Traditional Attribute-based Encryption Research Articles

Blockchain empowered access control for digital twin system with attribute-based encryption

Digital twin is a pivotal and burgeoning technique that plays a crucial role in the realms of digital transformation and intelligent advancement. To bolster diverse applications and realize digital transformation, it is imperative to share the generated device data among multiple stakeholders involved in the digital twin system product life cycle. Since the device data contains sensitive and secret information, strict access control is required. Attribute-based encryption (ABE) is commonly employed for the construction of a cryptographic-enforced data access control scheme. ABE enables data confidentiality and one-to-many fine-grained access control due to its flexibility and high scalability. Unfortunately, traditional ABE schemes adopted in digital twin system has been hindered by the single point of failure and trust problems. Blockchain is a secure distributed ledger technology with decentralization and tamper-proofing properties. In this article, we present a blockchain-empowered data access control scheme for digital twin system with attribute-based encryption. Firstly, blockchain is employed to construct a complete, tamper-resistant, and efficient architecture for digital twin system to address challenges of access control. Subsequently, to ensure the confidentiality of digital twin data, we employ ciphertext-policy ABE (CP-ABE) to achieve fine-grained and one-to-many access control. Finally, we combine blockchain-based architecture with the interplanetary file system (IPFS) to propose a data storage scheme to release storage pressure on the blockchain and improve system efficiency. Security analysis and performance evaluation exhibit that the proposed access control scheme can effectively protect the data security of digital twin system with efficient storage.

Hierarchical and non-monotonic key-policy attribute-based encryption and its application

Hierarchical-authority attribute-based encryption (HABE) can resolve the performance bottleneck of the key generation center in the traditional attribute-based encryption (ABE) system. HABE has numerous applications, such as cloud computing and smart grid systems. Nevertheless, almost all of the existing HABE schemes are in the ciphertext-policy setting and do not support non-monotonic access structures. In this work, we propose the first key-policy hierarchical-authority ABE with non-monotonic access structures, dubbed KP-HABE-NMaCS, which supports the authority key delegation, constant size ciphertexts and the large universe simultaneously. We further define the security model of KP-HABE-NMaCS and prove the selective security of it in the standard model. Then we optimize our scheme to realize the outsourced decryption. Subsequently, we present the detailed theoretical analysis of our constructions and the existing HABE constructions in computation and storage costs, and meanwhile implement ours and conduct a series of experiments. Both results indicate that our KP-HABE-NMaCS construction makes improvements in expressiveness and features, and achieves efficiency comparable to the previous HABE constructions. Furthermore, they also show that our extension construction is suitable for resource-limited applications. Eventually, we explore how to apply our KP-HABE-NMaCS to build an ABE with equality test and time-based authorization.

Towards achieving efficient access control of medical data with both forward and backward secrecy

Healthcare service providers store the patients’ electronic medical records in the cloud in order to provide high quality healthcare services. Patients’ sensitive data is typically encrypted before storing in the cloud. However, it gives rise to a new challenge, namely access control over encrypted data. Attribute-Based Encryption (ABE) is a promising cryptographic technique to achieve the fine grained access control on outsourced encrypted data. Traditional ABE schemes assume a fixed access policy that is not suitable for the present dynamic environment. Although some ABE schemes with a dynamic access control policy have been proposed in the literature, these schemes have not addressed forward security, backward security, and user revocation after a policy update. In this paper, we propose an ABE scheme that supports access policy updates, and also provides forward security, backward security and user revocation at the same time. We have formally shown that the proposed scheme is Chosen Plaintext Attack (CPA)-secure under the Decisional Bilinear Diffie–Hellman (DBDH) assumption. Finally, the performance analysis exhibits that the proposed scheme is efficient in communication and computation, and is also suitable for resource constrained devices.

Partial policy hiding attribute-based encryption in vehicular fog computing

Vehicular fog computing (VFC), combining the vehicular ad hoc network with fog computing, is an efficient vehicle communication architecture. However, the user data is often threatened since VFC is an open environment. Attribute-based encryption (ABE) is suitable for open scenarios, such as cloud and Internet of Things, because of its confidentiality and access control characteristics. However, the traditional ABE has disadvantages, such as the inability to hide the attributes in the access policy and the use of computationally inefficient composite order bilinear pairing groups to prove adaptive security. Traditional ABE is not practical in VFC. We summarized the existing schemes of full policy hiding ABE and partial policy hiding ABE and then concluded that partial policy hiding ABE is more suitable for VFC. We combine policy hiding technology and the technology of converting bilinear pairing cryptography schemes into prime-order bilinear pairing cryptography schemes and propose an efficient and partial policy hiding ciphertext-policy ABE scheme suitable for VFC. Experiments have proved that our scheme is computationally more efficient than previous policy hiding ABE schemes.

A survey on multi-authority and decentralized attribute-based encryption

The introduction of attribute-based encryption (ABE) targets to achieve the implementation of single-to-numerous encryption; however, the sole authority challenge and the issue of distributed management of attributes are bottlenecks to its realization. Multi-authority attribute-based encryption (MA-ABE) where various attribute authorities (which may be independent of each other) control different attribute universe and are involved in the administration of attribute keys for decryption provides the necessary platform to undertake the implementation of fine-grained access regulation over shared data while achieving single-to-numerous encryption. In recent years, research into MA-ABE has seen rapid advancement, and we believe that it is a suitable solution to thwarting the key escrow problem as well as the problem of distributed management of attributes. This paper offers a thorough survey and examines the state-of-the-art of some traditional ABE as well as multi-authority attribute-based encryption schemes over the past decade. Furthermore, the survey gives detailed insights on some essential techniques as well as some classic concretely constructed algorithms. Moreover, we discuss an extension (the different directions) of MA-ABE and its progress since its inception. We also provide design principles of MA-ABE and also show comparisons between existing works on areas as security, performance, and functionality. This paper also discusses several interesting open problems. As far as we can tell, no comparable survey on MA-ABE exists in literature so far.

PHAS-HEKR-CP-ABE: partially policy-hidden CP-ABE with highly efficient key revocation in cloud data sharing system

In recent years, attribute-based encryption (ABE) provides a new idea to help researchers solving the problem of data privacy protection in cloud. But there are two issues in traditional ABE, the first issue is that the attributes in the access structures will be sent to users in cleartext together with the ciphertext. So a attacker has the opportunity to obtain some of the private information from the plaintext access structure. And the other issue is the traditional ABE scheme cannot revoke the users' illegal keys in an efficient way. To handle both of the above challenges, we come up with a large universe ciphertext-policy ABE (CP-ABE) scheme which supports partially hidden access structures (PHAS) and highly efficient key revocation at the same time in this paper. What's more, unlike most previous schemes, first our access structure is based on the expressive linear secret sharing scheme (LSSS) which supports both AND and OR gates in access formulas and second our scheme is built from the prime-order bilinear pairing groups. The comparison with other relevant works presents that our scheme is more comprehensive and efficient. Finally we rigorously prove and analyze that our scheme is selectively indistinguishable secure under chosen plaintext attacks (IND-CPA) in the random oracle model (ROM) and our access structure is really anonymous against off-line dictionary attacks.

An efficient and outsourcing-supported attribute-based access control scheme for edge-enabled smart healthcare

In recent years, the continuous development of smart healthcare has brought substantial convenience to our lives, especially for emerging edge-enabled smart healthcare systems that transmit and store a large amount of medical data. However, if private health data of users are leaked or tampered with, it will cause enormous damage to users’ rights, even threatening the safety of their lives. Traditionally, attribute-based encryption (ABE) is used to encrypt data and implement fine-grained access control for such sensitive information. However, the computing overhead of traditional ABE is relatively large, and in an edge-enabled environment, the outsourcing part of encryption and decryption to the edge node can reduce the computing cost of resource-constrained devices for edge-enabled smart healthcare. However, current schemes are not efficient for resource-constrained devices and edge nodes. Therefore, an efficient ABE scheme is proposed that outsources part of the encryption and decryption to the edge nodes as well as supports attribute updates, enabling flexible right control. A formal security proof is provided, verifying that our scheme is secure under the Decisional Bilinear Diffie–Hellman assumption. The performance of our scheme is evaluated at different security levels, and the experimental results demonstrate that our scheme is more efficient for resource-constrained devices than the traditional ABE.

Decentralized ciphertext-policy attribute-based encryption schemes for lightweight devices

In a traditional attribute-based encryption (ABE) system, there is only one central authority who generates and hence knows the secret keys of all users, this problem is known as the key escrow problem. An ABE scheme which can deal with the aforementioned problem is so-called a decentralized (or multi-authority) ABE scheme. There have been several efforts to propose decentralized ABE schemes in the literature, and these schemes can enjoy some interesting properties such as fine-grained access control and full security. However, all of them suffer from two main weaknesses that are large secret key size and slow decryption time. These weaknesses are obviously not desirable for lightweight device applications such as Internet of Things applications.In this paper, we propose two decentralized ciphertext-policy attribute-based encryption schemes. Our proposed schemes have some nice properties such as constant-size secret key, fast decryption, optimized ciphertext size and fine-grained access control. Our schemes, as a result, could be seen as a solution for lightweight device applications. For completeness, we implement our schemes and give some concrete benchmarks.

Secure and efficient access of personal health record: a group-oriented ciphertext-policy attribute-based encryption

ABSTRACTThe personal health record (PHR) service is a promising model for health data exchange. In practice, however, users’ health data need to be stored in an untrusted cloud server, which requires the design of a mechanism to achieve secure data sharing. Although the traditional attribute-based encryption (ABE) can be employed to facilitate PHR sharing with confidentiality protection, it will become powerless when confronting certain case. For instance, this happens when the health data is encrypted under (‘ophthalmologist’ AND ‘dermatologist’) AND (‘chief physician’). The ciphertext cannot be successfully decrypted in the scenario if there is no doctor who is a specialist in both dermatology and ophthalmology, Motivated by this observation, we propose a group-oriented ciphertext-policy ABE, which classifies users into different groups. Specifically, users in the same group own the same group identifier and different users can combine their attributes to complete the decryption. The decryption operation can be completed successfully when the union of their attributes satisfies the Access Control Policy (ACP) involved in the ciphertext. Additionally, we propose a concrete scheme with a constant ciphertext size, which is independent of the count of attributes in the ACP. Our security analysis shows that the proposed scheme is secure against selective chosen-plaintext attack under the decisional n-BDHE assumption.

A novel chaotic hash-based attribute-based encryption and decryption on cloud computing

Cloud computing has evolved as widely accepted and used paradigm for service providers as well as customers on internet. As users share their sensitive information on cloud, it has become the major concern of the cloud service providers to make their environment more secure and trustworthy. For adding extended security, the sensitive data are needed to be encrypted prior to its upload on cloud. The numbers of cryptographic algorithms are proposed by various researchers for this purpose. The main objectives of the attribute-based encryption (ABE) models are to achieve security and access control. To resolve the issue of this conventional attribute-based model, a novel modified and extended hash-based ABE model was implemented on the cloud storage data. Experimental results proved that the proposed model has high computational accuracy compared to traditional ABE models in terms of time and data size concerned.

A novel chaotic hash-based attribute-based encryption and decryption on cloud computing

Cloud computing has evolved as widely accepted and used paradigm for service providers as well as customers on internet. As users share their sensitive information on cloud, it has become the major concern of the cloud service providers to make their environment more secure and trustworthy. For adding extended security, the sensitive data are needed to be encrypted prior to its upload on cloud. The numbers of cryptographic algorithms are proposed by various researchers for this purpose. The main objectives of the attribute-based encryption (ABE) models are to achieve security and access control. To resolve the issue of this conventional attribute-based model, a novel modified and extended hash-based ABE model was implemented on the cloud storage data. Experimental results proved that the proposed model has high computational accuracy compared to traditional ABE models in terms of time and data size concerned.

New directly revocable attribute-based encryption scheme and its application in cloud storage environment

Attribute-based encryption (ABE) is a special type of cryptosystem, which provide encryption and decryption functions based on users attributes. Due to the functionality and flexibility of ABE, it is considered to be suitable for providing data security and privacy preserving security in the cloud storage environment. However, lack of user revocation mechanism is considered to be a disadvantage of traditional ABE. In this paper, we study the direct revocation mechanism of ciphertext-policy ABE (CP-ABE), construct a new directly revocable CP-ABE in the composite order group, and prove it to achieve adaptive security using dual system encryption in the standard model. On this basis, we introduce user revocation centre (URC) in this system, and outsource the revocation tasks to URC. Users need not to master the latest revocation list for encrypting, and need not to pay any additional computing for revocation. In addition, when revocation list changes, URC can update the ciphertexts for users. Finally, we introduce how to deploy our schemes in cloud storage environment.

Enhancing Attribute-Based Encryption with Attribute Hierarchy

Attribute-based encryption (ABE) has been envisioned as a promising cryptographic primitive for realizing secure and flexible access control. However, ABE is being criticized for its high scheme overhead as extensive pairing operations are usually required. In this paper, we focus on improving the efficiency of ABE by leveraging a previously overlooked fact, i.e., the often-found hierarchical relationships among the attributes that are inherent to many access control scenarios. As the first research effort along this direction, we coin the notion of hierarchical ABE (HABE), which can be viewed as the generalization of traditional ABE in the sense that both definitions are equal when all attributes are independent. We further give a concrete HABE construction considering a tree hierarchy among the attributes, which is provably secure. More importantly, our construction exhibits significant improvements over the traditional ABE when attribute hierarchies exist.