Attribute-Based Encryption for Fine-Grained Access Control of Encrypted Data 20103350 An, Sanghong KAIST 2010 2010. 3. 11.

Contents Introduction Background Construction for Access Trees Proof of Security Large Universe Construction Delegation of Private Keys Applications KAIST CS 2018-12-01

Introduction How can we control access with fine-grained manner? Just encrypting data is not enough Needs of restrictive access (Audit log access, IP log access…) Keywords Fine-grained Access Control Secret-Sharing Scheme KAIST CS 2018-12-01

Background Definition : Access Structure Attributes = parties A set of parties: P = {P1, P2, … , Pn} A monotone collection A ⊆2P,{Φ}∈/A Authorized set S : S ∈A Attributes = parties KAIST CS 2018-12-01

Background Attribute Based Encryption scheme Selective-Set Model for ABE CPA(Chosen-Plaintext Attack) PK Setup A : Access Structure PK : Public parameter MK : Master Key E : Ciphertext D : Decryption Key(Private Key) Message m Encryption Set of Attributes γ MK E PK Key Generation D M if γ ∈A Decryption A KAIST CS 2018-12-01

Background Bilinear Map Decisional Bilinear-Diffie-Hellman Assumption G1, G2 : multiplicative cyclic groups of prime order p g : generator of G1 e : bilinear map, e: G1 X G1  G2 e(ua,ub) = e(u,v)ab, e(g,g) ≠ 1 Decisional Bilinear-Diffie-Hellman Assumption KAIST CS 2018-12-01

Construction for Access Tree Access Tree T Non-leaf node x : (kx,n) , t : threshold value n : # of children Leaf node described by an attribute att(x) : attribute associated with leaf node x index(x) : unique index value for node x Tx(γ) = 1 if γ satisfies the access tree Tx At least kx children returns 1 for Tx’(γ), Tx(γ) = 1 For leaf node, Tx(γ) = 1 iff att(x) ∈ γ KAIST CS 2018-12-01

Construction for Access Tree Init G1 : multiplicative cyclic groups of prime order p g : generator of G1 e : bilinear map Δi,S for i ∈Zp : Lagrange Coefficient S⊆ Zp KAIST CS 2018-12-01

Construction for Access Tree Setup U : universe of attributes = {1,2,…,n} ti : Randomly generated for i ∈ U, from Zp y = Randomly generated number from Zp Public Parameter PK Ti = g^ti , Y = e(g,g)y Master Key MK t1, … , t|U|, y KAIST CS 2018-12-01

Construction for Access Tree Encryption(M, γ, PK) M ∈G2, γ : a set of attributes s : Randomly generated number from Zp Ciphertext E E = (γ, E’ = MYs, {Ei = Tis}i ∈ γ) KAIST CS 2018-12-01

Construction for Access Tree Key Generation(T, PK) Generate a Key that decrypt encrypted message when Tr(γ) = 1 For each node x Degree dx of polynomial qx dx = kx -1 qr(0) = y, a proper polynomial qr for dr qx(0) = qparent(x)(index(x)) Decryption Key D = {D1, … Dn} Dx = g^(qx(0)/ti), where i = att(x) KAIST CS 2018-12-01

Construction for Access Tree Decryption(E, D) Recursive Algorithm DecryptNode(E,D,x) For leaf node DecryptNode(E,D,x) = e(Dx, Ei) = e(g,g)s qx(0) if i ∈ γ = ┴, otherwise For non-leaf node DecryptNode(E,D,x) = Fx For all x’s childeren z, Fz = DecryptNode(E,D,z) If Fz≠ ┴, put z into a set S KAIST CS 2018-12-01

Proof of Security Reduce Selective-set model to Decisional BDH Thm. If an adversary can break the scheme in the Attribute-based Selective-Set model, then a simulator can be constructed to play the Decisional BDH game with a non-negligible advantage. Pf) Reduction to absurdity SSM advantage = ε, but D-BDH advantage = ε/2 KAIST CS 2018-12-01

Large Universe Construction Hash function and arbitrary strings KAIST CS 2018-12-01

Delegation of Private Keys Delegate Key for sharing T’ : more restrictive than T (T’ ⊆ T) Adding a new trivial gate to T Manipulating existing (t,n)-gate in T To (t+1, n)-gate with (t+1)≤n To (t+1, n+1)-gate To (t, n-1)-gate with t≤(n-1) Re-randomizing the obtained key KAIST CS 2018-12-01

Applications Audit Log Application Targeted Broadcast Can’t collude to try to extract unauthorized information from the audit log Targeted Broadcast Broadcast with a label with attributes about the program User subscribes “packages” which have attributes of a program Selective broadcast KAIST CS 2018-12-01

References V.Goyal and O.Pandey. Attribute-Based Encryption for Fine-Grained Access Control of Encrypted Data, 2006 A.Sahai and B.Water. Fuzzy Idnetity Based Encryption. In Advances in Cryptology –Eurocrypt, 2005 KAIST CS 2018-12-01