A Proof of Security for a Key-Policy Rs-Abe Scheme

Abstract

A revocable-storage attribute-based encryption (RS-ABE) scheme is an encryption scheme which extends attribute-based encryption by introducing user revocation. A key-policy RS-ABE scheme links each key to an access structure. We propose a new key-policy RS-ABE scheme whose security we prove in term of indistinguishability under a chosen-plaintext attack (IND-CPA).on user revocation and in this paper we design a public-key scheme which enjoys ABE for encryption, while allowing to revoke users arbitrarily. This is the goal of revocablestorage attribute-based encryption (RS-ABE), a scheme described by Lee et al. [8] employing a ciphertext policy. To be more precise, our aim is to build a key-policy version of such scheme and to prove its security in a theoretical framework fit to the application context. Starting from the ideas in [8], we modify concepts and techniques described therein to adapt them to our goals. We observe that a key-policy RS-ABE scheme was independently described by Lee [7], but we employ a different construction and different security assumptions, reaching an independent security result.In Section 2 we describe the RS-ABE framework, and we give the definition of CPA-security. In Section 3 we describe the assumptions required for the security of our scheme. In Section 4 we give an overview of the building blocks of our scheme: Complete Subset (CS), Self-Updatable Encryption (SUE) and key-policy Attribute Based Encryption. In Section 5 we are finally able to describe our scheme in detail and state our main result on its security. Section 6 is entirely devoted to the proof of our claimed theorem. Finally, in Section 7 we discuss the efficiency of our key-policy RS-ABE scheme and draw some conclusions, sketching future work. StructureWe provide a high-level description of a key-policy revocable-storage attribute-based encryption scheme. A is the set of all possible attributes and an access structure A is a set of subsets of A (for a formal definition, see Definition 7). Moreover we denote with U the set of all users. Starting from A and other public parameters, an authority C must create some public information (PI) and two general keys: the general public key and the master key. The public information contains the general setting and is known to everyone. The general public key, which we shorten to public key (PK), can be used by any user to encrypt, even by anyone having access to the system and knowing only PI and PK. The master key (MK) is used only by C to create the users' private keys (no user has a personal public key), when user requests it, and the (general) time-update key (TK), at any time update. The latter is known to everyone and incorporates the information on the updated list of revoked users. In order to decrypt, any user needs her own private key (SK), TK and PI. This scheme is described by seven Probabilistic Polynomial Time (PPT) algorithms.Setup (λ, A, Tmax, Nmax) → (MK, PI, PK). λ is the security parameter, A is the set of all possible attributes, Tmax is the maximum time w...

A survey on functional encryption

“…The revocation functionality is realised in revocable ABE schemes, where it is possible to revoke malicious users from the system or revoke an expired attribute. For more details, see[108,114,96,17,73]. 5.2.7.…”