With the help of cloud computing, the ubiquitous and diversified Internet of things (IoT) has greatly improved human society. Revocable multi-authority attribute-based encryption (MA-ABE) is considered a promising technique to solve the security challenges on data access control in the dynamic IoT since it can achieve dynamic access control over the encrypted data. However, on the one hand, the existing revocable large universe MA-ABE suffers the collusion attack launched by revoked users and nonrevoked users. On the other hand, the user collusion avoidance revocable MA-ABE schemes do not support large attributes (or users) universe, i.e. the flexible number of attributes (or users). In this article, the author proposes an efficient revocable large universe MA-ABE based on prime order bilinear groups. The proposed scheme supports user-attribute revocation, i.e., the revoked user only loses one or more attributes, and she/he can access the data so long as her/his remaining attributes satisfy the access policy. It is static security in the random oracle model under the q-DPBDHE2 assumption. Moreover, it is secure against the collusion attack launched by revoked users and non-revoked users. Meanwhile, it meets the requirements of forward and backward security. The limited-resource users can choose outsourcing decryption to save resources. The performance analysis results indicate that it is suitable for large-scale cross-domain collaboration in the dynamic cloud-aided IoT.

The data collected, stored, shared, and accessed across different platforms in the dynamic IoT is mostly confidential and privacy-sensitive. Data security and access control issues urgently need to be addressed. Multi-authority attribute-based encryption (MA-ABE) is seen as a potential solution for addressing data access control security concerns in the dynamic IoT since it allows for dynamic access control over encrypted data. However, the existing key abuse problem is severely destroying the security access control of MA-ABE. The existing accountable attribute-based encryption schemes only support small attributes (users) universe and single authority. Moreover, they do not support revocation. Some schemes are inefficient since they are constructed in the composite order bilinear group. In this article, the author proposes the first accountable and revocable large universe decentralized multi-authority attribute-based encryption scheme with outsourcing decryption based on prime order bilinear groups. The proposed scheme allows for the dynamic capacity expansion of attributes, users, and authorities. An audit mechanism is given to judge if the suspicious key was leaked by a malicious user or by authorities and to determine the identity of the leaker. The malicious user who divulges key can be punished by user-attribute revocation. The revocation mechanism is resistant to collusion attacks undertaken by revoked users and non-revoked users. Meanwhile, it satisfies the requirements of forward and backward security. The proposed scheme is static security in the random oracle model under the q-DPBDHE2 assumption. To save resources, the outsourced decryption module is optional for users with restricted resources. According to the results of the performance analysis, it is suited for large-scale cross-domain cooperation in the dynamic cloud-aided IoT.

With the assistance of edge computing which reduces the heavy burden of the cloud center server by using the network edge servers, the Internet of Things (IoTs) architectures enable low latency for real-time devices and applications. However, there still exist security challenges on data access control for the IoT. Multiauthority attribute-based encryption (MA-ABE) is a promising technique to achieve access control over encrypted data in cross-domain applications. Based on the characteristics and technical requirements of the IoT, we propose an efficient fine-grained revocable large universe multiauthority access control scheme. In the proposed scheme, the most expensive encryption operations have been executed in the user’s initialization phase by adding a reusable ciphertext pool besides splitting the encryption algorithm to online encryption and offline encryption. Massive decryption operations are outsourced to the near-edge servers for reducing the computation overhead of decryption. An efficient revocation mechanism is designed to change users’ access privileges dynamically. Moreover, the scheme supports ciphertext verification. Only valid ciphertext can be stored and transmitted, which saves system resources. With the help of the chameleon hash function, the proposed scheme is proven CCA2-secure under the q-DPBDHE2 assumption. The performance analysis results indicate that the proposed scheme is efficient and suitable in edge computing for the IoT.