Survey on Revocation in Ciphertext-Policy Attribute-Based Encryption <s> The Single Authority Scheme <s> We develop an abstract framework that encompasses the key properties of bilinear groups of composite order that are required to construct secure pairing-based cryptosystems, and we show how to use prime-order elliptic curve groups to construct bilinear groups with the same properties. In particular, we define a generalized version of the subgroup decision problem and give explicit constructions of bilinear groups in which the generalized subgroup decision assumption follows from the decision Diffie-Hellman assumption, the decision linear assumption, and/or related assumptions in prime-order groups. ::: ::: We apply our framework and our prime-order group constructions to create more efficient versions of cryptosystems that originally required composite-order groups. Specifically, we consider the Boneh-Goh-Nissim encryption scheme, the Boneh-Sahai-Waters traitor tracing system, and the Katz-Sahai-Waters attribute-based encryption scheme. We give a security theorem for the prime-order group instantiation of each system, using assumptions of comparable complexity to those used in the composite-order setting. Our conversion of the last two systems to prime-order groups answers a problem posed by Groth and Sahai. <s> BIB001 </s> Survey on Revocation in Ciphertext-Policy Attribute-Based Encryption <s> The Single Authority Scheme <s> As more sensitive data is shared and stored by third-party sites on the internet, there will be a need to encrypt data stored at these sites. One drawback of encrypting data is that it can be selectively shared only at a coarse-grained level. Attribute based encryption is a public-key-based one-to-many encryption that allows users to encrypt and decry pt data based on user attributes. A promising application of ABE is flexible access control of encrypted data stored in the cloud using access policies and ascribed attributes associated with private keys and cipher text. One.One of the main efficiency drawbacks of the existing ABE schemes is that decryption involves expensive pairing operations and the number of such operations grows with the complexity of the access policy. Finally, we show an implementation scheme and result of performance measurements, which indicates a significant reduction on computing resources imposed on users. <s> BIB002 </s> Survey on Revocation in Ciphertext-Policy Attribute-Based Encryption <s> The Single Authority Scheme <s> In several distributed environments, users can decrypt a secret message using a certain number of valid attributes or credentials. Attribute-based encryption (ABE) is the most promising technique to achieve such fine-grain access control. In recent years, many ABE schemes have been proposed, but most of them are constructed based on the concept of pairing and secret sharing scheme. This paper aims at presenting a pairing-free threshold-based ABE scheme (PT-ABE) over multiplicative group. The propose work is secured under the standard decisional Diffie–Hellman (DDH) assumption, and both error-tolerant and collusion-free. The scheme does not consider random oracle operation to prove its security. We compare the PT-ABE scheme with other relevant ABE schemes and find that our scheme is much more efficient and flexible than others. Besides, we propose a protocol based on PT-ABE scheme and show that PT-ABE is perfectly suitable in cloud environment to provide cloud security. To the best of our knowledge, the proposed scheme should be implemented in real- life distributed scenarios, as it is well secured, flexible and perform better than existing ones. <s> BIB003 </s> Survey on Revocation in Ciphertext-Policy Attribute-Based Encryption <s> The Single Authority Scheme <s> Abstract ::: Attribute based encryption (ABE) has been widely applied for secure data protection in various data sharing systems. However, the efficiency of existing ABE schemes is not high enough since running encrypt and decrypt algorithms need frequent bilinear pairing operations, which may occupy too much computing resources on terminal devices. What’s more, since different users may share the same attributes in the system, a single user’s private key exposure will threaten the security and confidentiality of the whole system. Therefore, to further decrease the computation cost in attribute based cryptosystem as well as provide secure protection when key exposure happens, in this paper, we firstly propose a high efficient key-insulated ABE algorithm without pairings. The key-insulated mechanism guarantees both forward security and backward security when key exposure or user revocation happens. Besides, during the running of algorithms in our scheme, users and attribute authority needn’t run any bilinear pairing operations, which will increase the efficiency to a large extent. The high efficiency and security analysis indicate that our scheme is more appropriate for secure protection in data sharing systems. <s> BIB004 </s> Survey on Revocation in Ciphertext-Policy Attribute-Based Encryption <s> The Single Authority Scheme <s> Ciphertext-policy attribute-based encryption (CP-ABE) scheme can be deployed in a mobile cloud environment to ensure that data outsourced to the cloud will be protected from unauthorized access. Since mobile devices are generally resource-constrained, CP-ABE schemes designed for a mobile cloud deployment should have constant sizes for secret keys and ciphertexts. However, most existing CP-ABE schemes do not provide both constant size ciphertexts and secret keys. Thus, in this paper, we propose a new pairing-based CP-ABE scheme, which offers both constant size ciphertexts and secret keys (CSCTSK) with an expressive AND gate access structure. We then show that the proposed CP-ABE-CSCTSK scheme is secure against chosen-ciphertext adversary in the selective security model, and present a comparative summary to demonstrate the utility of the scheme. Since mobile devices are generally resource-constrained and cloud services are Internet-based and pay-by-use, a key feature in ciphertext-policyAttribute-based encryption (CP-ABE) should be constant sizes for secret keys and ciphertexts.In this paper, we propose a new pairing-based CP-ABE scheme, which offers both constant size ciphertexts and secret keys (CSCTSK) with an expressive AND gate access structure.We then show that the proposed CP-ABE-CSCTSK scheme is secure against chosen-ciphertext adversary in the selective security model, and demonstrate its utility. <s> BIB005 </s> Survey on Revocation in Ciphertext-Policy Attribute-Based Encryption <s> The Single Authority Scheme <s> First fully outsourced attributed-based encryption scheme.Lightweight operations for the private key generator and users.Imperceptible communication cost for the private key generator and users.Rigorous theoretical and detailed experimental analyses of our proposal.Suitable for cloud applications on mobile devices. Attribute-based encryption (ABE) has potential to be applied in cloud computing applications to provide fine-grained access control over encrypted data. However, the computation cost of ABE is considerably expensive, because the pairing and exponentiation operations grow with the complexity of access formula. In this work, we propose a fully outsourced ciphertext-policy ABE scheme that for the first time achieves outsourced key generation, encryption and decryption simultaneously. In our scheme, heavy computations are outsourced to public cloud service providers, leaving no complex operations for the private key generator (PKG) and only one modular exponentiation for the sender or the receiver, and the communication cost of the PKG and users is optimized. Moreover, we give the security proof and implement our scheme in Charm, and the experimental results indicate that our scheme is efficient and practical. <s> BIB006 </s> Survey on Revocation in Ciphertext-Policy Attribute-Based Encryption <s> The Single Authority Scheme <s> Propose large universe attribute based access control scheme with efficient decryption.Solve the problems that ciphertext size and decryption time scale with the complexity of access structure.Our scheme reduces ciphertext size and decryption time without the cloud computing server knowing the underlying plaintext.Our scheme verifies the correctness of transformation done by the cloud computing server.Use PowerTutor to test power consumed by OutKeyGen, Decrypt, and OutDecrypt in Android. Ciphertext Policy Attribute Based Encryption scheme is a promising technique for access control in the cloud storage, since it allows the data owner to define access policy over the outsourced data. However, the existing attribute based access control mechanism in the cloud storage is based on small universe construction, where the attribute set is defined at setup, and the size of the public parameters scales with the number of attributes. A large number of new attributes need to be added to the system over time, small universe attribute based access control is no longer suitable for cloud storage, whereas large universe attribute based encryption where any string can be employed as an attribute and attributes are not required to be enumerated at system setup meets this requirement. Unfortunately, one of the main efficiency drawbacks of existing large universe attribute based encryption is that ciphertext size and decryption time scale with the complexity of the access structure. In this work, we propose large universe attribute based access control scheme with efficient decryption. The user provides the cloud computing server with a transformation key with which the cloud computing server transforms the ciphertext associated with the access structure satisfied by the attributes associated with the private key into a simple and short ciphertext; thus it significantly reduces the time for the user to decrypt the ciphertext without the cloud computing server knowing the underlying plaintext; the user can check whether the transformation done by the cloud computing server is correct to verify transformation correctness. Security analysis and performance evaluation show our scheme is secure and efficient. <s> BIB007 </s> Survey on Revocation in Ciphertext-Policy Attribute-Based Encryption <s> The Single Authority Scheme <s> Abstract In the era of Internet of things, wearable devices can be used to monitor residents’ health and upload collected health data to cloud servers for sharing, which facilitates the development of e-healthcare record (EHR) systems. However, before finding wide applications, EHR systems have to tackle privacy and efficiency challenges. For one thing, the confidentiality of EHRs is one of most important issues concerned by patients. For another, wearable devices in mobile cloud computing are often resource-constrained to some extent. In this paper, we propose a fine-grained EHR access control scheme which is proven secure in the standard model under the decisional parallel bilinear Diffie–Hellman exponent assumption. In the proposed scheme, an EHR owner can generate offline ciphertexts before knowing EHR data and access policies, which performs a majority of computation tasks. Furthermore, the online phase can rapidly assemble the final ciphertexts when EHR data and access policies become known. Our EHR access control scheme allows access policies encoded in linear secret sharing schemes. Extensive performance comparisons and simulation results indicate that the proposed solution is very suitable for mobile cloud computing. <s> BIB008 </s> Survey on Revocation in Ciphertext-Policy Attribute-Based Encryption <s> The Single Authority Scheme <s> Abstract Data sharing becomes an exceptionally attractive service supplied by cloud computing platforms because of its convenience and economy. As a potential technique for realizing fine-grained data sharing, attribute-based encryption (ABE) has drawn wide attentions. However, most of the existing ABE solutions suffer from the disadvantages of high computation overhead and weak data security, which has severely impeded resource-constrained mobile devices to customize the service. The problem of simultaneously achieving fine-grainedness, high-efficiency on the data owner's side, and standard data confidentiality of cloud data sharing actually still remains unresolved. This paper addresses this challenging issue by proposing a new attribute-based data sharing scheme suitable for resource-limited mobile users in cloud computing. The proposed scheme eliminates a majority of the computation task by adding system public parameters besides moving partial encryption computation offline. In addition, a public ciphertext test phase is performed before the decryption phase, which eliminates most of computation overhead due to illegitimate ciphertexts. For the sake of data security, a Chameleon hash function is used to generate an immediate ciphertext, which will be blinded by the offline ciphertexts to obtain the final online ciphertexts. The proposed scheme is proven secure against adaptively chosen-ciphertext attacks, which is widely recognized as a standard security notion. Extensive performance analysis indicates that the proposed scheme is secure and efficient. <s> BIB009 </s> Survey on Revocation in Ciphertext-Policy Attribute-Based Encryption <s> The Single Authority Scheme <s> Fog computing as an extension of cloud computing provides computation, storage and application services to end users. Ciphertext-policy attribute-based encryption (CP-ABE) is a well-known cryptographic technology for guaranteeing data confidentiality and fine-grained data access control. It enables data owners to define flexible access policy for data sharing. However, in CP-ABE systems, the problems of the time required to encrypt, decrypt and attribute update are long-standing unsolved in the literature. In this paper, we propose the first access control (CP-ABE) scheme supporting outsourcing capability and attribute update for fog computing. Specifically, the heavy computation operations of encryption and decryption are outsourced to fog nodes, thus the computation operations for data owners to encrypt and users to decrypt are irrelevant to the number of attributes in the access structure and secret keys, respectively. The cost brought by attribute update is efficient in the sense that we only concentrate on the update of the ciphertext associated with the corresponding updated attribute. The security analysis shows that the proposed scheme is secure under the decisional bilinear Diffie–Hellman assumption. The proposed scheme is efficient, and the time of encryption for data owners and decryption for users are small and constant. The computational ability of fog nodes are fully utilizing during the access control, so the tiny computing cost is left to end users with resource-constrained devices. <s> BIB010 </s> Survey on Revocation in Ciphertext-Policy Attribute-Based Encryption <s> The Single Authority Scheme <s> With the rapid development of the Internet of Things and cloud computing technologies, smart health (s-health) is expected to significantly improve the quality of health care. However, data security and user privacy concerns in s-health have not been adequately addressed. As a well-received solution to realize fine-grained access control, ciphertext-policy attribute-based encryption (CP-ABE) has the potential to ensure data security in s-health. Nevertheless, direct adoption of the traditional CP-ABE in s-health suffers two flaws. For one thing, access policies are in cleartext form and reveal sensitive health-related information in the encrypted s-health records (SHRs). For another, it usually supports small attribute universe, which places an undesirable limitation on practical deployments of CP-ABE because the size of its public parameters grows linearly with the size of the universe. To address these problems, we introduce PASH, a privacy-aware s-health access control system, in which the key ingredient is a large universe CP-ABE with access policies partially hidden. In PASH, attribute values of access policies are hidden in encrypted SHRs and only attribute names are revealed. In fact, attribute values carry much more sensitive information than generic attribute names. Particularly, PASH realizes an efficient SHR decryption test which needs a small number of bilinear pairings. The attribute universe can be exponentially large and the size of public parameters is small and constant. Our security analysis indicates that PASH is fully secure in the standard model. Performance comparisons and experimental results show that PASH is more efficient and expressive than previous schemes. <s> BIB011 </s> Survey on Revocation in Ciphertext-Policy Attribute-Based Encryption <s> The Single Authority Scheme <s> Ciphertext-policy attribute-based encryption (CP-ABE) has been regarded as one of the promising solutions to protect data security and privacy in cloud storage services. In a CP-ABE scheme, an access structure is included in the ciphertext, which, however, may leak sensitive information about the underlying plaintext and the privileged recipients in that anyone who sees the ciphertext is able to learn the attributes of the privileged recipients from the associated access structure. In order to address this issue, CP-ABE with partially hidden access structures was introduced where each attribute is divided into an attribute name and an attribute value and the attribute values of the attributes in an access structure are not given in the ciphertext. Though a number of CP-ABE schemes with partially hidden access structures have been proposed, most of them only enable restricted access structures, whereas several other schemes supporting expressive access structures are computationally inefficient due to the fact that they are built in the composite-order groups. To our knowledge, there has been little attention paid to the design of expressive CP-ABE schemes with partially hidden access structures in the prime-order groups. In this paper, we revisit this problem, and present an expressive CP-ABE scheme supporting partially hidden access structures in the prime-order groups with improved efficiency. <s> BIB012 </s> Survey on Revocation in Ciphertext-Policy Attribute-Based Encryption <s> The Single Authority Scheme <s> The term of Internet of Things (IoT) remarkably increases the ubiquity of the internet by integrating smart object-based infrastructures. How to achieve efficient fine-grained data access control while preserving data privacy is a challenge task in the scenario of IoT. Despite ciphertext-policy attribute-based encryption (CP-ABE) can provide fine-grained data access control by allowing the specific users whose attributes match the access policy to decrypt ciphertexts. However, existing CP-ABE schemes will leak users attribute values to the attribute authority (AA) in the phase of key generation, which poses a significant threat to users privacy. To address this issue, we propose a new CP-ABE scheme which can successfully protect the users attribute values against the AA based on 1-out-of-n oblivious transfer technique. In addition, we use Attribute Bloom Filter to protect the attribute type of the access policy in the ciphertext. Finally, security and efficiency evaluations show that the proposed scheme can achieve the desired security goals, while keeping comparable computation overhead. We propose an efficient and robust attribute-encryption scheme supporting access policy hidden based on 1-out-of-n oblivious transfer.Our scheme does not require any change for the outsourced data in case of a new data is uploaded.We show how to extend the proposed scheme to support multi-user scenarios. <s> BIB013
Most of the existing systems employ one entity to have the power of generating the decryption private keys for all system users. In such schemes, one attribute authority administrates all system attributes. This authority has the master secret key that is used to derive all users' decryption secret keys. These keys are distributed to the system users via secret channels. The inherent issue of this type of schemes is the key escrow problem that occurs due to the ability of an attribute authority to recover any ciphertext using its master key. However, the security assumption that such systems is based on, is that the authority is fully trusted. On the other hand, crashing or corrupting this entity affects the availability of the whole system. In addition to the key escrow issue, due to the lack of schemes that can efficiently address some issues of CP-ABE, such as revocation and collusion resistance, many researchers have been motivated to construct a practical CP-ABE system using a single authority scheme ( Table 3 shows a summary of these studies). Notably, some approaches have been introduced to eliminate the computation cost BIB005 for lightweight devices. This type of study uses a CP-ABE scheme to offer constant sizes for both ciphertexts and secret keys. It uses one-way hash functions and an encryption algorithm to produce a ciphertext and a special polynomial function to generate a secret key with a key generation algorithm. However, it only supports the AND gate access structure. In addition, in this proposed scheme, the revocation problem is not taken into account. Furthermore, some recent work has been proposed to alleviate the computations to be appropriate for resource-limited mobile devices BIB007 BIB008 BIB009 . In Fu et al.'s system BIB007 , the system is introduced with a large attribute universe based access control, when the space and number of system attributes are flexible and not limited in the setup phase, outsources decryption to the cloud. This single-authority system uses the linear secret sharing (LSS) access structure. The works in Liu et al. and Li et al.'s schemes BIB008 BIB009 use an online-offline technique to eliminate most computations. The online/offline CP-ABE scheme in BIB008 is proposed to mitigate the online encryption computation burden on an e-healthcare record (EHR) owner by splitting these computations into offline computations, which are performed before knowing the data and specifying the access policy, and a few online computations which are required to keep long-lasting battery life. In this scheme, the linear secret sharing scheme is used to encode the access policy. However, these systems BIB007 BIB008 BIB009 do not address the revocation problem. In the scenario of encrypting medical records where a data owner (patient) ought to generate a secret key to system users, outsourcing the key generation is desirable. Therefore, some researchers have proposed a fully outsourced ABE scheme BIB006 that achieves outsourced key generation, encryption, and decryption. The system supports the LSS access structure. In terms of outsourcing the key generation and reducing the communication cost (e.g., battery consumption), the server will generate an intermediate secret key with only knowing the public key which can be downloaded later by the user after charging its mobile without draining the battery (i.e., the outsourcing operation is offline). To protect the master secret key and the private keys, the data owners hire two different servers to generate secret keys. However, the two servers colluding between each other means the whole system is under collusion attacks. Furthermore, the revocation problem is not considered in this system. Moreover, outsourcing the heavy operations of CP-ABE and fog computing has also attracted a lot of research attention BIB010 . Fog computing is a paradigm extended from the cloud computing. Such a scheme BIB010 uses an access tree as an access structure. The system proposes an approach to outsource part of the encryption and decryption operations to fog nodes in order to minimize the computational burden on the data owners and system users, respectively. In addition, the system addresses the attribute change by updating the secret keys for all affected system users who share the updated attribute. However, sending the updated key to those users via a secure channel causes communication and computation overheads. Furthermore, the system assumes that the cloud service provider, fog nodes, and the attribute authority are fully trusted. On the other hand, some studies have been carried out to reduce the computation cost of the ABE by using a pairing-free ABE system BIB003 BIB004 . In Karati and Amin's system BIB003 , the system also eliminates the transmission overhead on the secret channel by sending a large part of a secret key on a public channel to the users, while sending only the blinding factor via a secret channel. However, using the pairing instead is more reliable and secure. In addition, this scheme does not use the LSS to distribute the attributes in the users' secret keys, which is a more expressive access structure than the threshold scheme that this scheme uses. Moreover, the revocation problem is not taken into account by the authors. In Hong and Sun's scheme BIB004 , besides reducing the complexity of ABE by using pairing-free ABE, invalidating the leaked keys of non-revoked users and the revoked keys is considered. When a key of a non-revoked user is accidently leaked or revoked upon attribute revocation, a key insulation technique is utilized to divide the system lifetime into several periods. At each period of time, only one part of the secret key can be updated by the authority which computes the updating components and sends them to the authorized users. The authority uses a random number for each period of time. The system supports the tree access structure. However, the system does not provide an instant key invalidation operation. Alternatively, the revocation happens periodically. Furthermore, a heavy computation cost is imposed on data owners thanks to re-encrypting a plaintext at each period of time. Furthermore, some work has been done to not only outsource the decryption operation to a cloud server, but also further verify that the outsourced decryption carried out by the cloud is correct BIB002 . The verification technique transforms a ciphertext using some processes with a blinded secret key. Then, before computing the plaintext, a user compares each transformed ciphertext component with the corresponding, original ciphertext component to retrieve the blinded value. In this case, the outsourced decryption is verified. The tree access structure is used in this system. However, the system uses a big size of ciphertext as well as incurring a heavy computation cost. In addition, the revocation problem facing any access control system is not addressed. As a result of the importance of protecting health information, which may be revealed by access policies, some studies have been proposed to hide an access policy in CP-ABE schemes BIB011 . This system BIB011 uses a large attribute universe and partially hides the access policy. The system handles any expressive access policies represented as a linear secret sharing scheme (LSSS). However, some additional computational operations are added before the decryption phase for testing whether a user's attributes satisfy the access policy, imposing more burdens on a user. Furthermore, the scheme does not consider the revocation problem. In addition, recent studies have been proposed to achieve more security by hiding the access policy BIB012 BIB013 . In Han et al.'s scheme BIB013 , the authors present a CP-ABE scheme that provides two features. The first is to hide the attribute values from the attribute authority. This happens by utilizing a 1-out-of-n oblivious transfer technique that can send attributes in a fuzzy selection manner to the authority; in this case, the authority can generate the secret key without knowing the attribute value. The second is to protect the type of attribute in the access policy that is embedded in the ciphertext using an attribute bloom filter approach to check whether an attribute belongs to the hidden access policy without revealing it. The LSSS access structure is supported in this system. However, more computational operations are incurred by a data owner and users. These operations increase linearly with the complexity increase of the access structure and the number of the users' attributes. Furthermore, in terms of communication overhead, more information needs to be sent to the attribute authority. In addition, the revocation problem is not managed. Although most of the existing systems can hide access structures and support restricted access structures with a composite-order group, of which the order is a product of two large primes, the scheme of Cui et al. BIB012 introduces a mechanism to partially hide access structures by enabling the expressive LSSS access structure in a prime-order group, which is a cyclic group with a prime number order. Pairing performance in a scheme with a composite order group is~50 times lower than the same pairing in the prime order group BIB001 . In general, each attribute consists of a name and a value. In this scheme BIB012 , the attributes' values in the access policy are hidden by the data owner due to their sensitivity. The authors use a randomness splitting mechanism to protect the values of the attributes by hiding them in the ciphertext. However, the revocation problem is not dealt with. Furthermore, expensive operations are needed to compute the ciphertext and each user's private key as well as increasing the size of the ciphertext. In summary, it is essential to consider the problems that single authority schemes create. These include (1) the diversity of attributes that are hard to manage by only one authority, (2) the key escrow problem that occurs when the single authority is not totally trustworthy and has the ability to gain access to all users' keys, and (3) the security failure that creates a serious problem when the authority is compromised by an adversary that gains the system's master key. A multiauthority scheme is suitable for resolving these weaknesses.