Ciphertext-Policy Attribute-Based Encryption with Key-Delegation Abuse Resistance

Abstract

Attribute-based encryption (ABE) is a promising cryptographic primitive that allows one-to-many encryption. In such a system, users' private keys are linked to their access rights. We note that if a user can generate a new private key for a portion of his/her access right, this could potentially lead to some undesirable situations, which violate the access control policy. Interestingly, to date, there is no work that looks into this matter in detail nor addresses it. We point out that this is a "property" that exists in ABE systems, which we refer to "key-delegation abuse". ABE systems that suffer from key-delegation abuse will hinder the adoption of these systems in practice. In this work, for the first time in the literature, we address the "key-delegation abuse" problem in Ciphertext-policy Attribute-based Encryption (CP-ABE) systems. We introduce a new mechanism to enhance CP-ABE schemes that provide protections against this key-delegation abuse issue. We formalize the security requirements for such a property, and subsequently construct a CP-ABE scheme that satisfies the new security requirements. We also present an application of our scheme to a traceable CP-ABE, where the "traitors", i.e. the users who have leaked their keys, can be traced. address the "key-delegation abuse" problem in Ciphertext-policy Attribute-based Encryption (CP-ABE) systems. We introduce a new mechanism to enhance CPABE schemes that provide protections against this key-delegation abuse issue. We formalize the security requirements for such a property, and subsequently construct a CP-ABE scheme that satisfies the new security requirements.We also present an application of our scheme to a traceable CP-ABE, where the "traitors", i.e. the users who have leaked their keys, can be traced. Abstract. Attribute-based encryption (ABE) is a promising cryptographic primitive that allows one-to-many encryption. In such a system, users' private keys are linked to their access rights. We note that if a user can generate a new private key for a portion of his/her access right, this could potentially lead to some undesirable situations, which violate the access control policy. Interestingly, to date, there is no work that looks into this matter in detail nor addresses it. We point out that this is a "property" that exists in ABE systems, which we refer to "key-delegation abuse". ABE systems that suffer from key-delegation abuse will hinder the adoption of these systems in practice. In this work, for the first time in the literature, we address the "key-delegation abuse" problem in Ciphertext-policy Attribute-based Encryption (CP-ABE) systems. We introduce a new mechanism to enhance CP-ABE schemes that provide protections against this key-delegation abuse issue. We formalize the security requirements for such a property, and subsequently construct a CP-ABE scheme that satisfies the new security requirements. We also present an application of our scheme to a traceable CP-ABE, where the "traitors", i.e. the users who have leaked their keys, can...

Attribute‐based encryption scheme for secure data sharing in cloud with fine‐grained revocation

“…Our revocation techniques can be applied to any ABE scheme that does not support revocation (e.g., References 1,3,13). However, in this paper, we choose the scheme proposed in Reference 1 for several reasons.…”

A Study on CP-ABE-Based Medical Data Sharing System with Key Abuse Prevention and Verifiable Outsourcing in the IoMT Environment

“…Therefore, if the user ID value is managed by the AA, the anonymity of the cloud user will not be ensured. Another problem is that because data is encrypted with attribute-based encryption, the size of the ciphertext increases with the number of attributes contained in the access structure [ 12 , 13 , 14 ]. This can waste space in cloud storage, and when the user decrypts the ciphertext the amount of computation increases with the number of attributes, which affects the user’s ciphertext decryption speed.…”

SELI: statistical evaluation based leaker identification stochastic scheme for secure data sharing

“…A traceable CP‐ABE is provided by Liu et al in [10] to provide the traceability feature in the existing CP‐ABE while maintaining its security. Moreover, a CP‐ABE scheme is presented in [11] for addressing the key‐delegation abuse problem in the existing CP‐ABE system by introducing new properties related to security. Additionally, the authors integrated the traceability feature with the scheme.…”