Distributed multi-authority attribute-based encryption with fully adaptive security

Abstract

The present invention relates to a system, method, network device, and machine-readable medium for encrypting and decrypting messages in a distributed multi-authority attribute-based encryption (MA-ABE) scheme that is provably fully adaptively secure, specifically against an attacker who can corrupt some of the authorities and perform key queries adaptively throughout the life of the system.

Description

[Technical field]

[0001] [CROSS REFERENCE TO RELATED APPLICATIONS] This application claims priority to U.S. Provisional Patent Application No. 63 / 179,862, filed April 26, 2021, the entire contents of which are incorporated by reference.

[0002] [Technical field] The present disclosure relates to a multi-authority, attribute-based encryption scheme that is provably and fully adaptively secure, in particular against attackers that can corrupt some of the authorities, and that performs key queries adaptively throughout the lifetime of the system. [Background technology]

[0003] Attribute-based encryption (ABE) schemes allow fine-grained access control when accessing encrypted data. Such encryption schemes support decryption keys that allow users with specific credentials (or attributes) to decrypt a specific message without leaking any additional information. Over the years, the problem of designing ABE schemes has received a great deal of attention, resulting in a long line of research that achieves various tradeoffs between expressiveness, efficiency, security, and underlying assumptions.

[0004] Attribute-based encryption is a generalization of traditional public key encryption that provides fine-grained access control to encrypted data based on the certificates (or attributes) of the recipients. ABE has two avatars: ciphertext policy and key policy. In ciphertext-policy ABE (CP-ABE), as the name suggests, the ciphertext is associated with an access policy and the key is associated with the attributes. In key-policy ABE (KP-ABE), the roles of the access policy and the attribute set are reversed, i.e., the ciphertext is associated with the attributes and the key is associated with the access policy. In both cases, decryption is possible only if the attributes satisfy the access policy. Furthermore, it is required that, given any ciphertext created with respect to an access policy, a group of colluding users who do not individually possess the private key corresponding to the attribute set that satisfies the access policy cannot decrypt the encrypted message. This property is known as collusion resistance.

[0005] Since its inception by Goyal, Pandey, Sahai, and Waters, ABE has become a fundamental cryptographic primitive with a long list of potential applications. Therefore, the task of designing ABE schemes has received much attention from the cryptography community, resulting in a long sequence of work achieving various trade-offs between expressiveness, efficiency, security, and underlying assumptions.

[0006] Multi-Authority ABE The standard ABE scheme has one major limitation: In the ABE scheme, each user must go to a single master authority and prove that he or she has a certain set of attributes in order to receive a private key corresponding to each of these attributes. This means that there must be one trusted authority that monitors all attributes, e.g., driver's licenses, voter registration, and college admissions. However, in reality, there are different entities responsible for issuing and maintaining different attributes, e.g., the DMV is the custodian of driver's licenses, and similarly, for the other two attributes, the Board of Elections and the College Administration, respectively. Therefore, it is desirable to be able to entrust each of the attributes to a different (possibly not fully trusted) authority.

[0007] Multi-authority Attribute-Based Encryption: In ABE schemes, restricted decryption keys can only be generated and issued by a central authority that owns a master private key. Chase introduces the concept of multi-authority ABE (MA-ABE), which allows multiple parties to play the role of authorities. More precisely, in MA-ABE, there are multiple authorities that control different attributes, and each of these can issue private keys to users who own attributes under their control without any interaction with other authorities in the system. Given a ciphertext generated with respect to some access policy, users who own a set of attributes that satisfy the access policy can decrypt the ciphertext by deriving individual private keys obtained from the various authorities that control these attributes.

[0008] To address the above problems, the concept of multi-authority ABE (MA-ABE) schemes is introduced. In MA-ABE, there are multiple authorities that control different attributes, and each of these can issue private keys to users who own attributes under their control without any interaction with other authorities in the system. Given a ciphertext generated with respect to some access policy, users who own a set of attributes that satisfy the access policy can decrypt the ciphertext by deriving individual private keys obtained from the various authorities that control these attributes. As above, security requires prevention of collusion against non-authoritative users, but the key difference is that some of the attribute authorities can be corrupted and therefore collude with adversarial users.

[0009] After some initial attempts with various limitations, Lewko and Waters were able to design the first truly decentralized MA-ABE scheme, in which any party can become an authority and in which no global coordination is required beyond the creation of an initial trusted configuration. In their scheme, a party can act as an authority simply by issuing its own public key and issuing private keys to different users that reflect the attributes of the users. Different authorities can join the system at any point without even needing to be aware of each other. Also, there is no limit to the number of attribute authorities that can be involved during the life of the system. These schemes are based on NC 1 It supports all access policies computable by circuits. Furthermore, using powerful dual-system techniques, the security is proven under the random oracle model, using a "subgroup decision" type assumption, assuming composite order bilinear groups.

[0010] Following Lewko and Waters, there have been several extensions and improvements. Okamoto and Takashima provide a construction for prime order bilinear groups that relies on the decision-linear (DLIN) assumption. Rouselakis and Waters and Ambrona and Gay provide improvements in efficiency, but use lower than standard q-type assumptions and a generic group model, respectively. Datta et al. provide the first Learning With Errors (LWE)-based construction that supports a non-trivial class of access policies. All of the above are random oracle models.

[0011] Security: A natural definition of MA-ABE security requires the usual collusion resistance against non-authoritative users, but the key difference here is that some of the attribute authorities can be corrupted and therefore collude with adversarial users. Although some configurations support adaptive key queries, there is no known configuration that supports fully adaptive corruption of authorities under any assumptions. Given the distributed nature of MA-ABE, it seems unsatisfactory to assume that an attacker commits to a set of corrupted authorities at the start of the security game, even before seeing any private keys. In fact, we do not even realistically expect all attribute authorities to join the system at the same time. Thus, the “static corruption” model that previous work has considered does not capture realistic attack scenarios, and it is desired to improve on it by supporting adaptive corruption of authorities.

[0012] Obtaining fully adaptive security is a gap in existing configurations. This is one of the rare cases where generic complexity leveraging / guessing style arguments fail (even when admitting sub-exponential security losses). Indeed, applying these arguments to our setup results in exponential losses proportional to the maximum number of authorities per ciphertext. Thus, there must be a predefined maximum number of authorities per ciphertext limit, in which case the security parameters must be chosen appropriately. Furthermore, it is desirable to have a truly decentralized scheme, in which any party can participate as an authority at any time, and in which there is no limit on the number of authorities. Decentralized Multi-Authority Attribute-Based Encryption (MA-ABE) is a decentralized generalization of standard (ciphertext policy) attribute-based encryption, in which there is no trusted central authority, any party can become an authority and issue private keys, and no global coordination is required beyond the creation of an initial set of common reference parameters.

[0013] Standard complexity-based arguments do not work in multi-authority settings, and so we need constructions that can withstand adaptive corruption of authority, regardless of the assumptions used. Summary of the Invention

[0014] Some embodiments of the present invention provide a system, method, network device, and machine-readable medium for encrypting a message according to a multi-authority, attribute-based encryption scheme. The system includes: m for encryption i receiving an electronic message m comprising bits; storing the electronic message on a computerized storage medium; Run the global configuration algorithm to Create a group G, Sample g and h as two generators of G, Sample the seed for the seed extractor generating global parameters by Run the authority setting algorithm, Two exponents y A and y b Sampling Public key {yA} ,g {yb}} and set it as Private key A and y b} generating a public and private key pair by s,r A , r B Sampling C {1,A} =g {rA} C {1,B} =g {r_B} C {2,A} =g {yA*rA} g {s} C {2,B} =g {yB*rA} g {-s} C=m xor Ext(e(g,h),seed) Calculate As an encrypted message (C, C {1,A} , C {1,B} , C {2,A} , C {2,B} ) on a computerized storage medium. performing an encryption algorithm on the message m and the access policy M by (H(GID)*h) {yA} and (H(GID)) {yB} where H is a global cryptographic hash function that maps to groups. The method includes: In some further embodiments, any party can participate as an authority at any time, and there is no limit to the number of authorities. In some further embodiments, the method is fully adaptively secure. In some further embodiments, the method is provably fully adaptively secure, such that it is secure against an attacker who may corrupt some of the authorities and perform key queries adaptively throughout the life of the system. In some further embodiments, an adversary does not hold enough private keys or authority master keys to decrypt messages encrypted with respect to the access structure. In some embodiments, the computerized processor comprises: storing the message encrypted according to the attribute-based encryption scheme on a computerized storage medium; (K {GID,A} ,K {GID,B} ) and the ciphertext (C, C {1,A} , C {1,B} , C {2,A} , C {2,B} ) and D A =e(C {2,A} ,H(GID)*h) / e(C {1,A},K {GID,A} ) and D B =e(C {2,B} ,H(GID)) / e(C {1,B} ,K {GID,B} ) and C xor Ext(D A *D B ,seed) and executing a decryption algorithm by The device is further configured to decrypt the message by performing: [Brief description of the drawings]

[0015] The accompanying drawings, which are included to provide a further understanding, and are incorporated in and constitute a part of this specification, illustrate embodiments of the present disclosure and, together with the detailed description, serve to explain the principles of embodiments of the present disclosure. [Figure 1] 1 illustrates an example system architecture for a distributed multi-authority attribute-based encryption scheme. [Diagram 2] 1 shows an example sequence diagram of a distributed multi-authority attribute-based encryption scheme. [Diagram 3] 1 illustrates an example computer system architecture for implementing the systems and methods of the present invention. [Figure 4] Further details of an example computer system architecture for implementing the systems and methods of the present invention are provided. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] We construct the first truly distributed MA-ABE scheme that is provably secure even when fully adaptive corruption of the authority is allowed in addition to fully adaptive key queries. Our scheme is based on bilinear groups with standard polynomial hardness assumptions and in the random oracle model. We emphasize that our construction is the first provably secure scheme against fully adaptive corruption of the authority under any assumptions.

[0017] First, we provide constructions based on bilinear groups of composite order, using (so far) standard subgroup test assumptions, and then we provide constructions in k-linear or, more generally, prime order bilinear groups for which matrix Diffie-Hellman (MDDH) schemes hold.

[0018] Theorem (informal): Assume a composite-order bilinear group for which the "standard" subgroup decision assumptions hold. Then there exists a fully adaptive MA-ABE scheme in the random oracle model.

[0019] The assumptions we use in the above theorem have been used several times in the past and have been shown to hold true in the general bilinear group model. However, we point out that composite order based constructions have some drawbacks compared to the more standard prime order settings. First, in prime order groups, security can be obtained under more standard assumptions such as the k-LIN or bilinear Diffie-Hellman (BDH) assumptions. Second, in prime order groups, a much more efficient system can be achieved for the same level of security. This is because in composite order groups, security typically depends on the difficulty of factoring the group order. Second, this requires the use of large group orders, which results in significantly slower group and pairing operations.

[0020] For this reason, starting from Freeman and Lewko, several frameworks and tools have been developed to convert existing constructions of composite order groups to their prime order analogues. Using a recent set of tools by Chen, Gong, Kowalczyk and Wee, we have succeeded in obtaining constructions in (asymmetric) bilinear groups of prime order whose security is based on the more standard k-Lin or MDDH assumptions. Our constructions are secure under any choice of k. For example, setting k=1 gives security under the Symmetric External Diffie-Hellman Assumption (SXDH), and setting k=2 corresponds to security under the DLIN assumption.

[0021] Theorem (informal): Assume a prime-order bilinear group for which the k-Lin or MDDH assumptions hold. Then there exists a fully adaptive MA-ABE scheme in the random oracle model.

[0022] Technical overview Our MA-ABE (like other known MA-ABE schemes) uses a global identifier (ID) for each user in the system.

number

number

[0023] Here, N.C. 1 Recalling the syntax of distributed MA-ABE for the access policy, it is well known that this can be realized by a (monotonic) linear secret sharing scheme (LSSS). The distributed MA-ABE scheme consists of five steps: GlobalSetup, AuthSetup, KeyGen, Enc and Dec. The GlobalSetup step takes as input the security parameters (in a unary encoding) and outputs global public parameters. All the other steps depend on these global parameters (we may not mention them explicitly if it is clear from the context). The AuthSetup step obtains the corresponding public and master private key pair (PK u ,MSK u ) to generate any authority

number

number

number

number

[0024] Fully Adaptive Security As with standard ABE, the security of the MA-ABE scheme requires collusion resistance, i.e., a group of colluding users who are not individually authorized to decrypt the ciphertext should not be able to decrypt the ciphertext when they derive the components of their private keys together. However, in the case of MA-ABE, it is further required that collusion resistance holds even if some of the attribute authorities collude with hostile users, thereby allowing these users to freely obtain private keys corresponding to attributes controlled by the corrupted authorities. Decentralized MA-ABE makes it possible to still require collusion resistance even if the public and private keys of the corrupted authorities are generated in a malicious manner. This is important because in a decentralized MA-ABE scheme, anyone is allowed to act as an attribute authority by generating public and private keys locally and independently from everyone else in the system. We aim for fully adaptive security, loosely defined by the following game:

[0025] Global Setup: The challenger runs GlobalSetup to generate global public parameters.

[0026] Query Phase I: The attacker is allowed to adaptively make a polynomial number of queries of the form: (a) Authority Setup Query: The challenger runs AuthSetup to create a public / master key pair for an authority specified by the adversary. (b) Private Key Query: The challenger runs KeyGen to generate a private key for a given attribute. (c) Authority Master Key Query: The challenger provides the attacker with a master private key corresponding to some authority of the adversary's choice.

[0027] Challenge Phase: The adversary submits two messages msg0, msg1 and the access structure, along with the set of public keys of the authorities contained in the access structure. This obtains from the challenger an encryption of one of the messages (chosen at random) on the access structure. It is important that the adversary does not hold sufficient private keys / authority master keys to decrypt messages encrypted on the access structure.

[0028] Query Phase 2: Same as Query Phase 1 (while verifying that constraints from the challenge phase are not violated).

[0029] Guess: The attacker submits a guess as to which message is the basis for the challenge ciphertext.

[0030] All previous MA-ABE schemes consider a much weaker definition in which the adversary must commit to the set of authorities in the system and a subset of corrupted authorities during the global configuration phase. At that point, the private / public key pairs of all uncorrupted authorities have already been created by the challenger and the public keys have been given to the attacker. (i.e., only type 2 queries (private key queries) are allowed during query phases I and II.) Our fully adaptive definition is much more realistic given the distributed nature of MA-ABE.

[0031] Previous studies and the present approach

[0032] As with any ABE scheme, the challenge in MA-ABE is to make it collusion-resistant. Typically, ABE schemes achieve collusion resistance by using a system of authorities that know a master private key to "bind" together different key components that represent different attributes of the user with the help of new randomness specific to the user. Such randomization makes the different key components of a user compatible with each other, but incompatible with parts of a key issued to another user.

[0033] However, in a multi-authority setting, we want to meet the simultaneous goals of autonomous key generation and collusion resistance. The requirement of autonomous key generation means that standard techniques for key randomization are not applicable, since there is no party that compiles all the parts together. Furthermore, in a decentralized MA-ABE system, each component may come from a different authority, and such authorities have no coordination and in some cases do not even know about each other. To overcome this, conventional decentralized MA-ABE schemes use the output of a public hash function applied to the user's global identity GID as the randomness that ties together multiple key components issued to a particular user by different authorities.

[0034] To understand this challenge, we focus on one particular construction by Lewko and Waters. This is the first truly decentralized MA-ABE scheme, but all related subsequent work relies heavily on it and therefore suffers from similar problems. The security proof of Lewko and Waters' construction uses the dual system technique first developed by Waters. In the dual system, the ciphertext and key can take two forms: normal or semi-functional. Semi-functional ciphertexts and keys are not used in the actual system, they are only used in the security proof. A normal key can decrypt either normal or semi-functional ciphertexts, and normal ciphertexts can be decrypted by normal or semi-functional keys. However, when a semi-functional key is used to decrypt a semi-functional ciphertext, the decryption fails. The security of the dual system is proven using a series of "indistinguishable" games. The first game is the actual security game (with normal ciphertexts and keys). In the next game, the ciphertexts are semi-functional, but all the keys are normal. Define q games against an attacker who makes q secret key requests. In the kth game, the first k keys are semi-functional, while the remaining keys are normal. In game q, all keys and challenge ciphertexts given to the attacker are semi-functional. Thus, none of the given keys are useful for decrypting the challenge ciphertext.

[0035] The Lewko and Waters proof follows this high-level approach, but essentially relies on the fact that the corrupted authorities are specified in advance. Towards the end of the proof, all keys become semi-functional, and the challenge ciphertexts also become semi-functional. The goal of the final hybrid is to move to a game where the semi-functional challenge ciphertexts are random messages (rather than the original messages). To make this indistinguishable, they need to "shut off" the rows in the matrix of access policies that correspond to the corrupted authorities. This is done by using information theoretic tools to select vectors that are orthogonal to the rows in the challenge ciphertext (such vectors should exist, since corrupted sets should not be allowed). Effectively, this allows us to completely ignore the existence of authority master keys that correspond to these rows, while for other rows, the absence of private keys has already been addressed when we moved to a game where all keys are semi-functional.

[0036] This approach obviously fails if the authority can be adaptively corrupted. First, since the authority can be corrupted after the challenge ciphertext is created, and the challenger should be able to give the adversary the corresponding master key, the latter of which may not even be known at the time the challenge ciphertext is created, it is technically impossible to "cut off" the line corresponding to the corrupted authority. However, in the Lewko and Waters (proof) approach, this is not possible, since the challenger does not even have a properly formed master key for the authority (at that time).

[0037] Overcoming Barriers and (Composite Order) Schemes

[0038] To solve this problem, we must figure out how to integrate the corrupted authority into the dual system encrypted proof. This is difficult because, like Lewko and Waters, our authority keys simply consist of exponents over a group N=p1p2p3 of composite order. Because these authority keys are exponents and not group elements, there is no obvious way to transition them to be semi-functional, as proofs typically do to modify group-based private keys.

[0039] In our proof, we devise a new method to exploit such keys. The first step of the proof is to make the ciphertext semi-functional for the p3 subgroup. This argument relies on two important facts: (1) Any subset of authorities that the attacker compromises does not satisfy the access structure. Thus, the corrupted authorities alone are not enough to determine (information-theoretically) whether the challenge ciphertext is semi-functional or not. (2) The keys given by uncorrupted authorities do not have any components of the order p3 subgroup, so they do not help such an attacker (in this step). Taken together, this provides a way to exploit information-theoretic steps to handle adaptive corruption of authorities. Our approach uses both computational and information-theoretic arguments to navigate between different hybrid experiments. An important feature is that any step that relies on an attacker's key that does not satisfy the access structure is an information-theoretic argument, thus avoiding any problems that revolve around guessing which authorities are corrupted. (Of course, there are multiple computational arguments during and in the setting of information-theoretic arguments). A similar high-level approach, using information about what the adversary corrupts only in information-theoretic arguments, has been used in some previous dual-system proofs, but here it is possible to implement the technique in a (more difficult) distributed setting and surrounding corrupted authorities.

[0040] Our approach allows us to establish both semi-functional keys and ciphertexts in a given subspace of the cryptosystem. However, this comes with a big caveat. The semi-functional arguments are established in the p3 subgroup, but must be kept separate from the message-blinding ciphertext components that simply survive in the p1 subgroup. Thus, at this stage, it is unclear that all the work we have done will even hide the message at all. Thus, the next part of our proof requires us to "bleed" the semi-functional part of the ciphertext to the message-blinding part. To do this, we need to establish two subsystem configurations, where our configuration essentially looks like two copies of Lewko and Waters' multi-authority ABE scheme. Here, we take turns bleeding first to one and then to the other.

[0041] We call this novel technique Dual System with Dual Subsystem. This technique utilizes half-functionality in one subsystem to introduce half-functionality in the other subsystem. More specifically, we introduce a special group element in the public parameters that originally lives in the p1 subgroup. Our goal is to eventually make this group element live in both the p1 and p2 subgroups and blind the message with its p1 and p2 segments. We then subtly transform the challenge ciphertext and key such that the p2 segment of this special group element remains information-theoretically hidden to an adversary and its entropy can be amplified using an appropriate randomness extractor to completely hide the encrypted message.

[0042] The user private key components of the two subsystems are set asymmetrically, i.e., multiplying by a special group element in the user private key component corresponding to the first subsystem and not multiplying by one in the user private key component corresponding to the second subsystem. Then, first bleed the semi-functional part in the p3 subgroup of the second subsystem into the p2 subgroup of the same to make it semi-functional. Then, using this semi-functionality of the second subsystem, switch the special group element from that embedded in the user private key component of the first subsystem to that corresponding to the second subsystem. After this step, then bleed the anti-functional part in the p3 subgroup of the first subsystem into the p2 part of the same. At this point, the p2 segment of the ciphertext component that blinds the message becomes completely independent of the p2 segments of all other ciphertext and key components, so that its entropy can be used to blind the message information-theoretically.

[0043] We would like to emphasize that all applications of the dual system methodology have so far only dealt with a single system, and the idea of ​​two such subsystems is completely new to the present work. Also, the problem addressed in this work seems to be beyond the scope of standard single-system dual-system techniques, since it is not clear how to bleed semi-functional parts into the ciphertext components that blind the message and make the user key independent of its special group element in the single system. As is evident from our work in solving long-standing open problems, this new technique is very powerful. We envision finding further new applications related to adaptive security problems that seem beyond the scope of existing variants of the dual system encryption method, for example, constructing adaptively secure functional encryption schemes that go beyond linear functions under standard group-based assumptions.

[0044] composition:

[0045] The scheme of the present invention is based on the bilinear group of composite order N

number

number

number

[0046] At a very high level, as is evident from the construction, the encryption algorithm converts a message msg into the term Ext(e(g1,h) s , seed), where s is

number

number

number

number

[0047] AuthSetup(GP,u): The algorithm is a random value.

number

number

[0048] Enc(GP,msg,(M,ρ),{PK u}): First, a random value

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

[0049] KeyGen(GP,GID,MSK u ): The authority attribute u is a secret key SK for GID. GID,u SK GID,u =(K GID,A,u ,K GID,B,u ), where:

number

[0050] Dec(GP,CT,GID,{SK GID,u}): Decryption is done by using a global parameter GP, a hash function H, and an LSSS access structure

number

number

number

number

number

number

number

[0051] For all x∈I, the decryption algorithm is

number

number

number

[0052] The proposed scheme is accurate through testing.

[0053] Porting to prime order groups

[0054] As mentioned above, there has been a lot of work trying to come up with ways to convert existing composite order group constructions to their prime order analogues. All of these frameworks are different and have various levels of simplicity or generality. We have used the recent framework by Chen et al., which appears to be the most efficient and (arguably) the easiest to use, and have been successful in adapting the constructions and proofs from the composite order setting to the prime order setting.

[0055] At a high level, this framework shows how to use prime order groups to simulate composite order groups and their subgroups, while guaranteeing similarities of prime orders for various subgroup decision style assumptions. These similarities are obtained from the standard k-linear assumption (more generally, the MDDH assumption). Now, since the transformation process is not completely black box and needs to be adapted to the scheme at hand, some additional technical concepts need to be introduced to handle the specific setting of the present invention. Specifically, the proof of security of the prime order construction of the present invention relies not only on the subgroup decision style assumptions, but also on the security of some information theoretic arguments and random oracles. Using the framework to make it work for the scheme of the present invention is quite technical and systematic. See the technical section for details. Nevertheless, the inventors point out that the high level concepts and hybrid sequences are the same as for the composite order case.

[0056] Introduction

[0057] function

number

[0058] To represent a vector,

number

number

number

number

number

number

number

number

[0059] Indistinguishability: Two sequences of random variables X={X λ} λ∈N and Y = {Y λ} λ∈N Any non-uniform PPT algorithm

number

number

number

[0060] For two distributions D and D' on the discrete domain Ω, the statistical distance between D and D' is SD(D,D')=(1 / 2)·Σ ω∈Ω The distribution D = {D λ} λ∈N ) and D' = {D' λ} λ∈N The family of all

number

[0061] Access Structure and Linear Secret Sharing Scheme

[0062] In this subsection, we present the definition of the access structure and the linear secret sharing scheme.

[0063] Definition (access structure):

number

number

number

number

number

number

[0064] Definition (Linear Secret Sharing Scheme (LSSS)): Let q = q(λ) be a prime number,

number

number

number

number

number

number

number

number

number

number

[0065] 1.

number

number

number

[0066] 2.

number

number

number

number

number

number

number

number

number

number

number

[0067] The correctness and security of a monotonic LSSS are formalized as follows: Let S(S') be some monotonic access structure.

number

number

number

number

number

number

number

number

number

number

number

number

[0068] Note 1 (NC 1 and monotonic LSSS):NC 1 Access structure described by circuits

number

[0069] Powerful Randomness Extractor

[0070] The min-entropy of a random variable X is

number

number

number

[0071] Definition (Seed Randomness Extractor): The function Ext:Ω×S→Γ is a function that, for t sources X in Ω,

number

[0072] Theorem: All

number

[0073] Fully Adaptive Distributed MA-ABE for LSSS

[0074] The distributed multi-authority attribute-based encryption (MA-ABE) system consists of five steps whose syntax is given below: MA-ABE = (GlobalSetup, AuthSetup, KeyGen, Enc, Dec). The supported access structures that this invention deals with are those captured by linear secret sharing schemes (LSSS). The authority population is

number

number

number

[0075] GlobalSetup(1 λ ) → GP: The global configuration algorithm takes in a unary representation of a security parameter λ and outputs a global public parameter GP for the system. GP is a population of attribute authorities.

number

number

number

[0076] AuthSetup(GP,u)→(PK u ,MSK u ):authority

number

[0077] KeyGen(GP,GID,MSK u ) →SK GID,u The key generation algorithm takes as input a global parameter GP, a global identifier for the user,

number

number

[0078]

number

number

number

number

number

number

number

number

[0079] Dec(GP,CT,{SK GID,u}) → msg': The decryption algorithm is based on a global parameter GP, some LSSS access policy

number

number

number

number

[0080] Correctness: The MA-ABE scheme for LSSS-feasible access structures is accurate for all

number

number

number

number

number

number

[0081] Fully Adaptive Security: We define fully adaptive (chosen plaintext) security for a decentralized MA-ABE scheme. Namely, we consider a security game in which there may be an adaptive private key query, an adaptive authority corruption query, and an adaptive challenge ciphertext query. This is formalized in the following game between a challenger and an attacker. We consider two types of authority public keys: those legitimately generated by the challenger and those supplied by the attacker itself, noting that the former type of authority key can be corrupted by the attacker at any point during the game, while the latter type of authority key can potentially be formed fraudulently.

[0082] The game consists of the following stages: Global Setup: The challenger runs GlobalSetup to generate global public parameters GP and gives them to the attacker. Query Phase 1: The attacker is allowed to adaptively make a polynomial number of queries of the following type: Authority setting query: The attacker can set the authority of his choice

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

[0083] Definition (fully adaptive security of MA-ABE for LSSS): A MA-ABE scheme for any access structure feasible in LSSS is a scheme for all

number

number

number

[0084] Remark (Fully Adaptive Security of MA-ABE for LSSS in the Random Oracle Model): Further consider the above notion of fully adaptive security in the random oracle model. In this context, we assume a global hash function H that is published as part of the global public parameters and accessible by all parties in the system, including the attacker. In the security proof, we model H as a probability function and allow the challenger to program it. Thus, in the above fully adaptive security game, we further have the attacker adaptively present H oracle queries to the challenger, along with key queries both before and after the challenge ciphertext queries.

[0085] Composite order group MA-ABE scheme

[0086] In the following we describe composite order bilinear groups and the assumptions on which our constructions rely, and give a construction.

[0087] Composite order bilinear groups and hypotheses

[0088] The system of the present invention relies on bilinear groups of composite order. In particular, the bilinear group of composite order N, which is a product of three prime numbers, i.e., N=p1p2p3

number

number

number

number

number

number

number

number

number

number

number

number

[0089] composition

[0090] Here, NC in composite order bilinear groups 1 We present the MA-ABE for configuration.,As above, we assume that each authority controls only one attribute,,and therefore use the terms "authority" and "attribute" interchangeably.

[0091] GlobalSetup(1 λ ): The global configuration algorithm uses unary encoded security parameters 1 λThe procedure is to first select prime numbers p1, p2, and p3, and let N = p1p2p3. Next, we take the bilinear group of order N.

number

number

number

number

number

number

number

number

number

[0092] AuthSetup(GP,H,u): Global parameters GP, hash function H, and authority index

number

number

number

[0093] Enc(GP,H,msg,(M,ρ),{PK u}): An encryption algorithm takes as input a global parameter GP, a hash function H, and a message to encrypt.

number

number

number

number

[0094] First, a random number

number

number

number

number

number

number

number

number

number

number

number

[0095] Where:

number

[0096] KeyGen(GP,H,GID,MSK u ): A key generation algorithm takes as input a global parameter GP, a hash function H, and a global identifier for the user.

number

number

number

[0097] Dec(GP,H,CT,GID,{SK GID,u}): Decryption is done by using a global parameter GP, a hash function H, and an LSSS access structure

number

number

number

number

number

number

[0098] For all x∈I, first, the decryption algorithm is

number

number

number

[0099] Prime order group MA-ABE scheme

[0100] In the following, we recall prime order bilinear groups, provide the relevant notation, give the basic structure of the transformation framework, give the assumptions on which our constructions rely, and give the constructions.

[0101] Prime order bilinear groups and related notations

[0102] Notation:

number

number

number

number

number

number

number

number

number

number

number

number

number

[0103] Any bilinear group parameter

number

number

number

number

number

number

number

number

number

[0104] Prime order bilinear group:

number

number

number

number

number

number

number

number

number

[0105]

number

number

[0106] composition

[0107] Here, NC in prime order bilinear groups 1 We present the MA-ABE for configuration.,As above, we assume that each authority controls only one attribute,,and therefore use the terms "authority" and "attribute" interchangeably.

[0108] GlobalSetup(1 λ ): The global configuration algorithm uses unary encoded security parameters 1 λ The procedure begins by choosing a prime number p. Then, the bilinear group of order p

number

number

number

number

number

[0109]

number

number

number

number

number

[0110] In addition, all parties involved will have a global identifier

number

number

number

number

number

number

[0111] AuthSetup(GP,u): Global parameters GP and authority index

number

number

number

[0112] Enc(GP,msg,(M,ρ),{PK u}): An encryption algorithm takes as input a global parameter GP, a message to encrypt,

number

number

number

number

[0113] First a random vector

number

number

number

number

[0114] Where:

number

number

[0115] KeyGen(GP,GID,MSK u ): The key generation algorithm takes as input a global parameter GP, a global identifier for the user,

number

number

number

[0116] Dec(GP,CT,GID,{SK GID,u}): Decryption is done using the global parameters GP, the LSSS access structure

number

number

number

number

number

number

[0117] For all x∈I, first, the decryption algorithm is

number

number

number

[0118] System Implementation

[0119] Referring to FIG. 1, an example system architecture for a distributed multi-authority attribute-based encryption scheme is shown. An owner 105 of a message, such as any data, can encrypt the message as described herein and store the resulting ciphertext in cloud storage 110. Other users, shown as accessors 115, may retrieve this ciphertext from cloud storage 110. Multiple authorities 120 may be instantiated to manage public and private keys. An authority 120 may distribute private keys to data owners 105 and private keys to accessors 115. A user can decrypt the ciphertext only if he or she has at least a predefined number of attributes from the required authorities, as described herein.

[0120] Referring to Figure 2, an example sequence diagram of a distributed multi-authority attribute-based encryption scheme is shown. Any data may be stored in the cloud 201. The data may have been uploaded to the cloud by a data owner 202. A user 203 may then want to retrieve the data from the cloud 201. The user 203 may first view the file details and request a key from an authority 204. Although only a single authority 204 is shown here, multiple authorities may be instantiated and a user may communicate with multiple authorities.

[0121] Figures 3 and 4 show examples of computer systems useful for implementing various embodiments described in this disclosure. Various embodiments may be implemented using one or more computer systems, such as, for example, computer system 500 shown in Figure 3. One or more computer systems 500 may be used, for example, to implement any of the embodiments discussed herein, as well as combinations and subcombinations thereof.

[0122] Computer system 500 may include one or more processors (also referred to as central processing units, processing devices, or CPUs), such as processor 504. Processor 504 may be connected to a communications infrastructure 506 (e.g., a bus, etc.).

[0123] Computer system 500 may also include user input / output devices 503, such as a monitor, keyboard, pointing device, etc., which may communicate with a communications infrastructure 506 via user input / output interface 502. One or more of processors 504 may be a graphics processing unit (GPU). In one embodiment, a GPU may be a processor that is a specialized electronic circuit designed to process mathematically intensive applications. GPUs may have a parallel structure that makes them efficient for parallel processing of large blocks of data, such as the mathematically intensive data common in computer graphics applications, images, videos, etc.

[0124] The computer system 500 may also include a main memory 508, such as a random-access memory (RAM). The main memory 508 may include one or more levels of cache. The main memory 508 may store control logic (i.e., computer software, instructions, etc.) and / or data. The computer system 500 may also include one or more secondary storage devices or memories 510. The secondary memory 510 may include, for example, a hard disk drive 512 and / or a removable storage device or drive 514. The drive 514 may interface with a removable storage unit 518. The drive 518 may include a computer usable or readable storage device that stores computer software (control logic) and / or data. The drive 514 may read from and write to the removable storage unit 518.

[0125] The secondary memory 510 may include other means, devices, components, appliances, or other approaches by which computer programs and / or other instructions and / or data may be accessed by the computer system 500. Such means, devices, components, appliances, or other approaches may include, for example, a removable storage unit 522 and an interface 520. Examples of removable storage unit 522 and interface 520 may include a program cartridge and cartridge interface, a removable memory chip (such as an EPROM or PROM) and associated socket, a memory stick and a USB port, a memory card and associated memory card slot, and / or other removable storage unit and associated interface.

[0126] Computer system 500 may further include a communication interface 524 (e.g., a network interface). Communication interface 524 may enable computer system 500 to communicate and interact with any combination of external devices, external networks, external entities, etc. (individually and collectively referred to as remote devices, networks, entities 528). For example, communication interface 524 may enable computer system 500 to communicate with external or remote devices, networks, entities 528 via communication path 526. Communication path 526 may be wired and / or wireless (or a combination thereof) and may include any combination of a LAN, a WAN, the Internet, etc. Control logic and / or data may be transmitted to and from computer system 500 via communication path 526.

[0127] Computer system 500 may also be a personal digital assistant (PDA), a desktop workstation, a laptop or notebook computer, a netbook, a tablet, a smartphone, a smart watch or other wearable device, an appliance, part of the Internet of Things, and / or an embedded system, or any combination thereof, to name a few non-limiting examples.

[0128] Computer system 500 may be a client or server computing device that accesses or hosts any application and / or data through any delivery paradigm, including, but not limited to, remote or distributed cloud computing solutions, local or on-premise software ("on-premise" cloud-based solutions), an "as a service" model (e.g., content as a service (CaaS), digital content as a service (DCaaS), software as a service (SaaS), managed software as a service (MSaaS), platform as a service (PaaS), desktop as a service (DaaS), framework as a service (FaaS), backend as a service (BaaS), mobile backend as a service (MBaaS), infrastructure as a service (IaaS), etc.), and / or a hybrid model including any combination of the above examples or other service or delivery paradigms.

[0129] 4 illustrates an example of a computer system 900 machine in which a set of instructions may be executed to cause the machine to perform any one or more of the operations described herein. In another implementation, the machine may be connected (e.g., networked) to other machines in a LAN, an intranet, an extranet, and / or the Internet. The machine may operate as a server or a client machine in a client-server network environment, as a peer machine in a peer-to-peer (or distributed) network environment, or as a server or a client machine in a cloud computing infrastructure or environment.

[0130] The machine may be a personal computer (PC), a tablet PC, a set-top box (STB), a personal digital assistant (PDA), a mobile phone, a web appliance, a server, a network router, switch or bridge, a dedicated application or network security appliance or device, or any machine capable of executing a set of instructions (e.g., sequential) that specify actions to be performed by the machine. Additionally, although a single machine is illustrated, the term "machine" is also intended to include any collection of machines that individually or collectively execute a set (or multiple sets) of instructions to perform any one or more of the methodologies discussed herein.

[0131] An example computer system 900 includes a processing device 902, a main memory 904 (e.g., read-only memory (ROM), flash memory, dynamic random-access memory (DRAM), such as synchronous DRAM (SDRAM), etc.), a static memory 906 (e.g., flash memory, static random-access memory (SRAM), etc.), and a data storage device 918, communicating via a bus 930.

[0132] Processing device 902 represents one or more processing devices, such as a microprocessor, a central processing unit, or the like. More specifically, processing device may be a complex instruction set computing (CISC) microprocessor, a reduced instruction set computing (RISC) microprocessor, a very long instruction word (VLIW) microprocessor, or a processor implementing other instruction sets or a combination of instruction sets. Processing device 902 may be one or more special-purpose processing devices, such as an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), a digital signal processor (DSP), a network processor, or the like. Processing device 902 is configured to execute instructions 926 to perform the operations and steps described herein.

[0133] The computer system 900 may further include a network interface device 908 for communicating over a network 920. The computer system 900 may also include a video display unit 910, an alphanumeric input device 912 (e.g., a keyboard), a cursor control device 914 (e.g., a mouse), a graphics processing unit 922, a signal generating device 916 (e.g., a speaker), a graphics processing unit 922, a video processing unit 928, and an audio processing unit 932.

[0134] The data storage device 918 may include a machine-readable medium 924 (also known as a computer-readable storage medium) on which is stored one or more sets of instructions 926 (e.g., software instructions) that embody any one or more of the operations described herein. The instructions 926 may also reside, completely or at least partially, within the main memory 904 and / or within the processing device 902 during execution by the computer system 900, where the main memory 904 and the processing device 902 also constitute machine-readable storage media.

[0135] In one example, the instructions 926 include instructions for implementing operations and functions corresponding to the subject matter of this disclosure. Although the machine-readable storage medium 924 is shown to be a single medium in the implementation, the term "machine-readable storage medium" should be understood to include a single medium or multiple media (e.g., a centralized or distributed database and / or associated caches and servers) that store one or more sets of instructions 926. The term "machine-readable storage medium" should also be understood to include a medium that can store or encode a set of instructions 926 for execution by a machine and cause the machine to perform any one or more of the operations of this disclosure. Thus, the term "machine-readable storage medium" is intended to include, but is not limited to, solid-state memories, optical media, and magnetic media.

[0136] Some portions of the detailed descriptions are presented in terms of algorithms and symbolic representations of operations on data bits within a computer memory. These algorithmic descriptions and representations are the means used by those skilled in the data processing arts to most effectively convey the substance of their work to others skilled in the art. An algorithm is generally conceived here as a self-consistent sequence of operations leading to a desired result. The operations require physical manipulations of physical quantities. Usually, though not necessarily, these quantities take the form of electrical or magnetic signals capable of being stored, combined, compared and otherwise manipulated. It has proven convenient at times to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, or the like, principally for reasons of common usage.

[0137] It should be borne in mind, however, that all of these and similar terms are associated with the appropriate physical quantities and are merely convenient labels applied to these quantities.Unless otherwise indicated, and as is evident from the above description, it will be recognized that throughout the description, descriptions utilizing terms such as "identify," "determine," "execute," "perform," "collect," "create," "transmit," and the like refer to actions and processes of a computer system or similar electronic computing device that manipulate and transform data represented as physical (electronic) quantities in the registers and memory of the computer system into other data similarly represented as physical quantities in the memory or registers of the computer system or other such information storage devices.

[0138] The present disclosure also relates to an apparatus for performing the operations herein, which may be specially constructed for the intended purposes, or may include a computer selectively activated or reconfigured by a computer program stored in the computer. Such computer programs may be stored on a computer-readable storage medium, such as, but not limited to, a floppy disk, optical disk, any type of disk including CD-ROM and magneto-optical disk, read-only memory (ROM), random access memory (RAM), EPROM, EEPROM, magnetic or optical card, or any type of medium suitable for storing electronic instructions, each coupled to a computer system bus.

[0139] The operations and examples presented herein are not inherently related to any particular computer or other apparatus. Various types of systems may be used with programs in accordance with the teachings presented herein, or it may prove convenient to construct more specialized apparatus to perform the operations. The structure of a variety of these systems will appear as described in the description herein. In addition, this disclosure has not been described with reference to any particular programming language. It will be appreciated that a variety of programming languages ​​may be used to implement the teachings of the disclosure as described herein.

[0140] The present disclosure may be provided as a computer program product or software that may include a machine-readable medium having instructions stored thereon, which may be used to program a computer system (or other electronic device) to perform a process according to the present disclosure. A machine-readable medium includes any mechanism for storing information in a form readable by a machine (e.g., a computer). For example, machine-readable (e.g., computer-readable) media includes machine (e.g., computer) readable storage media such as read-only memory ("ROM"), random access memory ("RAM"), magnetic disk storage media, optical storage media, flash memory devices, and the like.

[0141] In some embodiments, a tangible, non-transitory apparatus or article of manufacture that includes a tangible, non-transitory computer usable or readable medium having control logic (software) stored thereon is also referred to herein as a computer program product or program storage device. This includes, but is not limited to, computer system 500, main memory 508, secondary memory 510, removable storage units 518 and 522, and tangible articles of manufacture that embody any combination of the above. Such control logic, when executed by one or more data processing devices (such as computer system 500), may cause such data processing devices to operate as described herein.

[0142] Based on the teachings contained herein, it will be apparent to one of ordinary skill in the relevant art how to make and use embodiments of the present disclosure using data processing devices, computer systems and / or computer architectures other than those shown in Figures 3 and 4. In particular, embodiments may operate with software, hardware and / or operating system implementations other than those specifically described.

[0143] It is understood that the Detailed Description section, and not the other sections, is intended to be used to interpret the claims. The other sections may set forth one or more embodiments contemplated by the inventor, but not all, and are therefore not intended to limit the scope of the disclosure or the claims.

[0144] Although the present disclosure describes exemplary embodiments for exemplary fields and applications, it should be understood that the disclosure is not limited to the contents thereof. Other embodiments and modifications thereto are possible and are within the scope and spirit of the present disclosure. For example, without limiting the generality of this paragraph, the embodiments are not limited to the software, hardware, firmware and / or entities shown in the figures described herein. Moreover, the embodiments (whether or not explicitly described herein) have considerable utility for fields and applications other than the examples described herein.

[0145] The embodiments are described herein using functional building blocks that illustrate implementations of specified functions and relationships thereof. The boundaries of these functional building blocks have been arbitrarily defined herein for convenience of description. Alternate boundaries may be defined so long as the specified functions and relationships (or their equivalents) are appropriately performed. Also, alternative embodiments may perform the functional blocks, steps, operations, methods, etc. using an order different from that described herein.

[0146] The use of "one embodiment," "embodiment," "exemplary embodiment," or similar phrases herein indicates that the described embodiment may include a particular feature, structure, or characteristic, but not all embodiments include the particular feature, structure, or characteristic. Moreover, such phrases do not necessarily refer to the same embodiment. Moreover, when a particular feature, structure, or characteristic is described in connection with an embodiment, it is within the purview of one of ordinary skill in the relevant art to incorporate such feature, structure, or characteristic in other embodiments, even if not explicitly mentioned or described herein. Additionally, some embodiments may be described using the terms "coupled" and "connected," along with their derivatives. These terms are not necessarily intended as synonyms for each other. For example, some embodiments may be described using the terms "connected" and / or "coupled" to indicate that two or more elements are in direct physical or electrical contact with each other. However, the term "coupled" can mean that two or more elements are not in direct contact with each other, but still cooperate or interact with each other.

[0147] The breadth and scope of the present disclosure should not be limited by any of the above exemplary embodiments, but should be defined only in accordance with the following claims and their equivalents. In the above specification, implementations of the present disclosure have been described with reference to specific implementations thereof. It is apparent that various modifications may be made without departing from the broader spirit and scope of the present disclosure, as set forth in the following claims. Thus, the specification and drawings should be considered in an illustrative and not a restrictive sense.

Claims

1. 1. A computerized system for encrypting a message according to a multi-authority attribute-based encryption scheme, comprising: m for encryption i receiving an electronic message m comprising bits; storing said electronic message on a computerized storage medium; Run the global configuration algorithm to Create a group G, Sample g and h as two generators of G, Sample the seed for the seed extractor generating global parameters by Run the authority setting algorithm, Two exponents y A and y b Sampling Public key {yA} ,g {yb} } and Private key A and y b } generating a public and private key pair by s,r A , r B Sampling C {1,A} =g {rA} C {1,B} =g {r_B} C {2,A} =g {yA*rA} g {s} C {2,B} =g {yB*rA} g {-s} C=m xor Ext(e(g,h),seed) Calculate As an encrypted message (C, C {1,A} , C {1,B} , C {2,A} , C {2,B} ) on a computerized storage medium. performing an encryption algorithm on the message m and the access policy M, (H(GID)*h) {yA} and (H(GID)) {yB} where H is a global cryptographic hash function that maps to groups.

1. A computerized system comprising a processor configured to:

2. 2. The computerized system for encrypting messages of claim 1, wherein any party can participate as an authority at any time and there is no limit to the number of authorities.

3. A computerized system for encrypting a message as described in claim 1, wherein the encrypted message is fully adaptively secure.

4. A computerized system for encrypting a message as described in claim 1, wherein the encrypted message is provably completely adaptively secure such that it is secure against an attacker who can corrupt part of the authority and perform key queries adaptively throughout the life of the computerized system.

5. 5. The computerized system for encrypting messages of claim 4, wherein the adversary does not hold sufficient private keys or authority master keys to decrypt messages encrypted with respect to the access structure.

6. The processor, storing said message encrypted according to an attribute-based encryption scheme on a computerized storage medium; (K {GID,A} ,K {GID,B} ) and the ciphertext (C, C {1,A} , C {1,B} , C {2,A} , C {2,B} ) and D A =e(C {2,A} ,H(GID)*h) / e(C {1,A },K {GID,A} ) and D B =e(C {2,B} ,H(GID)) / e(C {1,B} ,K {GID,B} ) and C xor Ext(D A *D B ,seed) and executing a decryption algorithm by 2. The computerized system for encrypting a message of claim 1, further configured to decrypt the message by performing:

7. 1. A computerized method for encrypting a message according to a multi-authority attribute-based encryption scheme, comprising: m for encryption i storing an electronic message m including the bits on a computerized storage medium; Run the global configuration algorithm to Create a group G, Sample g and h as two generators of G, Sample the seed for the seed extractor generating global parameters by Run the authority setting algorithm, Two exponents y A and y b Sampling Public key {yA} ,g {yb} } and Private key A and y b } generating a public and private key pair by s,r A , r B Sampling C {1,A} =g {rA} C {1,B} =g {r_B} C {2,A} =g {yA*rA} g {s} C {2,B} =g {yB*rA} g {-s} C=m xor Ext(e(g,h),seed) Calculate As an encrypted message (C, C {1,A} , C {1,B} , C {2,A} , C {2,B} ) on a computerized storage medium. performing an encryption algorithm on the message m and the access policy M, (H(GID)*h) {yA} and (H(GID)) {yB} where H is a global cryptographic hash function that maps to groups. The method includes:

8. 8. The computerized method for encrypting a message of claim 7, wherein any party can participate as an authority at any time and there is no limit to the number of authorities.

9. 8. The computerized method for encrypting a message of claim 7, wherein the method is fully adaptively secure.

10. 8. The computerized method for encrypting a message of claim 7, wherein the method is provably fully adaptively secure such that it is secure against an attacker who may corrupt part of the authority and perform key queries adaptively throughout the life of the system.

11. 11. The computerized method for encrypting a message of claim 10, wherein the adversary does not hold sufficient private keys or authority master keys to decrypt messages encrypted with respect to the access structure.

12. The method further comprises the step of decrypting a message according to the multi-authority attribute-based encryption scheme; The method comprises: storing the message encrypted according to the attribute-based encryption scheme on a computerized storage medium; (K {GID,A} ,K {GID,B} ) and the ciphertext (C, C {1,A} , C {1,B} , C {2,A} , C {2,B} ) and D A =e(C {2,A} ,H(GID)*h) / e(C {1,A },K {GID,A} ) and D B =e(C {2,B} ,H(GID)) / e(C {1,B} ,K {GID,B} ) and C xor Ext(D A *D B ,seed) and executing a decryption algorithm by 8. A computerized method for encrypting a message according to claim 7, comprising:

Images