# Multi-Authority Revocable Access Control Method Based on CP-ABE in NDN
## 3 Design and Implementation of Access Control Method
### Revocation of Consumer Privilege  
As long as the consumer user is restricted from accessing the data file again, a user revocation is performed. In this method, the consumer user does not need to update the keys of other users who have not been revoked, they only need to re-encrypt the ciphertext. The content publisher only needs to issue an undo message containing the revoked user's identity \(uid\) to NDN routing node, and the routing node deletes the revoked user's proxy key \(PxK_{wild,aid}\). Once \(PxK_{wild,aid}\) is removed, NDN  
Figure 3: Content release process.  
router can no longer execute the _ProxyDec_ proxy decryption algorithm for the revoked user. Therefore, revoked user cannot perform decryption process. The undo process requires the execution of URev \((uid,L_{\textit{PxK}})\to L_{\textit{PxK}})\). The user revocation function is executed by the NDN routing node, inputting the \(uid\) of the consumer user and the proxy key list \(L_{\textit{PxK}}\), and outputting the updated proxy key list \(L_{\textit{PxK}}\).  
Key update needs to execute the ReKeyUpdate function. The relevant authorization center first produces a novel attribute version number, then changes attribute public key for revoked attribute, and broadcasts a message to the data owner in the system, making them to receive updated attribute public keys. At the same time, the NDN routing node updates the proxy key using the proxy key update function \(\textit{PxKUp}\) date. The consumer key update needs to perform the following functions:  
* ReKeyUpdate \(\left(uid,\textit{PxK}_{uid,uid},v_{\textit{xK}}\right)\to\left\{\textit{ VUK}_{\textit{XK}},\textit{PxUK}_{\textit{XK}}\right\}\)
* \(AA_{i}\) executes this key material update function. Enter the \(uid\), \(\textit{PxK}_{uid,uid}\) of the consumer user that has not been revoked, and the current attribute version number \(v_{\textit{xK}}\), and output the version update key \(\textit{VUK}_{\textit{XK}}\) and the agent update key \(\textit{PxUK}_{\textit{XK}}\).
* PxKUpdate \(\left(uid,\textit{PxK}_{uid,uid},\textit{PxUK}_{\textit{XK}}\right)\to \textit{PxK}^{*}_{uid,uid}\)  
The NDN routing node performs the proxy key update function. The function inputs the \(uid\), \(\textit{PxK}_{uid,uid}\) of the consumer user that has not been revoked, and the current attribute version number \(v_{\textit{xK}}\)-output version update key \(\textit{VUK}_{\textit{XK}}\) and agent update key \(\textit{PxUK}_{\textit{XK}}\).  
The ciphertext re-encrypted  
Data owner uses the version update key to calculate the ciphertext update key through the ciphertext material update function CTUpdate and sends it to the NDN cache node, and the NDN cache node performs the ciphertext re-encryption function ReEnc to perform the ciphertext re-encryption. Consumer ciphertext re-encryption needs to perform the following functions:  
* CTUpdate \(\left(\textit{VUK}_{\textit{xK}},\textit{CT}\right)\to\textit{CUK}_{ \textit{xK}}\)  
The ciphertext material update function is executed by the content publisher and input \(\textit{VUK}_{\textit{xK}}\), \(\textit{CT}\) and output the ciphertext update key \(\textit{CUK}_{\textit{xK}}\).
* ReEnc \(\left(\textit{CT},\textit{CUK}_{\textit{xK}}\right)\to\textit{CT}\)*  
The NDN routing node performs the ciphertext re-encryption function. Enter the current ciphertext \(\textit{CT}\) and \(\textit{CUK}_{\textit{xK}}\).