CP-ABE (Ciphertext-Policy Attribute-Based Encryption) with hidden access control policy enables data owners to share their encrypted data using cloud storage with authorized users while keeping the access control policies blinded. However, a mechanism to prevent users from achieving successive access to a data owner’s certain number of data objects, which present a conflict of interest or whose combination thereof is sensitive, has yet to be studied. In this paper, we analyze the underlying relations among these particular data objects, introduce the concept of the sensitive data set constraint, and propose a CP-ABE access control scheme with hidden attributes for the sensitive data set constraint. This scheme incorporates extensible, partially hidden constraint policy. In our scheme, due to the separation of duty principle, the duties of enforcing the access control policy and the constraint policy are divided into two independent entities to enhance security. The hidden constraint policy provides flexibility in that the data owner can partially change the sensitive data set constraint structure after the system has been set up.

Ciphertext‐policy attribute‐based encryption (CP‐ABE) is a cryptographic scheme suitable for secure data sharing on cloud storage. The CP‐ABE based on lattice theory has the property of resisting quantum attack. Some data objects uploaded to the cloud by the same data owner may cause conflicts of interest, or their combination may expose sensitive information. This paper proposes a revocable CP‐ABE scheme on the lattice, based on ring learning with error (R‐LWE) problem, to enforce access control constraints on user access to such data objects. In this scheme, first, the access policies of such data objects are amended by adding dummy attributes. Second, we control the secret key components associated with the dummy attributes or revoke the dummy attributes to prevent users from continuously accessing specific parts or all data objects from this kind of data set. Finally, we carry on the efficiency and security analysis of the scheme. The analysis results show that the scheme is efficient and safe.

In ciphertext-policy attribute-based encryption, there might be different levels of overlapping in the access policies of different data objects outsourced by the same data owner. This paper proposes a soft set decision-making method and cluster percolation method-based policy clustering by using policy similarity for CP-ABE, aiming to merge the duplicated access policy pieces to reduce repeated computations during the encryption process of corresponding data objects. Firstly, the access policies are clustered using either the soft set decision-making or the cluster percolation method. Secondly, the access policies within the same cluster are integrated for further encryption of corresponding data objects as a whole, thereby preventing redundant computations during the encryption process and thus reducing computational overhead. Theoretical analysis and experimental results demonstrate the feasibility and effectiveness of the proposed approach in this paper.

KSII Transactions on Internet and Information Systems TIIS Paper Details

Ciphertext-policy attribute-based encryption (CP-ABE) is a cryptographic scheme that is suitable for cloud storage and can realize secure data sharing. However, in most existing CP-ABE schemes, the encryption computational overhead is proportional to the number of attributes in the access policy. Therefore, reducing the computational overhead of the scheme’s encryption is an important consideration to improve its efficiency. Furthermore, in the scenario where the access control policies corresponding to different data shared by the same data owner have multiple shared subpolicies, there is still further optimizing space for encryption. This study proposes an optimization approach for CP-ABE via the flexible integration of access policies with multiple shared subpolicies. Regarding the root nodes of policies being both the same and different, we provide optimal policy integration methods to reduce the overall encryption computation cost of the data associated with these access policies. Under the premise of preserving the original security of the CP-ABE scheme, this scheme avoids repeated calculation related to the shared subpolicies during encryption, thus improving the scheme’s efficiency. Finally, the correctness and feasibility of the scheme are examined and verified by theoretical analysis and experiments.

Ciphertext-Policy Attribute-Based Searchable Encryption (CP-ABSE) is essential for fine-grained search authorization in multi-user data sharing, with notable practical application value. However, existing CP-ABSE schemes have prominent performance problems. Their encryption and search overhead rise linearly as the number of attributes increases, leading to obvious search latency. Furthermore, it is still difficult to balance the strong expressiveness of Linear Secret Sharing Scheme (LSSS) access structures with system scalability. This issue limits the large-scale practical deployment of those schemes. To solve these problems, this paper designs an efficient CP-ABSE scheme that retains LSSS-based fine-grained access control capability. This scheme simultaneously takes into account both attribute scale growth and performance degradation, and the computational efficiency gets better while ensuring access control expressiveness. The security proof shows that it can resist Chosen Keyword Attacks (CKA). Experimental results show that compared with existing schemes, our scheme reduces the cost of key generation by 40%–50%, encryption by 25%–40%, trapdoor generation by 50%–60%, and search operation by 30%–45%. In addition, its performance overhead grows more slowly with the increase of attributes, and the search latency remains stable. These advantages confirm its good scalability and high practicability in large-scale user data sharing scenarios.