• 한국산업정보학회논문지
• /
• 제19권1호
• /
• pp.1-12
• /
• 2014

An access control system is needed to ensure only authorized users can access a sensitive resource. We propose a secure access control based on a fully secure and fine grained ciphertext-policy attribute-based encryption scheme. The access control for a sensitive resource is ensured by encrypting it with encryption algorithm from the CP-ABE scheme parameterized by an access control policy. Furthermore, the proposed access control supports non-monotone type access control policy. The ciphertext only can be recovered by users whose attributes satisfy the access control policy. We also implement and measure the performance of our proposed access control. The results of experiments show that our proposed secure access control is feasible.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제11권6호
• /
• pp.3254-3272
• /
• 2017

With the development of wireless access technologies and the popularity of mobile intelligent terminals, cloud computing is expected to expand to mobile environments. Attribute-based encryption, widely applied in cloud computing, incurs massive computational cost during the encryption and decryption phases. The computational cost grows with the complexity of the access policy. This disadvantage becomes more serious for mobile devices because they have limited resources. To address this problem, we present an efficient verifiable outsourced scheme based on the bilinear group of prime order. The scheme is called the verifiable outsourced computation ciphertext-policy attribute-based encryption scheme (VOC-CP-ABE), and it provides a way to outsource intensive computing tasks during encryption and decryption phases to CSP without revealing the private information and leaves only marginal computation to the user. At the same time, the outsourced computation can be verified by two hash functions. Then, the formal security proofs of its (selective) CPA security and verifiability are provided. Finally, we discuss the performance of the proposed scheme with comparisons to several related works.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제10권7호
• /
• pp.3339-3352
• /
• 2016

In ciphertext-policy attribute-based encryption (CP-ABE) scheme, a user's secret key is associated with a set of attributes, and the ciphertext is associated with an access policy. The user can decrypt the ciphertext if and only if the attribute set of his secret key satisfies the access policy specified in the ciphertext. In the present schemes, access policy is sent to the decryptor along with the ciphertext, which means that the privacy of the encryptor is revealed. In order to solve such problem, we propose a CP-ABE scheme with hidden access policy, which is able to preserve the privacy of the encryptor and decryptor. And what's more in the present schemes, the users need to do excessive calculation for decryption to check whether their attributes match the access policy specified in the ciphertext or not, which makes the users do useless computation if the attributes don't match the hidden access policy. In order to solve efficiency issue, our scheme adds a testing phase to avoid the unnecessary operation above before decryption. The computation cost for the testing phase is much less than the decryption computation so that the efficiency in our scheme is improved. Meanwhile, our new scheme is proved to be selectively secure against chosen-plaintext attack under DDH assumption.

• 전자공학회논문지
• /
• 제50권9호
• /
• pp.21-31
• /
• 2013

CP-ABE 방식은 신뢰된 서버 없이 접근 제어 메카니즘을 구현할 수 있다. 본 논문에서는 권한을 부여받은 사용자가 민감한 데이터에 접근할 수 있도록 CP-ABE 방식으로 속성기반 접근 제어 메카니즘을 제안한다. CP-ABE 개념은 암호문에서 접근 제어 방법을 포함하는 것이다. 만약 사용자가 암호문의 접근 구조를 통해 속성을 가진다면 암호문은 복호될 수 있다. 본 논문에서는 제안한 CP-ABE 방식이 비단조 접근 구조로 표현됨을 증명하고 다른 CP-ABE 방식들과 성능 비교한다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제11권4호
• /
• pp.2292-2309
• /
• 2017

Ciphertext policy attribute-based encryption (CP-ABE) is a useful cryptographic technology for guaranteeing data confidentiality but also fine-grained access control. Typically, CP-ABE can be divided into two classes: small universe with polynomial attribute space and large universe with unbounded attribute space. Since the learning with errors over rings (R-LWE) assumption has characteristics of simple algebraic structure and simple calculations, based on R-LWE, we propose a small universe CP-ABE scheme to improve the efficiency of the scheme proposed by Zhang et al. (AsiaCCS 2012). On this basis, to achieve unbounded attribute space and improve the expression of attribute, we propose a large universe CP-ABE scheme with the help of a full-rank differences function. In this scheme, all polynomials in the R-LWE can be used as values of an attribute, and these values do not need to be enumerated at the setup phase. Different trapdoors are used to generate secret keys in the key generation and the security proof. Both proposed schemes are selectively secure in the standard model under R-LWE. Comparison with other schemes demonstrates that our schemes are simpler and more efficient. R-LWE can obtain greater efficiency, and unbounded attribute space means more flexibility, so our research is suitable in practices.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제15권9호
• /
• pp.3401-3420
• /
• 2021

We provide a traceable ciphertext-policy attribute based encryption (CP-ABE) construction for monotone access structures (MAS) based on composite order bilinear groups, which is secure adaptively under the standard model. We construct this scheme by making use of an "encoding technique" which represents the MAS by their minimal sets to encrypt the messages. To date, for all traceable CP-ABE schemes, their encryption costs grow linearly with the MAS size, the decryption costs grow linearly with the qualified rows in the span programs. However, in our traceable CP-ABE, the ciphertext is linear with the minimal sets, and decryption needs merely three bilinear pairing computations and two exponent computations, which improves the efficiency extremely and has constant decryption. At last, the detailed security and traceability proof is given.

• International Journal of Computer Science & Network Security
• /
• 제22권6호
• /
• pp.212-222
• /
• 2022

There has been a rapid increase in the use of cloud email services. As a result, email encryption has become more commonplace as concerns about cloud privacy and security grow. Nevertheless, this increase in usage is creating the challenge of how to effectively be searching and filtering the encrypted emails. They are popular technologies of solving the issue of the encrypted emails searching through searchable public key encryption. However, the problem of encrypted email filtering remains to be solved. As a new approach to finding and filtering encrypted emails in the cloud, we propose a ciphertext-based encrypted policy attribute-based encryption scheme and keyword search procedure based on hidden policy ciphertext. This feature allows the user of searching using some encrypted emails keywords in the cloud as well as allowing the emails filter-based server toward filter the content of the encrypted emails, similar to the traditional email keyword filtering service. By utilizing composite order bilinear groups, a hidden policy system has been successfully demonstrated to be secure by our dual system encryption process. Proposed system can be used with other scenarios such as searching and filtering files as an applicable method.

• 대한수학회보
• /
• 제46권4호
• /
• pp.803-819
• /
• 2009

In classical encryption schemes, data is encrypted under a single key that is associated with a user or group. In Ciphertext-Policy Attribute-Based Encryption(CP-ABE) keys are associated with attributes of users, given to them by a central trusted authority, and data is encrypted under a logical formula over these attributes. We extend this idea to the case where an arbitrary number of independent parties can be present to maintain attributes and their corresponding secret keys. We present a scheme for multi-authority CP-ABE, propose the first two constructions that fully implement the scheme, and prove their security against chosen plaintext attacks.

• 융합보안논문지
• /
• 제19권1호
• /
• pp.49-60
• /
• 2019

개인 의료정보는 개인의 존엄성과 가치를 소중히 여기는 개인정보의 한 부분으로서, 만약 불법적인 유출이 되었을 때 한 개인에게 심각한 사회적 편견과 불이익이 돌아올 수 있다. 또한, 그 의료정보는 쓰임새가 많아 그 가치가 상대적으로 높아 내, 외부적인 위협이 지속되고 있는 것이 현실이다. 이에 본 논문에서는 암호문 정책 속성중심 프락시 재암호 기법을 사용하여 블록체인 기반 환자 프라이버시가 보장되는 의료정보공유 프레임워크를 제안한다. 제안하는 프레임워크는 먼저 블록체인을 사용하여 의무기록의 무결성과 투명성을 보장하고, 스텔스 주소를 사용하여 의사-환자의 연계불가성을 제안한다. 또한 암호문 기반 속성중심 암호를 이용하여 세밀한 접근제어가 가능하고, 환자 미동의 및 응급 상황에서의 정보공유가 가능하다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제13권5호
• /
• pp.2718-2731
• /
• 2019

Conjunctive keyword search encryption is an important technique for protecting sensitive data that is outsourced to cloud servers. However, the process of searching outsourced data may facilitate the leakage of sensitive data. Thus, an efficient data search approach with high security is critical. To solve this problem, an efficient conjunctive keyword search scheme based on ciphertext-policy attribute-based encryption is proposed for cloud storage environment. This paper proposes an efficient mechanism for removing the secure channel and resisting off-line keyword-guessing attacks. The storage overhead and the computational complexity are regardless of the number of keywords. This scheme is proved adaptively secure based on the decisional bilinear Diffie-Hellman assumption in the standard model. Finally, the results of theoretical analysis and experimental simulation show that the proposed scheme has advantages in security, storage overhead and efficiency, and it is more suitable for practical applications.