DET-ABE: A Java API for Data Confidentiality and Fine-Grained Access Control from Attribute Based Encryption

Abstract

Many works in the literature have proposed information security mechanisms relying on Paring Based Cryptography (PBC), for example, Ciphertext Policy Attribute Based Encryption (CP-ABE). However, a public set of software modules that allow integrating that kind of encryption for data security of information systems in an easy and transparent way is still missing. Available APIs like PBC (C-based) or jPBC (Java-based) are focused on low level arithmetic operations and several non trivial issues must still be addressed to integrate a functional PBC/ABE scheme into end-user applications for implementing end-toend encryption. We present a novel and portable Java library (API) to ensure confidentiality and access control of sensitive data accessed only by authorized entities having as credentials a set of attributes. Novel encryption and decryption processes are defined, using the digital envelope technique (DET) under a client-server computing model. The new DET-ABE scheme supports standard security levels (AES encryption) and provides the user with an easy interface for transparent use of next generation cryptography, hiding the complexity associated to PBC (field and group arithmetic, curve selection) and ABE (setup, key management, encryption/decryption details). Running times of main API's modules at server (ABE setup and key generation) and client (DET-ABE encryption/decryption) side are presented and discussed. From these results, it is concluded that the proposed API is easy to use and viable for providing confidentiality and access control mechanisms over data in end-user applications.

A policy-based containerized filter for secure information sharing in organizational environments

“…high, medium, and low) 1 . III) In the Mitigation Phase, a security module performs the encryption of the file depending on the risk scoring detected in the previous phase by using a multi-level security engine, which uses symmetric encryption to ensure privacy and confi-85 dentiality [20], attribute-based encryption to ensure confidentiality and access control [21,22,13], and digital signatures to ensure integrity and authentication [23,13]. Security level can be changed onthe-fly and the security level for the three types of 90 encryption is determined based on the risk level detected on the file content/context (The bigger the risk level, the larger the size of the encryption keys) and the access control attributes are chosen for each file depending on the context (The attributes of the 95 users included in a sharing operations are on-thefly defined and used in the encryption/decryption of each file).…”

“…A realization of digital envelopes from ABE based on symmetric cryptography (AES) to encrypt data and policy-based attribute to encrypt the AES key by using public key cryptography has been [22] proposed. In this model, only the recipient of the dig-195 ital envelope, with its private key, can decrypt the key with which to decrypt the data.…”