Anonymous attribute-based encryption supporting efficient decryption test

Fog computing is a paradigm that extends cloud computing to the edge of the network. It can provide computation and storage services to end devices in Internet of Things (IoT). Attribute-based cryptography is a well-known technology to guarantee data confidentiality and fine-grained data access control. However, its computational cost in encryption and decryption phase is linear with the complexity of policy. In this paper, we propose a secure and fine-grained data access control scheme with ciphertext update and computation outsourcing in fog computing for IoT. The sensitive data of data owner are first encrypted using attribute-based encryption with multiple policies and then outsourced to cloud storage. Hence, the user whose attributes satisfy the access policy can decrypt the ciphertext. Based on the attribute-based signature technique, authorized user whose attributes integrated in the signature satisfy the update policy can renew the ciphertext. Specifically, most of the encryption, decryption, and signing computations are outsourced from end devices to fog nodes, and thus, the computations for data owners to encrypt, end users to decrypt, re-encrypt, and sign are irrelevant to the number of attributes in the policies. The security analysis shows that the proposed scheme is secure against known attacks, and the experimental results show that the fog nodes perform most of the computation operations of encryption, decryption, and signing, and hence, the time of encryption for data owner, decryption, re-encryption, and signing for users is small and constant.

WSN-integrated cloud computing (WCC) has become a promising cloud service architecture, in which sensors and mobile devices are utilized as the data collecting and processing nodes for the cloud service model, while cloud servers can provide computing services and storage services with high performance and reliability. However, since cloud servers are not fully trusted, and sensors and mobile devices have very limited computing capability and storage capacity, WCC brings forth new challenges for data confidentiality, data integrity and access control when sensors store important data for sharing in the WCC environment. Moreover, there are still no proper solutions for fine-grained, efficient and secure data access control in WCC. To solve this issue, we propose a fine-grained and lightweight data access control scheme for WCC, namely FLAC, which includes a ciphertext-policy attribute-based encryption algorithm for data confidentiality and fine-grained data access control, and an attribute-based signature algorithm for data integrity and the many-read-many-write case of data access. By delegating most computation intensive tasks to cloud services, FLAC enables resource constrained sensors and mobile devices to perform security operations rapidly. The security assessment and performance evaluation demonstrate that FLAC is secure, highly efficient and well suited for WSN applications.

Attribute-based encryption is a very powerful primitive in public-key cryptography. It can be adopted in many applications, such as cloud storage, etc. To further protect the privacy of users, anonymity has been considered as an important property in an attribute-based encryption. In an anonymous attribute-based encryption, the access structure of a ciphertext is hidden from users. In this paper, we find an attack method against Li et al.’s anonymous attribute-based encryption schemes. The proposed attack uses an “invalid attribute key” to recover the hidden access structure of a given ciphertext. No information of the master secret key nor private keys are necessary in our attack.

Attribute Based Encryption (ABE) allows fine-grained access control along with data confidentiality. Anonymous Attribute Based Encryption (AABE) supports hiding the access control policies within ciphertext so that the receiver's information remains unknown to public. Keyword-based query search over encrypted storage has become a challenging research problem when (i) the search query should not reveal the user identity and (ii) the search procedure should be able to verify whether the access policy associated with cipher document matches with the user's access rights. In this paper, we present an anonymous attribute based searchable encryption (A <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> BSE) scheme that allows user to retrieve only a subset of documents, containing the keyword(s) that satisfies the user's search query and for which the user is having sufficient access rights. In A BSE scheme, the search operation does not reveal user's identity. The A <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> BSE scheme is secure under the selective ciphertext-policy with chosen plaintext attack and under the selective ciphertext-policy with chosen keyword attack. The A <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> BSE scheme is efficient in comparison to existing AABE schemes.

Distributed sensor data storage and retrieval have gained increasing popularity in recent years for supporting various applications. While distributed architecture enjoys a more robust and fault-tolerant wireless sensor network (WSN), such architecture also poses a number of security challenges especially when applied in mission-critical applications such as battlefield and e-healthcare. First, as sensor data are stored and maintained by individual sensors and unattended sensors are easily subject to strong attacks such as physical compromise, it is significantly harder to ensure data security. Second, in many mission-critical applications, fine-grained data access control is a must as illegal access to the sensitive data may cause disastrous results and/or be prohibited by the law. Last but not least, sensor nodes usually are resource-constrained, which limits the direct adoption of expensive cryptographic primitives. To address the above challenges, we propose, in this paper, a distributed data access control scheme that is able to enforce fine-grained access control over sensor data and is resilient against strong attacks such as sensor compromise and user colluding. The proposed scheme exploits a novel cryptographic primitive called attribute-based encryption (ABE), tailors, and adapts it for WSNs with respect to both performance and security requirements. The feasibility of the scheme is demonstrated by experiments on real sensor platforms. To our best knowledge, this paper is the first to realize distributed fine-grained data access control for WSNs.

Personal health record (PHR) is an emerging patient-centric model of health information exchange, which is often outsourced to be stored at a third party, such as cloud providers. However, there have been wide privacy concerns as personal health information could be exposed to those third party servers and to unauthorized parties. To assure the patients' control over access to their own PHRs, it is a promising method to encrypt the PHRs before outsourcing. Yet, issues such as risks of privacy exposure, scalability in key management, flexible access, and efficient user revocation, have remained the most important challenges toward achieving fine-grained, cryptographically enforced data access control. In this paper, we propose a novel patient-centric framework and a suite of mechanisms for data access control to PHRs stored in semitrusted servers. To achieve fine-grained and scalable data access control for PHRs, we leverage attribute-based encryption (ABE) techniques to encrypt each patient's PHR file. Different from previous works in secure data outsourcing, we focus on the multiple data owner scenario, and divide the users in the PHR system into multiple security domains that greatly reduces the key management complexity for owners and users. A high degree of patient privacy is guaranteed simultaneously by exploiting multiauthority ABE. Our scheme also enables dynamic modification of access policies or file attributes, supports efficient on-demand user/attribute revocation and break-glass access under emergency scenarios. Extensive analytical and experimental results are presented which show the security, scalability, and efficiency of our proposed scheme.

Messaging systems operating within the public cloud are gaining popularity. To protect message confidentiality from the public cloud including the public messaging servers, we propose to encrypt messages in messaging systems using Attribute-Based Encryption (ABE). ABE is an one-to-many public key encryption system in which data are encrypted with access policies and only users with attributes that satisfy the access policies can decrypt the ciphertexts, and hence is considered as a promising solution for realizing expressive and fine-grained access control of encrypted data in public servers. Our proposed system, called Attribute-Based Secure Messaging System with Outsourced Decryption (ABSM-OD), has three key features: enabling expressive and fine-grained access control of encrypted messages by users, supporting outsourced decryption to the cloud while without compromising confidentiality of decrypted messages, and allowing server-aided revocation to provide effective and instant user revocations.

To allow fine-grained access control of sensitive data, researchers have proposed various types of functional encryption schemes, such as identity-based encryption, searchable encryption and attribute-based encryption. We observe that it is difficult to define some complex access policies in certain application scenarios by using these schemes individually. In this paper, we attempt to address this problem by proposing a functional encryption approach named Key-Policy Attribute-Based Encryption with Attribute Extension (KP-ABE-AE). In this approach, we utilize extended attributes to integrate various encryption schemes that support different access policies under a common top-level KP-ABE scheme, thus expanding the scope of access policies that can be defined. Theoretical analysis and experimental studies are conducted to demonstrate the applicability of the proposed KP-ABE-AE. We also present an optimization for a special application of KP-ABE-AE where IPE schemes are integrated with a KP-ABE scheme. The optimization results in an integrated scheme with better efficiency when compared to the existing encryption schemes that support the same scope of access policies.

Software defined networking (SDN) separates the data layer and the control layer to achieve logical centralization, scalability and programmability. In hierarchical software defined networking (HSDN), controllers are classified into the upper controller- Root Controller (RC) and the lower controller- Local Controller (LC) to improve the scalability of the network. HSDN effectively relieve the workload of controllers. However, the features of HSDN puts forward higher requirements of data privacy protection and access control. Because RC stores global network data, it must ensure authorized access and prevent the forged data. The attribute-based encryption scheme can provide fine-grained data access control and data privacy protection of controllers at the same time. When LC accesses data in RC, the algorithm of ciphertext-policy attribute-based encryption with identity authentication (CP-ABE-IA) is presented to protect the data privacy of RC and guarantee the legitimate access of LC. When LC sends message to RC, we propose an algorithm of key-policy attribute based signcryption for multi-access structures (KP-ABSC-MAS). KP-ABSC-MAS provides data privacy protection and verification as well as the authentication of LC.

To secure cloud storage and enforce access control, data encryption has become essential, given the ever increasing cyber threat everywhere. Attribute-based Encryption (ABE) crypto systems are widely considered as a promising solution under such a context for its security strength, scalability and control flexibility. One major challenge, however, for applying ABE-based techniques in real world applications is its high overhead in various aspects. In this research, we are particularly concerned with the storage size expansion in existing ABE schemes. This combined with the vast-size nature of the cloud data poses an enormous challenge to the effective usage of the cloud data storage space and affects the utility of data deduplication. Normally, data deduplication is carried out based on identifying similar and even identical contents both within and between data files, however, these patterns will be destroyed after performing data encryption using any semantically secure encryption scheme including ABE. In this research, we focus on ciphertexts deduplication under ABE, which to our best knowledge is the first of such an effort. Our fundamental observation stems from the structure of ABE ciphertexts and the possible similarities among different access structures. We show how to design a secure ciphertext deduplication scheme based on a classical CP-ABE scheme by innovatively modifying the construction with a recursive algorithm, eliminating the duplicated secrets and adding additional randomness to some certain ciphertext. We then give a detailed analysis on the proposed scheme with respect to both efficiency and security. To thoroughly assess the performance of the proposed scheme, we also implement a prototype system and conduct comprehensive experiments, which shows that our ciphertext reduplication scheme could reduce up to 80% computation and storage cost in the best case.

Cloud Service Providers (CSPs) allow data owners to migrate their data to resource-rich and powerful cloud servers and provide access to this data by individual users. Some of this data may be highly sensitive and important and CSPs cannot always be trusted to provide secure access. It is also important for end users to protect their identities against malicious authorities and providers, when they access services and data. Attribute-Based Encryption (ABE) is an end-to-end public key encryption mechanism, which provides secure and reliable fine-grained access control over encrypted data using defined policies and constraints. Since, in ABE, users are identified by their attributes and not by their identities, collecting and analyzing attributes may reveal their identities and violate their anonymity. Towards this end, we define a new anonymity model in the context of ABE. We analyze several existing anonymous ABE schemes and identify their vulnerabilities in user authorization and user anonymity protection. Subsequently, we propose a Privacy-Preserving Access Control Scheme (PACS), which supports multi-authority, anonymizes user identity, and is immune against users collusion attacks, authorities collusion attacks and chosen plaintext attacks. We also propose an extension of PACS, called Statistical Privacy-Preserving Access Control Scheme (SPACS), which supports statistical anonymity even if malicious authorities and providers statistically analyze the attributes. Lastly, we show that the efficiency of our scheme is comparable to other existing schemes. Our analysis show that SPACS can successfully protect against Collision Attacks and Chosen Plaintext Attacks.

In this paper, we present two constructions of the attribute-based broadcast encryption(ABBE) algorithm. Attribute-based encryption(ABE) algorithm enables an access control mechanism over encrypted data by specifying access policies among private keys and ciphertexts. ABBE algorithm can be used to construct ABE algorithm with revocation mechanism. Revocation has a useful property that revocation can be done without affecting any non-revoked uers. The main difference between our algorithm and the classical ones derived from the complete subtree paradigm which is apt for military hierarchy. Our algorithm improve the efficiency from the previously best ABBE algorithm, in particular, our algorithm allows one to select or revoke users by sending ciphertext of constant size with respect to the number of attributes and by storing logarithm secret key size of the number of users. Therefore, our algorithm can be an option to applications where computation cost is a top priority and can be applied to military technologies in the near future.

Cloud storage is a useful service of cloud computing which allows users to upload their data in the cloud and share it with others. Although, this new service is affordable and practical, but it is associated with several privacy and security challenges. Nowadays, Attribute Based Encryption (ABE) is widely used to provide secure data sharing in the distributed environment such as cloud computing. Unfortunately, most of the existing ABE schemes are not suitable for resource- constraint cloud systems, because they use expensive bilinear pairing operation and thus they cause a very high encryption and decryption computation overhead. In this paper, we propose an efficient no-pairing and revocable ABE data sharing scheme based on Elliptic Curve Cryptography (ECC) for cloud storage systems. Moreover, a comprehensive security and performance analysis shows that our scheme is both secure and efficient.

computing power network (CPN) can possess powerful data computing capabilities and storage resources by equipping a host of computing nodes. However, data sharing in the CPN faces significant challenges, particularly in data security and access control. attribute-based searchable encryption (ABSE) is a feasible technology to tackle this problem. Nevertheless, CPNs typically contain a vast amount of sensitive data that requires strict fine-grained retrieval permissions. Hence, we construct a decentralized and anonymous ABSE scheme with policy update and batch revocation for CPN, highlighting the generation of keyword indexes based on access structure. Meanwhile, considering the limited computing power of users, we transfer the time-consuming calculation to the edge computing node. Besides, security analysis indicates that our scheme can achieve the security of chosen plaintext attack and chosen keyword attack, collusion resistance, forward and backward security. Experimental evaluations demonstrate that our scheme is trustworthy and applicable to CPNs.

Anonymous Attribute-Based Searchable Encryption for Smart Health System