Abstract:In recent years, to address the security defect that the explicit attribute values in access policies may reveal the privacy, a new variant of ciphertext-policy attribute-based encryption(CP-ABE)——hidden policy CP-ABE (HP-CP-ABE) is proposed in some recent works. But there are two tremendous flaws in most existing HP-CP-ABE schemes. The one issue is that an attacker can launch the attribute values guessing attacks (AVGA) to detect the attribute values in access policies of many HP-CP-ABE schemes. And another issue is that, if the HP-CP-ABE schemes are using the “Linear Secret Sharing Schemes (LSSS)” as their access structures, as the rows of the LSSS matrix grows, the time complexity of the decryption testing algorithm will boost rapidly which will greatly aggravate the computing burden of the user. So in this paper, we propose a partially HP-CP-ABE (PHP-CP-ABE) scheme which can perfectly withstand the attribute values guessing attacks (AVGA). As our access structure is using the LSSS, to alleviate the computing burden of the user, we design a online privacy-protective decryption testing algorithm for the users to privately and securely outsource the decryption testing phase to the cloud server. Our online testing algorithm is privacy-protective which means during running the privacy-protective decryption testing algorithm, the cloud server has no chance to know anything about the attribute values in the access policy and the attribute values of the user. This will prevent the privacy from leaking out to the third party cloud server. Then we rigorously prove that our scheme is selectively indistinguishable secure under chosen plaintext attacks (IND-CPA). Next, by reduction to the computational q-PBDHE assumption which is firstly proposed in our paper, we prove that our HP-CP-ABE scheme is indistinguishable secure under the attribute values guessing attacks (IND-AVGA). Finally through the comparison with the state-of-art HP-CP-ABE schemes from the perspective of functionality and efficiency, it is easily to observe that our scheme has high-security and high-efficiency. In appendix, we give a straightaway analysis to some relevant works to point out the security vulnerabilities in their schemes.

Privilege-Escalation Vulnerability Discovery for Large-scale RPC Services: Principle, Design, and Deployment

UPA: an Automated, Accurate and Efficient Differentially Private Big-Data Mining System

Detecting Privilege Escalation Attacks through Instrumenting Web Application Source Code.

Automated Enforcement of the Principle of Least Privilege over Data Source Access

AutoPaG: towards automated software patch generation with source code root cause identification and repair

Remote Procedure Call as a Managed System Service

White-box Fuzzing RPC-based APIs with EvoMaster: An Industrial Case Study

LPET -- Mining MS-Windows Software Privilege Escalation Vulnerabilities by Monitoring Interactive Behavior

Scaling Pseudonymous Authentication for Large Mobile Systems

RPC for Internet Applications

PrivAgent: Agentic-based Red-teaming for LLM Privacy Leakage

Stealthy Peers: Understanding Security Risks of WebRTC-Based Peer-Assisted Video Streaming

VPKIaaS: A Highly-Available and Dynamically-Scalable Vehicular Public-Key Infrastructure

The CURE To Vulnerabilities in RPKI Validation

Patient-centric medical service matching with fine-grained access control and dynamic user management

Arbiter: Bridging the Static and Dynamic Divide in Vulnerability Discovery on Binary Programs

pdRide: Privacy-Preserving Distributed Online Ride-Hailing Matching Scheme

Automated Progressive Red Teaming

A Query System for Efficiently Investigating Complex Attack Behaviors for Enterprise Security

Continuous Intrusion: Characterizing the Security of Continuous Integration Services.

A Partially Hidden Policy CP-ABE Scheme Against Attribute Values Guessing Attacks with Online Privacy-Protective Decryption Testing in IoT Assisted Cloud Computing.