# Selective Disclosure on Encrypted Documents

Hao Lei, Dengguo Feng

► To cite this version:

Hao Lei, Dengguo Feng. Selective Disclosure on Encrypted Documents. 23th Data and Applications Security (DBSec), Jul 2011, Richmond, VA, United States. pp.255-262, 10.1007/978-3-642-22348-8_21. hal-01586575

HAL Id: hal-01586575

https://inria.hal.science/hal-01586575

Submitted on 13 Sep 2017

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
Selective Disclosure on Encrypted Documents

Hao Lei*, Dengguo Feng

State Key Laboratory of Information Security (SKLOIS), China
leiyokster@gmail.com

**Abstract.** With tackling the dilemma between the privacy concern and information utilization in mind, an efficient pairing-based instantiation of a new primitive, which we call Selective Disclosure scheme, is proposed in this paper. Selective Disclosure scheme allows the document issuer to distribute and publish the outsourced document in a secure way such that it achieves fine-grained authorized reading by selective parts in a document to different visitors and only one copy is needed. It is proved secure against fully adaptive adversaries in the random oracle model. The Selective Disclosure technique will be of use by embedding or integrating it into various word processors, e-mail, .etc.

**Keywords:** Selective Disclosure, Privacy-Preserved Information Utilization, Plaintext Awareness Secure

# 1 Introduction

With respect to all content in an outsourced document, it is reasonable that the content is selective disclosure to different visitors for the sake of document owner's privacy. That is, every visitor only has access to the information specified by the document owner, who totally controls and puts on different restrictions for different visitors. So, for the same document, the content read by different visitors is different. For example, in the case of a Blog document, a document visitor may be Blog owner's soul-mate, real friend, good friend, or just a simple friend. In this case, although they are all permissible visitors, it is reasonable that what a simple friend can read is different from what a soul-mate can.

In general, assume there are *n* kinds of permissible visitors related to a document, that is, *n* is the number of selective disclosure views stemming from this document. Once attempting to achieve above selective disclosure goals, a common approach appears below using known techniques (1) According to the dedicated content to be presented, the document owner creates *n* different copies from the original document. (2) For every copy, document owner selects *n* different keys, generates *n* different encrypted copies, and outsources them to the storage server. (3) The document owner distributes the corresponding decryption key to every matched permissible visitor. (4) Every permissible visitor can decrypt the encrypted dedicated copy and obtain the selective disclosure view.

* This is the extended abstract, May 4, 2011.
This way has two significant drawbacks in terms of efficiency, functionality and security analysis: (1) It is very troublesome for the document owner to generate *n* different dedicated copies and *n* different encrypted copies. (2) These *n* encrypted dedicated copies would require more storage space because of the redundant content among them.

Besides the above two applications, we find the selective disclosure also plays an important role in the scenario of outsourced storage [9], peer-to-peer storage systems [6, 10], long-term archives[11], and web-service object stores [16], all of which share both information utilization and privacy concerns. In general, for the sake of data security and privacy, the outsourced document must be encrypted by the document owner before outsourcing to a third party storage provider.

## 1.1 Requirements, and Related Technologies

From above observations, the main security requirements of Selective Disclosure (SD for short) on outsourced documents can be phased as (1) It is the document owner that controls the content disclosed to different visitors, which means that the restrictions to every parts of the outsourced document are to be set by the document owner on his/her own, instead of a so-called trusted administrator, and SD guarantees the restrictions can be enforced correctly and strictly. This is termed as *document owner centric control property*. (2) Visitors with different permission can review different content, but they cannot read more content even if all of them collude against the document owner.

In the view of practical concerns such as functionality and performance, the following three requirements must also be taken into accounts (1) It admits any selective part (Paragraphs, Sections, Pages, etc.) contained in a document, and any subset of possible visitors, both of which are chosen ad hoc by the document owner. (2) It allows that every visitor can perform decryption independently without cooperation or any help from others. (3) Last but not the least, regardless of multiple views stemming from the original document, only one real copy of this document remains in storage and it incurs no additional storage costs.

Besides the above 5 requirements, a practical Selective Disclosure scheme must be provably secure without doubt.

The technologies that are closely related to Selective Disclosure are in three different areas, namely (1) *Traditional Access Control Approach*, (2) *Revocation and Broadcast Encryption* [3, 15, 14, 12, 5, 4, 7, 13], and *Attribute-Based Encryption* [1, 8]. The detailed introduction about related work as well as the difference between SD and them is listed in full version.

## 1.2 Key Idea, Challenges, and Our Contribution

The key idea to achieve the five requirements of SD at the same time is to aggregate all impermissible visitors for each part as a whole and use it to construct cipher text.

Our approach presents us with two challenges. First, we need to make sure that an impermissible visitor cannot do anything useful with his/her private key,
even they collude against the document owner. Second, simply combining the
ABE and revocation technologies is not sufficient, and we must ensure that not
only the public and private keys, but also the ciphertext are of size independent
of the number of permissible visitors.

With tackling the dilemma between the privacy concern and information
utilization in mind, we propose an efficient pairing-based instantiation of a new
primitive, which we call Selective Disclosure scheme. It allows the document
issuer to distribute and publish the outsourced document in a secured way such
that it achieves fine-grained authorized reading by selective parts in a document
to different visitors and only one copy is needed. We then proved it is secure
against fully adaptive adversaries in the random oracle model. To the best of
our knowledge, there is no previous solution to enable selective disclosure on a
document while incurs no additional storage consumption. The following Figure
1 presents a document with 3 parts which are selective disclosure to 8 different
subsets of permissible visitors.

<figure><img src="image_2.png" /><figcaption>Fig. 1. SD enables eight views stemming from a three-part-document.</figcaption></figure>

## 2 Syntax For SD Scheme

Before presenting our SD scheme we briefly review the definition as well as its
security formulation for an SD scheme. If $S$ is a set then $s \in_R S$ denotes the
operation of picking an element $s$ of $S$ uniformly at random. We write $A(x, y, \dots)$
to indicate that $A$ is an algorithm with inputs $x, y, \dots$ and by $z \stackrel{R}{\leftarrow} A(x, y, \dots)$ we
denote the operation of running probabilistic algorithm $A$ with inputs $x, y, \dots$
and letting $z$ be the output. $z \leftarrow A(x, y, \dots)$ indicates that $A$ is a deterministic
algorithm.
## 2.1 Syntax for SD Scheme

Regarding to a part $m$ contained in document, let $Q$ denote all visitors who are represented by his/her public key $pk_i$, and $\overline{Q}_R \subset Q$ be a subset of impermissible visitors to $m$. A SD scheme consists of the following four algorithms:

($Msk, Params$) $\stackrel{R}{\rightleftharpoons}$ Setup($1^k$). The setup algorithm, on input security parameter $1^k$, outputs a master secret key $Msk$ and public parameters $Params$.

($PK_i, SK_i$) $\stackrel{R}{\rightleftharpoons}$ KeyGen($Msk, Params, ID_i$). The key generation algorithm takes as input master secret key $Msk$, public parameters $Params$ and user's identifier $ID_i$, outputs the corresponding public key $PK_i$ and private key $SK_i$.

$C \stackrel{R}{\rightleftharpoons} Enc(\overline{Q}_R, Params, m, SK_s)$. The encryption algorithm takes as input a document's portion $m \in \{0, 1\}^{k_0}$ together with public parameters $Params$, the owner's private key $SK_s$, and $\overline{Q}_R \subset Q$ which are impermissible visitors to $m$, outputs $C$ which is the encryption of $m$ for permissible visitors $Q/\overline{Q}_R$. The encryption algorithm is run by the document owner.

$m/ \perp \leftarrow Dec(C, \overline{Q}_R, Params, SK_i, PK_i)$. The decryption algorithm takes as input the cipher text $C$ together with public parameters $Params$, the permissible visitor private key $SK_i$ and all the public keys of impermissible visitors $\overline{Q}_R$ to $m$, outputs correct plaintext $m \in \{0, 1\}^{k_0}$. Otherwise, it returns $\perp$. This algorithm is run by anyone of the permissible visitors independently.

## 2.2 The IND-SD-CPA Security Game and Plaintext Awareness

The security for a SD scheme $\Pi = (Setup, KeyGen, Enc, Dec)$ is formulated by the following IND-SD-CPA experiment between an attacker $A$ and a challenger $B$. Furthermore, we strengthen the standard definition of IND-CPA game by allowing the attacker $A$ to issue chosen private key extraction queries.

Experiment $ExP_{A,\Pi}^{IND-SD-CPA-b}(k)$
($Msk, Params$) $\stackrel{R}{\rightleftharpoons}$ Setup($g_1, g_2, e(\cdot, \cdot)$).
$\forall ID_i \in \{0, 1\}^*$, ($pk_i, sk_i$) $\stackrel{R}{\rightleftharpoons}$ KeyGen($Msk, Params, ID_i$).
$Q = \{pk_1, ..., pk_n\}$.
($m_0, m_1, ID_c$) $\leftarrow A^{O_H, O_{sk}}(Params, Q)$.
$pk_c \leftarrow$ KeyGen($Msk, Params, ID_c$).
$b \in_R \{0, 1\}; \overline{Q}_R = Q/\{(x_c, pk_c)\}; C^* \leftarrow Enc_{\overline{Q}_R}(m_b)$.
$b' \leftarrow A^{O_H, O_{sk}}(C^*, Params, Q)$.
return $b'$

**Definition 1(IND-SD-CPA Secure)**[2] A SD scheme $\Pi$ is secure against IND-CPA if for $k \in N$ and $b \in_R \{0, 1\}$, $Adv_{A,\Pi}^{IND-SD-CPA}(k) = |Pr[ExP_{A,\Pi}^{IND-SD-CPA-1}(k) = 1] - Pr[ExP_{A,\Pi}^{IND-SD-CPA-0}(k) = 1]|$ is negligible. The probability is over the random bits consumed by both the challenger $B$ and adversary $A$.

Plaintext Awareness(PA) was defined in [2] and it formalizes an adversary's inability to create ciphertext without knowing its corresponding plaintext $m$.
PA can be achieved through constructing a $\lambda(k)$-Knowledge Extractor $K$ on the basis of proved secure in the sense of IND-CPA, and PA implies SD is security against IND-CCA2 [2]. The following is a formal definition for PA and $\lambda(k)$-Knowledge Extractor.

Let $\Pi = (\text{Setup}, \text{KeyGen}, \text{Enc}, \text{Dec})$ be an encryption scheme, let $B$ be an adversary, and let $K$ be a knowledge extractor. For every $k \in N$ define:

$$ \begin{aligned} \text{Succ}_{\Pi, B, K}^{\text{PA}}(k) &\stackrel{\text{def}}{=} \Pr[H \leftarrow \text{Hash}; (pk, sk) \leftarrow K(k); \\ (hH, C, y) &\leftarrow \text{run}^{\text{B}^{\text{OH}}, \text{Enc}_{pk}^{\text{H}}}(pk) : \text{K}(hH, C, y, pk) = \text{D}_{sk}^{\text{H}}(y)] \geq \lambda(k) \end{aligned} $$

**Definition 2 (λ(k)-Knowledge Extractor [2])** We say that $K$ is a $\lambda(k)$-extractor if $K$ has running time polynomial in the length of its inputs and for every $B$, $\text{Succ}_{\Pi, B, K}^{\text{PA}} \geq \lambda(k)$ where $1 - \lambda(k)$ is negligible and $y \notin C$, where $C$ is the queried cipher text set.

**Definition 3 (Plaintext Awareness Secure [2])** We say that $\Pi$ is secure in the sense of PA if $\Pi$ is secure in the sense of IND-CPA and there exists a $\lambda(k)$-extractor $K$.

## 3 A CCA2 Secure SD Scheme and its Application

SD scheme is a pairing-based cryptology methodology based on the following general decisional q-BDHI assumption. Let $G_1, G_2$ and $G_T$ be cyclic groups with the same prime order $p(|p| = k)$, where $k = k_0 + k_1$ is the security parameter. The parameter $k_0$ determines the size of plaintext to be encrypted, i.e., $m \in \{0, 1\}^{k_0}$. There exists an efficient computationally bilinear map $e: G_1 \times G_2 \to G_T$ with bilinearity and non-degeneracy properties, and a computable isomorphism $\psi: G_2 \to G_1$.

General Decisional q-BDHI Assumption is defined as follows.

**Definition 4 (General Decisional q-BDHI Assumption)** Taking a $(q + 4)$-tuple $(x_c, g_1, g_2, g_2^\gamma, g_2^{\gamma^2}, \dots, g_2^{\gamma^q}, T) \in Z_p^* \times G_1 \times G_2^{q+1} \times G_T$ as input where $\gamma \in_R Z_p^*$, no P.P.T. adversary $A$ has non-negligible advantage $\varepsilon(k)$ in distinguishing whether $T$ is $e(g_1, g_2)^{1/(\gamma+x_c)}$ or a random in group $G_T$. That is, with respect to $|\Pr[A(x_c, g_1, g_2, g_2^\gamma, g_2^{\gamma^2}, \dots, g_2^{\gamma^q}, e(g_1, g_2)^{1/(\gamma+x_c)}) = 1]| - \Pr[A(x_c, g_1, g_2, g_2^\gamma, g_2^{\gamma^2}, \dots, g_2^{\gamma^q}, T) = 1]|$, the advantage $\varepsilon(k)$ for any P.P.T. adversary $A$ is negligible.

Let $g_1$ and $g_2$ be a generator of $G_1$ and $G_2$ respectively. Let $Q = \{pk_1, \dots, pk_{q-1}\}$ denotes all of the visitors (including document owner) in a SD scheme where $pk_i = (ID_i, x_i, B_i)$ and the $ID_i$ is the identifier of visitor $i$. The IND-SD-CCA2 scheme is proposed in the following Table 1.

It is easy to see that the decryption algorithm is consistent. Indeed, if $C$ is a valid cipher text, then we have

$$ \begin{aligned} D_2 &= e(C_1, F^{\bar{Q}_R \cup \{x_i\}}) \cdot e(A_i, C_2) \cdot D_1 \\ &= e(u^t, F^{\bar{Q}_R \cup \{x_i\}}) \cdot e(A_i, w^t \cdot (F^{\bar{Q}_R})^t) \cdot e(u^t, B_i)^{-x_i} \\ &= e(h^{\gamma t}, (F^{\bar{Q}_R})^{\frac{1}{\gamma+x_i}}) \cdot e(h^{\frac{x_i}{\gamma+x_i}}, (F^{\bar{Q}_R})^t) \cdot e(h^{\frac{x_i}{\gamma+x_i}}, g_2^{\gamma t}) \cdot e(h^{\gamma t}, g_2^{\frac{1}{\gamma+x_i}})^{-x_i} \\ &= e(h, F^{\bar{Q}_R})^t \in G_T. \end{aligned} $$
Then $\frac{e(A_s, v)^t \cdot e(h, F^{\tilde{Q}_R})^t}{e(h, F^{\tilde{Q}_R})^t} = e(A_s, v)^t$, hence $\hat{M} = C_4 \oplus H_2(\frac{C_3}{D_2}) = C_4 \oplus H_2(V) = \hat{m} || \hat{s}$.

<table><caption>**Table 1.** The IND-SD-CCA2 scheme</caption><tr><td><b>Setup</b>(1<sup>k</sup>)</td></tr><tr><td>g<sub>1</sub>, h &isin; G<sub>1</sub>, g<sub>2</sub>, v &isin; G<sub>2</sub>, &gamma; &isin; Z<sub>p</sub><sup>*</sup>, u = h<sup>&gamma;</sup> &isin; G<sub>1</sub>, w = g<sub>2</sub><sup>&gamma;</sup> &isin; G<sub>2</sub>,<br/>H: {0, 1}<sup>*</sup> &rarr; Z<sub>p</sub><sup>*</sup>, H<sub>1</sub>: {0, 1}<sup>k</sup> &rarr; Z<sub>p</sub><sup>*</sup>, H<sub>2</sub>: G<sub>T</sub> &rarr; {0, 1}<sup>k</sup>, Msk &larr; &gamma;,<br/>Params &larr; (g<sub>1</sub>, h, u = h<sup>&gamma;</sup>, g<sub>2</sub>, w = g<sub>2</sub><sup>&gamma;</sup>, v, e(&middot;, &middot;), H, H<sub>1</sub>, H<sub>2</sub>).<br/>Output(Msk, Params)</td></tr><tr><td><b>KeyGen</b>(Msk, Params, ID<sub>i</sub>)</td></tr><tr><td>H(ID<sub>i</sub>) = x<sub>i</sub>, SK<sub>i</sub> = A<sub>i</sub> = h<sup>x<sub>i</sub>/(&gamma;+x<sub>i</sub>)</sup> &isin; G<sub>1</sub>, B<sub>i</sub> = g<sub>2</sub><sup>1/(&gamma;+x<sub>i</sub>)</sup> &isin; G<sub>2</sub>, PK<sub>i</sub> = (ID<sub>i</sub>, x<sub>i</sub>, B<sub>i</sub>).<br/>Output(SK<sub>i</sub>, PK<sub>i</sub>)</td></tr><tr><td><b>Enc</b>(m, Params, SK<sub>s</sub>, Q&#773;<sub>R</sub>)</td></tr><tr><td>s &isin; R {0, 1}<sup>k<sub>1</sub></sup>, t = H<sub>1</sub>(m||s) &isin; Z<sub>p</sub><sup>*</sup>, V = e(A<sub>s</sub>, v)<sup>t</sup> &isin; R G<sub>T</sub>,<br/>F<sup>Q&#773;<sub>R</sub></sup> = g<sub>2</sub><sup>(&gamma;+x<sub>1</sub>)/(&gamma;+x<sub>2</sub>)&middot;&middot;&middot;&middot;&middot;&middot;(&gamma;+x<sub>d</sub>)</sup> &isin; G<sub>2</sub>,<br/>C &larr; {u<sup>t</sup>, w<sup>t</sup> &middot; (F<sup>Q&#773;<sub>R</sub></sup>)<sup>t</sup>, e(A<sub>s</sub>, v)<sup>t</sup> &middot; e(h, F<sup>Q&#773;<sub>R</sub></sup>)<sup>t</sup>, (m||s) &oplus; H<sub>2</sub>(e(A<sub>s</sub>, v)<sup>t</sup>)}.<br/>Output(C, Q&#773;<sub>R</sub>)</td></tr><tr><td><b>Dec</b>(C, Q&#773;<sub>R</sub>, Params, SK<sub>i</sub>, PK<sub>i</sub>)</td></tr><tr><td>Parse C as{C<sub>1</sub>, C<sub>2</sub>, C<sub>3</sub>, C<sub>4</sub>}.<br/>If PK<sub>i</sub> &notin; Q&#773;<sub>R</sub>: F<sup>Q&#773;<sub>R</sub></sup> &cup; {x<sub>i</sub>} = g<sub>2</sub><sup>(1/(&gamma;+x<sub>1</sub>))&middot;&middot;&middot;&middot;&middot;&middot;(1/(&gamma;+x<sub>2</sub>))&middot;&middot;&middot;&middot;&middot;&middot;(1/(&gamma;+x<sub>d</sub>))</sup> = (F<sup>Q&#773;<sub>R</sub></sup>)<sup>1/(&gamma;+x<sub>i</sub>)</sup>.<br/>D<sub>1</sub> = e(C<sub>1</sub>, B<sub>i</sub>)<sup>-x<sub>i</sub></sup> = e(A<sub>i</sub>, g<sub>2</sub><sup>&gamma;t</sup>)<sup>-1</sup> &isin; G<sub>T</sub>,<br/>D<sub>2</sub> = e(C<sub>1</sub>, F<sup>Q&#773;<sub>R</sub></sup> &cup; {x<sub>i</sub>}) &middot; e(A<sub>i</sub>, C<sub>2</sub>) &middot; D<sub>1</sub> = e(h, F<sup>Q&#773;<sub>R</sub></sup>)<sup>t</sup> &isin; G<sub>T</sub>,<br/>M = C<sub>4</sub> &oplus; H<sub>2</sub>(C<sub>3</sub>/D<sub>2</sub>) = C<sub>4</sub> &oplus; H<sub>2</sub>(e(A<sub>s</sub>, v)<sup>t</sup>), t = H<sub>1</sub>(M) &isin; Z<sub>p</sub><sup>*</sup>.<br/>If C<sub>1</sub> &ne; u<sup>t</sup>, C<sub>2</sub> &ne; w<sup>t</sup> &middot; (F<sup>Q&#773;<sub>R</sub></sup>)<sup>t</sup>, output &perp;.<br/>Output m = [M]<sub>k<sub>0</sub></sub>.</td></tr></table>

The algorithm for computing $F^{\tilde{Q}_R} = g_2^{\frac{1}{(\gamma+x_1)\cdot(\gamma+x_2)\cdots(\gamma+x_d)}} \in G_2$ can be found in [14], i.e., to aggregate all impermissible visitors $\tilde{Q}_R$ on $m$. In addition, for efficiency consideration as well as avoiding the direct application of private key $A_s$ in practical use, the component $e(A_s, v)$ of $C_3$ can be pre-computed and one time pairing can be saved.

To testify the potential practical use of SD scheme, we show that SD scheme enables us to add selective disclosure property to the Microsoft Word in a secure manner. Firstly, the document owner highlights the dedicated part that desires to put restrictions on, then s/he selects the impermissible visitors from a list of all the potential visitors, which is analogous to the one of selecting recipients from the mail list. Secondly, the dedicated part will be encrypted according to SD scheme. Thus, every visitor only has access to the information specified by the document owner, who totally restricts the information content and puts on different restriction for different visitors.
# 4 Security Proof for IND-SD-CCA2

Informally, the security of SD scheme is equivalent to the nonexistence of an adversary that is capable, within the confines of a certain game, of decrypting the cipher text on the condition that she/he is impermissible visitor.

By the definition 4.1 in [2], the security in the sense of IND-CPA and the existence of a knowledge extractor imply the security in the sense of Plaintext Awareness, which implies security against the adaptive chosen-ciphertext attack (IND-CCA2) in virtue of the Theorem 4.2 in [2]. The detailed proof related to Theorem 1, Lemma 1 and Theorem 2 have been omitted because of space limit, and they are provided in the full version.

Firstly, the above SD scheme is IND-CPA secure according to Theorem 1.

**Theorem 1** Let $A$ be an adversary that has non-negligible advantage $\varepsilon(k)$ against the SD scheme in the sense of IND-SD-CPA. If the hash functions $H(\cdot)$, $H_1(\cdot)$ and $H_2(\cdot)$ are modeled as random oracles, and we let $q > 0$, $q_1 > 0$, $q_2 > 0$ and $q_{sk} > 0$ be the number of queries that $A$ makes to $H(\cdot)$, $H_1(\cdot)$, $H_2(\cdot)$ and key generation oracle respectively. Then there is an algorithm $B$ to solve the general decision $q$-BDHI problem in groups of order $p$ with non-negligible advantage $\varepsilon(k)/2$.

Before conducting a knowledge extractor $K$, the following Lemma 1 elaborates $f_{u,v,w,h,\bar{Q}_R}(A_s, t)$ is injective. The partially trapdoor one-way function implied in the encryption function Encryption($m, \mathit{Params}, SK_s, \bar{Q}_R$) is defined as $f_{u,v,w,h,\bar{Q}_R}(A_s, t) \mapsto \{u^t, w^t \cdot (F^{Q_R})^t, e(A_s, v)^t \cdot e(h, F^{Q_R})^t\}$.

**Lemma 1** The function $f_{u,v,w,h,\bar{Q}_R}(A_s, t)$ is injective.

Now we turn to construct a knowledge extractor $K$ in Theorem 2.

**Theorem 2** Let $B$ be an adversary for $\mathcal{PA}$. Then there is a knowledge $\lambda(k)$-extractor $K$ and hence the SD scheme is secure in the sense of $\mathcal{PA}$, thus it is IND-CCA2.

# 5 Conclusion

In this paper, we proposed a secure Selective Disclosure Scheme that enables not only its content is selective disclosure to different document visitors, but also the dedicated information to every visitor is strict under the control of the document owner, while just requiring one real copy in storage and no additional storage consumption incurred.

Our work motivates two interesting open problems. The first is to find an efficient Selective Disclosure scheme in the case of a large number of impressible visitors. The second is to explore a Dynamic Selective Disclosure scheme, which comprises of the two requirements: (1) It allows new visitor added into existing permissible visitor set. Recall the proposed SD scheme only admits static visitor set, i.e., the impermissible visitor set must be determined prior to encryption. Otherwise, the new added member is able to read all the parts because he is not in any impressible visitor set. (2) It suits well to revoke permissible visitor, and/or make an impermissible visitor to be a permissible one, without constructing the cipher text from scratch.
Acknowledgments.

Part of the work was done while the author was at High Privacy and Security
group, NEC Labs., China. We are grateful to Ph.D Ke Zeng, and Ph.D Wenbin
Chen for helpful discussions, and the anonymous reviewers for their comments.

References

1. N.Attrapadung, H.Imai.: Conjunctive Broadcast and Attribute-Based Encryption. In: H. Shacham and B. Waters. (eds.) Pairing-based Cryptography 2009. LNCS, vol. 5671, pp. 248 - 265. Springer-Verlag (2009)

2. M.Bellare, A.Desai, D Pointcheval, P.Rogaway.: Relations among Notions of Secu- rity for Public-key Encryption Schemes. In: H. Krawczyk.(eds.) Advances in Cryp- tology, Proc. of Crypto'98, LNCS, vol.1462, pp. 26-45. Springer-Verlag (1998)

3. A.Fiat, M.Naor.: Broadcast Encryption. In:D.R.Stinson.(eds.) Advances in Cryptology,Proc.of Crypto'93. LNCS, Vol.773, pp.480-491. Springer-Verlag (1994)

4. M. T. Goodrich, J. Z. Sun, and R. Tamassia.: Efficient tree-based revocation in groups of low-state devices. In: M. Franklin (eds.) Advances in Cryptology, Proc. of CRYPTO '04. LNCS, Vol.2204, pp.511-527. Springer-Verlag (2004)

5. D.Halevy and A.Shamir.: The LSD Broadcast Encryption Scheme, In: M.Yung. (eds.) Advances in Cryptology,Proc. of CRYPTO '02. LNCS, Vol.2442, pp.41-62. Springer-Verlag (2002)

6. J. Kubiatowicz, D. Bindel, Y. Chen, et al.: Oceanstore: An architecture for global-scale persistent

7. K.Kurosawa and Y.Desmedt.: Optimum traitor tracing and asymmetric schemes.In: K.Nyberg,(eds.) Advances in Cryptology,Proc. of Eurocrypt'98. LNCS, Vol.1403, pp.145-157. Springer-Verlag (1998)

8. J.Li, K.Ren, K.Kim.: A²BE: Accountable Attribute-based Encryption for Abuse Free Access Control. Cryptology ePrint Archive, Report 2009/118.(2009)

9. J.S.Millstein, M.King and Morrison & Foerster LLP.: Cloud Computing and Outsourcing: Is Data Lost in the Fog? http://www.tawpi.org/uploadDocs/CloudComputingandOutsourcing.pdf (2009)

10. A.A.Muthitacharoen, R.Morris, T.M.Gil, and B.Chen.: Ivy: A read/write peer-to-peer file system. In: Proceedings of OSDI'02. pp.31-44.(2002)

11. P.Maniatis, M.Roussopoulos, T.Giuli, D.Rosenthal, M.Baker, and Y.Muliadi.The LOCKSS peer-to-peer digital preservation system. ACM Trans. on Computing Systems,23(1),2-50 (2005)

12. D.Naor, M.Naor, and J.Lotspiech,: Revocation and Tracing Schemes for Stateless Receivers.In: J. Kilian.(eds.) Advances in Cryptology,Proc. of Crypto'01.LNCS, Vol.2139, pp.41-62. Springer-Verlag (2001)

13. M.Naor and B.Pinkas.: Efficient trace and revoke schemes. In:Y.Frankel.(eds.)Proc.of Financial cryptography'00. LNCS,Vol.1962,pp.1-20. Springer-Verlag(2000)

14. C.Delerablée, P.Paillier and D Pointcheval. Fully Collusion Secure Dynamic Broadcast Encryption with Constant-Ciphertexts. In: T. Takagi et al.(eds.) Pairing 07, LNCS,Vol.4575,pp.39C59. Springer-Verlag (2007)

15. A.Sahai, B.Waters.: Revocation Systems with Very Small Private Keys. Cryptology ePrint Archive, Report 2008/309.(2008)

16. A.Y.Yumerefendi,J.Chase.: Strong accountability for network storage. In: Proc. of FAST'07. Trans. Storage, 3(3).(2007)