Re‐definable access control over outsourced data in cloud storage systems

IET Information SecurityVolume 13, Issue 3 p. 258-268 Research ArticleFree Access Re-definable access control over outsourced data in cloud storage systems Zhigang Zhang, Corresponding Author Zhigang Zhang 15838150770@126.com Zhengzhou Information Science and Technology Institute, Henan, Zhengzhou, 450000 People's Republic of China Electric Science Institute of State Grid He'nan Electric Power Company, Zhengzhou, 450000 People's Republic of ChinaSearch for more papers by this authorChaowen Chang, Chaowen Chang Zhengzhou Information Science and Technology Institute, Henan, Zhengzhou, 450000 People's Republic of ChinaSearch for more papers by this authorZhimin Guo, Zhimin Guo Electric Science Institute of State Grid He'nan Electric Power Company, Zhengzhou, 450000 People's Republic of ChinaSearch for more papers by this authorPeisheng Han, Peisheng Han Zhengzhou Information Science and Technology Institute, Henan, Zhengzhou, 450000 People's Republic of ChinaSearch for more papers by this author Zhigang Zhang, Corresponding Author Zhigang Zhang 15838150770@126.com Zhengzhou Information Science and Technology Institute, Henan, Zhengzhou, 450000 People's Republic of China Electric Science Institute of State Grid He'nan Electric Power Company, Zhengzhou, 450000 People's Republic of ChinaSearch for more papers by this authorChaowen Chang, Chaowen Chang Zhengzhou Information Science and Technology Institute, Henan, Zhengzhou, 450000 People's Republic of ChinaSearch for more papers by this authorZhimin Guo, Zhimin Guo Electric Science Institute of State Grid He'nan Electric Power Company, Zhengzhou, 450000 People's Republic of ChinaSearch for more papers by this authorPeisheng Han, Peisheng Han Zhengzhou Information Science and Technology Institute, Henan, Zhengzhou, 450000 People's Republic of ChinaSearch for more papers by this author First published: 01 May 2019 https://doi.org/10.1049/iet-ifs.2018.5365AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinkedInRedditWechat Abstract There is an increasing concern for data privacy when people outsource their data to remote cloud storage servers. To secure outsourced data, cloud users are suggested to employ cryptographic encryption to specify access policies such that only users meeting the policies can access the data. After the application of an encryption, however, users are difficult to modify their access policies since the policies were already formulated by the encryption. To address such problem, the authors propose a new approach referred to as re-definable access control (RDAC). The RDAC utilises identity-based encryption (IBE) and attribute-based encryption (ABE) to secure outsourced data and allows users to choose either to achieve access control according to their capability and requirements. Moreover, the RDAC allows users to change simple access policies into fine-grained access policies by converting IBE encrypted files into ABE encrypted ones, without leaking the underlying data. Surprisingly, the access policy conversion does not require the users to perform any costly computation, nor the storage servers to be disturbed. The authors prove the security of RDAC under a rigorous definition, and empirically show that the introduction of the conversion incurs almost no costs to the outsourcing and access procedures. 1 Introduction Cloud computing has become a promising paradigm for individuals and organisations to save costs, improve efficiency and achieve flexibility. It provides scalable, ubiquitous and on-demand services, which frees people from the burden of local data management. Cloud storage has many outstanding advantages, such as considerable storage, flexible accessibility and convenient data retrieval. In cloud storage systems [1, 2], users can outsource their database to a remote storage server so that themselves and other authorised users can retrieve the data when necessary. Outsourcing and retrieving data remotely delivers great conveniences to users and meanwhile, brings security concerns. The fact that users lose physical control of their data rises up at least two serious problems: how to protect the privacy and security of their data, and how cloud storage users can securely share their data with intended receivers. For the first question, a typical countermeasure is cryptographic encryption, such that all outsourced data are encrypted and unreadable to cloud servers. Compared to conventional public key infrastructure (PKI)-based encryption schemes [3], identity-based encryption (IBE) [4] provides more efficient generation of public keys and has been adopted in many conditional storage applications, such as body sensor network [5], enterprise data storage system [6] and internet of things [7]. Despite of its various potential applications, IBE has a major insufficiency that it requires an explicit identity of the recipient for each encryption, while a user in encryption might do not know who will request his data. Attribute-based encryption (ABE) [8] extends the IBE by providing a fine-grained access control mechanism by which users only need to specify access policies (not specific identities) on their data such that only the users meeting the policies can decrypt and read. This advantageous feature renders ABE extensively employed in many cloud-based environments [9-11]. The IBE and ABE, as two powerful cryptographic tools, provide proper encryption approaches to protect the privacy and security of cloud data. However, there is still a problem that how cloud data protected by one encryption system (e.g. IBE) can be shared with users belonging to another encryption system (e.g. ABE). This is inspired by the fact that in complicated cloud storage systems (e.g. hybrid clouds [12]), there may be not only one encryption system adopted to secure outsourced data; contrary, different organisations and individuals could employ appropriate encryption systems according to their demands. To be more clear, we consider the following scenario. Motivating scenario: Company A and Company B allow its employees to outsource data to a cloud service provider. For data security purpose, Company A chooses a cryptographic system to secure outsourced data. The IBE would be an appropriate choice for Company A if it does not have a large number of employees and would like efficient and simple access control on outsourced data. On contrary, Company B has a certain number of employees and prefers to the ABE encryption system to realise more flexible access control. Company A signs contracts with Company B to share its outsourced data. Unfortunately, Company A's outsourced data are encrypted by IBE system and therefore are unable to be decrypted by users in a different cryptographic system, i.e. ABE. A trivial solution may be asking Company A to first decrypt its IBE encrypted files and then encrypt to Company B via ABE, which, however, would introduce great inconvenience and heavy computation tasks for the company. A feasible solution may be a re-definable access control (RDAC) mechanism for Company A. In RDAC mechanism, Company A does not need to run decryption and then encryption; alternatively, it performs the RDAC procedure to directly convert the IBE encrypted files into ABE encrypted ones by specifying a re-defined access policy so that Company B's employees meeting the policy can read data. For instance, Company A can formulate a re-defined access policy 'Company B AND (Engineer OR Manager)' and run RDAC procedure such that only the engineers or the managers of Company B can access. In this way, a simple access policy which points out a specific receiver has been transformed ('re-defined') into a fine-grained access policy that describes attributes of a group of receivers. A fundamental security of RDAC is that only the data owner (Company A) and authorised users can access the data in plaintext. We note that there exists some schemes achieving the similar RDAC functionality, while most of them only support ciphertext conversion in the same encryption system [13], or do not provide fine-grained access control [14, 15], which renders them inappropriate for the cloud storages. 2 Our contributions In this paper, we propose a new approach referred to as RDAC scheme to enable one to convert a file encrypted by an IBE access policy into a file encrypted by an ABE access policy without exposing or altering the underlying plaintext. In a RDAC system, users who seek for low computation burden and fast encryption can use IBE to encrypt their data, while those who want more flexible access control on data can apply ABE. Between these two separate cryptosystems, the RDAC provides the IBE users with a unique and important mechanism that allows them to directly convert their IBE ciphertexts into ABE ciphertext without performing ABE encryption. During the conversion, the underlying plaintext will not be exposed to any unauthorised users. Besides, the cloud storage servers are not required to take any costs in the re-definition. Specifically, our contributions are described as follows. We present a framework of RDAC and give a rigorous security definition. Intuitively, there are encrypted files with IBE and ABE access control policies, respectively, in RDAC. When a user wants to convert his IBE encrypted file into an ABE encrypted file, the user just invokes an auxiliary computation server (ACS) to help to compute a re-definition key (RK). A proxy server then applies the RK to transform the IBE-encrypted file associated with the IBE access policy into an ABE encrypted file associated with the ABE access policy. In this access policy re-definition, the user takes almost no efforts, and neither the ACS nor the proxy knows the underlying data. To ensure data privacy, we also define a formal security against practical attacks in outsourced database storage systems. We construct a RDAC scheme and prove its security under the provided definition. The most challenging problem in the construction is the form of the ciphertexts generated by different IBE and ABE access policies. We overcome this issue by finding two compatible IBE and ABE schemes sharing some parameters and providing a ciphertext conversion that barely needs users' participation. We then prove the security of RDAC scheme by assuming the security of the IBE and the ABE without random oracle. To evaluate the performance of RDAC, we conduct thorough theoretical and experimental analyses. The results show that the normal encryption procedures of IBE and ABE have not been affected by the introduction of re-definition; accordingly, the normal decryption procedures of IBE and ABE are not affected either. Notably, the access policy re-definition takes the invoking user little time and does not disturb the storage servers since most computations are given to the ACS and the proxy. These features make RDAC a practical solution to re-define the access policy of outsourced data in cloud storage. The rest of the paper is organised as follows. Section 3 reviews some related works. Section 4 presents the framework of RDAC and Section 5 gives some background knowledge about the construction. Section 6 proposes the concrete RDAC scheme. Section 7 proves the security of RDAC under a rigorous definition. Section 8 analyses the SEC scheme both theoretically and experimentally and Section 9 concludes the paper. 3 Related work Protecting data privacy in outsourced database storage systems is a hot topic and has been extensively researched. Cryptographic encryption (classified into symmetric and asymmetric encryption) is a typical measure to achieve data privacy protection [16, 17]. The symmetric encryption such as stream cipher [18] and block cipher [19, 20] usually has fast processing speed since it requires only simple computations (e.g. XOR). The asymmetric encryption, i.e. public-key encryption, does not require the encryption key to be identical to the decryption key and allows the encryption one to be public, which overcomes the key transmission issue in symmetric encryption. Kao et al. [21] employed the traditional RSA public-key encryption to secure sensitive data in clouds. Lee [3] proposed a private key issuing protocol by combining PKI and IBE, and then an improved secure protection of data privacy is fulfilled. Deng et al. [6] applied the IBE into cloud computing such that only the users with correct identities can access the outsourced data. In wireless communication environments, e.g. body sensor network [5], internet of things [7], IBE is also leveraged to secure outsourced data. The concept of ABE was first introduced by Sahai and Waters [8]. ABE allows one to encrypt a data with an access policy rather than a public key (in PKI-based system) or an identity (in IBE), then only the users meeting the policy can decrypt and read the data. Yu et al. [9] used ABE in cloud computing system to achieve the fine-grained access control on outsourced data. Alshehri et al. [11] also utilised ABE to protect sensitive health records in cloud. Yang and Jia [10] proposed a multi-authority ABE scheme to solve the issues caused by single authority. Secure multi-party computation (MPC) [22] enables multiple participants to cooperatively compute on their private inputs without revealing nothing but the results. In cloud environments, MPC is a useful technique to protect cloud users' privacy and many efforts have been made to improve the security or efficiency of MPC. Zhang et al. [23] focused on the verifiability of users inputs and outcomes and designed a series of MPC protocols for dot product, ranging and ranking. Recently, Gueron et al. [24] proposed a MPC protocol that can be proved secure under a weaker assumption. Yoshida and Obana [25] presented a non-interactive MPC against honest-but-curious adversaries (e.g. cloud service providers) and improved its efficiency by using offline-online methods. Searchable encryption allows a cloud user to securely search over encrypted data outsourced to clouds through keywords and retrieve matching files. Considering typical and frequent searching behaviours, Li et al. [26] proposed a fuzzy keyword searchable encryption that enables users to search on encrypted data with tolerance of typos and format inconsistencies. Li et al. [27] presented an authorised private keyword search solution over encrypted data to solve the issue of search capability authorisation. Kuzu et al. [28] utilised the locality sensitive hashing technique to achieve a scalable scheme for similarity search over encrypted data. Hamlin et al. [29] revisited the multi-key searchable encryption to achieve a strengthened security notion and proposed a concrete construction that enables a user to perform searches on both his own files and the files shared by other users. Fully homomorphic encryption (FHE) [30] is a kind of encryption that allows arbitrary computations on ciphertexts, generating an encrypted result which can be decrypted into the result of the operations as if they had been performed on the plaintext. Gentry proposed the first FHE construction by using ideal lattices. FHE is a promising measure to protect data privacy in clouds. Chatterjee and Sengupta [31] provided techniques to translate basic operators (like bitwise, arithmetic and relational operators) to handle complicated FHE computations on encrypted data on clouds. Cao et al. [32] proposed a method to accelerate FHE over large integers. Also, to improve the performance of FHE, Wang et al. [33] presented a novel precomputation technique and used to optimise Gentry and Halevi FHE scheme [34]. Doröz et al. [35] recently constructed a FHE scheme proved to be secure based on a new hard problem they proposed. Proxy re-encryption (PRE) is a useful cryptographic tool to achieve encryption conversion. In PRE, a proxy can transform a ciphertext for Alice into a ciphertext for Bob, without seeing the underlying plaintext. Ateniese et al. [13] presented several efficient PRE schemes which do not require Alice to store additional secrets, nor interact with Bob. Libert and Vergnaud [36] improved Ateniese et al. 's PRE schemes to achieve a stronger security, i.e. chosen-ciphertext security. Identity-based PRE (IBPRE) was first formulated by Green and Ateniese [37], where the public keys can be arbitrary strings. Chu and Tzeng [38] then proposed an IBPRE scheme proved to be secure without random oracle. By combining ABE and PRE, Liang et al. [39] extended PRE to attribute-based PRE (ABPRE). Subsequently, Liang et al. [40] enhanced the security of the ABPRE scheme of [39] while the security is only proved in random oracle model, i.e. a weaker security definition. Derler et al. [41] employed the hierarchical IBE to design a forward-secret PRE construction where the proxy periodically evolves the re-encryption keys. Table 1 compares our scheme with related works [37-40] that also achieve the access control re-definition mechanism, in terms of the size of RK, the size of converted file, the number of bilinear pairings required in the converted file access, the granularity of access control (fine-grained or not) and the consumption of the users (clients) in file conversion. More details are described in Section 8. Table 1. Comparison with related works Proposal Re-definition key size Converted file size Pairings in converted file access Fine-grained access control Clients' low consumption [38] ✓ [37] ✓ [39] ✓ [40] ✓ ours ✓ ✓ Mizuno and Doi [15] presented a hybrid ABPRE that can convert an ABE ciphertext into an IBE ciphertext, which is opposite re-encryption direction compared to the proposed RDAC. In Mizuno and Doi's re-encryption scheme, the size of public key, secret key and ABE ciphertext are all linear with the number of total attributes in the system, while in the RDAC the public key has a constant size, and the size of ABE secret key and ciphertext are linear with the related attributes rather than the total ones. This advantageous feature renders the proposed RDAC a more efficient and practical solution. All the aforementioned works mainly focus on protecting data privacy using different encryption systems, e.g. PKI, IBE, ABE, to cater for specific applications. Although there are some PRE schemes that achieve the encryption conversion similar with our purpose, they either provide conversion in the same cryptosystem, or are proposed as improvements in terms of security and efficiency. However, the proposed RDAC on the one hand provides both IBE and ABE to protect data privacy, and importantly, on the other hand, offers an efficient way for users to convert their IBE encrypted files associated with simple access policies (i.e. identities) into ABE encrypted ones associated with fine-grained access policies describing what attributes authorised visitors should have. 4 System model and security 4.1 System model Two cryptosystems, i.e. IBE and ABE, are considered in RDAC to protect data privacy and provide two kinds of access control mechanisms. The IBE provides a simple-yet-efficient access control on outsourced data, while the ABE achieves complicated-yet-versatile access control. As depicted in Fig. 1, our RDAC system consists of six entities as follows: Trusted authority (TA): a party trusted by others to publish the system parameters and issue access credentials; Data owners: users who encrypt their data with an IBE access policy and outsource them to cloud storage provider (CSP); Data consumers: users who can download and decrypt the outsourced files if they have the correct access credentials issued by TA; CSP: a storage server which stores files encrypted by IBE or ABE in a cloud storage system. ACS: a server which responds to the requests from data owners and helps to compute conversion keys; Proxy: a server which transforms the files encrypted with IBE access policies into the files encrypted with ABE access policies by applying the RKs given by the data owners. The IBE can be employed for the users seeking for low computation and simple access control, and the ABE can be used for the users who want to achieve flexible encryption. The TA is responsible for generating access credentials for both IBE and ABE users. When a data owner (i.e. an IBE user) decides to convert his/her IBE encrypted file into an ABE encrypted file associated with a fine-grained access policy, the ACS can provide computation resources to generate a blinded RK, given that the IBE users very likely possess limited computation capability. The user then can compute a real RK from the blinded one at a very low cost. The IBE user gives this key to the proxy so that the proxy can directly transform the encrypted files, which results in an ABE encrypted file associated with the access policy specified by the IBE user. Then, by the access policy realised on the ABE encrypted file, the fine-grained access control on outsourced data is achieved. In the re-definition phase, the ACS does not know the real RK and the proxy does not know any secret of the data owner nor the data in plaintext. We note that the IBE encryption system and the ABE encryption one can also have data consumers and data owners, respectively. This means that there are data consumers decrypting IBE encrypted files and data owners generating ABE encrypted files in our RDAC system. We omit such data consumers and data owners from the figure to concentrate on the access control re-definition mechanism. Fig. 1Open in figure viewerPowerPoint System architecture 4.2 Security model We assume that the CSP is honest-but-curious in the sense that it is curious about the content of the file but still honestly perform the assigned tasks. Unauthorised users or intruders may try to access the data outsourced to the CSP. A typical way to protect data privacy is to encrypt the data before outsourcing. The proxy and the ACS also may be compromised by unauthorised users or attackers to get the RKs. If the attackers obtain the RK that can transform a file encrypted under an IBE access policy into a file encrypted under an ABE access policy, and additionally have the access credential that can decrypt the ABE encrypted files, then they can recover the data encrypted in the original file, which severely damages the data privacy. Therefore, to ensure data security, we require that anyone without the correct access credentials issued by the TA cannot access the data stored the CSP. In addition, to secure the file conversion, we also require that even one compromises the proxy server and the ACS, it still cannot know the data encrypted in original files if having no correct access credential. More formal security definition for RDAC will be described in Section 7. 5 Preliminaries We review some basic concepts and technologies underlying the RDAC construction. 5.1 Bilinear map Let and be two cyclic groups of order p for some large prime p. Let g be a generator of . A map e is said to be bilinear if (i): for all and all ; and (ii): . We say that is a bilinear group if there exists an efficiently computable bilinear map . The bilinear map is widely used in identity-based and attribute-based cryptographic systems to achieve some cancellations of random factors in decryption. 5.2 Access structure and linear secret sharing scheme (LSSS) [42] We now introduce the definition of access structure and the LSSS. Definition 1.Let be a set of parties. A collection is monotone if for , we have that holds if and . An access structure (respectively, monotone access structure) is a collection (respectively, monotone collection) of non-empty subsets of , i.e. . The sets in are called the authorised sets, and the sets not in are called the unauthorised sets. In the ABE systems, the role of parties is played by the attributes and the access structure is a collection of sets of attributes. Then, in the cloud storage system employing ABE, stored files are associated with access structures specifying which attributes that the authorised visitors should possess. For instance, a data owner specifies an access structure over his/her file stored on cloud. Then only the data consumers associated with the attribute set including the authorised set {Male, 40} or {Professor, Computer Science} can access the file. In our construction, we concentrate on the monotone access structures, which means that as a data consumer in an ABE system acquiring more attributes, he would not lose the potential access rights. However, one can still realise general access structures by taking the negation of an attribute as a single attribute, at the cost of doubling the number of attributes in the system. As previous work, we employ the LSSS to realise access structure. Informally, an LSSS is an secret-sharing matrix whose rows are mapped to attributes through a function . When we consider a vector , where is the secret to be shared and are randomly picked, is the l shares of the secret s and the value (inner product) is the share belonging to attribute . If a user's attribute set S satisfies an access structure realised by an LSSS , then the rows of M labeled by the attributes in S have the linear reconstruction property, which means that there exist constants such that for the valid shares of the attributes , we have that . Formal definition of LSSS can be found in [42]. 5.3 IBE and ABE IBE [4] is a cryptographic primitive that allows arbitrary string to serve as a user's public key. It removes the public-key certificates which are usually required in traditional public-key cryptosystem and hence allows users not to query public key for each encryption. Generally, an IBE system consists of four algorithms: setup, key generation, encryption and decryption. For each user associated with a recognisable identity ID (e.g. name, email address etc.) serving as the user public key, the key generation algorithm run by a trusted party creates a decryption key for ID. The encryption algorithm generates a ciphertext for an identity and the decryption algorithm succeeds if the identity of the decryption key is equal to that associated with the ciphertext. ABE [8] is a more flexible cryptosystem than IBE. It is very suitable for the applications where the data owners cannot exactly know who will request to access their data prior to their encrypting. With ABE, the data owners could specify access structures with regard to some attributes such that only the data consumers with the attributes meeting the access policy can access their data. Formally, ABE consists of the similar algorithms of IBE with some difference. Specifically, the encryption algorithm of (ciphertext-policy) ABE (CP-ABE) generates ciphertext with access structures over attributes; the key generation algorithm creates decryption keys using sets of attributes. Then the decryption algorithm judges whether the attribute set of the decryption key satisfies the access structure of the ciphertext and if so, the decryption algorithm successfully works. 6 Proposal In this section, we propose our RDAC scheme. Before describing the scheme, we first introduce the main idea driving the construction. 6.1 Basic idea Our RDAC scheme allows data owners to convert their files encrypted by IBE access control policies (i.e. identities) into files encrypted by ABE access control policies (i.e. sets of attributes), without leaking the underlying data nor the secrets of the data owners. The normal files are encrypted by the IBE cryptosystem and accordingly, the data consumers are given by IBE access credentials (IBE decryption keys). In contrast, the converted files are encrypted by the ABE cryptosystem and corresponding data owners have ABE access credentials. The main challenge in the construction is the non-uniform form of the IBE-encrypted and ABE-encrypted files. Specifically, the normal files are created by the encryption algorithm of the IBE and thus are associated with single identities; however, the converted files are associated with attributes due to the ABE encryption. Hence, it is very difficult to first 'extract' the identities embedded into the IBE encrypted file and then 'replace' them with specified attributes to form ABE encrypted files, provided that the data cannot be revealed. To overcome the above challenges, we seek for two compatible IBE and ABE schemes which share some common parameters. This similarity in parameters enables us to encrypt data with the two cryptosystems and more importantly, to achieve the encrypted file conversion from one into another. The CP-ABE scheme in [43] allows any string to sever as an attribute, just as the IBE permitting any string to serve as an identity. This property greatly saves the size of the system parameters and makes the encryption more efficient. To retain this enjoyable property in our RDAC system, we need an IBE scheme sharing some system parameters with the CP-ABE scheme. We find that we can directly apply the IBE scheme in [4] with a simple modification. That is, to make the IBE compatible with the CP-ABE scheme, we drop one element from the system parameters of the IBE scheme in [4] and obtain an IBE scheme with little difference. The resulting IBE scheme can be proved to achieve the same security as the original one by simply following its proof techniques. 6.2 Construction We now describe the RDAC sc