PAbAC: A Privacy Preserving Attribute based Framework for Fine

Grained Access Control in Clouds

Sana Belguith

1,2

, Nesrine Kaaniche

, Abderrazak Jemai

, Maryline Laurent

and Rabah Attia

1,2

Tunisia Polytechnic School, Laboratory of Electronic Systems and Communication Network, Tunis, Tunisia

Telnet Holding, Telnet Innovation Labs, Tunis, Tunisia

SAMOVAR, CNRS, Telecom SudParis, University Paris-Saclay, Paris, France

Laboratory LIP2, University of Sciences of Tunis, Tunis, Tunisia

Keywords:

Cloud Storage Systems, Attribute-based Encryption, Attribute-based Signature, Data Conﬁdentiality, Privacy.

Abstract:

Several existing access control solutions mainly focus on preserving conﬁdentiality of stored data from unau-

thorized access and the storage provider. Moreover, to keep sensitive user data conﬁdential against untrusted

servers, existing solutions usually apply cryptographic methods by disclosing data decryption keys only to au-

thorized users. However, these solutions inevitably introduce a heavy computation overhead on the data owner

for key distribution and data management when ﬁne-grained data access control is desired. In addition, access

control policies as well as users’ access patterns are also considered as sensitive information that should be

protected from the cloud. In this paper, we propose PAbAC, a novel privacy preserving Attribute-based frame-

work, that combines attribute-based encryption and attribute-based signature mechanisms for securely sharing

outsourced data via the public cloud. Our proposal is multifold. First, it ensures ﬁne-grained cryptographic ac-

cess control enforced at the data owner’s side, while providing the desired expressiveness of the access control

policies. Second, PAbAC preserves users’ privacy, while hiding any identifying information used to satisfy

the access control. Third, PAbAC is proven to be highly scalable and efﬁcient for sharing outsourced data in

remote servers, at both the client and the cloud provider side.

1 INTRODUCTION

Data security and privacy are major challenges in the

adoption of cloud storage applications, mainly due to

the loss of data control. It is commonly agreed that

data encryption at the client side is a good alterna-

tive to mitigate data secrecy concerns. As such, the

client preserves the decrypting keys out of reach of the

cloud. Although encryption assures the conﬁdential-

ity against curious cloud service providers, the use of

conventional encryption approaches is not sufﬁcient

to support the enforcement of ﬁne-grained access con-

trol policies. That is, data conﬁdentiality preserva-

tion becomes more complicated, considering ﬂexible

data sharing among dynamic groups of users. First,

access control policies should be ﬂexible and distin-

guishable among users with different privileges. Sec-

ond, dynamic groups require efﬁcient sharing of de-

ciphering keys between different authorized users. In

fact, the subscription of a new group member should

not require updating the secret keys of the remaining

users. So that, the complexity of key management is

minimized. Thus, the challenge is to deﬁne a com-

prehensive access control mechanism for outsourced

data while both ensuring data conﬁdentiality and pro-

tecting users’ privacy.

For instance, with the involvement of a third-party

cloud provider, a crucial issue is that access patterns

may reveal privacy-sensitive information about users

and potentially leak conﬁdential information about

the content. The conﬁdentiality of outsourced data

and the privacy of users are thus not assured if these

sensitive data are not protected.

In this paper, we propose PAbAC, a novel privacy

preserving Attribute-based framework, that com-

bines Attribute Based Encryption (ABE) and At-

tribute Based Signature (ABS) mechanisms for se-

curely sharing outsourced data via public clouds.

PAbAC introduces a two-level access control model

that combines ﬁne-grained access control which en-

sures a comprehensive granularity for access rules,

and anonymous data access, which allows the stor-

age server to manage access requests with no need to

learn the user identity nor his attributes. The original-

Belguith, S., Kaaniche, N., Jemai, A., Laurent, M. and Attia, R.

PAbAC: A Privacy Preserving Attribute based Framework for Fine Grained Access Control in Clouds.

DOI: 10.5220/0005968201330146

In Proceedings of the 13th International Joint Conference on e-Business and Telecommunications (ICETE 2016) - Volume 4: SECRYPT, pages 133-146

ISBN: 978-989-758-196-0

133

ity of PAbAC is multifold. First, PAbAC introduces a

privacy preserving authentication scheme, based on

a novel use of attribute-based signatures.The iden-

tity of the requesting entity client remains protected

against the certifying authorities as well as the cloud

service provider. Moreover, the combination between

attribute based encryption mechanisms and attribute

based signature scheme allows the cloud provider to

control the bandwidth consumption, and then, the sys-

tem’s availability. In fact, the authentication of re-

questing users permits to mitigate Flooding attacks

which exploit the bandwidth under provisioning vul-

nerability (Zunnurhain, 2012). Thus, only authorized

users can download encrypted data.

Second, as a designed decentralised multi-authority

attribute based framework, PAbAC reduces the bottle-

neck of maintaining a central authority for managing

secret parameters. Additionally, it supports issuing a

set of attributes from each attribute authority unlike

other access control schemes which rely on issuing

only one attribute per authority.

Third, the original use of attribute based encryption

and the related attribute based signature guarantees

ﬁne grained access control to outsourced data and

provides an effective key management in sharing sce-

narios. For instance, the PAbAC framework is highly

scalable and offers interesting performances such as

low computation and communication cost, at both the

client and the cloud provider side.

Paper Organisation – The remainder of this work is

as follows: Section 2 presents security considerations

and design goals. Then, Section 3 reviews related

work and introduces attribute based mechanisms. In

Section 4, we describe the system model and review

some preliminaries and cryptographic primitives. Af-

terwards, we detail the framework design and de-

scribe the prototype and its different procedures in

Section 5. In Section 6, rigorous security discussions

are given. Finally, theoretical performances analysis

is provided in Section 7, before concluding in Sec-

tion 8.

2 PROBLEM STATEMENT

Let us consider the following example, where a hospi-

tal supports ﬁne-grained access control on Electronic

Health Records (EHRs) and makes these records

available to hospital employees through a public

cloud. In accordance with regulations such as the

Health Insurance Portability and Accountability Act

(HIPAA) (HIP, ), the hospital policies must specify

which users can access which data item(s). In fact,

a health-care information system based on cloud ser-

vices is required to restrict access of protected medi-

cal records to eligible doctors while a client relation

management system running on a cloud may allow ac-

cess of patients’ information to high-level executives

of the hospital only. In many cases, hospital employ-

ees, mainly doctors, have to share patients’ health in-

formation, in order to properly prescript treatments.

Thus, they usually form dynamic sharing groups with

different granted privileges. Therefore, it is notewor-

thy that data conﬁdentiality preservation is not the

only security concern. It is crucial to support ﬂexible

sharing of encrypted outsourced data among dynamic

group of users, while protecting users’ privacy. In a

real e-health scenario, different medical organisations

can be involved such as hospitals, research laborato-

ries, pharmacies, health ministry as well as doctors

and patients. Let us consider that a doctor shares his

patients’ EHR in a public cloud. On one hand, the

shared data have to be protected from unauthorized

access while ensuring ﬁne grained access control for

different authorized actors. Moreover, the data conﬁ-

dentiality must be preserved against a malicious cloud

service provider. Thus, encryption on the client side

should be applied while supporting ﬂexible sharing of

outsourced data among dynamic group of users.

On the other hand, the private identifying information

of the involved cloud users, such as doctors and pa-

tients, must not be revealed to the remote server. For

instance, the system should not reveal any private in-

formation related to a doctor, such as his professional

card or its speciality, as well as his patients’ data. That

is, the disclosure of such information may be used to

produce targeted advertisement related to the health

condition of the patients, or to run statistical surveys.

Thus, the design of PAbAC is motivated by providing

the support of both robustness and efﬁciency while

fulﬁlling the following properties:

• Data Conﬁdentiality – PAbAC has to protect the

secrecy of outsourced and encrypted data contents

against both curious cloud service providers and

malicious users.

• Flexible Access Control – our proposal should

ensure ﬂexible security policies among dynamic

groups of users with different granted privileges,

belonging to different groups.

• Privacy – PAbAC must protect group members’

access patterns privacy, while requesting access to

outsourced data. That is, the cloud server must

be able to grant access with no need to additional

identifying information of the requesting users.

• Low Computation Overhead – on one hand, for

scalability reasons, the amount of computation at

the cloud storage server should be minimized, as

SECRYPT 2016 - International Conference on Security and Cryptography

134

the server may be involved in concurrent interac-

tions. On the other hand, the proposed algorithms

should also have low processing complexity, at the

client side.

• Low Storage Cost – PAbAC should provide ac-

ceptable storage cost at the client side.

3 RELATED WORK

Several research works have been proposed in the lit-

erature in order to securely share data among groups

of users while protecting their privacy (Horv

ath,

2015),(Kaaniche et al., 2014),(Wan et al., 2012),(Yu

et al., 2010a), (Raykova et al., 2012), (Di Vimer-

cati et al., 2010b). In order to prevent untrusted

servers from accessing outsourced data, several so-

lutions apply encryption mechanisms at the client

side while disclosing the decryption keys to autho-

rized users only (Benaloh et al., 2009),(Di Vimer-

cati et al., 2010a), (Kaaniche et al., 2013), (Benaloh

et al., 2009), (Di Vimercati et al., 2015). Although

these methods ensure secure data access control, the

key distribution remains a bottleneck. For instance,

it becomes more complicated with the increase of the

number of users. To deal with this concern, Wang

et al. (Wang et al., 2009) propose to deliver the key

management to the remote server while assuming that

this latter is trusted. Moreover, in order to enforce au-

thorization policies, De Vimercati et al. (Di Vimercati

et al., 2007) proposed a novel solution aiming to en-

force the access control to the outsourcing systems.

De Vimercati et al. proposal is based on the appli-

cation of selective encryption as a means to enforce

authorizations while applying hierarchical key assign-

ment schemes.

Recently, Attribute-based Cryptography appears as

a promising technique, designed for ensuring ﬁne

grained access control for outsourced data. This cryp-

tographic mechanism was introduced by Sahai and

Waters in 2005 (Sahai and Waters, 2005).

In the following, we present Attribute based Encryp-

tion mechanisms (ABE) and their application in cloud

environments in Section 3.1. Then, we introduce At-

tribute based Signature schemes (ABS) and review re-

lated work applying ABS for protecting access to out-

sourced data in cloud servers.

3.1 Attribute based Encryption (ABE)

In 2005, Sahai and Waters introduced the concept of

Attribute Based Encryption (ABE), as a new mean for

encrypted access control (Sahai and Waters, 2005).

In ABE, ciphertexts are not necessarily encrypted to

one particular user as in traditional public key cryp-

tography. Instead both users’ private keys and ci-

phertexts are associated with a set of attributes or a

structure over attributes (Bethencourt et al., 2007).

The user is able to decrypt a ciphertext if there is a

match between his private key and the ciphertext. For

instance, Goyal et al. distinguishes two ABE cate-

gories, namely: Key-Policy ABE (KP-ABE) (Goyal

et al., 2006) and Ciphertext-Policy ABE (CP-ABE)

(Bethencourt et al., 2007). Several works rely on ABE

to provide ﬁne grained access control for outsourced

data (Hur and Noh, 2011),(Yu et al., 2010b),(Jahid

et al., 2011). Although these schemes proposed efﬁ-

cient solutions to protect outsourced data, they require

the use of a central trusted authority to manage all

the attributes and issue the related secret keys to users

in the system. Thus, this central authority is able to

achieve a key escrow attack, due to its knowledge of

the users’ private keys.

Wang et al. (Wang et al., 2010) propose a hierarchical

access control mechanism for cloud storage. Their

scheme is based on the Bethencourt et al. CP-ABE

scheme (Bethencourt et al., 2007) and hierarchical

Identity based Encryption (IBE) (Horwitz and Lynn,

2002). This scheme relies on the use of several au-

thorities arranged in a hierarchical way. However, it

still relies on the trusted authority and fails, if the lat-

ter is compromised.

Recently, Lewko and Waters (Lewko and Waters,

2011) proposed a decentralized ABE scheme, where

users could obtain their private keys from different

attribute authorities. Each attribute authority is in

charge for deriving a private key associated to a one

attribute. The proposal (Lewko and Waters, 2011)

did not require a central trusted server, which must

remain active and uncorrupted throughout the life-

time of the system. Based on this decentralized ar-

chitecture, there is no need for absolute trust in a

single designated entity. However, Lewko and Wa-

ters (Lewko and Waters, 2011) assume that each at-

tribute authority is responsible for issuing only one

attribute. Moreover, in order to prevent collusion in

such a setting, this scheme requires that each user

has a unique global identiﬁer (GID), which they must

present to each authority. Unfortunately, due to the

use of GID, the users cannot preserve their privacy

against attribute authorities. In fact, while a user must

present the same GID to each authority, colluding au-

thorities can pool their data and build a complete pro-

ﬁle of all of the attributes corresponding to each GID.

However, this might be undesirable, particularly if the

user uses the ABE system in many different settings

and wants to keep information about some of those

settings private. Based on the Lewko and Waters pro-

PAbAC: A Privacy Preserving Attribute based Framework for Fine Grained Access Control in Clouds

135

posal (Lewko and Waters, 2011), Ruj et al. (Ruj

et al., 2011) proposed a distributed sharing scheme

in cloud environments scheme with an attribute revo-

cation extension (DACC). The DACC solution con-

sists of using one or several key distribution centers

responsible for issuing keys to data owners and users

related to their attributes. The data owner encrypts

data under an access structure and stores them in the

cloud. The users, while matching their set of at-

tributes to the access structure, can retrieve the data

from the cloud. We must note that the DACC proposal

also supports revocation of users, without redistribut-

ing keys to all the users of cloud services. In 2015,

Horv

a (Horv

ath, 2015) proposed a decentralized ABE

scheme for securely sharing data in cloud computing

systems based on the use of the decentralized Lewko

and Waters scheme (Lewko and Waters, 2011). In

order to achieve an efﬁcient revocation scheme, this

proposal relies on the use of an identity based user re-

vocation mechanism to manage access rights for out-

sourced data. This proposed extension supports mul-

tiple independent attribute authorities in which revo-

cation of speciﬁc users (e.g. based on users’ identi-

ties) from the system is possible without updates of

attribute public and secret keys.

Most of the mentioned approaches do not propose a

mechanism to authenticate requesting users. More-

over, these schemes are based on the use of Lewko

et al. decentralised ABE scheme (Lewko and Waters,

2011) which requires the use of the users’ global iden-

tiﬁers GIDs. Thus, the privacy of the user is not pro-

tected against the attribute authorities.

3.2 Attribute based Signature (ABS)

Attribute-Based Signatures (ABS) (Maji et al., 2011)

is a ﬂexible primitive that enables a user to sign a

message with ﬁne grained access control over iden-

tifying information. In ABS, the user possesses a set

of attributes, obtained from a trusted authority. This

latter can sign a message with respect to a predicate

satisﬁed by his attributes. The signature reveals no

more that the fact that a single user with some set

of attributes satisfying the predicate has attested to

the message. Maji et al. presented a comparison of

ABS with other signature-related-notions (Maji et al.,

2011), such that ring signatures (Rivest et al., 2001)

and group signatures (Chaum and Van Heyst, 1991)

that can be considered as particular categories of at-

tribute based signatures (El Kaafarani et al., 2014a).

In (Maji et al., 2011), Maji et al. also introduced dif-

ferent applications of ABS including attribute-based

messaging (Bobba et al., 2006), trust negotiation

(Frikken et al., 2006) and leaking secrets. Some

constructions of ABS consider multiple authorities

while others only support a single attribute authority.

Okamoto et al. (Okamoto and Takashima, 2013) and

El Kaafarani et al. (El Kaafarani et al., 2014b) have

proposed the ﬁrst fully decentralized attribute based

signatures schemes. These schemes consist of involv-

ing multiple attribute authorities in the system, with

no reliance on a central authority. The security of at-

tribute based signatures requires users’ privacy and

unforgeability. On one hand, users’ anonymity re-

quires that signatures reveal neither users’ identities

nor the attributes used in the signing algorithm. On

the other hand, unforgeability requires that a user can-

not forge a signature with respect to a signing predi-

cate that the user attributes do not satisfy, even if this

user colludes with other users (Ghadaﬁ, 2015).

Several works rely on the attribute based signature

to ensure the authentication of data owners and ﬁne

grained access control to outsourced data in the cloud.

Indeed, Ruj et al. (Ruj et al., 2012) presented a pri-

vacy preserving authenticated access control scheme

for securing data in clouds based on an attribute based

signature scheme. In the proposed scheme, the cloud

provider veriﬁes the authenticity of the data owner

without knowing the user’s identity before storing in-

formation. To do so, this scheme uses a combina-

tion of the decentralized attribute based encryption

(Lewko and Waters, 2011) and the multi-authority at-

tribute based signature proposed by Maji et al. (Maji

et al., 2011). This proposal relies on the use of a

global identiﬁer GID in order to issue private keys

from attribute authorities to users, thus the attribute

authorities can reveal the user’s identity. Finally, the

proposed authentication scheme is used to authenti-

cate the data owner and there is no way to authenticate

the requesting users. In (Zhao et al., 2011), Zhao et

al. applied the ciphertext-policy attribute based en-

cryption (CP-ABE) proposed by Bethencourt et al.

(Bethencourt et al., 2007) combined with the Maji

et al. (Maji et al., 2011) attribute based signature to

ensure ﬁne grained access control to outsourced data

in the cloud. This proposal does not take interest in

authenticating the requesting users. Moreover, it is

based on a centralized ABE and ABS schemes, thus

it relies on a central trusted authority to issue secret

keys to all the users.

4 PAbAC SYSTEM

In this section, we present our system model in sec-

tion 4.1 and the mathematical background is pre-

sented in section 4.2.

SECRYPT 2016 - International Conference on Security and Cryptography

136

Figure 1: The main architecture entities and their interac-

tion.

4.1 System Model

Figure 1 presents the different entities involved in

PAbAC and deﬁned as follows:

Cloud Service Provider (CSP): the CSP is assumed

to have abundant storage capacity and computation

resources in order to manage data storage service.

The cloud provider consists of data servers and a data

service manager. Data servers are responsible for

storing data outsourced by the data owner while the

data manager is in charge of controlling the accesses

from requesting users to outsourced data and provid-

ing corresponding contents services.

Data Owner (O): the data owner is responsible for

outsourcing data into the remote cloud servers and

granting access privileges to other cloud users, by

specifying an attribute-based access policy for each

data ﬁle.

Users (U): a user is a cloud client that may access to

outsourced content by data owners. In a nutshell, if

a user has the set of attributes satisfying the access

structure of the encrypted data ﬁle, he then may have

access to data.

Trusted Authority (TA): TA is a trusted third party

in our system which is responsible for generating and

managing public parameters for both used mecha-

nisms: attribute based encryption and attribute based

signature.

Attribute Authority (AA): AA is a party responsi-

ble for deriving a public keys and issuing private keys

to different users that are assigned to their attributes.

The Attribute Authority can be considered as an Iden-

tity Provider. In PAbAC, any trusted party can be-

come an attribute authority and there is no require-

ment for any global coordination other than the cre-

ation of an initial set of common public parameters.

4.2 Mathematical Background

In this section, we ﬁrst introduce the access structure

in section 4.2.1. Then, in section 4.2.2, we present

the bilinear maps. Finally, we introduce our security

assumptions.

4.2.1 Access Policies

Access policies can be represented by one of the fol-

lowing formats: i) Boolean functions of attributes, ii)

Linear Secret Sharing Scheme (LSSS) matrix, or iii)

Monotone span programs (Lewko and Waters, 2011).

Deﬁnition 1. Access Structure

Let {P

,··· , P

} be a set of parties. A collection

A ⊆ 2

,···,P

}

is monotone if ∀B,C if B ∈ A and B ⊆ C

then C ∈ A (Lewko and Waters, 2011).

An access structure is a collection A of non-empty

subsets of {P

,· ·· , P

}, such as A ⊆ 2

,···,P

}

We note that any access structure can be converted

into a Boolean function. Boolean functions can

be represented by an access tree, where the leaves

present the attributes while the intermediate and the

root nodes are the logical operators AND (∧) and OR

(∨).

Deﬁnition 2. Linear Secret Sharing Schemes (LSSS)

A Linear Secret Sharing Scheme LSSS over a set

of parties P (Lewko and Waters, 2011) is deﬁned as

follows:

1. the shares of each party form a vector over Z

2. there exists a matrix A with n rows and l columns

called the share-generating matrix for LSSS. ∀i ∈

[1,· ·· , n], the i

row of A is labeled by a party ρ(i)

( where ρ is function from {1,·· · , n} to P). When

we consider the column vector ~v = [s,r

,· ·· , r

where s ∈ Z

is the secret to be shared, and

,· ·· , r

∈ Z

are randomly chosen, then A.~v =

is the vector n shares of the secret s according to

LSSS.

In (Beimel, 1996), Beimel presents the algorithm that

converts a boolean function (in the form of access

tree) as a LSSS matrix.

Deﬁnition 3. Monotone Span Programs

For a ﬁeld F and a variable set S = {a

,..., a

}, a

Monotone Span Program (Karchmer and Wigderson,

1993) is deﬁned by a α × β matrix A along with a

labeling map ρ which associates each row in A with

an element a

∈ S. The span program accepts a set

γ if 1 ∈ Span(A

), where (A

) is the sub-matrix of

A containing only rows with labels a

∈ γ. In other

words, the span program only accepts the set γ if there

exists a vector s such that s · A

= [1, 0,..., 0].

4.2.2 Bilinear Maps

An admissible symmetric pairing function ˆe from

× G

in G

has to be bilinear, non degenerate

PAbAC: A Privacy Preserving Attribute based Framework for Fine Grained Access Control in Clouds

137

and efﬁciently computable. G

and G

are two mul-

tiplicative subgroups of a ﬁnite ﬁeld. G

and G

have

the same order N.

4.2.3 Complexity Assumptions

Our proposal is based on three cryptographic assump-

tions detailed as follows:

Deﬁnition 1. Discrete Logarithm Problem (DLP)

Given a generator g of a multiplicative cyclic

group G of order N, and given the public element

y = g

∈ G, the problem of ﬁnding x is called the Dis-

crete Logarithm Problem.

Deﬁnition 2. Computational Difﬁe Hellman prob-

lem (CDH)

Given a generator g of a multiplicative cyclic

group G of order N, and given two group elements

∈ G and g

∈ G where a, b ∈ Z

are two secrets,

the problem of calculating g

from g

and g

is called

the Computational Difﬁe Hellman problem.

Deﬁnition 3. Decisional Difﬁe Hellman problem

(DDH)

Given a generator g of a multiplicative cyclic

group G of order N, and given two group elements

∈ G and g

∈ G where a,b ∈ Z

∗

are two secrets, the

problem of distinguishing between tuples of the form

) and (g

) for some random integer

c, is called the Decisional Difﬁe Hellman problem.

5 PAbAC: PROPOSED SOLUTION

5.1 Motivation

In order to achieve ﬁne grained and privacy preserv-

ing access control to outsourced data in cloud storage,

we combine two latest cryptographic techniques, CP-

ABE and ABS. The choice of attribute based cryptog-

raphy (ABC) is motivated by several reasons. First,

we beneﬁt from an easier key management system,

thanks to the certiﬁcate-free feature of ABC. Second,

ABC permits deriving public keys with no need for

previous computation of corresponding private keys.

That is, contrary to traditional public key derivation

schemes, ABC does not require to generate the private

key before the public key. Indeed, users have only to

generate access structure and the related enciphering

key to encrypt data before storage.

CP-ABE is much more appropriate to data outsourc-

ing, since it enables the data owner to generate an ac-

cess tree over selected attributes. Thanks to its ﬂex-

ibility in specifying different access rights for each

individual user, ABE is considered as one of the most

public key primitive which is appropriate for one-to-

many communications. That is, data are encrypted

under a set of attributes so that multiple users who

possess proper keys can decrypt. This potentially

makes encryption and key management more efﬁ-

cient. Moreover, the enciphering entity is not required

to know the access control list.

In order to protect the requesting entity’s privacy,

PAbAC relies on using Attribute based Signature

(ABS). In ABS, messages are signed with respect to

an access structure. Thus, the CSP veriﬁes that the

requesting user having a set of attributes satisfying

the access tree has indeed authenticated the message

without revealing his identity or the set of attributes

used in the signing procedure.

Our PAbAC framework is based on an original use

of the identity based signature scheme presented by

Waters (Waters, 2005) combined with the decen-

tralized Attribute Based Encryption introduced by

Lewko and Waters (Lewko and Waters, 2011) to

achieve an extension of waters’ scheme to a multi-

authority attribute based encryption. This novel en-

cryption scheme presented by PAbAC supports the is-

suance of a set of attribute obtained from the same

authority. Moreover, PAbAC introduces an origi-

nal multi-authority attribute based signature scheme

based on an extension of Waters’ identity based sig-

nature adapted to the multi-authority ABE encryption.

Thus, PAbAC presents lower computation costs espe-

cially at the client side compared with the other access

control schemes. The different notations used in this

paper are listed in Table 1.

Table 1: The different notations used in this paper.

Notation Description

Set of users’ attributes

Set of attributes certiﬁed by the at-

tribute authority AA

Secret keys related the set of at-

tributes S

obtained from the at-

tribute authority AA

AA Attribute Authority

Data ﬁle

O Data Owner

U User

Encrypted data ﬁle

ψ Access policy

5.2 Overview

In PAbAC, there are two main actors: a data owner

(O) and data users (U). The data owner ﬁrst deﬁnes

SECRYPT 2016 - International Conference on Security and Cryptography

138

an access structure ψ that points out who can access

the outsourced data with respect to a set of attributes.

Then, the data ﬁle is encrypted under the access struc-

ture ψ, based on an attribute based encryption algo-

rithm. Then, the data owner stores the encrypted data

in the cloud. When a user wants to access the out-

sourced data ﬁle, he has ﬁrst to authenticate with the

cloud. For this purpose, he has to sign a random

message, obtained from the cloud, under the access

structure ψ associated with the outsourced data ﬁle.

Afterwards, the cloud veriﬁes the correctness of the

received signature in order to send the requested ele-

ments, namely the encrypted data ﬁle.

We suppose that each cloud user has already obtained

the private keys related to his attributes from the cor-

responding attribute authorities. For an e-health use

case, an attribute authority may be the hospital ad-

ministration issuing the afﬁliation card of each doctor

(i.e the professional card contains a set of attributes

such as the name of the doctor, his afﬁliation, his se-

rial number, ···).

Based on the required attributes, speciﬁed in the ac-

cess structure ψ, the requesting user selects related

private keys in order to decrypt the encrypted data ﬁle.

Our PAbAC proposal is deﬁned upon the following

seven algorithms. It involves three procedures on the

basis of two phases. During the ﬁrst phase, the system

initialisation procedure SYS INIT is executed. The

second phase occurs when the data owner wants to

share data ﬁles with other cloud users, based on both

the data storage procedure STORE and the data re-

trieval procedure BACKUP.

The SYS INIT procedure consists of three random-

ized algorithms for the generation of public param-

eters related to the involved attribute authorities re-

ferred to as setup and setup

auth

, and the generation

of users’ private keys denoted by keygen.

The STORE procedure presents the data storage sce-

nario. It consists of the encdata algorithm for the

encryption of data ﬁles.

For the data retrieval scenario, the BACKUP procedure

deals with the user’ authentication, namely sign and

verif and the data decryption algorithms referred to

as decdata.

5.3 System Initialisation Procedure

The SYS INIT procedure consists of three random-

ized algorithms, deﬁned as follows:

• setup – this randomized algorithm takes as in-

put the security parameter λ. It outputs the global

public parameters PP deﬁned as follows:

PP = {G

,N, h, ˆe,u

,· ·· , u

}

where G and G

are two multiplicative groups of

order N, ˆe : G

× G

→ G

is a bilinear map, g,h

are generators of G

and {u

= g,· ·· , u

} are gen-

erators of G

randomly chosen such as u

= g

• setup

auth

– the setup

auth

algorithm is executed

by an attribute authority AA. The setup

auth

al-

gorithm takes as inputs the public parameters PP

and outputs the pair of private and public keys

(sk

, pk

), where sk

correspond to a random val-

ues α, and the related public key pk

is deﬁned as

follows:

= { ˆe(g

)

}

• keygen – this algorithm is performed by an at-

tribute authority AA

. It takes as input the global

parameters PP, the attribute authority’s secret key

{sk

}, a random value t where t ∈ Z

and a set

of attributes S

= {a

,· ·· , a

}, where n

is the

number of attributes of S

. It outputs the secret

key sk

related to the set of attributes S

, as de-

picted by Algorithm 1.

Algorithm 1: Keygen procedure.

1: Input: the global parameters PP, the attribute au-

thority’s secret key {sk

} and a set of attributes

2: Output: the secret key sk

related to the set of

attributes S

3: K ← g

· h

;

4: L ← g

;

5: sk

← {K, L};

6: for all i ∈ [1. .. n

] do

7: K

← u

;

8: sk

← sk

∪ K

;

9: end for

10: return sk

5.4 Data Storage Procedure

To outsource a data ﬁle (D

) to the cloud, the data

owner (O) performs the STORE procedure. For this

purpose, he ﬁrst deﬁnes an access policy ψ and ob-

viously selects the attribute needed to satisfy it. We

note that the access policy ψ is described in terms

of a monotonic boolean formula. We represent the

boolean formula as an access tree where the interior

nodes are AND and OR gates, and the leaf nodes cor-

respond to attributes as detailed in Section 4.2.

Thus, the access policy corresponds to the couple

(A,ρ) where A is an n × l access matrix and ρ is the

function that maps the matrix rows to the required at-

tributes. These attributes have to be obtained from a

certiﬁed Attribute authority (AA) that is responsible

PAbAC: A Privacy Preserving Attribute based Framework for Fine Grained Access Control in Clouds

139

of issuing the required attributes.

After deﬁning the access structure (A, ρ), the data

owner encrypts the data ﬁle D

, based on the

encdata algorithm. We note that our encryption al-

gorithm relies on the decentralized Lewko and Wa-

ters ABE scheme (Lewko and Waters, 2011). That is,

we extend the (Lewko and Waters, 2011) proposal to

support deriving a set of private keys related a set of

attributes from each single attribute authority, while

preserving users’ privacy with respect to the involved

attribute authorities.

The STORE procedure consists of the encdata algo-

rithms, deﬁned as follows:

• encdata – the encryption algorithm encdata

is executed by the data owner. It takes as in-

put the attribute authorities’ public keys {pk

the data ﬁle D

, the public parameters PP and

the access policy (A,ρ). The encdata algo-

rithm outputs the ciphertext as a tuple E

1,i

2,i

3,i

)

i∈{1,n}

(where i presents a ma-

trix row corresponding to attribute i) deﬁned as

follows:

= D

ˆe(g

)

(1)

1,i

= ˆe(g

)

(2)

2,i

= g

(3)

3,i

= g

(4)

Where p

,s ∈ Z

are random values selected by

the data owner, λ

·~v where ~v ∈ Z

is a ran-

dom vector with s as its ﬁrst entry and w

such as

τ ∈ Z

is a random vector with 0 as its

ﬁrst entry.

Figure 2 depicts the storage procedure STORE of the

PAbAC framework.

5.5 Data Backup Procedure

For the data retrieval scenario, the BACKUP proce-

dure starts with the user’ authentication, with respect

to the sign and verif algorithms and is achieved by

the data decryption algorithm referred to as decdata.

The ﬁgure 3 presents different interactions between

Figure 2: PAbAC data storage procedure STORE.

Figure 3: PAbAC data backup procedure BACKUP.

the cloud provider and the requesting user for the data

access procedure.

We detail, in Section 5.5.1, the different algo-

rithms for user authentication with the cloud provider

upon requesting access to an outsourced data ﬁle E

Then, we present, in Section 5.5.2, the algorithm

needed for decrypting the outsourced data ﬁle.

5.5.1 Anonymous User Authentication

When a user (U) wants to access to the encrypted data

ﬁle (E

) outsourced by the data owner, the CSP has

to ﬁrst authenticate the user, with respect to the ac-

cess tree ψ associated with the encrypted data ﬁle. So

that, the cloud provider sends a random value m which

consists of the cloud provider identity concatenated

with the current time (i.e. m is assumed to be different

for each authentication session). The requesting user

has then to sign the received value m with respect to

the signing predicate ψ, and sends his signature to the

cloud provider. We note that if the veriﬁcation fails,

the user cannot access to data and the cloud provider

does not send the encrypted data ﬁle. The anonymous

authentication procedure consists of two algorithms,

deﬁned as follows:

• sign – this algorithm takes as input the global

public parameters PP, a random token m, a sign-

ing policy ψ and the set of attributes’ secret keys

{sk

} that satisﬁes the signing predicate. It out-

puts a signature σ.

In fact, the user ﬁrst selects the sub-set of his at-

tributes S

that satisﬁes the signing predicate ψ,

such as: ψ(S

) = 1 and signs the received value

m. The user ﬁnally sends the signature σ to the

cloud provider who checks the resulting signature.

Thus, the user ﬁrst converts ψ to its corresponding

monotone span program A which is an n ×l access

matrix, with respect to the row labeling function

ρ : [n] → S

. In addition, he computes the vector

~y such as ψ(S

) = 1 and ~y ·

A = [1,0, ·· · , 0]. In

order to sign the random token m, the data owner

SECRYPT 2016 - International Conference on Security and Cryptography

140

ﬁrst randomizes his secret key sk

as follows:

= Kh

= g

t+t

(5)

= Lg

= g

t+t

(6)

= K

= u

t+t

,∀i ∈ S

(7)

In the sequel, the requesting user’s new pri-

vate key is deﬁned by {sk

} such as {sk

} =

{(K

)}.

Then, for each i ∈ [1,n], the signer computes x

)

and sets z =

∏

i=1

((K

ρ(i)

)

. Afterwards, the

signer generates a random r ∈ Z

and computes:

= zK

(8)

= g

(9)

Finally, the signature for the message m gener-

ated by the user with respect to the signing policy

(A,ρ) is set as follows:

σ = (x

,· ·· , x

,σ

) (10)

• verif – this algorithm is a deterministic algo-

rithm which takes as input an ordered list of at-

tribute authorities’ public keys {pk

}, a random

token m, a signature σ and a signing predicate

ψ corresponding to (A,ρ) and outputs accept if

σ is valid on m using the access policy (A,ρ) or

reject otherwise. Afterwards, the CSP com-

putes the vector

β = [β

= 1, β

,· ·· , β

], such

that {β

}

i∈[2,n]

are randomly chosen and computes

∑

j=1

i, j

. The cloud server accepts the

signature if the following equation holds.

ˆe(g

,σ

)

= pk

ˆe(g

,σ

)

∏

i=1

ˆe(h

ρ(i)

) (11)

The correctness of the signature algorithm is detailed

in the Section 6.4.

5.5.2 Data Retrieval

The data retrieval procedure consists of decdata al-

gorithm, deﬁned as follows:

• decdata – this algorithm takes as input the user

secret decryption key {sk

}, the public parame-

ters PP and the ciphertext E

and outputs the orig-

inal data ﬁle D

. If the requesting user has the re-

quired private keys {sk

} for a subset of rows A

of A such that [1,0,··· ,0] is in the span of these

rows, then the user proceeds as follows.

For each matrix row i, the user computes:

1,i

. ˆe(L,C

3,i

)

ˆe(LK

2,i

)

= ˆe(g

)

ˆe(g

)

(12)

∏

( ˆe(g

)

ˆe(g

)

= ˆe(g

)

(13)

Where c

∈ Z

are constants such that

∑

[1,0, ·· · , 0].

Then, the data ﬁle D

can then be obtained as fol-

lows:

= C

/ ˆe(g

)

(14)

The proof of correctness of the decryption algo-

rithm is detailed in the Section 6.4.

6 SECURITY DISCUSSION

In this section, we discuss the resistance of PAbAC

against two adversaries, based on two realistic threat

models, deﬁned hereafter in Section 6.1. We prove

the security of our proposed scheme with respect to

the security requirements introduced in Section 2.

6.1 Threat Model

For designing the most suitable security solutions for

cloud sharing scenarios, we consider two adversaries:

malicious cloud user and honest but curious cloud

server.

Honest but Curious Cloud Server Adversary – this

storage server honestly performs the operations de-

ﬁned by our proposed scheme, but it may actively at-

tempt to gain knowledge of the outsourced sensitive

data, such as access patterns.

Malicious User Adversary – this attacker can be an

unauthorized user. As such, he targets to get access to

the outsourced shared data. The objective of a mali-

cious user is to convince the cloud server that he is a

legitimate cloud user.

6.2 Conﬁdentiality

In our proposed PAbAC scheme, data ﬁles are stored

on an encrypted form in cloud servers relying on an

attribute based encryption scheme, in order to ensure

efﬁcient access control. As such, the data conﬁden-

tiality preservation is tightly related to security of the

used attribute based encryption scheme.

Theorem 1. PAbAC guarantees data conﬁdentiality

of the outsourced data.

Proof. The proposed PAbAC framework is designed

to ensure data conﬁdentiality against both malicious

users and curious cloud provider.

In PAbAC, the data owner is in charge of encrypting

his data before outsourcing them to the cloud stor-

age server. He is also responsible for deﬁning an

PAbAC: A Privacy Preserving Attribute based Framework for Fine Grained Access Control in Clouds

141

access structure that points out who can access the

outsourced data with respect to a set of attributes.

Then, the cloud provider is responsible for sending

data to requesting users after authenticating them, re-

lying on the access policy deﬁned by the data owner.

As such, only the authorized users having the access

structure’s satisfying attributes can generate the deci-

phering keys.

In addition, while considering a curious cloud ser-

vice provider who tries to gain knowledge about out-

sourced data ﬁle, this latter cannot access the out-

sourced data. As detailed in Section 5, our encryption

algorithm relies on the Lewko and Waters proposal.

That is, PAbAC inherits the security properties from

(Lewko and Waters, 2011). In addition, data conﬁ-

dentiality preservation against malicious users and a

curious cloud provider is ensured based on the secu-

rity of our proposed access control scheme detailed in

the Section 6.4 and the security level of the applied

encryption scheme (c.f. Lemma 1).

Lemma 1. Unauthorized users cannot decrypt the en-

crypted data.

Proof. The proof of this lemma is equivalent to the

security of the data decryption algorithm. The cor-

rectness of our decryption algorithm is as follows:

A user can decrypt data if and only if it has a match-

ing set of attributes. In fact, access structure ψ (and

hence matrix A) is constructed if and only if there ex-

ists a set of rows A

in A, and linear constants c

∈ Z

such that

∑

= [1, 0,· ·· , 0].

We note that

1,i

ˆe(L,C

3,i

)

ˆe(LK

2,i

)

(15)

ˆe(g

)

ˆe(g

) ˆe(g

)

ˆe(u

) ˆe(g

)

(16)

Thus

∏

( ˆe(g

)

ˆe(g

)

= ˆe(g

)

(17)

We note that Equation (17) holds because λ

·~v, w

τ, where ~v · [1,0, ·· · , 0] = s and

τ ·

[1,0, ·· · , 0] = 0. In the sequel, an authorized user can

obtain the data D

as follows:

= C

/ ˆe(g

)

(18)

For an unauthorized user who does not possess the

secret keys related to the set of attributes required for

satisfying the access policy, it is impossible to com-

pute

∑

= [1,0,··· ,0] (Lewko and Waters, 2011).

Thus, ˆe(g

)

cannot be calculated and the adver-

sary cannot recover the data ﬁle D

6.3 Privacy

Based on an attribute based signature scheme, PAbAC

ensures users’ privacy against curious cloud provider.

In our proposed scheme, the requesting data user has

to authenticate with the cloud provider. As such, (U)

has to sign a message received from the cloud service

provider with respect to the access structure deﬁned

by the data owner. The CSP is responsible for verify-

ing the user’s access rights without knowing neither

his identity nor the attributes used to sign the mes-

sage. But, beyond the ABS properties, our PAbAC

scheme ensures the protection of the users identities’

( non traceability property). In fact, the ABE scheme

used does not reveal the encryptor identity neither

the users’ attributes used in the backup phase. The

PAbAC inherits the non traceability property from the

Lewko encryption scheme (Lewko and Waters, 2011).

Theorem 2. PAbAC signature scheme is a privacy

preserving signature.

Proof. The PAbAC signature scheme does not reveal

neither the identity of the signer nor the set of at-

tributes used in the signing. Our signature scheme

requires that the identity of the signer remains anony-

mous. Thus, PAbAC ensures that a signature does not

reveal more information other than what can be al-

ready inferred from the signing predicate itself. The

demonstration of this state is derived from the follow-

ing lemmas.

Lemma 2. PAbAC protects user’s anonymity

Proof. In the authentication procedure, the user has

to sign a random message received from the CSP.

Based on the signature scheme introduced in PAbAC,

the user signs the message using his private keys

which have already been randomized. Thus, the gen-

erated signature does not reveal the attributes used

neither the user’s private keys. Based on the hard-

ness of the Computational Difﬁe Hellman problem

(CDH), the CSP can not deduce the user’s private

keys related to the used attributes from the signature

σ = (x

,· ·· , x

,σ

) received.

In addition, let us consider a curious cloud provider

adversary that chooses a message m, a signing policy

and two requesting users with two, possibly different,

sets of attributes with the condition that both sets have

to satisfy the signing policy. The adversary gets a sig-

nature by either signer and wins if it correctly guesses

the signer. The curious provider has a negligible ad-

vantage to win the previous game. That is, the PAbAC

signature scheme is based on the randomization of the

signer secret keys.

Lemma 3. PAbAC’s signature scheme is unlinkable

SECRYPT 2016 - International Conference on Security and Cryptography

142

Proof. Let us consider that a curious cloud provider

aims to deduce identifying information about a re-

questing user by running different authentication ses-

sions. In the PAbAC sign algorithm, the user ran-

domises the attributes’ secret keys received from the

attributes authorities as follows:

= Kh

(19)

= Lg

(20)

= K

∀i ∈ S

(21)

Then, in every authentication session, the user gen-

erates a new signature σ = (x

,· ·· , x

,σ

) thanks

to the selected random value t

. Moreover, the CSP

sends a random value m which consists of the cloud

provider identity concatenated with the current time

(i.e. m is assumed to be different for each authen-

tication session). As such, while authenticating the

same user based on different authentication sessions,

a curious cloud service provider cannot identify the

requesting user.

6.4 Access Control to Data

PAbAC introduces two-level access control model

that combines the authentication of the requesting

users and the attribute based decryption algorithm. In

the following, we demonstrate that our PAbAC access

control enforcement is resistant against both mali-

cious data users and a curious cloud service provider.

Theorem 3. Authorized users can successfully au-

thenticate and decrypt enciphered data ﬁles.

We recall that cloud users have to collect their cer-

tiﬁed attributes and the related secret keys from at-

tribute authorities AAs. As such, in PAbAC, only

users, having valid private keys related to their at-

tributes, are able to access data stored in the cloud

while successfully authentication with the cloud

server. This is due to the correctness of our encryp-

tion and signature algorithms and the compliance of

the unforgeability property of the PAbAC signature

scheme inherited from (Waters, 2005).

Lemma 4. Data Decryption Correctness.

Proof. After receiving his attributes’ secret keys

{sk

}, the authorized user ﬁrst computes:

1,i

ˆe(L,C

3,i

)

ˆe(LK

2,i

)

= ( ˆe(g

)

ˆe(g

)

(22)

Then, he computes the constants c

∈ Z

such that

∑

= [1,0,··· ,0]. Then, ˆe(g

)

could be ob-

tained as follows:

∏

( ˆe(g

)

ˆe(g

)

(23)

= ˆe(g

)

∑

ˆe(g

)

∑

= ˆe(g

)

(24)

Note that λ

·~v where ~v = [s, v

,· ·· , v

] and w

τ such as

τ = [0,τ

,· ·· , τ

]. Consequently, we note

that

∑

= s and

∑

= 0.

Afterwards, the user can recover the data ﬁle D

follows:

= C

/ ˆe(g

)

Lemma 5. Data signature correctness

Proof. When an authorized user wants to access out-

sourced data, he has to provide a correct signature,

with respect to the access policy deﬁned by the data

owner, that can be veriﬁed by the CSP in an anony-

mous way. If σ = (x

,· ·· , x

,σ

) is a valid signa-

ture of the message m for the predicate ψ, then

= zK

r (25)

= g

t+t

∏

i=1

(t+t

)

(26)

Thus

ˆe(g

,σ

) = ˆe(g

t+t

∏

i=1

(t+t

)

) (27)

= pk

ˆe(g

)

ˆe(g

t+t

)

∏

i=1

ˆe(g

(t+t

)

(28)

= pk

ˆe(g

,σ

)

∏

i=1

ˆe(x

) (29)

Note that µ

∑

j=1

i, j

, the last equality is obtained

by:

∑

i=1

t = t

∑

i=1

= t.1 = t (30)

Theorem 4. Unauthorized entities are unable to ac-

cess the outsourced data ﬁles

Lemma 6. PAbAC is secure against the collusion at-

tack.

Proof. We recall that the unforgeability property en-

sures that even if requesting users collude and com-

bine their attributes together, they cannot forge a sig-

nature that opens to a signer whose attributes do

not satisfy the access policy. It also covers non-

frameability and ensures that even if requesting users

collude, they cannot frame a user who did not produce

the signature. Similarly, malicious users cannot col-

lude to decipher an encrypted data ﬁle if the attributes

of each individual user do not satisfy the access pol-

icy, deﬁned by the data owner.

PAbAC: A Privacy Preserving Attribute based Framework for Fine Grained Access Control in Clouds

143

Table 2: Performances Comparison for Different Access Control Mechanisms in Cloud Data Storage Environments.

Scheme Data Owner Comp. CSP Comp. User comp.

(Zhao et al., 2011) E + (2n + 1)E

(3 + 2n) + (2nl + 1)E

(2 + 3n + 2nl)E

+ (2n +

1)τ

+ (n + 1)E

(Ruj et al., 2012) 3nE

+ (2n + 1)E + τ

(3 + 2n) + (2nl + 1)E

(2 + 3n + 2nl)E

+ 2nτ

(Ruj et al., 2011) 3nE

+ (2n + 1)E + τ

−− 2nτ

+ nE

(Ruj et al., 2014) 3nE

+ (2n + 1)E + τ

(3 + 2n) + (2nl + 1)E

(2 + 3n + 2nl)E

+ 2nτ

PAbAC (n + 1)E + 4nE

+ τ

(2 + n)τ

+ (n + 1)E

2(n + 1)E

+ 2nτ

+ nE

Let us consider two malicious users U

and U

hav-

ing each a set of attributes X

and X

such as X

∪ X

satisfy the access structure. Suppose that U

gets

= (K

) = (g

·h

) and U

gets

= (K

) = (g

· h

). The users

collude to create a valid set of attributes and derive a

secret key sk

1∪2

= sk

∪ sk

from the combination

of the two user’s keys. Then, the colluded malicious

users try to decrypt the data as follows:

1,i

ˆe(L,C

3,i

)

ˆe(LK

2,i

)

= (31)

ˆe(g

)

ˆe(g

) ˆe(g

)

ˆe(u

) ˆe(g

)

(32)

Afterwards, the equation (12) cannot be resolved as

detailed in (32). Thus, the malicious users can not

recover the original data.

Lemma 7. The CSP is unable to access the encrypted

data ﬁles

Proof. The CSP cannot decipher encrypted data be-

cause it does not possess the secret keys {sk

}, re-

quired for satisfying the access policy deﬁned by the

data owner. Even if the cloud provider colludes with

other unauthorized users, it cannot decrypt data, since

the PAbAC scheme is collusion resistant as detailed

in Section 6.4. Moreover, we suppose that the at-

tribute authorities AAs are not hosted by the CSP.

Thus, even if some attribute authorities are compro-

mised, the CSP cannot decipher data.

Lemma 8. PAbAC is resistant to replay attacks.

Proof. In our proposed PAbAC signature scheme, the

message m, sent by the CSP to the requesting user,

is assumed to be different in each authentication ses-

sion (i.e; m presents the cloud provider’s identity con-

catenated with the current time). In fact, for two

different authentication sessions α and β, the CSP

produces two different messages m

and m

respec-

tively. Consequently, a malicious user cannot gen-

erate a valid signature if he attempts a replay attack

based on collected data from two different authenti-

cation sessions.

7 PERFORMANCE ANALYSIS

In this section, we present the computation and stor-

age complexities of the PAbAC protocol at both the

client and cloud provider sides. For this purpose,

we are interested by the computations performed at

the data owner side in order to execute the STORE

procedure. Moreover, we will consider the compu-

tation cost related to the execution of the BACKUP

procedure by both the user (U) and the cloud service

provider (CSP).

In the following, we denote by:

• E

: exponentiation in G

• E : exponentiation in G

• τ

: computation of a pairing function ˆe

Table 2 details the performance comparison with

most closely related data sharing schemes in cloud

environments.

The STORE procedure consists of performing the

encryption algorithm encdata. During this proce-

dure, the data owner has to encrypt the data ﬁle.

As such, he calculates one pairing function ˆe(g

)

and nE exponentiations in G to compute each of C

1,i

where n is the number of attributes. In addition, the

data owner executes 4n exponentiations in G

to cal-

culate C

2,i

and C

3,i

The BACKUP procedure is made up three algorithms

verif executed by the CSP and sign and decdata

runned by the data user (U). The user ﬁrst signs a ran-

dom message in order to authenticate with the cloud.

To sign the message, the user performs 2(n+1) expo-

nentiations in G

. Then, this latter executes 2n pairing

to calculate ˆe(L),C

3,i

) and ˆe(K

·L,C

2,i

) to decrypt the

data ﬁle. In the veriﬁcation phase, the CSP executes

the verif algorithm. As such, the cloud provider

performs (n +2) pairing functions’ computations and

n + 1 exponentiations in G

SECRYPT 2016 - International Conference on Security and Cryptography

144

The existent access control schemes (Ruj et al., 2012),

(Ruj et al., 2011), (Ruj et al., 2014) are based on

the Lewko’s decentralized attribute based encryption

scheme (Lewko and Waters, 2011). During the en-

cryption phase, the data owner has to perform one

pairing function ˆe(g

) and 2n exponentiations in

to calculate each of C

1,i

. In addition, to calculate

2,i

and C

3,i

, the data owner performs 3n in G

. In the

data decryption phase, the data user performs n expo-

nentiations in G

and 2n pairing functions.

The zhao et al.’s proposal (Zhao et al., 2011) is

based on the use of the CP-ABE scheme proposed

by Bethencourt et al. (Bethencourt et al., 2007).

To encrypt the data ﬁle, the data owner performs

(2n + 1) exponentiations in G

and one exponentia-

tion in G

. The user while decrypting data performs

n + 1 exponentiations in G

and 2n + 1 pairing func-

tions. The proposals (Ruj et al., 2012),(Zhao et al.,

2011), (Ruj et al., 2014) are based on the use of the

attribute based signature scheme proposed by (Maji

et al., 2011). In order to sign the message, the user

performs 2 + 3n + 2nl exponentiations in G

, where

n is the number of rows of the access matrix A and l

presents the number of columns of A. In the veriﬁ-

cation phase, the CSP has to perform 3 + 2n pairing

function and 2nl + 1 exponentiations in G

8 CONCLUSIONS

The growing need for secure cloud sharing services

and the attractive properties of the Attribute based

Cryptography lead us to combine them, thus, deﬁning

an innovative solution to the data outsourcing security

and efﬁciency issues.

In this paper, we design a privacy preserving attribute

based framework for ﬁne grained access control, for

dynamic groups in untrusted cloud storage environ-

ments. Our approach ensures the conﬁdentiality of

outsourced data in public untrusted cloud servers and

deﬁnes efﬁcient data sharing in dynamic groups. That

is, ﬂexible access control policies are enforced among

users belonging to separate groups with different priv-

ileges. Our theoretical performances analysis shows

the efﬁciency of PAbAC in scalable data sharing,

while considering the impact of the cryptographic op-

erations at both the client and the cloud provider side.

ACKNOWLEDGEMENTS

This work is a part of the MOBIDOC project achieved

under the PASRI program, funded by the European

Union and administered by the ANPR.

REFERENCES

Health Insurance Portability and Accountability Act

(HIPAA). https://www.hipaa.com/about/.

Beimel, A. (1996). Secure schemes for secret sharing and

key distribution. PhD thesis, Technion-Israel Institute

of technology, Faculty of computer science.

Benaloh, J., Chase, M., Horvitz, E., and Lauter, K. (2009).

Patient controlled encryption: ensuring privacy of

electronic medical records. In The 2009 ACM work-

shop on Cloud computing security, pages 103–114.

ACM.

Bethencourt, J., Sahai, A., and Waters, B. (2007).

Ciphertext-policy attribute-based encryption. In IEEE

Symposium on Security and Privacy, 2007., pages

321–334.

Bobba, R., Fatemieh, O., Khan, F., Gunter, C., Khurana,

H., et al. (2006). Using attribute-based access con-

trol to enable attribute-based messaging. In The 22nd

Annual Computer Security Applications Conference,

pages 403–413. IEEE.

Chaum, D. and Van Heyst, E. (1991). Group signatures. In

Advances in CryptologyEUROCRYPT91, pages 257–

265. Springer.

Di Vimercati, S. D. C., Foresti, S., Jajodia, S., Paraboschi,

S., Pelosi, G., and Samarati, P. (2010a). Encryption-

based policy enforcement for cloud storage. In Dis-

tributed Computing Systems Workshops (ICDCSW),

2010 IEEE 30th International Conference on, pages

42–51. IEEE.

Di Vimercati, S. D. C., Foresti, S., Jajodia, S., Paraboschi,

S., and Samarati, P. (2007). Over-encryption: man-

agement of access control evolution on outsourced

data. In Proceedings of the 33rd international confer-

ence on Very large data bases, pages 123–134. VLDB

endowment.

Di Vimercati, S. D. C., Foresti, S., Livraga, G., and Sama-

rati, P. (2015). Selective and private access to out-

sourced data centers. In Handbook on Data Centers,

pages 997–1027. Springer.

Di Vimercati, S. D. C. D., Foresti, S., Jajodia, S., Para-

boschi, S., and Samarati, P. (2010b). Encryption poli-

cies for regulating access to outsourced data. ACM

Transactions on Database Systems (TODS), 35(2):12.

El Kaafarani, A., Chen, L., Ghadaﬁ, E., and Davenport,

J. (2014a). Attribute-based signatures with user-

controlled linkability. In Cryptology and Network Se-

curity, pages 256–269. Springer.

El Kaafarani, A., Ghadaﬁ, E., and Khader, D. (2014b).

Decentralized traceable attribute-based signatures. In

Topics in Cryptology–CT-RSA 2014, pages 327–348.

Springer.

Frikken, K. B., Li, J., and Atallah, M. J. (2006). Trust ne-

gotiation with hidden credentials, hidden policies, and

policy cycles. In NDSS. Citeseer.

Ghadaﬁ, E. (2015). Stronger security notions for decen-

tralized traceable attribute-based signatures and more

efﬁcient constructions. In Topics in Cryptology—CT-

RSA 2015, pages 391–409. Springer.

PAbAC: A Privacy Preserving Attribute based Framework for Fine Grained Access Control in Clouds

145

Goyal, V., Pandey, O., Sahai, A., and Waters, B. (2006).

Attribute-based encryption for ﬁne-grained access

control of encrypted data. In The 13th ACM con-

ference on Computer and communications security,

pages 89–98.

Horv

ath, M. (2015). Attribute-based encryption optimized

for cloud computing. In SOFSEM 2015: Theory

and Practice of Computer Science, pages 566–577.

Springer.

Horwitz, J. and Lynn, B. (2002). Toward hierarchical

identity-based encryption. In Advances in Cryptolo-

gyEUROCRYPT 2002, pages 466–481. Springer.

Hur, J. and Noh, D. K. (2011). Attribute-based access con-

trol with efﬁcient revocation in data outsourcing sys-

tems. IEEE Transactions on Parallel and Distributed

Systems, 22(7):1214–1221.

Jahid, S., Mittal, P., and Borisov, N. (2011). Easier:

Encryption-based access control in social networks

with efﬁcient revocation. In The 6th ACM Symposium

on Information, Computer and Communications Se-

curity, pages 411–415. ACM.

Kaaniche, N., Boudguiga, A., and Laurent, M. (2013). Id

based cryptography for cloud data storage. In 2013

IEEE Sixth International Conference on Cloud Com-

puting, pages 375–382. IEEE.

Kaaniche, N., Laurent, M., and El Barbori, M. (2014).

Cloudasec: A novel publickey based framework to

handle data sharing security in clouds. In 11th IEEE

International Conference on Security and Cryptogra-

phy(Secrypt).

Karchmer, M. and Wigderson, A. (1993). On span pro-

grams. In Structure in Complexity Theory Conference,

pages 102–111.

Lewko, A. and Waters, B. (2011). Decentralizing attribute-

based encryption. In Advances in Cryptology–

EUROCRYPT 2011, pages 568–588. Springer.

Maji, H. K., Prabhakaran, M., and Rosulek, M. (2011).

Attribute-based signatures. In Topics in Cryptology–

CT-RSA 2011, pages 376–392. Springer.

Okamoto, T. and Takashima, K. (2013). Decen-

tralized attribute-based signatures. In Public-Key

Cryptography–PKC 2013, pages 125–142. Springer.

Raykova, M., Zhao, H., and Bellovin, S. (2012). Privacy

enhanced access control for outsourced data sharing.

In Financial Cryptography and Data Security, volume

7397, pages 223–238.

Rivest, R. L., Shamir, A., and Tauman, Y. (2001). How to

leak a secret. In Advances in CryptologyASIACRYPT

2001, pages 552–565. Springer.

Ruj, S., Nayak, A., and Stojmenovic, I. (2011). Dacc: Dis-

tributed access control in clouds. In IEEE 10th Inter-

national Conference on Trust, Security and Privacy in

Computing and Communications (TrustCom), pages

91–98.

Ruj, S., Stojmenovic, M., and Nayak, A. (2012). Privacy

preserving access control with authentication for se-

curing data in clouds. In The 12th IEEE/ACM Inter-

national Symposium on Cluster, Cloud and Grid Com-

puting (CCGrid), 2012, pages 556–563. IEEE.

Ruj, S., Stojmenovic, M., and Nayak, A. (2014). Decentral-

ized access control with anonymous authentication of

data stored in clouds. IEEE Transactions on Parallel

and Distributed Systems, 25(2):384–394.

Sahai, A. and Waters, B. (2005). Fuzzy identity-based

encryption. In EUROCRYPT 2005, pages 457–473.

Springer.

Wan, Z., Liu, J. E., and Deng, R. H. (2012). Hasbe: a hierar-

chical attribute-based solution for ﬂexible and scalable

access control in cloud computing. IEEE Transactions

on Information Forensics and Security, 7(2):743–754.

Wang, G., Liu, Q., and Wu, J. (2010). Hierarchical attribute-

based encryption for ﬁne-grained access control in

cloud storage services. In The 17th ACM conference

on Computer and communications security, pages

735–737. ACM.

Wang, W., Li, Z., Owens, R., and Bhargava, B. (2009). Se-

cure and efﬁcient access to outsourced data. In The

2009 ACM workshop on Cloud computing security,

pages 55–66. ACM.

Waters, B. (2005). Efﬁcient identity-based encryption with-

out random oracles. In Advances in Cryptology–

EUROCRYPT 2005, pages 114–127. Springer.

Yu, S., Wang, C., Ren, K., and Lou, W. (2010a). Achieving

secure, scalable, and ﬁne-grained data access control

in cloud computing. In INFOCOM IEEE Proceedings

2010, pages 1–9.

Yu, S., Wang, C., Ren, K., and Lou, W. (2010b). Attribute

based data sharing with attribute revocation. In The

5th ACM Symposium on Information, Computer and

Communications Security, pages 261–270.

Zhao, F., Nishide, T., and Sakurai, K. (2011). Realizing

ﬁne-grained and ﬂexible access control to outsourced

data with attribute-based cryptosystems. In Informa-

tion Security Practice and Experience, pages 83–97.

Springer.

Zunnurhain, K. (2012). Fapa: a model to prevent ﬂooding

attacks in clouds. In The 50th Annual Southeast Re-

gional Conference, pages 395–396. ACM.

SECRYPT 2016 - International Conference on Security and Cryptography

146