Abstract
Attribute-based encryption, especially ciphertext policy attribute based encryption (CP-ABE), is a standard method for achieving access control using cryptography. The access control policy is determined by access structure in a CP-ABE scheme. If negative permission is required in the access control model, which is a quite common setting, then non-monotonic access structures must be allowed in the CP-ABE scheme.
In 2011, Chen et al. proposed a CP-ABE scheme with non-monotonic access structures that has constant decryption cost. However, it requires a secret key size linear to the number of total attributes, which is hard to implement when the resources are limited for both computation and storage. In this paper, we improve this scheme to get a CP-ABE scheme where access structure is non-monotonic AND-gate, while the secret key size is only linear to the number of attributes held by a user, without increasing the decryption cost. This scheme will be useful if the total attributes are much more than attributes for each user. Our scheme is provably secure for selective CPA-security under the decision n-BDHE assumption. We also show that our scheme can be naturally extended to supporting attribute addition and revocation, where the attribute set of each user can be updated dynamically, without any complicated proxy re-encryption or decryption procedure.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
References
Attrapadung, N.: Dual system encryption via doubly selective security: framework, fully secure functional encryption for regular languages, and more. In: Nguyen, P.Q., Oswald, E. (eds.) EUROCRYPT 2014. LNCS, vol. 8441, pp. 557–577. Springer, Heidelberg (2014). https://doi.org/10.1007/978-3-642-55220-5_31
Attrapadung, N.: Dual System Encryption Framework in Prime-Order Groups. IACR Cryptology ePrint Archive 2015 (2015). 390
Attrapadung, N., Hanaoka, G., Matsumoto, T., Teruya, T., Yamada, S.: Attribute based encryption with direct efficiency tradeoff. In: Manulis, M., Sadeghi, A.-R., Schneider, S. (eds.) ACNS 2016. LNCS, vol. 9696, pp. 249–266. Springer, Cham (2016). https://doi.org/10.1007/978-3-319-39555-5_14
Attrapadung, N., Hanaoka, G., Yamada, S.: Conversions among several classes of predicate encryption and applications to ABE with various compactness tradeoffs. In: Iwata, T., Cheon, J.H. (eds.) ASIACRYPT 2015. LNCS, vol. 9452, pp. 575–601. Springer, Heidelberg (2015). https://doi.org/10.1007/978-3-662-48797-6_24
Attrapadung, N., Yamada, S.: Duality in ABE: converting attribute based encryption for dual predicate and dual policy via computational encodings. In: Nyberg, K. (ed.) CT-RSA 2015. LNCS, vol. 9048, pp. 87–105. Springer, Cham (2015). https://doi.org/10.1007/978-3-319-16715-2_5
Boneh, D., Boyen, X., Goh, E.-J.: Hierarchical identity based encryption with constant size ciphertext. In: Cramer, R. (ed.) EUROCRYPT 2005. LNCS, vol. 3494, pp. 440–456. Springer, Heidelberg (2005). https://doi.org/10.1007/11426639_26
Boldyreva, A., Goyal, V., Kumar, V.: Identity-based encryption with efficient revocation. In: Proceedings of the 15th ACM Conference on Computer and Communications Security, pp. 417–426. ACM (2008)
Bethencourt, J., Sahai, A., Waters, B.: Ciphertext-policy attribute-based encryption. In: IEEE Symposium on Security and Privacy, SP 2007, pp. 321–334. IEEE (2007)
Chase, M.: Multi-authority attribute based encryption. In: Vadhan, S.P. (ed.) TCC 2007. LNCS, vol. 4392, pp. 515–534. Springer, Heidelberg (2007). https://doi.org/10.1007/978-3-540-70936-7_28
Chen, C., Chen, J., Lim, H.W., Zhang, Z., Feng, D., Ling, S., Wang, H.: Fully secure attribute-based systems with short ciphertexts/signatures and threshold access structures. In: Dawson, E. (ed.) CT-RSA 2013. LNCS, vol. 7779, pp. 50–67. Springer, Heidelberg (2013). https://doi.org/10.1007/978-3-642-36095-4_4
Canetti, R., Halevi, S., Katz, J.: Chosen-ciphertext security from identity-based encryption. In: Cachin, C., Camenisch, J.L. (eds.) EUROCRYPT 2004. LNCS, vol. 3027, pp. 207–222. Springer, Heidelberg (2004). https://doi.org/10.1007/978-3-540-24676-3_13
Cheung, L., Newport, C.: Provably secure ciphertext policy ABE. In: Proceedings of the 14th ACM Conference on Computer and Communications Security, pp. 456–465. ACM (2007)
Chen, C., Zhang, Z., Feng, D.: Efficient ciphertext policy attribute-based encryption with constant-size ciphertext and constant computation-cost. In: Boyen, X., Chen, X. (eds.) ProvSec 2011. LNCS, vol. 6980, pp. 84–101. Springer, Heidelberg (2011). https://doi.org/10.1007/978-3-642-24316-5_8
Emura, K., Miyaji, A., Nomura, A., Omote, K., Soshi, M.: A ciphertext-policy attribute-based encryption scheme with constant ciphertext length. In: Bao, F., Li, H., Wang, G. (eds.) ISPEC 2009. LNCS, vol. 5451, pp. 13–23. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-00843-6_2
Fujisaki, E., Okamoto, T.: How to enhance the security of public-key encryption at minimum cost. In: Imai, H., Zheng, Y. (eds.) PKC 1999. LNCS, vol. 1560, pp. 53–68. Springer, Heidelberg (1999). https://doi.org/10.1007/3-540-49162-7_5
Goyal, V., Jain, A., Pandey, O., Sahai, A.: Bounded ciphertext policy attribute based encryption. In: Aceto, L., Damgård, I., Goldberg, L.A., Halldórsson, M.M., Ingólfsdóttir, A., Walukiewicz, I. (eds.) ICALP 2008. LNCS, vol. 5126, pp. 579–591. Springer, Heidelberg (2008). https://doi.org/10.1007/978-3-540-70583-3_47
Guo, F., Mu, Y., Susilo, W., et al.: CP-ABE with constant-size keys for lightweight devices. IEEE Trans. Inf. Forensics Secur. 9(5), 763–771 (2014)
Goyal, V., Pandey, O., Sahai, A., et al.: Attribute-based encryption for fine-grained access control of encrypted data. In: Proceedings of the 13th ACM Conference on Computer and Communications Security, pp. 89–98. ACM (2006)
Herranz, J., Laguillaumie, F., Ràfols, C.: Constant size ciphertexts in threshold attribute-based encryption. In: Nguyen, P.Q., Pointcheval, D. (eds.) PKC 2010. LNCS, vol. 6056, pp. 19–34. Springer, Heidelberg (2010). https://doi.org/10.1007/978-3-642-13013-7_2
Hur, J., Noh, D.K.: Attribute-based access control with efficient revocation in data outsourcing systems. IEEE Trans. Parallel Distrib. Syst. 22(7), 1214–1221 (2011)
Ibraimi, L., Petkovic, M., Nikova, S., Hartel, P., Jonker, W.: Mediated ciphertext-policy attribute-based encryption and its application. In: Youm, H.Y., Yung, M. (eds.) WISA 2009. LNCS, vol. 5932, pp. 309–323. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-10838-9_23
Jahid, S., Mittal, P., Borisov, N.: EASiER: encryption-based access control in social networks with efficient revocation. In: Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security, pp. 411–415. ACM (2011)
Lai, J., Deng, R.H., Liu, S., Kou, W.: Efficient CCA-secure PKE from identity-based techniques. In: Pieprzyk, J. (ed.) CT-RSA 2010. LNCS, vol. 5985, pp. 132–147. Springer, Heidelberg (2010). https://doi.org/10.1007/978-3-642-11925-5_10
Lewko, A., Okamoto, T., Sahai, A., Takashima, K., Waters, B.: Fully secure functional encryption: attribute-based encryption and (Hierarchical) inner product encryption. In: Gilbert, H. (ed.) EUROCRYPT 2010. LNCS, vol. 6110, pp. 62–91. Springer, Heidelberg (2010). https://doi.org/10.1007/978-3-642-13190-5_4
Lewko, A., Sahai, A., Waters, B.: Revocation systems with very small private keys. In: IEEE Symposium on Security and Privacy (SP), pp. 273–285. IEEE (2010)
Odelu, V., Das, A.K., Rao, Y.S., et al.: Pairing-based CP-ABE with constant-size ciphertexts and secret keys for cloud environment. Comput. Stan. Interfaces (2016)
Ostrovsky, R., Sahai, A., Waters, B.: Attribute-based encryption with non-monotonic access structures. In: Proceedings of the 14th ACM Conference on Computer and Communications Security, pp. 195–203. ACM (2007)
Rouselakis, Y., Waters, B.: Practical constructions and new proof methods for large universe attribute-based encryption. In: Proceedings of the 2013 ACM SIGSAC Conference on Computer and Communications Security, pp. 463–474. ACM (2013)
Sahai, A., Waters, B.: Fuzzy identity-based encryption. In: Cramer, R. (ed.) EUROCRYPT 2005. LNCS, vol. 3494, pp. 457–473. Springer, Heidelberg (2005). https://doi.org/10.1007/11426639_27
Waters, B.: Ciphertext-policy attribute-based encryption: an expressive, efficient, and provably secure realization. In: Catalano, D., Fazio, N., Gennaro, R., Nicolosi, A. (eds.) PKC 2011. LNCS, vol. 6571, pp. 53–70. Springer, Heidelberg (2011). https://doi.org/10.1007/978-3-642-19379-8_4
Wang, G., Liu, Q., Wu, J.: Hierarchical attribute-based encryption for fine-grained access control in cloud storage services. In: Proceedings of the 17th ACM Conference on Computer and Communications Security, pp. 735–737. ACM (2010)
Yamada, S., Attrapadung, N., Hanaoka, G., Kunihiro, N.: Generic constructions for chosen-ciphertext secure attribute based encryption. In: Catalano, D., Fazio, N., Gennaro, R., Nicolosi, A. (eds.) PKC 2011. LNCS, vol. 6571, pp. 71–89. Springer, Heidelberg (2011). https://doi.org/10.1007/978-3-642-19379-8_5
Yang, K., Jia, X.: DAC-MACS: effective data access control for multi-authority cloud storage systems. In: Security for Cloud Storage Systems, pp. 59–83. Springer, New York (2014). https://doi.org/10.1007/978-1-4614-7873-7_4
Yang, K., Jia, X., Ren, K.: Attribute-based fine-grained access control with efficient revocation in cloud storage systems. In: Proceedings of the 8th ACM SIGSAC Symposium on Information, Computer and Communications Security, pp. 523–528. ACM (2013)
Yu, S., Wang, C., Ren, K., et al.: Attribute based data sharing with attribute revocation. In: Proceedings of the 5th ACM Symposium on Information, Computer and Communications Security, pp. 261–270. ACM (2010)
Zhang, Y., Zheng, D., Chen, X., Li, J., Li, H.: Computationally efficient ciphertext-policy attribute-based encryption with constant-size ciphertexts. In: Chow, S.S.M., Liu, J.K., Hui, L.C.K., Yiu, S.M. (eds.) ProvSec 2014. LNCS, vol. 8782, pp. 259–273. Springer, Cham (2014). https://doi.org/10.1007/978-3-319-12475-9_18
Acknowledgement
This work is partially supported by Foundation of Science and Technology on Information Assurance Laboratory under Grant 6142112010202.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
A Security for Our Dynamic Scheme
A Security for Our Dynamic Scheme
We shall give the security proof sketch for our dynamic scheme under generic group model. Since the challenged ciphertext \(C=M_\mu (\prod _{i\in X}H_i)^\kappa \), \(\mu \in \{0,1\}\), it suffices to show that given all information in the d-CPA-CP-ABE game for Adv, \((\prod _{i\in X}H_i)^\kappa \) is uniformly random under Adv’s view.
We first list all elements of \(\mathbb {G}\) and \(\mathbb {G}_T\) that Adv can get from the game, and then analyse the elements Adv can get from the oracles assumed by the generic group model. In the d-CPA-CP-ABE game, Adv is provided with (for each w at version number ver, we distinguish it among others by \(w_{ver}\)):
In \(\mathbb {G}\): \(a_1,...,a_n,b_1,...,b_n,w_1,...,w_{ver^*}\),
\(\{(v)_k,(p_1)_k,...,(p_n)_k,(t_1)_k,...,(t_{ver^*})_k|(v)_k... \text{ is } v,... \text{ in } \text{ the } k\text{-th } \text{ query }\}\),
\(k,u,\{z_i|i\in Z\}\).
In \(\mathbb {G}_T\): \(H_1,...,H_n\).
We can write each element by its exponent. For the given generator g of \(\mathbb {G}\), we write an element in \(\mathbb {G}\), \(g^i\) by i, and an element in \(\mathbb {G}_T\), \(e(g,g)^j\) by j. We need to include some new variables. We suppose that \(h_i=g^{\sigma _i}\), so \(H_i=e(g,g)^{\sigma _i}\). Also we suppose that \((v)_k=g^{\upsilon _k}\).
Then, we write the elements Adv can get by:
In \(\mathbb {G}\): 1, \(\alpha _1,...,\alpha _n,\beta _1,...,\beta _n,\omega _1,...,\omega _{ver^*}\),
\(\{\upsilon _k,\{\sigma _i-\upsilon _k(\alpha _i+\beta _i)|i=1,...,n\},\{\upsilon _k(\sum _{i\in S_j}\beta _i-\omega _j)|j=1,...,ver^*\}|k=1,...,s\}\), s is the number of total private key queries,
\(\kappa ,\kappa (\omega _{ver^*}+\sum _{i\in X}\alpha _i),\{\kappa \beta _i|i\in Z\}\).
In \(\mathbb {G}_T\): \(\sigma _1,...,\sigma _n\). Also the required \((\prod _{i\in X}H_i)^\kappa \) could be written by \(\kappa \sum _{i\in X}\sigma _i\).
The only restriction on them is that either \(X\not \subseteq S_{ver^*}\) or \(Y\cap S_{ver^*}\ne \emptyset \).
There are two kinds of oracles in the generic group model: one can call the mapping oracle e which maps two elements a, b in \(\mathbb {G}\) into element ab in \(\mathbb {G}_T\), and the group operation oracle which maps two elements a, b in \(\mathbb {G}\) (or \(\mathbb {G}_T)\) into an element \(a+b\) in \(\mathbb {G}\) (or \(\mathbb {G}_T\), respectively). We show that it is unable for Adv to get \(\kappa \sum _{i\in X}\sigma _i\) by these oracles. Without loss of generality, we assume that the mapping oracle is always called between two elements which Adv gotten from the game.
For each \(i\in X\), in order to get the term \(\kappa \sigma _i\), Adv must at least call the mapping oracle once with two elements, one has the term \(\kappa \) and the other has the term \(\sigma _i\). The only element contains term \(\kappa \) is \(\kappa \) itself, and the element contains the term \(\sigma _i\) is \(\sigma _i-\upsilon _k(\alpha _i+\beta _i)\) for any k. Then, Adv must further get the term \(\kappa \upsilon _k\alpha _i\) and \(\kappa \upsilon _k\beta _i\) from other mapping oracle calls. The former can only be get from \((\kappa (\omega _{ver^*}+\sum _{i\in X}\alpha _i),\upsilon _k)\), while the latter can only be get from \((\kappa ,\upsilon _k(\sum _{i\in S_j}\beta _i-\omega _j))\) for some j. Here, j must be equal to \(ver^*\), or there is no way for Adv to get rid of the term \(\kappa \upsilon _k\omega _j\).
Note that although Adv can the term \(\kappa \sigma _i\) for each \(i\in X\) from \((\kappa ,\sigma _i-\upsilon _k(\alpha _i+\beta _i))\) with different ks, but the additional terms in \((\kappa (\omega _{ver^*}+\sum _{i\in X}\alpha _i),\upsilon _k)\) requires that all k to be same.
We sum up all the oracle calls Adv must make, and get:
The additional term of \(\kappa \upsilon _k\beta _i\) must be gotten from mapping queries different from those above, which means that only from \((\kappa \beta _i,\upsilon _k)\) where \(i\in Z\). So we must have that \((S_{ver^*}-X)\cup (X-S_{ver^*})\subseteq Z\). But \(X\cap Z=\emptyset \), so we must have \(X-S_{ver^*}=\emptyset \), which means \(S_{ver^*}\subseteq X\). Also, \(Y\cap Z=\emptyset \), so \((S_{ver^*}-X)\cap Y=\emptyset \). But \(X\cap Y=\emptyset \), so \(S_{ver^*}\cap Y=\emptyset \). This contradicts with our requirement for \(S_{ver^*}\).
The only chance for Adv to get the hidden elements, is that there happen to be two same elements in two different oracle calls. Suppose that the number of total oracle calls is q, so the advantage for Adv cannot be greater than \(O(q^2/p)\).
Rights and permissions
Copyright information
© 2018 Springer International Publishing AG, part of Springer Nature
About this paper
Cite this paper
Wang, G., Zhang, X., Li, Y. (2018). Constant Decryption-Cost Non-monotonic Ciphertext Policy Attribute-Based Encryption with Reduced Secret Key Size (and Dynamic Attributes). In: Chen, X., Lin, D., Yung, M. (eds) Information Security and Cryptology. Inscrypt 2017. Lecture Notes in Computer Science(), vol 10726. Springer, Cham. https://doi.org/10.1007/978-3-319-75160-3_15
Download citation
DOI: https://doi.org/10.1007/978-3-319-75160-3_15
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-75159-7
Online ISBN: 978-3-319-75160-3
eBook Packages: Computer ScienceComputer Science (R0)