Attribute-based encryption for fine-grained access control of encrypted data

TLDR

Sensitive data stored on third‑party sites increasingly requires encryption, yet existing schemes permit only coarse‑grained sharing by distributing private keys. The authors propose Key‑Policy Attribute‑Based Encryption (KP‑ABE) to enable fine‑grained sharing of encrypted data, and illustrate its use for audit‑log sharing and broadcast encryption. KP‑ABE labels ciphertexts with attribute sets and issues private keys tied to access structures, allowing delegation of keys and subsuming Hierarchical Identity‑Based Encryption.

Abstract

As more sensitive data is shared and stored by third-party sites on the Internet, there will be a need to encrypt data stored at these sites. One drawback of encrypting data, is that it can be selectively shared only at a coarse-grained level (i.e., giving another party your private key). We develop a new cryptosystem for fine-grained sharing of encrypted data that we call Key-Policy Attribute-Based Encryption (KP-ABE). In our cryptosystem, ciphertexts are labeled with sets of attributes and private keys are associated with access structures that control which ciphertexts a user is able to decrypt. We demonstrate the applicability of our construction to sharing of audit-log information and broadcast encryption. Our construction supports delegation of private keys which subsumesHierarchical Identity-Based Encryption (HIBE).