Abstract:As an advanced one-to-many public key encryption system, attribute-based encryption (ABE) is widely believed to be a promising technology for achieving flexible and fine-grained access control of encrypted data on untrusted storage servers (e.g., public cloud servers). However, user revocation in ABE is a critical but challenging problem, and designing efficient revocable ABE has been an active research topic in the past decade. Almost all the existing revocable ABE schemes incorporate a timestamp in the encryption algorithm such that revoked users cannot decrypt ciphertexts generated in future time intervals. To prevent revoked users from decrypting past ciphertexts, the storage server needs to perform a process called ciphertext delegation (Sahai et al., CRYPTO’12) that periodically updates the timestamp for all ciphertexts. As the number of ciphertexts could be huge in a storage system, ciphertext delegation could pose a huge computation overhead to the server.Motivated by the popularity of commodity Trusted Execution Environment (TEE) technologies, this paper initiates the study on hardware-based revocable ABE (HR-ABE) to eliminate the (unscalable) ciphertext delegation and prevent collusion attacks between an untrusted storage server and revoked users. We formalize this new notion and present an efficient HR-ABE construction that also supports outsourced decryption for resource-constrained data users. Furthermore, HR-ABE is also designed to address the potential secret leakage problem suffered by TEE (e.g., due to side-channel attacks) so that the leakage of secrets possessed by TEE does not lead to leakage of user data. We prove HR-ABE’s security formally and benchmark its performance experimentally.

Attribute Based Encryption with Efficient Revocation from Lattices

Revocable attribute-based encryption from standard lattices

Revocable-Attribute-Based Encryption with En-DKER from Lattices

Revocable, dynamic and decentralized data access control in cloud storage

Attribute-Based Data Sharing with Flexible and Direct Revocation in Cloud Computing.

Efficient lattice-based revocable attribute-based encryption against decryption key exposure for cloud file sharing

Make Revocation Cheaper: Hardware-Based Revocable Attribute-Based Encryption

How to use attribute-based encryption to implement role-based access control in the cloud.

FDR-ABE: Attribute-Based Encryption with Flexible and Direct Revocation.

New ciphertext-policy attribute-based access control with efficient revocation

An Efficient and Revocable Storage CP-ABE Scheme in the Cloud Computing

Lattice‐Based CP‐ABE Access Control for SDS Constraint with Lazy Assignment of Attributes and Attribute Revocation

An attribute based encryption scheme with fine-grained attribute revocation

A Traceable Outsourcing CP-ABE Scheme with Attribute Revocation

A Boolean circuit-based revocable ciphertext policy attribute-based encryption scheme

Practical Attribute-Based Encryption: Outsourcing Decryption, Attribute Revocation and Policy Updating

An Efficient Ciphertext-Policy Attribute-Based Access Control Towards Revocation in Cloud Computing

Attribute-Based Encryption with Efficient Keyword Search and User Revocation.

Revocable Attribute-Based Encryption Scheme with Cryptographic Reverse Firewalls.

A Revocable Outsourcing Attribute-Based Encryption Scheme.

Multi-Authority Attribute Based Encryption Scheme with Revocation.