Attribute-Based Encryption with Non-Monotonic Access Structures Rafail Ostrovsky UCLA Amit Sahai UCLA Brent Waters SRI International

Server Mediated Access Control File 1 Server stores data in clear Expressive access controls Access list: John, Beth, Sue, Bob Attributes: “Computer Science” , “Admissions”

Distributed Storage Downside: Increased vulnerability Scalability Reliability Downside: Increased vulnerability

Traditional Encrypted Filesystem Encrypted Files stored on Untrusted Server Every user can decrypt its own files File 1 Owner: John Files to be shared across different users? Credentials? File 2 Owner: Tim Lost expressivity of trusted server approach!

Attribute-Based Encryption [SW05] Goal: Encryption with Expressive Access Control File 1 “Creator: John” “Computer Science” “Admissions” “Date: 04-11-06” Label files with attributes File 2 “Creator: Tim” “History” “Admissions” “Date: 03-20-05”

Attribute-Based Encryption Univ. Key Authority File 1 “Creator: John” “Computer Science” “Admissions” “Date: 04-11-06” OR AND “Computer Science” “Admissions” “Bob” File 2 “Creator: Tim” “History” “Admissions” “Date: 03-20-05”

Attribute-Based Encryption Ciphertext has set of attributes Keys reflect a tree access structure Decrypt iff attributes from CT satisfy key’s policy OR AND “Computer Science” “Admissions” “Bob” “Creator: John” “Computer Science” “Admissions” “Date: 04-11-06”

Central goal: Prevent Collusions If neither user can decrypt a CT, then they can’t together AND “Computer Science” “Admissions” AND “History” “Hiring” Ciphertext = M, {“Computer Science”, “Hiring”}

Current ABE Systems [GPWS06] Monotonic Access Formulas Tree of ANDs, ORs, threshold (k of N) … Attributes at leaves NOT is unsupported! OR AND “Bob” “Computer Science” “Admissions”

Fresh randomness used for each key generated! Key Generation Public Parameters Fresh randomness used for each key generated! gt1, gt2,.... gtn, e(g,g)y OR AND “Computer Science” “Admissions” “Bob” y r (y-r) y3= yn= y1= “Greedy” Decryption Private Key gy1/t1 , gy3/t3 , gyn/tn

Supporting “NOTs” [OSW07] Example Peer Review of Other Depts. Bob is in C.S. dept => Avoid Conflict of Interest AND “Computer Science” NOT “Dept. Review” “Year:2007” Challenge: Can’t attacker just ignore CT components?

A Simple Solution Use explicit “not” attributes Attribute “Not:Admissions”, “Not:Biology” Problems: Encryptor does not know all attributes to negate Huge number of attributes per CT “Creator: John” “History” “Admissions” “Date: 04-11-06” “Not:Anthropology” “Not:Aeronautics” … “Not:Zoology”

Technique 1: Simplify Formulas Use DeMorgan’s law to propagate NOTs to just the attributes AND NOT OR NOT “Dept. Review” “Public Policy” “Computer Science”

Revocation Systems [NNL01,NP01…] Broadcast to all but a certain set of users Application: Digital content protection P1 P2 P3

Applying Revocation Techniques Focus on a particular Not Attribute AND “Year:2007” “Dept. Review” “Computer Science” NOT

Applying Revocation Techniques Focus on a particular ‘Not’ Attribute “Computer Science” NOT Attribute in ‘Not’ as node’s “identity” Attributes in CT as Revoked Users “Creator: John” “Computer Science” “Admissions” “Date: 04-11-06” Node ID not in “revoked” list =>satisfied N.B. – Just one node in larger policy

“Polynomial Revocation” [NP01] Pick a degree n polynomial q( ), q(0)=a n+1 points to interpolate User t gets q(t) Encryption: gs , ,Mgsa Revoked x1, …, xn gsq(x1) , ..., gsq(xn) gsq(t) Can interpolate to gsq(0)=gsa iff t not in {x1,…xn}

ABE with Negation Push NOTs to leaves Apply ABE key generation Collusion resistance still key! Treat non-negated attributes same New Type of Polynomial Revocation at Leaves

Choose degree n polynomial q(), q(0)=b System Sketch Choose degree n polynomial q(), q(0)=b Public Parameters Can compute gq(x) gq(0), gq(1),.... gq(n), Ciphertext gs, gsq(x1) , … , gsq(xn) Attributes: x1, x2… e(g,g)srq(t) e(g,g)srq(x1) e(g,g)srq(xn) Private Key grq(t), gr “Computer Science” NOT Derived from ABE key generation If points different can compute e(g,g)srb =t

Conclusions and Open Directions Goal: Increase expressiveness of Encryption Systems Provided Negation to ABE systems Challenge: Decryptor Ignores “Bad” Attributes Solution: Revocation techniques Future: ABE with Circuits Other cryptographic access control

Thank You