Attribute-Based Encryption Optimized for Cloud Computing

  • Máté Horváth
Part of the Lecture Notes in Computer Science book series (LNCS, volume 8939)


In this work, we aim to make attribute-based encryption (ABE) more suitable for access control to data stored in the cloud. For this purpose, we concentrate on giving to the encryptor full control over the access rights, providing feasible key management even in case of multiple independent authorities, and enabling viable user revocation, which is essential in practice. Our main result is an extension of the decentralized CP-ABE scheme of Lewko and Waters [6] with identity-based user revocation. Our revocation system is made feasible by removing the computational burden of a revocation event from the cloud service provider, at the expense of some permanent, yet acceptable overhead of the encryption and decryption algorithms run by the users. Thus, the computation overhead is distributed over a potentially large number of users, instead of putting it on a single party (e.g., a proxy server), which would easily lead to a performance bottleneck. The formal security proof of our scheme is given in the generic bilinear group and random oracle models.


storage in clouds access control attribute-based encryption multi-authority user revocation 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Beimel, A.: Secure schemes for secret sharing and key distribution. Ph.D. thesis, Israel Institute of Technology, Technion, Haifa, Israel (1996)Google Scholar
  2. 2.
    Bethencourt, J., Sahai, A., Waters, B.: Ciphertext-policy attribute-based encryption. In: IEEE Symposium on Security and Privacy, pp. 321–334 (2007)Google Scholar
  3. 3.
    Chase, M.: Multi-authority Attribute Based Encryption. In: Vadhan, S.P. (ed.) TCC 2007. LNCS, vol. 4392, pp. 515–534. Springer, Heidelberg (2007)CrossRefGoogle Scholar
  4. 4.
    Horváth, M.: Attribute-Based Encryption Optimized for Cloud Computing. Cryptology ePrint Archive, Report 2014/612 (2014),
  5. 5.
    Lewko, A., Sahai, A., Waters, B.: Revocation systems with very small private keys. In: IEEE Symposium on Security and Privacy, pp. 273–285 (2010)Google Scholar
  6. 6.
    Lewko, A., Waters, B.: Decentralizing attribute-based encryption. In: Paterson, K.G. (ed.) EUROCRYPT 2011. LNCS, vol. 6632, pp. 568–588. Springer, Heidelberg (2011)CrossRefGoogle Scholar
  7. 7.
    Li, Q., Xiong, H., Zhang, F.: Broadcast revocation scheme in composite-order bilinear group and its application to attribute-based encryption. International Journal of Security and Networks 8(1), 1–12 (2013)CrossRefGoogle Scholar
  8. 8.
    Li, Y., Zhu, J., Wang, X., Chai, Y., Shao, S.: Optimized Ciphertext-Policy Attribute-Based Encryption with Efficient Revocation. International Journal of Security & Its Applications 7(6) (2013)Google Scholar
  9. 9.
    Liang, X., Lu, R., Lin, X., Shen, X.S.: Ciphertext policy attribute based encryption with efficient revocation. TechnicalReport, University of Waterloo (2010)Google Scholar
  10. 10.
    Ruj, S., Nayak, A., Stojmenovic, I.: Dacc: Distributed access control in clouds. In: IEEE 10th International Conference on Trust, Security and Privacy in Computing and Communications, pp. 91–98 (2011)Google Scholar
  11. 11.
    Sahai, A., Seyalioglu, H., Waters, B.: Dynamic credentials and ciphertext delegation for attribute-based encryption. In: Safavi-Naini, R., Canetti, R. (eds.) CRYPTO 2012. LNCS, vol. 7417, pp. 199–217. Springer, Heidelberg (2012)CrossRefGoogle Scholar
  12. 12.
    Sahai, A., Waters, B.: Fuzzy identity-based encryption. In: Cramer, R. (ed.) EUROCRYPT 2005. LNCS, vol. 3494, pp. 457–473. Springer, Heidelberg (2005)CrossRefGoogle Scholar
  13. 13.
    Wang, G., Liu, Q., Wu, J., Guo, M.: Hierarchical attribute-based encryption and scalable user revocation for sharing data in cloud servers. Computers & Security 30(5), 320–331 (2011)CrossRefGoogle Scholar
  14. 14.
    Waters, B.: Ciphertext-policy attribute-based encryption: An expressive, efficient, and provably secure realization. In: Catalano, D., Fazio, N., Gennaro, R., Nicolosi, A. (eds.) PKC 2011. LNCS, vol. 6571, pp. 53–70. Springer, Heidelberg (2011)CrossRefGoogle Scholar
  15. 15.
    Yang, K., Jia, X., Ren, K., Zhang, B.: DAC-MACS: Effective data access control for multi-authority cloud storage systems. In: INFOCOM, 2013 Proceedings IEEE, pp. 2895–2903 (2013)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2015

Authors and Affiliations

  • Máté Horváth
    • 1
  1. 1.Department of Networked Systems and Services, Laboratory of Cryptography and System Security (CrySyS Lab)Budapest University of Technology and EconomicsBudapestHungary

Personalised recommendations