Abstract:Cloud computing has become the priority for users to store and share data due to its numerous tempting advantages. The "encryption-before-outsourcing" mechanism is necessary to protect data privacy against the semi-trusted cloud server. Key-Aggregate Cryptosystem (KAC) is a novel encryption paradigm for cloud data sharing. It enables users to decrypt multiple data encrypted with different keys using a constant size aggregate key. When selectively sharing data, the KAC effectively addresses the challenges of expensive key management in symmetric encryption (SE) and eliminates the need for multiple copies of ciphertexts in public key encryption (PKE). However, previous KAC schemes can only control what data users are allowed to receive by distributing aggregate keys, but not what data users can send. This limitation could potentially allow a malicious data owner to leak sensitive information by distributing aggregate keys to unauthorized users. Therefore, this paper aims to design the key-aggregate cryptosystem with bidirectional access control, which can control both what the user can receive and what the data owner can send. Inspired by access control encryption (ACE), we first propose a key-aggregate based access control encryption with user level (KA-ACE-UL) system that can control whether a sender can share his data with a receiver. Then, we investigate a finer-grained access control policy and propose a key-aggregate based access control encryption with user-data level (KA-ACE-UDL) system that can control the data classes a sender can share with a receiver. We instantiate the KA-ACE-UL and KA-ACE-UDL schemes based on Chu et al.'s KAC scheme. We prove our proposed schemes can achieve both secure data storage and controlled data sharing, ensuring security against unauthorized receivers and malicious senders. Finally, theoretical performance analysis and practical experiments show the efficiency of our proposed schemes.

DACPCC:A Data Access Control Scheme with Access Permission for Cloud Computing

DAC-MACS: Effective Data Access Control for Multi-Authority Cloud Storage Systems

Combining Data Owner-Side and Cloud-Side Access Control for Encrypted Cloud Storage.

Cloud+: A safe and restrained data access control program for cloud

FEACS: A Flexible and Efficient Access Control Scheme for Cloud Computing

Achieving Secure, Scalable, and Fine-grained Data Access Control in Cloud Computing

EACS: an Efficient Access Control Scheme for Electronic Publishing in Cloud Computing

Key-aggregate based access control encryption for flexible cloud data sharing

An Attribute-Based Controlled Collaborative Access Control Scheme for Public Cloud Storage.

Hierarchical Attribute-Based Access Control with Authentication for Outsourced Data in Cloud Computing

Attribute-based Encryption for Cloud Computing Access Control

A Secure Data-Sharing Scheme for Privacy-Preserving Supporting Node–Edge–Cloud Collaborative Computation

Efficient CP-ABE Scheme With Shared Decryption in Cloud Storage

Key-customizable Encrypted Deduplication with Access Control for Cloud Storage

RAAC: Robust and Auditable Access Control with Multiple Attribute Authorities for Public Cloud Storage

TAFC: Time and Attribute Factors Combined Access Control on Time-Sensitive Data in Public Cloud

Efficient lattice-based revocable attribute-based encryption against decryption key exposure for cloud file sharing

A Blockchain and CP-ABE Based Access Control Scheme with Fine-Grained Revocation of Attributes in Cloud Health

DOAS: Efficient data owner authorized search over encrypted cloud data

Efficient and Secure Access Control Scheme in the Standard Model for Vehicular Cloud Computing

Attribute Based Encryption with Privacy Protection and Accountability for CloudIoT