System, Apparatus and Method for Decentralizing Attribute-Based Encryption Information

• US 20120314854A1
• Filed: 01/18/2012
• Published: 12/13/2012
• Est. Priority Date: 06/10/2011
• Status: Active Grant

• Current Assignee: NTT Research, Inc. (Nippon Telegraph and Telephone Corporation)
• Original Assignee: Zeutro LLC
• Inventors: Waters, Brent Richard
• Granted Patent: US 8,516,244 B2
• Time in Patent Office: Days
• US Class Current: 380/28
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 2209/84 Vehicles
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/3073 involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing

Abstract

A method for secure transmission of a message encrypted under an attribute based encryption scheme is provided. A first and a second authority parameter may be received from one or more authorities. A policy is generated based on the parameters. The generated policy comprises a flexible access control structure. A ciphertext is constructed based on the policy. To decrypt the ciphertext, key components are received from one or more authorities, the key components associated with a decryptor identifier. A decryption key is generated based on the policy and the key components. A plaintext is generated by decrypting the ciphertext.

Claims

1. A method comprising:

receiving a first authority parameter from a first authority;

receiving a second authority parameter from a second authority;

generating a policy based on the first authority parameter and the second authority parameter, wherein the policy comprises a flexible access control structure; and

constructing a ciphertext based on the policy.

2. The method of claim 1, wherein the first authority does not communicate with the second authority.

3. The method of claim 1, wherein the first authority parameter is distinct from the second authority parameter.

4. The method of claim 1, wherein the flexible access control structure comprises an operator selected from the group of operators:

a greater-than threshold operator, a less-than threshold operator, and an equality operator.

5. The method of claim 1, wherein the flexible access control structure comprises a boolean formula over the authority parameters.

6. The method of claim 3, wherein the flexible access control structure comprises at least one threshold operator between distinct authority parameters, and at least one AND operator between distinct authority parameters.

7. The method of claim 3, wherein the flexible access control structure comprises at least one OR operator between distinct authority parameters, and at least one AND operator between distinct authority parameters.

8. The method of claim 1, wherein generating a policy comprises receiving a component of the policy from an authority.

9. The method of claim 1, wherein the first authority parameter varies over time.

22. The method of claim 1, wherein a component of the first authority parameter is signed by a certificate authority or a component of the first authority parameter is generated inside of a hardware security module.

10. A method comprising:

receiving a ciphertext comprising a policy;

transmitting a request to a first authority, the request comprising a first attribute identifier and a first decryptor identifier;

receiving a first key from the first authority in response to the request to the first authority;

transmitting a request to a second authority, the request comprising a second attribute identifier and a second decryptor identifier;

receiving a second key from the second authority in response to the request to the second authority;

generating a decryption key based on the policy, the first key and the second key; and

decrypting the ciphertext with the decryption key.

11. The method of claim 10, wherein transmitting the request to the first authority occurs prior to receiving the ciphertext.

12. The method of claim 10, wherein the generation of the plaintext is based on whether the first decryptor identifier is the same as the second decryptor identifier.

13. The method of claim 10, wherein the first decryptor identifier comprises a variable-length string of bits.

14. The method of claim 10, wherein the first attribute identifier comprises a textual or numerical identifier.

15. The method of claim 14, wherein the textual or numerical identifier comprises one of:

a name, an organizational role, an email address, a phone number, a social security number, a date, a time or an event.

16. The method of claim 10, further comprising:

storing the decryption key on a smartcard or a tamper-resistant device.

17. The method of claim 10, wherein receiving the first key from the first authority further comprises:

conducting a verification operation on the first decryptor identifier and the first attribute identifier; and

determining whether to return a key based on the verification operation.

18. A method comprising:

receiving a ciphertext comprising a policy;

transmitting a request to a first authority, the request comprising an identifier;

receiving a first certificate from the first authority in response to the request to the first authority;

transmitting a request to a second authority, the request comprising the identifier;

receiving a second certificate from the second authority in response to the request to the second authority;

transmitting the first certificate and the second certificate to a third authority;

receiving a decryption key in response to the first certificate and the second certificate; and

decrypting the ciphertext using the decryption key.

19. An encryption method comprising

receiving a first authority parameter from a first authority;

receiving a second authority parameter from a second authority;

generating a message;

generating a policy;

constructing a first ciphertext component based on the policy, the message, and the first authority parameter, wherein the first ciphertext component comprises a first confounding factor; and

constructing a second ciphertext component based on the policy, the message, and the second authority parameter, wherein the second ciphertext component comprises a second confounding factor.

20. The method of claim 19 further comprising:

generating a ciphertext based on the first ciphertext component and the second ciphertext component.

21. The method of claim 20, further comprising:

decrypting the ciphertext, where decrypting the ciphertext causes the first confounding factor to cancel out the second confounding factor.

23. The method of claim 19, wherein a component of the first authority parameter is signed by a certificate authority or a component of the first authority parameter is generated inside of a hardware security module.

24. The method of claim 19, wherein the first authority parameter varies over time.