Non-Interactive Cryptographic Access Control for Secure Outsourced Storage

Abstract

Traditionally, a CP-ABE scheme includes 4 basic algorithms: Setup, KeyGen, Encrypt, and Decrypt as Figure 1(a). If the data owner wants to change the access policy of data, he/she should download, re-encrypt, and then re-upload a new ciphertext. NIPU-CP-ABE consists of 7 polynomial time algorithms as Figure 1(b): Setup and KeyGen are executed by a trusted center; UpdateKeyGen, Encrypt and PolicyUpdate are executed by the data owner; Decrypt is executed by the data receivers; CiphertextUpdate is executed by a semi-trusted storage platform. If the data owner wants to change the data access policy, he/she can directly generate a public update component (PUC). Then the data access policy can be changed based on PUC and existing ciphertext. That is to say, the ciphertext under a new access policy can be synthesized by the ciphertext under an old policy and a sectional ciphertext under the new access policy. We can simply express the update as: Old CT + PUC → New CT Or say, we have following equivalence relation for policy update: Decrypt + Encrypt ⇔ PolicyUpdate + CiphertextUpdate Obviously, this bring an advantage that the communication times to change data access policy becomes half of traditional reencryption.