1. Attribute-Based Encryption for Fine-Grained Access Control of Encrypted Data
An, Sanghong
KAIST 2010

2. Contents Introduction Background Construction for Access Trees
Proof of Security
Large Universe Construction
Delegation of Private Keys
Applications
KAIST CS

3. Introduction How can we control access with fine-grained manner?
Just encrypting data is not enough
Needs of restrictive access (Audit log access, IP log access…)
Keywords
Fine-grained Access Control
Secret-Sharing Scheme
KAIST CS

4. Background Definition : Access Structure Attributes = parties
A set of parties: P = {P1, P2, … , Pn}
A monotone collection A ⊆2P,{Φ}∈/A
Authorized set S : S ∈A
Attributes = parties
KAIST CS

5. Background Attribute Based Encryption scheme
Selective-Set Model for ABE
CPA(Chosen-Plaintext Attack) PK
Setup
A : Access Structure
PK : Public parameter
MK : Master Key
E : Ciphertext
D : Decryption Key(Private Key)
Message m
Encryption
Set of Attributes γ MK E PK
Key Generation D
M if γ ∈A
Decryption A
KAIST CS

6. Background Bilinear Map Decisional Bilinear-Diffie-Hellman Assumption
G1, G2 : multiplicative cyclic groups of prime order p
g : generator of G1
e : bilinear map, e: G1 X G1  G2
e(ua,ub) = e(u,v)ab, e(g,g) ≠ 1
Decisional Bilinear-Diffie-Hellman Assumption
KAIST CS

7. Construction for Access Tree
Access Tree T
Non-leaf node x : (kx,n) , t : threshold value n : # of children
Leaf node described by an attribute
att(x) : attribute associated with leaf node x
index(x) : unique index value for node x
Tx(γ) = 1 if γ satisfies the access tree Tx
At least kx children returns 1 for Tx’(γ), Tx(γ) = 1
For leaf node, Tx(γ) = 1 iff att(x) ∈ γ
KAIST CS

8. Construction for Access Tree
Init
G1 : multiplicative cyclic groups of prime order p
g : generator of G1
e : bilinear map
Δi,S for i ∈Zp : Lagrange Coefficient
S⊆ Zp
KAIST CS

9. Construction for Access Tree
Setup
U : universe of attributes = {1,2,…,n}
ti : Randomly generated for i ∈ U, from Zp
y = Randomly generated number from Zp
Public Parameter PK
Ti = g^ti , Y = e(g,g)y
Master Key MK
t1, … , t|U|, y
KAIST CS

10. Construction for Access Tree
Encryption(M, γ, PK)
M ∈G2, γ : a set of attributes
s : Randomly generated number from Zp
Ciphertext E
E = (γ, E’ = MYs, {Ei = Tis}i ∈ γ)
KAIST CS

11. Construction for Access Tree
Key Generation(T, PK)
Generate a Key that decrypt encrypted message when Tr(γ) = 1
For each node x
Degree dx of polynomial qx
dx = kx -1
qr(0) = y, a proper polynomial qr for dr
qx(0) = qparent(x)(index(x))
Decryption Key D = {D1, … Dn}
Dx = g^(qx(0)/ti), where i = att(x)
KAIST CS

12. Construction for Access Tree
Decryption(E, D)
Recursive Algorithm DecryptNode(E,D,x)
For leaf node
DecryptNode(E,D,x) = e(Dx, Ei) = e(g,g)s qx(0) if i ∈ γ = ┴, otherwise
For non-leaf node
DecryptNode(E,D,x) = Fx
For all x’s childeren z, Fz = DecryptNode(E,D,z)
If Fz≠ ┴, put z into a set S
KAIST CS

13. Proof of Security Reduce Selective-set model to Decisional BDH
Thm. If an adversary can break the scheme in the Attribute-based Selective-Set model, then a simulator can be constructed to play the Decisional BDH game with a non-negligible advantage.
Pf) Reduction to absurdity
SSM advantage = ε, but D-BDH advantage = ε/2
KAIST CS

14. Large Universe Construction
Hash function and arbitrary strings
KAIST CS

15. Delegation of Private Keys
Delegate Key for sharing
T’ : more restrictive than T (T’ ⊆ T)
Adding a new trivial gate to T
Manipulating existing (t,n)-gate in T
To (t+1, n)-gate with (t+1)≤n
To (t+1, n+1)-gate
To (t, n-1)-gate with t≤(n-1)
Re-randomizing the obtained key
KAIST CS

16. Applications Audit Log Application Targeted Broadcast
Can’t collude to try to extract unauthorized information from the audit log
Targeted Broadcast
Broadcast with a label with attributes about the program
User subscribes “packages” which have attributes of a program
Selective broadcast
KAIST CS

17. References
V.Goyal and O.Pandey. Attribute-Based Encryption for Fine-Grained Access Control of Encrypted Data, 2006
A.Sahai and B.Water. Fuzzy Idnetity Based Encryption. In Advances in Cryptology –Eurocrypt, 2005
KAIST CS