High efficient key-insulated attribute based encryption scheme without bilinear pairing operations.

Attribute based encryption (ABE) has been widely applied for secure data protection in various data sharing systems. However, the efficiency of existing ABE schemes is not high enough since running encrypt and decrypt algorithms need frequent bilinear pairing operations, which may occupy too much computing resources on terminal devices. What's more, since different users may share the same attributes in the system, a single user's private key exposure will threaten the security and confidentiality of the whole system. Therefore, to further decrease the computation cost in attribute based cryptosystem as well as provide secure protection when key exposure happens, in this paper, we firstly propose a high efficient key-insulated ABE algorithm without pairings. The key-insulated mechanism guarantees both forward security and backward security when key exposure or user revocation happens. Besides, during the running of algorithms in our scheme, users and attribute authority needn't run any bilinear pairing operations, which will increase the efficiency to a large extent. The high efficiency and security analysis indicate that our scheme is more appropriate for secure protection in data sharing systems.

Background

With the continuing increase of network information resources, users are confronted with urgent challenges such as how to make secure data sharing with others efficiently. To help users achieve secure and flexible data access control, Sahai and Waters (2005) proposed a new notion called attribute based encryption (ABE). In this cryptosystem, data receiver’s access privileges are described by a certain number of attributes. A data receiver can get access to the ciphertext only if the attributes he owns match with the access control policy set by the data owner. Equipped with the advantages of providing secure data protection as well as flexible access control, ABE (Goyal et al. 2006; Lewko et al. 2010; Waters 2011) has become an effective tool for secure data sharing between users.

However, the efficiency of current ABE schemes is still not high enough compared to traditional public key cryptosystem. One important factor is that encryption and decryption in ABE need frequent bilinear pairing calculations. Researchers have proved that the computational complexity of bilinear pairing is much larger than that of other operations (exponential operation, multiplication, addition) in discrete group (Chen et al. 2007; Bertoni et al. 2005). In some special network systems such as wireless sensor networks (Yu et al. 2011) or body area networks (Hu and Zhang 2013; Tan et al. 2011), the computation capacity and energy resources of terminal devices are limited, frequent bilinear pairing operations may consume too much computing resources and lead to bottleneck or node failure during the process of data sharing. Consequently, to further enrich the application scenarios of ABE, it is essential to improve the efficiency by reducing the number of pairing operations. To the best of our knowledge, the elimination of pairing operation in attribute based cryptosystem is quite new in the research literature, which has not been solved yet.

Key exposure protection is another issue remains to be tackled in attribute based cryptosystem. Although many schemes have achieved forward and backward security in terms of attribute revocation (Hur 2013; Yu et al. 2010), however, the system is still at risk when key exposure happens. If the private key owned by a non-revoked user leaks, any user can use the private key to decrypt the corresponding ciphertext since the leaked private key is still a valid one. Consequently, all the potential threat calls for frequent key refreshing in attribute based cryptosystem. When key exposure happens, effective and efficient key updating mechanism should be implemented to keep the system from potential threat.

To better guarantee the security during the process of data sharing as well as minimize the total computation cost, in the paper, we do the following research:

We propose a high efficient key-insulated ABE scheme without pairings (KI-ABE-WP). In our scheme, each user’s private key corresponds to an access structure. A user can decrypt the ciphertext only if the attributes used for encryption match with the access structure he owns. Besides, we divide the system lifetime into discrete time periods. When time period evolves, only part of the private key has to be updated and the system public parameters remain unchanged. This saves a lot of computation and transmission load when attribute revocation or key exposure happens. What’s more, during the running of algorithms in our scheme, users and attribute authority (AA) needn’t do any bilinear pairing operations, which will increase the total efficiency to a large extent compared to current ABE schemes. At last, our scheme is proved to be secure under CDH hardness assumption. The high efficiency due to the elimination of bilinear pairings makes our scheme more appropriate for secure data sharing in various network systems, especially those with limited computing capacity such as wireless sensor networks, mobile communication, etc.

The rest sections are arranged as follows:

In “Related works and preliminaries” section, we introduce the related works and essential mathematical preliminaries used to construct our scheme. The security model and concrete constructions of our scheme are proposed in “Models and assumptions” and “Constructions to our KI-ABE-WP” sections respectively. The security and performance analysis are given in “Security proof and performance analysis” section. At last, we conclude our paper and make prospects on future directions in “Conclusion” section.

Related works and preliminaries

Related works

Existing literatures have achieved much progress in ABE with respect to fine-grained access control (Goyal et al. 2006; Waters 2011; Bethencourt et al. 2007; Goyal et al. 2008), user flexible revocation (Hur and Noh 2011; Yu et al. 2011) and attribute based signcryption (Wang and Huang 2011), etc. Meanwhile, ABE has been widely designed for providing data protection in various network systems such as personal health record system (Li and Yu 2013), body area networks (Hu and Zhang 2013; Tan et al. 2011), wireless sensor networks (Yu et al. 2011), cloud computing (Yang et al. 2012). However, these schemes may not be entirely realistic to be applied to some application scenarios thanks to the heavy computation cost from bilinear pairing operations. Take the proposed scheme in Xhafa et al. (2015) for instance, if the number of attributes involved in encryption is n, then the decryption will take 4n times of pairing operations, which will bring a heavy computation burden on terminal devices. Consequently, to further improve the efficiency and performance of ABE, the number of pairing operations should be reduced, even totally eliminated.

Besides efficiency, key exposure protection is another issue urgently to be solved in ABE. Many existing schemes have guaranteed forward and backward security when attribute revocation happens by introducing a proxy re-encryption server (Hur and Noh 2011; Yu et al. 2010). However, these schemes only focus on the key regeneration of the revoked users, but neglect the key updating for non-revoked users. If a non-revoked user’s private key leaks, the confidentiality of the system will be threatened since the leaked private key is still a valid one. In fact, in attribute based cryptosystem, key refreshing is more important since either attribute revocation or private key exposure protection calls for frequent key-updating. Xu and Martin (2012) proposed an ABE scheme with secure key refreshing in, but their scheme has to regenerate the master key and public parameters in the system, this will bring about much more computation overheads when key updating happens. Key-insulation (Dodis et al. 2002) is a promising tool to guarantee forward and backward security as well as achieving high efficiency of key updating. In this mechanism, the lifetime of the system is divided into discrete periods. The public key remains unchanged throughout the lifetime, while temporary secret keys are updated periodically. Key-insulation mechanism can provide full security when user’s private key exposure happens and it has been designed for effective key exposure protection in identity based cryptosystem (Zhu et al. 2014), certificateless cryptosystem (Chen et al. 2015), etc. The advantage of key-insulation mechanism can also be combined into attribute based cryptosystem and propose a key-insulated ABE scheme with efficient and secure key updating.

Hardness assumptions

Discrete logarithm assumption (DL):

Given it is computational infeasible to calculate the value of a such that X = aP with a non-negligible probability within probabilistic polynomial-time.

Computational Diffie–Hellman assumption (CDH):

For given (p, ap, bp), it is computational infeasible to calculate the value of abp with a non-negligible probability within probabilistic polynomial-time.

Models and assumptions

A real world example of KI-ABE-WP

One typical application of our KI-ABE-WP is the mobile communication system, which can be illustrated in Fig. 1. It consists of six entitles: AA, key helper, base station, data centre, data sender and receiver. Base station and data centre are hardware architectures which are responsible for mobile communications and file storage. AA generates initial attribute private keys for each user in the system and the private key corresponds with an access structure. Data sender and receiver are the two sides of communication, data sender encrypts the file with a set of attributes, while a receiver can decrypt the ciphertext if the attributes used for encryption match with the access structure he owns. When system evolves into a new time period, users in the system update their private keys to the latest version with the assistance of key helper. Due to the elimination of bilinear pairing operations, the proposed KI-ABE-WP will relieve the terminal devices from heavy computation burden, thus improving the efficiency and performance of the whole system.

Fig. 1

Apply KI-ABE-WP for mobile communication system

Formalized definition of the algorithms in KI-ABE-WP

Our KI-ABE-WP consist of five algorithms:

Setup(1){PK, MK} This algorithm takes a security parameter λ as input and outputs the public parameter PK and master key MK. PK is shared by users while MK is kept private by AA.

This algorithm is operated by AA. It takes PK, MK, initial time period TP0 and the user’s access structure γ as input. The output of this algorithm is user’s initial private key

This algorithm is an interaction between AA and user. On input PK, MK, γ and the current time period TP, AA outputs the key-updating component and transfers it to users. User updates his temporal private key to the latest version using

Encrypt This algorithm is operated by the data sender. It takes PK, a plaintext M and an attribute set {A} as input and outputs the corresponding ciphertext CT.

This algorithm is run by the data receiver. The algorithm takes as input the ciphertext CT and the receiver’s temporal private key it outputs the plaintext M.

Security model of KI-ABE-WP

Definition

Our KI-ABE-WP scheme is secure under chosen ciphertext attacks if there exists an Adversary has non-negligible advantage in the following game played by a Challenger and an Adversary.

Phase 1 Setup

Challenger runs Setup procedure to obtain the system parameters PK and master keys MK. It sends PK to Adversary.

Phase 2 Queries

Adversary can make the following queries to Challenger.

Initial private key generation query

Challenger can obtain user’s initial private key by running Initial private key generation algorithm and returns the result back to Adversary.

Temporal private key generation query

Challenger can obtain user’s temporal private key at the current time period and returns the result back to Adversary.

Decrypt query

Adversary can ask Decryptquery for ciphertext CT. Challenger runs Decrypt algorithm and returns the results to Adversary.

Phase 3 Challenge

Adversary chooses two plaintexts M0 and M1 and a challenging access structure at current time period.

Challenger chooses randomly and calculates CT = Encrypt(PK, M, {A}) and returns the result to Adversary.

Adversary outputs a value as a conjecture of σ.

During the whole process of the challenge game:

Adversary cannot ask Challenger for Decryptquery of M0 and M1.

Adversary cannot ask Challenger for Temporal private key generation query for the challenging structure

If then Adversary wins the game.

We denote to be the Adversary’s advantage in the above challenge game.

Constructions to our KI-ABE-WP

Concrete algorithms of KI-ABE-WP

Setup

Let G to be a cyclic addition group. Denote q and p to be the prime order and generator of G respectively. AA defines a global attribute set and picks for each attribute in . Let T = tp to be the public key of A. Picks for each time period TP in the system lifetime. Let K = kp. Chooses a secret number and calculates Y = yp. Define two hash functions m is the size of plaintext. Define a Lagrange interpolation function

The system public parameters are and the system master keys are {t, y, k}.

Initial private key generation

AA randomly chooses a polynomial q for each node x in the user’s access tree γ. Denote d to be the degree of q and thr to be the threshold value node. Let For the root node AA sets For any other node (except for root node) in the access tree, let The initial attribute private key at time period TP0 for access structure γ can be denoted by

Key updating

When time period evolves from TP to TP, AA calculates the updated key component and transfers it to user. User calculates as the temporal private key at time period TP.

Encrypt

At time period TP, for a plaintext M,data sender picks a random number and calculates:

Then data sender sends to data receiver.

Decrypt

Upon receiving CT, receiver calculates:

Correctness proof

If x is a leaf node, the calculation process is as follows:

All the value calculated from will be stored as F. For any F ≠ 0,the algorithm calculates F (the value of root node) using Lagrange interpolation method.

If x is a non-leaf node, z is the child node of x, then the algorithm calculates the value of as follows:

Let i = index(z),

Since the value of whether x is a leaf node or non-leaf node, consequently, the value of root node F and the plaintext M can be calculated by:

Security proof and performance analysis

Security proof

Theorem

If the proposed KI-ABE-WP can be broken by an Adversary in the random oracle model, then a Simulator can be constructed to break the CDH hardness assumption in group G successfully with a non-negligible advantage.

Proof

In the challenge game, if there exists an Adversary can break our KI-ABE-WP with an advantage (t, ɛ) in the random oracle model, then there exists a Simulator which can break the CDH assumption with an advantage of which satisfies:

In the lemma (6), are the maximum numbers of Public key generation query,H1query, Initial private key generation query, Temporal private key generation query and Decryptquery respectively. Denote t and t to be the time consumption for running a scalar multiplication operation and an addition operation respectively.

The process of the challenge game is as follows:

Phase 1 Setup:

Challenger sets the parameters as follows:

Defines a global attribute set {A}. Let G be a cyclic addition group with prime order q. The generator of group G is denoted by p. Defines two hash functions: m is the size of plaintext. Randomly picks sets X = bp, Y = ap.

The aim of Simulator is to calculate the value of abp according to the process of the challenge game. Simulator plays the role of Challenger and runs Adversary as a sub-program.

Phase 2 Queries:

The proof skills used in our scheme resembles the method which has been proposed in Coron (2000). Without loss of generality, supposing that Adversary will make Public key generation query for an attribute A before making Initial private key generation query, Temporal private key generation query and Decrypt query to Simulator.

Then Adversary makes the following queries to Simulator:

Public key generation query: Simulator maintains a list L{A, γ, c, t, T}. When Adversary asks a Public key generation query for A in the γ. Simulator responds as follows:

Checks if A has already existed in the list L. If so, Simulator returns the result of T to Adversary. If not, Simulator picks a biased coin at random and sets while . When c = 0, Simulator chooses and sets T = tp. Otherwise let T = tX. Simulator adds the tuple {A, γ, c, t, T} into L and sends T to Adversary.

H1query: Simulator maintains a list . When Adversary asks a H1query for A, Simulator responds as follows:

Checks if A has already existed in . If so, Simulator sends the result back to Adversary. If not, Simulator calculates the value of H1(T, TP) and adds it into the

Initial private key generationquery: Simulator maintains a list When Adversary asks a Initial private key generationquery for γ, Simulator responds as follows:

Checks if exists in the list L{A, γ, c, t, T}. If not, Simulator aborts the challenge game and outputs failure. We denote this incident by E1.

Otherwise, Simulator randomly chooses a polynomial q for each node x in the user’s access tree γ. Denote d to be the degree of q and thr to be the threshold value node. Let For any other node (except for root node) in the access tree, let Simulator chooses and sets initial private key . Then simulator adds the tuple into L and sends to Adversary.

maintains a list . When Adversary asks a Temporal private key generation query for γ, Simulator responds as follows:

Checks γ in the list If γ does not exist in L, Simulator aborts the challenge game and outputs failure. We denote this incident by E2.

Checks . If the tuple {γ, A} does not exist in , Simulator aborts the challenge game and outputs failure. We denote this incident by E3.

Otherwise, Simulator randomly chooses and calculates . Simulator sends to Adversary and adds the tuple into

Decrypt query: Simulator maintains a list L{A, γ, CT = {C1, C2, C3, C4}, M}. When Adversary asks a Decrypt query for {A, γ, CT = {C1, C2, C3, C4}}, Simulator responds as follows:

Checks {A, γ} in the list L{A, γ, c, t, T}. If c = 1, Simulator aborts the game and outputs failure. We denote this incident by E4.

Otherwise, Simulator recovers from and calculates . Simulator sends the result to Adversary and adds the tuple into L{A, γ, CT = {C1, C2, C3, C4}, M}.

Phase 3 Challenge:

Adversary outputs two plaintext M0 and M1 with a challenging access structure γ* at the current time period TP.

Simulator checks if γ* exists in the list L{A, γ, c, t, T}. If not, Simulator aborts the challenge game and outputs failure. We denote this incident by E5. If γ* exists in the list L{A, γ, c, t, T} and c = 0, Simulator aborts the challenge game and outputs failure. We denote this incident by E6.

Simulator runs Temporal private key generation query for γ* and calculates . Then, Simulator picks , and calculates:

Simulator sends CT = {C1,, C2,, C3,, C4,} to Adversary.

Adversary outputs as a guess of If and Adversary wins the game, Simulator outputs as the solution to CDH assumption in group G.

Then we will analyse the time complexity of Simulator in breaking CDH assumption in group G.

From the description, assuming the average number of attributes involved is “n”, for each request of Public key generation query, Initial Private key generation query, Temporal private keygenerationquery and Decryptquery, Simulator has to run n times of multiplication operation, n times of multiplication operation and 2n times of addition operation, n times of multiplication operation and 2n times of addition operation, 2n times of multiplication operation and 2n times of addition operation respectively.

During the Challenge phase, Simulator has to run (3n + 4) times of multiplication operation and 2n times of addition operation.

Denote t, t to be the time consumption of scalar multiplication operation and addition operation in group G respectively. From what has been discussed above, the total time complexity of Simulatort′ satisfies:

Next we will discuss the advantage of Simulator in breaking the CDH assumption.

During the process of the challenge game, the responses of Initial Private key generation query, Temporal private keygenerationquery and Decryptquery return to Adversary are valid and indistinguishable if E1, E2, E3, E4 do not happen. Furthermore, if Adversary succeeds in distinguishing and E5, E6 do not happen, then Simulator is capable of breaking the CDH assumption.

Next we will calculate the probability of the incidents discussed above.

According to the process of queries phase, the probability of E4 and E6 not occurring can be denoted by lemma (9):

The value of is maximized in lemma (10) when

Since the responses of Public key generation query act as random oracle model, consequently, the probability of E1 and E5 not occurring can be denoted by lemma (11):

Likewisely, the probability of E2 and E3 not occurring can be denoted by lemma (12):

Taking all the probabilities of the above incidents into account, it can be figured out that if Adversary successfully attacks our scheme with an advantage ɛ, then a Simulator can break the CDH assumption in group G with an advantage of ɛ′ which satisfies:

Secure and efficient key updating

Our scheme achieves both secure and efficient key updating. According to the Keyupdating algorithm, the updated key component for attribute A at time period TP is calculated as Since a user cannot obtain the value of k, k, it is computational infeasible for him to calculate the value of and update his private keys. Without loss of generality, when a user’s private key was leaked during the time period TP, the system still maintains safe after TP since all the private keys have been securely updated.

With respect to the computation cost, key updating for a single attribute at a discrete period only needs one multiplication operation, one addition operation and 1 H1 operation. Besides, the system parameters remain unchanged throughout different time periods and this will reduce more the communication overheads.

Performance analysis

In this paper, assuming that the number of attributes involved in encryption is n, according to the algorithms discussed above, the Encrypt algorithm will take (n + 3) times of multiplication operations, one addition operation and one H2 operation, while the Decrypt algorithm will take 2n times of multiplication operations, 2n times of addition operations and 1 H2 operation. Detailed computation costs of each algorithm is listed in Table 1.

Table 1

Computation cost of algorithms in our scheme

Algorithms	Setup	Initial private key generation	Encrypt	Decrypt	Key updating
Multiplication	n + 1	n	n + 3	2n	n
Addition	0	2n	1	2n	n
Hash 1	0	n	0	0	n
Hash 2	0	0	1	1	0

From Table 1, it can be seen that the total computation efficiency is much higher in our scheme compared to current ABE schemes since bilinear pairing operations have been totally eliminated.

Conclusion

In this paper, we combine the advantage of key-insulation mechanism with ABE and propose a high efficient key-insulated ABE algorithm without pairings (KI-ABE-WP). During the running of algorithms in our scheme, users and AA needn’t run any bilinear pairing operations. The high efficiency and proved security make our scheme more appropriate for data sharing in network systems, especially those with limited computing capacity such as wireless sensor networks, mobile communication system, etc.

Our future research should focus on the ABS (attribute based signature) without pairing operations, which provides secure data authentication with higher efficiency than current ABS schemes.