Enabling comparable data access control for lightweight mobile devices in clouds

• US 9,705,850 B2
• Filed: 03/17/2014
• Issued: 07/11/2017
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: Arizona Board of Regents (University of Arizona)
• Original Assignee: Arizona Board of Regents (University of Arizona)
• Inventors: Wang, Zhijie, Huang, Dijiang
• Primary Examiner(s): Choudhury, Azizul
• Application Number:
  US14/216,332
• Publication Number:
  US 20140289513A1
• Time in Patent Office: 1,212 Days
• Field of Search: None
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 9/3073 involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing

Abstract

A new efficient framework based on a Constant-size Ciphertext Policy Comparative Attribute-Based Encryption (CCP-CABE) approach. CCP-CABE assists lightweight mobile devices and storing privacy-sensitive sensitive data into cloudbased storage by offloading major cryptography-computation overhead into the cloud without exposing data content to the cloud. CCP-CABE extends existing attribute-based data access control solutions by incorporating comparable attributes to incorporate more flexible security access control policies. CCP-CABE generates constant-size ciphertext regardless of the number of involved attributes, which is suitable for mobile devices considering their limited communication and storage capacities.

Claims

1. A method of storing encrypted data in a computer based processing system, comprising:

generating a public key PK and a master key MK;

publishing said public key PK;

issuing private keys SK_LU and public keys PK_LU to each data user, said public and private keys based on the data user'"'"'s ID and an attribute set L_U, the attribute set L_U including one or more attributes Ai, wherein each attribute corresponds to an attribute range;

receiving a request for a partially encrypted header from a data owner, said request including a specified access control policy Ps;

generating a partially encrypted header {tilde over (H)} based on the public key PK, the master key MK, and the specified access control policy Ps;

transmitting said partially encrypted header {tilde over (H)} to said data owner; and

receiving a header H and encrypted data from said data owner, said header H and encrypted data being based at least on part on said partially encrypted header {tilde over (H)}.

2. The method of claim 1, wherein the access control policy Ps is a non-hierarchical structure.

3. The method of claim 1, further comprising:

receiving a request from a user for access to encrypted data;

partially decrypting said header H based on the user'"'"'s public key PK_LU, attribute set L_U and access control policy Ps; and

sending the partially decrypted header {tilde over (H)} to the user.

4. The method of claim 3, wherein the step of partially decrypting uses multi-dimensional forward/backward derivative functions to compare a data user'"'"'s attribute set L_U to a specified access control policy Ps.

5. The method of claim 3, further comprising decrypting the encrypted data.

6. The method of claim 1, wherein the step of generating a public key PK and a master key MK is performed in accordance with the following algorithm:

1) selects two generators G, Wε

;

2) randomly chooses λ

ε

*_n and computes T=λ

Wε

;

3) selects a random α

ε

*_n and computes e(G, W)^α

;

4) selects random {right arrow over (π

)}, ε

*_n;

5) publishes PK={, T, W, h(·

)}, e(G, W)^α

as public key, keep master key MK={λ

, α

, G, {right arrow over (π

)}, } as secret.

7. The method of claim 1, wherein the step of issuing private keys SK_LU and public keys PK_LU to each data user, said public and private keys based on the data user'"'"'s ID and attribute set L_U is performed in accordance with the following algorithm:

KeyGen(MK, u, L_u)→

(SK_Lu, PK_Lu);

Given a user u'"'"'s attribute ranges L_u={[v_i,a, v_i,b]}<sub>1≦

i≦

m</sub>, this algorithm outputs u'"'"'s public key PK_Lu={{right arrow over (ψ

)}_U, _Ū

} and u'"'"'s private key SK_Lu={A_u, {right arrow over (A)}_u, _u}, Each part of PK_Lu and SK_Lu are generated as follows;

1) computes {{right arrow over (w)}_i,a=Π

<sub>0≦

ξ

≦

a</sub>(h(v_i,ξ

))}<sub>1≦

i≦

m</sub> and {_i,b=Π

<sub>b≦

ξ

≦

ni</sub>(h(v_i,ξ

))}<sub>1≦

i≦

m</sub>;

2) computes the first part and second part of public key PK_Lu;

{right arrow over (ψ

)}_U={right arrow over (π

)}^{{right arrow over (w)}U}={right arrow over (π

)}<sup>Π

1≦

i≦

m{right arrow over (w)}i,a</sup>, _Ū

=^Ū

=<sup>Π

1≦

i≦

mi,b</sup>;

3) chooses a random γ

_uε

_N* for each user u and computes the first part of private key SK_Lu;

A_u=(γ

_u+α

)Gε

;

4) computes the second part and third part of private key

8. The method of claim 1, wherein the step of generating a partially encrypted header {tilde over (H)} is performed in accordance with the following algorithm:

EncDelegate(PK, MK, P_S)→

H;

Given public key PK, master key MK and the designated access control policy of attribute range P_S={[v_i,j, v_i,k]}<sub>1≦

i≦

m</sub>, this algorithm outputs the partially encrypted header {tilde over (H)}={{right arrow over (ψ

)}_S, _S} by the steps below;

1) computes {{right arrow over (w)}_i,k=Π

<sub>0≦

ξ

≦

k</sub>(h(v_i,ξ

))}<sub>1≦

i≦

m</sub> and {_i,j=Π

<sub>j≦

ξ

≦

ni</sub>(h(v_i,ξ

))}<sub>1≦

i≦

m</sub>;

2) computes {right arrow over (w)}_S=Π

<sub>1≦

i≦

m</sub>{right arrow over (w)}_i,k and _S=Π

<sub>1≦

i≦

mi,j</sub>;

3) computes the first part of partially encrypted header {right arrow over (ψ

)}_S={right arrow over (π

)}^{{right arrow over (w)}S}={right arrow over (π

)}<sup>Π

1≦

i≦

m{right arrow over (w)}i,k</sup> and the second part of partially encrypted header _S=^S=<sup>Π

1≦

i≦

mi,j</sup>.

9. A non-transitory computer readable medium storing a program causing a computer to execute a method in accordance with claim 1.

10. An encryption device comprising:

a microprocessor;

a memory coupled to said microprocessor;

wherein said microprocessor comprises logic that executes a method in accordance with claim 1.

11. A cloud storage system comprising:

a cloud resource, said cloud resource comprising a microprocessor that comprises logic that executes a method in accordance with claim 1; and

a hardware computing device having at least one microprocessor that receives data from the cloud resource.

12. The method of claim 1, wherein a communication overhead and a size of a ciphertext output remains constant regardless of the number of attributes in the attribute set L_U.

13. The method of claim 1, wherein a computation overhead of the data owner and the data user remains constant regardless of the number of attributes by delegation.

14. The method of claim 1, further comprising:

enforcing access control by checking whether the data user satisfies one or more attribute range relationships on multiple attributes Ai specified by the access control policy Ps, wherein the one or more attribute range relationships on each attribute Ai involves a data user'"'"'s attribute range [t_i,a, t_i,b] and an attribute constraint [t_i,j, t_i,k] specified by the access control policy Ps.

15. The method of claim 14, wherein the one or more attribute range relationships includes:

wherein the data user'"'"'s attribute range belongs to the attribute constraint, such that [t_i,b]⊂

[t_i,j, t_i,k];

wherein the data user'"'"'s attribute range intersects the attribute constraint but does not belong to the attribute constraint, such that ([t_i,j, t_i,k]\[t_i,a, t_i,b]/=∅

)Λ

([t_i,j, t_i,k]∩

[t_i,a, t_i,b]/=∅

);

wherein the data user does not own attribute Ai, and the data user is assigned a dummy integer value t_i,0 distinct from one or more other attribute integer values, such that t_i,a =t_i,b=t_i,0; and

wherein the attribute Ai is out of consideration and does not impact access control, such that t_i,j=t_i,0 and t_i,k=t_t,ni.