Mix&Slice

Abstract

We present an approach to enforce access revocation on resources stored at external cloud providers. The approach relies on a resource transformation that provides strong mutual inter-dependency in its encrypted representation. To revoke access on a resource, it is then sufficient to update a small portion of it, with the guarantee that the resource as a whole (and any portion of it) will become unintelligible to those from whom access is revoked. The extensive experimental evaluation on a variety of configurations confirmed the effectiveness and efficiency of our solution, which showed excellent performance and compatibility with several implementation strategies.

Mix&Slice for Efficient Access Revocation on Outsourced Data

“…Indeed, 3 rounds are necessary, but also sufficient, to create a pseudorandom permutation, ensuring complete mixing. 1 With 3-round OAEP ensuring complete mixing, we need then to consider the other two properties that must be ensured by mixing, that is, support for macro-blocks of arbitrary size and no-shrinking effect. Before discussing the mixing function to guarantee these properties we make a note on the input and final step to produce output for the application of OAEP mixing.…”

“…A preliminary version of this paper appeared under the title "Mix&slice: Efficient access revocation in the cloud," in Proc. of the 23rd ACM Conference on Computer and Communications Security (CCS 2016) [1] One of the complex aspects in using encryption to enforce access control concerns access revocation. If granting an authorization is easy (it is sufficient to give the newly authorized user access to the key for decrypting the resource), revoking an authorization is a completely different problem.…”

“…A preliminary version of this work appeared in [1]. In this paper, we extend our proposal with a more general approach to mixing by considering also the application of the Optimal Asymmetric Encryption Padding (OAEP), discussing two strategies for such a solution.…”

Selective Owner-side Encryption in Digital Data Markets: Strategies for Key Derivation

“…The adoption of selective encryption, possibly combined with key derivation, has been widely adopted in data outsourcing scenarios, which are characterized by data owners storing their resources on the premises of non fully trusted cloud providers (e.g., (Bacis et al, 2016;De Capitani di Vimercati et al, 2010;De Capitani di Vimercati et al, 2016)). These approaches however operate in a different scenario and aim at enforcing a (quite static) authorization policy defined by the data owner.…”

Lightweight Attribute-based Encryption Supporting Access Policy Update for Cloud Assisted IoT

“…Due to their limited storage and computation capacities, IoT devices are usually assisted with cloud services to store and process generated data (Kaaniche and Laurent, 2017b;Belguith et al, 2015). IoT devices produce huge amounts of data which need to be securely collected and shared among different users (Bacis et al, 2016a;Bacis et al, 2016b). Consequently, encryption and access control mechanisms are important to protect data from unauthorised access (Belguith et al, 2016).…”