Matthew Pirretti
Brent Waters
ABSTRACT
Attributes define, classify, or annotate the datum to which they are assigned. However, traditional attribute architectures and cryptosystems are ill-equipped to provide security in the face of diverse access requirements and environments. In this paper, we introduce a novel secure information management architecture based on emerging attribute-based encryption (ABE) primitives. A policy system that meets the needs of complex policies is defined and illustrated. Based on the needs of those policies, we propose cryptographic optimizations that vastly improve enforcement efficiency. We further explore the use of such policies in two example applications: a HIPAA compliant distributed file system and a social network. A performance analysis of our ABE system and example applications demonstrates the ability to reduce cryptographic costs by as much as 98% over previously proposed constructions. Through this, we demonstrate that our attribute system is an efficient solution for securely managing information in large, loosely-coupled, distributed systems.
- Friendster. http://www.friendster.com, 2006.]]Google Scholar
- The human genome project. http://www.ornl.gov/sci/techresources/Human_Genome/home.shtml, 2006.]]Google Scholar
- The OpenSSL project. http://www.openssl.org, 2006.]]Google Scholar
- M. Bellare and P. Rogaway. Random oracles are practical: A paradigm for designing efficient protocols. In ACM Conference on Computer and Communications Security, pages 62--73, 1993.]] Google ScholarDigital Library
- D. Boneh and M. K. Franklin. Identity-based encryption from the weil pairing. In Proceedings of the 21st Annual International Cryptology Conference on Advances in Cryptology, pages 213--229. Springer-Verlag, 2001.]] Google ScholarDigital Library
- M. Bowman, C. Dharap, M. Baruah, B. Camargo, and S. Potti. A file system for information management. In Proceedings of the ISMM International Conference on Intelligent Information Management Systems, March 1994.]]Google Scholar
- R. Canetti, J. Garay, G. Itkis, D. Micciancio, M. Naor, and B. Pinkas. Multicast security: A taxonomy and some efficient constructions. In Proceedings of IEEE INFOCOM'99, 1999.]]Google ScholarCross Ref
- R. Canetti, O. Goldreich, and S. Halevi. The random oracle methodology, revisited (preliminary version). In STOC, pages 209--218, 1998.]] Google ScholarDigital Library
- C. Cocks. An identity based encryption scheme based on quadratic residues. In IMA Int. Conf., pages 360--363, 2001.]] Google ScholarDigital Library
- E. Cronin, S. Jamin, T. Malkin, and P. McDaniel. On the Performance, Feasibility, and Use of Forward Secure Signatures. In Proceedings of 10th ACM Conference on Computer and Communications Security (CCS), pages 131--144. ACM, October 2003. Washington, DC.]] Google ScholarDigital Library
- D. E. Denning. A lattice model of secure information flow. Commun. ACM, 19(5):236--243, 1976.]] Google ScholarDigital Library
- C. Ellison and B. Schneier. Ten Risks of PKI: What You're Not Being Told About Public i Key Infrastructure. Computer Security Journal, 16(1):1--7, 2000.]]Google Scholar
- D. F. Ferraiolo, R. Sandhu, S. Gavrila, D. R. Kuhn, and R. Chandramouli. Proposed NIST standard for role-based access control. ACM Trans. Inf. Syst. Secur., 4(3):224--274, 2001.]] Google ScholarDigital Library
- B. Gopal and U. Manber. Integrating content-based access mechanisms with hierarchical file systems. In OSDI '99: Proceedings of the third symposium on Operating systems design and implementation, pages 265--278, Berkeley, CA, 1999. USENIX Association.]] Google ScholarDigital Library
- T. Hardjono and B. Weis. The Multicast Group Security Architecture. RFC 3740 (Informational), Mar. 2004.]] Google ScholarDigital Library
- D. R. Hardy and M. F. Schwartz. Essence: A resource discovery system based on semantic file indexing. In Proceedings of the USENIX Winter Conference, pages 361--374, Berkeley, CA, January 1993. USENIX Association.]]Google Scholar
- F. J. Hill and G. R. Peterson. Computer aided logical design with emphasis on VLSI. Wiley, 4 edition, 1993.]] Google ScholarDigital Library
- B. Lampson. Protection. In Proceedings of the 5th Annual Princeton Conference on Information Sciences and Systems, pages 437--443, Princeton University, 1971.]]Google Scholar
- B. Lynn. PBC library. http://rooster.stanford.edu/ben/pbc/, 2006.]]Google Scholar
- P. McDaniel, A. Prakash, and P. Honeyman. A flexible framework for secure group communication. In USENIX Security Symposium, pages 99--114, 1999.]] Google ScholarDigital Library
- P. McDaniel and A. D. Rubin. A response to "can we eliminate certificate revocation lists?''. In FC '00: Proceedings of the 4th International Conference on Financial Cryptography, pages 245--258, London, UK, 2001. Springer-Verlag.]] Google ScholarDigital Library
- A. J. Menezes, T. Okamoto, and S. A. Vanstone. Reducing elliptic curve logarithms to logarithms in a finite field. IEEE Transactions On Information Theory, 39(5):1639--1646, September 1993.]]Google ScholarDigital Library
- A. Miyaji, M. Nakabayashi, and S. Takano. New explicit conditions of elliptic curve traces for FR-reduction. IEICE Transactions on Fundamentals, E84-A(5):1234--1243, 2001.]]Google Scholar
- M. Myers, R. Ankney, A. Malpani, S. Galperin, and C. Adams. X.509 Internet Public Key Infrastructure: Online Certificate Status Protocol - OCSP. http://www.ietf.org/rfc/rfc2560.txt, 1999.]] Google ScholarDigital Library
- D. Nali, C. Adams, and A. Miri. Using threshold attribute-based encryption for practical biometric-based access control. 1(3):173--182, November 2005.]]Google Scholar
- A. Sahai and B. Waters. Fuzzy identity based encryption. In Eurocrypt 2005, 2005.]] Google ScholarDigital Library
- R. S. Sandhu, E. J. Coyne, H. L. Feinstein, and C. E. Youman. Role-based access control models. Computer, 29(2):38--47, 1996.]] Google ScholarDigital Library
- R. S. Sandhu and P. Samarati. Access control: Principles and practice. IEEE Communications Magazine, 32(9):40--48, 1994.]]Google ScholarDigital Library
- A. Shamir. How to share a secret. Commun. ACM, 22(11):612--613, 1979.]] Google ScholarDigital Library
- A. Shamir. Identity-based cryptosystems and signature schemes. In Proceedings of CRYPTO 84 on Advances in cryptology, pages 47--53. Springer-Verlag New York, Inc., 1985.]] Google ScholarDigital Library
- V. Shoup. Using hash functions as a hedge against chosen ciphertext attack. In EUROCRYPT, pages 275--288, 2000.]]Google ScholarDigital Library
- United States Department of Health and Human Services. Health Insurance Portability and Accountability Act. http://aspe.hhs.gov/admnsimp/pl104191.htm, 1996.]]Google Scholar
Index Terms
- Secure attribute-based systems
Recommendations
A novel approach for privacy homomorphism using attribute-based encryption
In CRYPTO'13, Gentry et al. proposed the first homomorphic encryption HE scheme for the attribute-based encryption ABE. However, Gentry's scheme requires the same index for encryption of each ciphertext and supports only the key-policy ABE. Indeed, in ...
Computational friendly attribute-based encryptions with short ciphertext
We propose two Key-Policy Attribute-Based Encryption (KP-ABE) schemes for Linear Secret-Sharing Scheme (LSSS)-realizable Monotone Access Structure (MAS). We show that the first construction is secure against Chosen Plaintext Attacks (CPAs) while the ...
Chosen-Ciphertext Secure Multi-identity and Multi-attribute Pure FHE
Cryptology and Network SecurityAbstractA multi-identity pure fully homomorphic encryption (MIFHE) enables a server to perform arbitrary computation on the ciphertexts that are encrypted under different identities. In case of multi-attribute pureFHE (MAFHE), the ciphertexts are ...
Comments