoc networks

Secure communication in vehicular ad hoc networks (VANETs) has been extensively researched; however, access control in VANETs has not been studied adequately. Access control ensures that only authorized vehicles receive quality services over the VANETs to enhance the driving experience. Attribute-based encryption (ABE) with revocation is a promising access control technique that keeps data confidential and is suitable for application in VANETs. However, most existing revocable ABE schemes require the private keys of all non-revoked users to be updated if the private key of any user is revoked, which makes the implementation of such schemes extremely inefficient. In this paper, a dynamic fine-grained access control scheme based on ABE is proposed to ensure vehicle network security. It enables the message sender to determine which vehicles receive the message according to their attributes and can also freely revoke the decryption authorization of certain vehicles without needing to update all non-revoked keys. To the best of our knowledge, this is the first time that secure and efficient dynamic access control in VANETs has been achieved. Performance analysis and simulation evaluations have shown that the algorithm is more efficient in terms of computational delay and communication overhead, as compared with existing schemes.

AKC-Based Revocable ABE Schemes from LWE Assumption

The emergence of quantum computing threatens many classical cryptographic schemes, leading to the innovations in public-key cryptography for postquantum cryptography primitives and protocols that resist to quantum attacks. Lattice-based cryptography is considered to be one of the promising mathematical approaches to achieving security resistant to quantum attacks, which could be built on the learning with errors (LWE) problem and its variants. The fundamental building blocks of protocols for public-key encryption (PKE) and key encapsulation mechanism (KEM) submitted to the National Institute of Standards and Technology (NIST) based on LWE and its variants are called key consensus (KC) and asymmetric key consensus (AKC) by Jin et al. They are powerful tools for constructing PKE schemes. In this work, we further demonstrate the power of KC/AKC by proposing two special types of PKE schemes, namely, revocable attribute-based encryption (RABE). To be specific, on the basis of AKC and PKE/KEM protocols submitted to the NIST based on LWE and its variants, combined with full-rank difference, trapdoor on lattices, sampling algorithms, leftover hash lemma, and binary tree structure, we propose two directly revocable ciphertext-policy attribute-based encryption (DR-ABE) schemes from LWE, which support flexible threshold access policies on multivalued attributes, achieving user-level and attribute-level user revocation, respectively. Specifically, the construction of the ciphertext is derived from AKC, and the revocation list is defined and embedded into the ciphertext by the message sender to revoke a user in the user-level revocable scheme or revoke some attributes of a certain user in the attribute-level revocable scheme. We also discuss how to outsource decryption and reduce the workload for the end user. Our schemes proved to be secure in the standard model, assuming the hardness of the LWE problem. The two schemes imply the versatility of KC/AKC.

Cloud-Assisted Attribute-Based Data Sharing with Efficient User Revocation in the Internet of Things

Nowadays, the development of the Internet of Things (IoT) has received much attention from both industry and academia. Sensors and devices connected to the IoT network can conveniently gather and collect information for further usage and analysis by IoT users. However, a large quantity of data produced by IoT devices contain sensitive information, which leads to many challenging security issues in IoT systems. The most important one is how to efficiently and securely share IoT data with valid IoT users while forbidding others from obtaining the data. In this article, we propose a cryptographic method to protect the privacy of IoT data while maintaining the functionality of efficient data sharing and user revocation. Our solution relies on a revocable attribute-based encryption (ABE) scheme to encrypt IoT data. The ABE technique makes fine-grained access control available on the encrypted IoT data, while the revocation technique makes invalid users unable to access future encrypted IoT data. To alleviate the issue of resource limitation of IoT devices, we involve a cloud-assisted data sharing and user revocation technique. Finally, we experimentally tested our scheme, and the performance evaluation results demonstrate the practice of our solution scheme.

Server-Aided Revocable Attribute-Based Encryption from Lattices

Attribute-based encryption (ABE) can support a fine-grained access control to encrypted data. When the user’s secret-key is compromised, the ABE system has to revoke its decryption privileges to prevent the leakage of encrypted data. Although there are many constructions about revocable ABE from bilinear maps, the situation with lattice-based constructions is less satisfactory, and a few efforts were made to close this gap. In this work, we propose the first lattice-based server-aided revocable attribute-based encryption (SR-ABE) scheme and thus the first such construction that is believed to be quantum resistant. In the standard model, our scheme is proved to be secure based on the hardness of the Learning With Errors (LWE) problem.

Server‐aided revocable attribute‐based encryption for cloud computing services

SummaryAttribute‐based encryption (ABE) has been regarded as a promising solution in cloud computing services to enable scalable access control without compromising the security. Despite of the advantages, efficient user revocation has been a challenge in ABE. One suggestion for user revocation is using the binary tree in the key generation phase of an ABE scheme, which enables a trusted key generation center to periodically distribute the key update information to all nonrevoked users over a public channel. This revocation approach reduces the size of key updates from linear to logarithmic in the number of users. But it requires each user to keep a private key of the logarithmic size, and asks each nonrevoked user to periodically update his/her decryption key for each new time period. To further optimize user revocation in ABE, a server‐aided revocable ABE (SR‐ABE) scheme has been proposed, in which almost all workloads of users incurred by the user revocation are outsourced to an untrusted server, and each user only needs to store a private key of the constant size. In addition, SR‐ABE does not require any secure channel for the key transmission, and a user only needs to perform a small amount of calculations to decrypt a ciphertext. In this paper, we revisit the notion of SR‐ABE, and present a generic construction of SR‐ABE, which can transform a revocable ABE (RABE) scheme to an SR‐ABE scheme. In addition, we give an instantiation of SR‐ABE by applying the generic construction on a concrete RABE scheme, and implement an instantiation of SR‐ABE and an RABE scheme to evaluate the performance of SR‐ABE.