Attribute-based data access control in mobile cloud computing

Attribute-based encryption (ABE) for cloud computing access control is reviewed in this article. A taxonomy and comprehensive assessment criteria of ABE are first proposed. In the taxonomy, ABE schemes are assorted into key-policy ABE (KP-ABE) schemes, ciphertext-policy ABE (CP-ABE) schemes, anti-quantum ABE schemes, and generic constructions. In accordance with cryptographically functional features, CP-ABE is further divided into nine subcategories with regard to basic functionality, revocation, accountability, policy hiding, policy updating, multi-authority, hierarchy, offline computation, and outsourced computation. In addition, a systematical methodology for discussing and comparing existing ABE schemes is proposed. For KP-ABE and each type of CP-ABE, the corresponding access control scenario is presented and explained by concrete examples. Specifically, the syntax of ABE is given followed by the adversarial model and security goals. ABE schemes are discussed according to the design strategies and special features and are compared in the light of the proposed assessment criteria with respect to security and performance. Compared to related state-of-the-art survey papers, this article not only provides a broader 12 categories of ABE schemes, but also makes a more comprehensive and holistic comparison. Finally, a number of open research challenges in ABE are pointed out.

https://ink.library.smu.edu.sg/cgi/viewcontent.cgi?article=6370&context=sis_research

Attribute-based Encryption for Cloud Computing Access Control: A Survey

Nowadays cloud servers have become the primary choice to store and share data with multiple users across the globe. The major challenge in sharing data using cloud servers is to protect data against untrusted cloud service provider and illegitimate users. Attribute-Based Encryption (ABE) has emerged as a useful cryptographic technique to securely share data with legitimate recipients in fine-grained manner. Several solutions employing ABE have been proposed to securely share data using cloud servers. However, most of the solutions are data owner-centric and focus on providing data owner complete control on his outsourced data. The existing solutions in cloud computing fail to provide shared access privileges among users and to enable cloud users to delegate their access privileges in a flexible manner. In order to simultaneously achieve the notion of fine-grained access control, scalability and to provide cloud users shared access privileges and flexibility on delegation of their access privileges, we propose a scalable attribute-based access control scheme for cloud storage. The scheme extends the ciphertext policy attribute-based encryption to achieve flexible delegation of access privileges and shared access privileges along with scalability and fine-grained access control. The scheme achieves scalability by employing hierarchical structure of users. Furthermore, we formally prove the security of our proposed scheme based on security of the ciphertext-policy attribute-based encryption. We also implement the algorithm to show its scalability and efficiency.

A Scalable Attribute-Based Access Control Scheme with Flexible Delegation cum Sharing of Access Privileges for Cloud Storage

With the fast growing demands for the big data, we need to manage and store the big data in the cloud Since the cloud is not fully trusted and it can be accessed by any users, the data in the cloud may face threats In this paper, we propose a secure authentication protocol for cloud big data with a hierarchical attribute authorization structure Our proposed protocol resorts to the tree-based signature to significantly improve the security of attribute authorization To satisfy the big data requirements, we extend the proposed authentication protocol to support multiple levels in the hierarchical attribute authorization structure Security analysis shows that our protocol can resist the forgery attack and replay attack In addition, our protocol can preserve the entities privacy Comparing with the previous studies, we can show that our protocol has lower computational and communication overhead

Secure Authentication in Cloud Big Data with Hierarchical Attribute Authorization Structure

Ciphertext-policy attribute-based encryption (CP-ABE) schemes are an appropriate cryptographic technique to enable privacy along with access control in the cloud, but the existing CP-ABE schemes do...

Efficient Escrow-free CP-ABE with Constant Size Ciphertext and Secret Key for Big Data Storage in Cloud

With the popularity of cloud computing, there have been increasing concerns about its security and privacy. Since the cloud computing environment is distributed and untrusted, data owners have to encrypt outsourced data to enforce confidentiality. Therefore, how to achieve practicable access control of encrypted data in an untrusted environment is an urgent issue that needs to be solved. Attribute-based encryption (ABE) is a promising scheme suitable for access control in cloud storage systems. This paper proposes a hierarchical attribute-based access control scheme with constant-size ciphertext. The scheme is efficient because the length of ciphertext and the number of bilinear pairing evaluations to a constant are fixed. Its computation cost in encryption and decryption algorithms is low. Moreover, the hierarchical authorization structure of our scheme reduces the burden and risk of a single authority scenario. We prove the scheme is of CCA2 security under the decisional q-Bilinear Diffie-Hellman Exponent assumption. In addition, we implement our scheme and analyse its performance. The analysis results show the proposed scheme is efficient, scalable, and fine-grained in dealing with access control for outsourced data in cloud computing.

Attribute-Based Access Control with Constant-Size Ciphertext in Cloud Computing

The invention provides a file encrypting and decrypting method allowing parallel computing to be conducted in a cloud storage system. According to the method, through a parallel computing mechanism of a cloud computing environment, such as a MapReduce parallel computing technology, grouped encryption is conducted on plaintext data, and through a partitioned matrix multiplication algorithm, encryption of a whole file is finally achieved and the encrypted file is uploaded to the storage system of the cloud computing environment. The method includes five steps of generating an involutory secret key matrix, calculating a computing secret key, partitioning a data file, encrypting data and decrypting the data. In an encryption system initialization process, a modular arithmetic method is adopted, a random secret key matrix is constructed, and the matrix has the characteristic that the matrix is equal to the inverse matrix of the matrix. In a matrix partitioning process, through a boundary division method, each block of parallel computing is determined. In a data encrypting process, through the partition multiplication of the secret key matrix and a plaintext matrix, encryption of the plaintext data is finally achieved. In a decrypting process, according to the property of an involutory matrix, a ciphertext matrix is multiplied by the secret key matrix, mocking up is conducted, and the final encrypted file is obtained.

Dongyang Wang

Papers

Attribute-Based Access Control with Constant-Size Ciphertext in Cloud Computing

File encrypting and decrypting method allowing parallel computing to be conducted in cloud storage system