Revocable Key-Aggregate Cryptosystem for Data Sharing in Cloud

Abstract

With the rapid development of network and storage technology, cloud storage has become a new service mode, while data sharing and user revocation are important functions in the cloud storage. Therefore, according to the characteristics of cloud storage, a revocable key-aggregate encryption scheme is put forward based on subset-cover framework. The proposed scheme not only has the key-aggregate characteristics, which greatly simplifies the user’s key management, but also can revoke user access permissions, realizing the flexible and effective access control. When user revocation occurs, it allows cloud server to update the ciphertext so that revoked users can not have access to the new ciphertext, while nonrevoked users do not need to update their private keys. In addition, a verification mechanism is provided in the proposed scheme, which can verify the updated ciphertext and ensure that the user revocation is performed correctly. Compared with the existing schemes, this scheme can not only reduce the cost of key management and storage, but also realize user revocation and achieve user’s access control efficiently. Finally, the proposed scheme can be proved to be selective chosen-plaintext security in the standard model.

Efficient dynamic key‐aggregate cryptosystem for secure and flexible data sharing

“…There exists a revocable KAC due to Gan et al 7 However, the construction of their scheme is based on multilinear maps which need expensive computations. Since there are no known secure and efficient implementations of multilinear maps, their scheme has very limited practical application.…”

“…There are different KACs 5‐7,9 in the existing literature. In References 4 and 6, the cost of performing dynamic updates is too much as to update a single message class, all the aggregate keys need to be updated.…”

“…In Reference 5, the scheme obtained as a result of augmenting the KAC scheme with broadcast encryption is not dynamic. The KAC scheme, which is proposed in Reference 7 uses multilinear maps, which are computationally too expensive to be considered for any practical application. The work in Reference 9 is not secure as anyone can decrypt the ciphertext without the use of a legitimate aggregate key.…”

“…However, the ciphertexts under data class $$$ j $$$ produced prior to adding $$$ j $$$ to $$$ {S}_k $$$ are inaccessible using current or past version(s) of . In the following, we define the dynamic security of the proposed KAC, inspired from works like References 7, 8, and 25, as a game between the adversary and a challenger $$$ \mathcal{B} $$$. Init: The adversary outputs the aggregate sets $$$ \left\{{S}_1,{S}_2,\dots, {S}_m\right\} $$$, where each $$$ {S}_i\subseteq \left\{1,2,\dots, n\right\} $$$.…”

“…Specifically, to revoke the access capability of such that it can no longer decrypt data encrypted under class $$$ i $$$, must require only to be updated. However, we stress that in all the existing KACs, 4,5 including those that claim to be dynamic, 6,7 the data owner has to update all the aggregate keys to revoke one data class from an aggregate set 8 . For a large value of $$$ m $$$, updating all $$$ m $$$ aggregate keys in the system also requires $$$ m $$$ secure transmissions to be carried out to their respective users.…”