Attribute based data sharing with attribute revocation

TLDR

Ciphertext‑Policy Attribute‑Based Encryption (CP‑ABE) enables fine‑grained access control by encrypting data under attribute access structures that users satisfy to decrypt, but practical deployments require additional capabilities beyond this basic property. This work addresses the challenging problem of attribute revocation in CP‑ABE schemes. We combine proxy re‑encryption with CP‑ABE, employing semi‑trustworthy online proxy servers to delegate most revocation tasks and reduce the authority’s workload. The resulting scheme allows the authority to revoke attributes with minimal effort, is provably secure against chosen‑ciphertext attacks, and extends naturally to Key‑Policy ABE.

Abstract

Ciphertext-Policy Attribute Based Encryption (CP-ABE) is a promising cryptographic primitive for fine-grained access control of shared data. In CP-ABE, each user is associated with a set of attributes and data are encrypted with access structures on attributes. A user is able to decrypt a ciphertext if and only if his attributes satisfy the ciphertext access structure. Beside this basic property, practical applications usually have other requirements. In this paper we focus on an important issue of attribute revocation which is cumbersome for CP-ABE schemes. In particular, we resolve this challenging issue by considering more practical scenarios in which semi-trustable on-line proxy servers are available. As compared to existing schemes, our proposed solution enables the authority to revoke user attributes with minimal effort. We achieve this by uniquely integrating the technique of proxy re-encryption with CP-ABE, and enable the authority to delegate most of laborious tasks to proxy servers. Formal analysis shows that our proposed scheme is provably secure against chosen ciphertext attacks. In addition, we show that our technique can also be applicable to the Key-Policy Attribute Based Encryption (KP-ABE) counterpart.