Advertisement

Journal of Computer Science and Technology

, Volume 26, Issue 4, pp 697–710 | Cite as

Provably Secure Role-Based Encryption with Revocation Mechanism

  • Yan ZhuEmail author
  • Hong-Xin Hu
  • Gail-Joon Ahn
  • Huai-Xi Wang
  • Shan-Biao Wang
Article
First Online:

Abstract

Role-Based Encryption (RBE) realizes access control mechanisms over encrypted data according to the widely adopted hierarchical RBAC model. In this paper, we present a practical RBE scheme with revocation mechanism based on partial-order key hierarchy with respect to the public key infrastructure, in which each user is assigned with a unique private-key to support user identification, and each role corresponds to a public group-key that is used to encrypt data. Based on this key hierarchy structure, our RBE scheme allows a sender to directly specify a role for encrypting data, which can be decrypted by all senior roles, as well as to revoke any subgroup of users and roles. We give a full proof of security of our scheme against hierarchical collusion attacks. In contrast to the existing solutions for encrypted file systems, our scheme not only supports dynamic joining and revoking users, but also has shorter ciphertexts and constant-size decryption keys.

Keywords

cryptography role-based encryption role hierarchy key hierarchy collusion security revocation 
This is a preview of subscription content, log in to check access.

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

Supplementary material

11390_2011_1169_MOESM1_ESM.pdf (69 kb)
(PDF 68.5 KB)

References

  1. [1]
    Sandhu R, Ferraiolo D F, Kuhn D R. The nist model for role-based access control: Towards a unified standard. In Proc. the 5th ACM Workshop on Role Based Access Control (RBAC), Berlin, Germany, Jul. 26–27, 2000, pp.47-63.Google Scholar
  2. [2]
    Li Q, Zhang X W, Xu M W, Wu J P. Towards secure dynamic collaborations with group-based RBAC model. Computers & Security, 2009, 28(5): 260–275.CrossRefGoogle Scholar
  3. [3]
    Shafiq B, Joshi J, Bertino E, Ghafoor A. Secure interoperation in a multidomain environment employing RBAC policies. IEEE Transactions on Knowledge and Data Engineering, 2005, 17(11): 1557–1577.CrossRefGoogle Scholar
  4. [4]
    Zhu Y, Ahn G J, Hu H X, Wang H X. Cryptographic role-based security mechanisms based on role-key hierarchy. In Proc. the 5th ACM Symposium on Information, Computer and Communications Security (ASIACCS), Beijing, China, Apr. 13–16, 2010, pp.314-319.Google Scholar
  5. [5]
    Akl S G, Taylor P D. Cryptographic solution to a problem of access control in a hierarchy. ACM Transactions on Computer System, 1983, 1(3): 239–248.CrossRefGoogle Scholar
  6. [6]
    Akl S G, Taylor P D. Cryptographic solution to a multilevel security problem. In Proc. Advances in Cryptology: CRYPTO, Santa Barbara, USA, 1982, pp.237-249.Google Scholar
  7. [7]
    Wallner D M, Harder E G, Agee R C. Key management for multicast: Issues and architecture. Internet Draft, draft-waller-key-arch-01.txt, 1998.Google Scholar
  8. [8]
    Wong C K, Gouda M, Lam S S. Secure group communications using key graphs. In Proc. the Annual Conference of the Association for Computing Machinery's Special Interest Group on Data Communication (SIGCOMM), Vancouver, Canada, Sept. 2–4, 1998, 28, pp.68-79.Google Scholar
  9. [9]
    Asano T. Reducing receiver's storage in CS, SD and LSD broadcast encryption schemes. IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences, 2005, 88(1): 203–210.CrossRefGoogle Scholar
  10. [10]
    Naor D, Naor M, Lotspiech J. Revocation and tracing schemes for stateless receivers. In Proc. the 21st Annual International Cryptology Conference (CRYPTO), Santa Barbara, USA, Aug. 19–23, 2001, pp.41-62.Google Scholar
  11. [11]
    Halevy D, Shamir A. The LSD broadcast encryption scheme. In Proc. the 22nd International Cryptology Conference (Crypto), Santa Barbara, USA, Aug. 18–22, 2002, pp.47-60.Google Scholar
  12. [12]
    Boneh D, Franklin M. Identity-based encryption from the weil pairing. In Proc. the 21st Annual International Cryptology Conference (CRYPTO), Santa Barbara, USA, Aug. 19–23, 2001, pp.213-229.Google Scholar
  13. [13]
    Yuen T H, Susilo W, Mu Y. How to construct identity-based signatures without the key escrow problem. International Journal of Information Security, 2010, 9(4): 297–311.CrossRefGoogle Scholar
  14. [14]
    Gentry C, Silverberg A. Hierarchical ID based cryptography. In Proc. the 8th International Conference on the Theory and Application of Cryptology and Information Security (ASIACRYPT), Queenstown, New Zealand, Dec. 1–5, 2002, pp.548-566.Google Scholar
  15. [15]
    Tzeng W G. A time-bound cryptographic key assignment scheme for access control in a hierarchy. IEEE Transactions on Knowledge and Data Engineering, 2002, 14(1): 182–188.CrossRefMathSciNetGoogle Scholar
  16. [16]
    Sahai A, Waters B. Fuzzy identity-based encryption. In Proc. the 24th Annual International Conference on the Theory and Applications of Cryptographic Techniques (EUROCRYPT), Aarhus, Denmark, May 22–26, 2005, pp.457-473.Google Scholar
  17. [17]
    Goyal V, Pandey O, Sahai A, Waters B. Attribute-based encryption for ¯ne-grained access control of encrypted data. In Proc. the 13th ACM Conference on Computer and Communications Security (CCS), Alexandria, USA, Oct. 30-Nov. 3, 2006, pp.89-98.Google Scholar
  18. [18]
    Ostrovsky R, Sahai A, Waters B. Attribute-based encryption with non-monotonic access structures. In Proc. the 14th ACM Conference on Computer and Communications Security (CCS), Alexandria, USA, Oct. 28–31, 2007, pp.195-203.Google Scholar
  19. [19]
    Chase M. Multi-authority attribute based encryption. In Proc. the 4th Theory of Cryptography Conference (TCC), Amsterdam, The Netherlands, Feb. 21–24, 2007, pp.515-534.Google Scholar
  20. [20]
    Bethencourt J, Sahai A, Waters B. Ciphertext-policy attribute-based encryption. In Proc. 2007 IEEE Symposium on Security and Privacy (S&P), Oakland, USA, May 20–23, 2007, pp.321-334.Google Scholar
  21. [21]
    Waters B. Ciphertext-policy attribute-based encryption: An expressive, efficient, and provably secure realization. Cryptology ePrint Archive, Report 2008/290, 2008, http://eprint.iacr.org/.
  22. [22]
    Goyal V, Jain A, Pandey O, Sahai A. Bounded ciphertext policy attribute based encryption. In Proc. the 35th International Colloquium on Automata, Languages and Programming, Part II ― Track B: Logic, Semantics, and Theory of Programming & Track C: Security and Cryptography Foundations (ICALP(2)), Reykjavik, Iceland, Jul. 7–11, 2008, pp.579-591.Google Scholar
  23. [23]
    Ibraimi L, Tang Q, Hartel P H, Jonker W. Efficient and provable secure ciphertext-policy attribute-based encryption schemes. In Proc. the 5th International Conference on Information Security Practice and Experience (ISPEC), Xi'an, China, Apr. 13–15, 2009, pp.1-12.Google Scholar
  24. [24]
    Attrapadung N, Imai H. Dual-policy attribute based encryption. In Proc. the 7th International Conference on Applied Cryptography and Network Security (ACNS), Paris, France, Jun. 2–5, 2009, pp.168-185.Google Scholar
  25. [25]
    Attrapadung N, Imai H. Dual-policy attribute based encryption: Simultaneous access control with ciphertext and key policies. IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences, 2010, E93-A(1): 116–125.CrossRefGoogle Scholar
  26. [26]
    Wang L Y, Wijesekera D, Jajodia S. A logic-based framework for attribute based access control. In Proc. the 2004 ACM Workshop on Formal Methods in Security Engineering (FMSE), Washington DC, USA, Oct. 29, 2004, pp.45-55.Google Scholar
  27. [27]
    Frikken K B, Atallah M J, Li J T. Attribute-based access control with hidden policies and hidden credentials. IEEE Transaction on Computers, 2006, 55(10): 1259–1270.CrossRefGoogle Scholar
  28. [28]
    Schoinas I, Falsafi B, Lebeck A R, Reinhardt S K, Larus J R, Wood D A. Fine-grain access control for distributed shared memory. In Proc. the 6th International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS), San Jose, USA, Oct. 4–7, 1994, pp.297-306.Google Scholar
  29. [29]
    Damiani E, Vimercati S D C D, Paraboschi S, Samarati P. A fine-grained access control system for xml documents. ACM Transactions on Information and System Security, 2002, 5(2): 169–202.CrossRefGoogle Scholar
  30. [30]
    Shahandashti S F, Naini R S. Threshold attribute-based sig natures and their application to anonymous credential systems. In Proc. the 2nd International Conference on Cryptology in Africa (AFRICACRYPT), Gammarth, Tunisia, Jun. 21–25, 2009, pp.198-216.Google Scholar
  31. [31]
    Maji H, Prabhakaran M, Rosulek M. Attribute-based signatures: Achieving attribute-privacy and collusion- resistance. Cryptology ePrint Archive, Report 2008/328, 2008, http://eprint.iacr.org/.
  32. [32]
    Wang H X, Zhu Y, Feng R Q. Attribute-based signature with policy-and-endorsement mechanism. Journal of Computer Science and Technology, 2010, 25(6): 1293–1304.CrossRefMathSciNetGoogle Scholar
  33. [33]
    Attrapadung N, Imai H. Attribute-based encryption supporting direct/indirect revocation modes. In Proc. the 12th IMA International Conference on Cryptography and Coding, Cirencester, UK, Dec. 15–17, 2009, pp.278-300.Google Scholar
  34. [34]
    Boneh D, Boyen X, Goh E J. Hierarchical identity based encryption with constant size ciphertext. In Proc. the 24th Annual International Conference on the Theory and Applications of Cryptographic Techniques (EUROCRYPT), Aarhus, Denmark, May 22–26, 2005, pp.440-456.Google Scholar
  35. [35]
    Boneh D, Gentry C, Waters B. Collusion resistant broadcast encryption with short ciphertexts and private keys. In Proc. the 25th Annual International Cryptology Conference (CRYPTO), Santa Barbara, USA, Aug. 14–18, 2005, pp.258-275.Google Scholar
  36. [36]
    Toahchoodee M, Xie X, Ray I. Towards trustworthy delegation in role-based access control model. In Proc. the 12th International Conference on Information Security (ISC), Pisa, Italy, Sept. 7–9, 2009, pp.379-394.Google Scholar
  37. [37]
    Microsoft Corporation. How encrypting file system works. Microsoft TechNet Report, 2009, http://technet.microsoft.com/en-us/library/cc781588(WS.10).aspx.
  38. [38]
    SEC1. Standards for efficient cryptograhy group: Elliptic curve cryptography, Version 1.0, 2000.Google Scholar
  39. [39]
    SEC2. Standards for efficient cryptograhy group: Recommended elliptic curve domain parameters, Version 1.0, 2000.Google Scholar
  40. [40]
    Su D, Lv K W. A new hard-core predicate of paillier's trapdoor function. In Proc. the 10th International Conference on Cryptology in India (INDOCRYPT), New Delhi, India, Dec. 13–16, 2009, pp.263-271.Google Scholar
  41. [41]
    Schultz E E. Windows 2000 security: A postmortem analysis. Network Security, 2004, 2004(1): 6–9.CrossRefGoogle Scholar

Copyright information

© Springer Science+Business Media, LLC & Science Press, China 2011

Authors and Affiliations

  • Yan Zhu
    • 1
    • 2
    Email author
  • Hong-Xin Hu
    • 3
  • Gail-Joon Ahn
    • 3
  • Huai-Xi Wang
    • 4
  • Shan-Biao Wang
    • 4
  1. 1.Institute of Computer Science and TechnologyPeking UniversityBeijingChina
  2. 2.Beijing Key Laboratory of Internet Security TechnologyPeking UniversityBeijingChina
  3. 3.School of Computing, Informatics and Decision Systems EngineeringArizona State UniversityTempeU.S.A.
  4. 4.School of Mathematical SciencesPeking UniversityBeijingChina

Personalised recommendations

Cite article

Buy options