Efficient registered attribute-based encryption with non-monotone policies

Abstract

The present disclosure provides a flexible slotted registered attribute-based key encapsulation mechanism scheme. The scheme includes a setup algorithm that generates a common reference string, a key generation algorithm that generates public and secret keys for each slot, a verification algorithm that verifies public keys, an aggregation algorithm that aggregates public keys and attributes into a master public key and helper secret keys, an encapsulation algorithm that generates a ciphertext and key using multiple master public keys and a header, and a decapsulation algorithm that recovers the key using a secret key, helper secret key, and ciphertext. The scheme supports partial and sequential aggregation of public keys, allows encryption with respect to multiple master public keys, and includes header information in ciphertexts. The scheme provides compactness, correctness, and security properties for attribute-based access control.

Description

[0001] EFFICIENT REGISTERED ATTRIBUTE-BASED ENCRYPTION WITH NON-MONOTONE POLICIES

[0002] CROSS-REFERENCE TO RELATED APPLICATION

[0003] This application claims the benefit of U. S. Provisional Application Ser. No.

[0004] 63 / 761,822 filed February 21, 2025, the content of which is incorporated by reference herein in its entirety, for all purposes.

[0005] FIELD OF THE INVENTION

[0006] The present disclosure relates to cryptographic systems, and more particularly to an efficient registered attribute-based encryption scheme supporting non-monotone access policies.

[0007] BACKGROUND

[0008] Registered attribute-based encryption (Reg- ABE) is a new variant of attributebased encryption (ABE) that is introduced to resolve the key escrow problem. In a Reg-ABE system, there is no authority that generates secret keys, and each user join the system by generating its own public / secret key pair. Because of its publickey infrastructure-like model and versatile access control functionality, Reg-ABE is a promising alternative of ABE. Although several reasonably efficient Reg-ABE schemes have been proposed, there is still a large efficiency gap between ABE and Reg-ABE. Especially, since master public key (MPK) and ciphertext are frequently transmitted in a Reg-ABE system, their sizes critically affect the practicality of the system. In this work, we present a highly efficient Reg-ABE scheme to narrow the gap between ABE and Reg-ABE. Specifically, the sizes of MPK and ciphertext of our scheme are both about 7.5KB, which could be more than 2000 x and 5x smaller than those of the state-of-the-art scheme by Garg et al. (Crypto’24) in a realistic parameter setting, respectively. The sizes of other elements such as helper secret key and a state that the system maintain could also become more than 40 x smaller. Furthermore, our scheme supports non-monotone policies and CCA-security, which are not supported by the scheme of Garg et al.

[0009] Attribute-based encryption (ABE) is a generalization of public-key encryption and allows fine-grained access over encrypted data. ABE has a variety of applications such as electronic medical records, online social networks, key distribution system,and there are many ABE schemes that are practically efficient and scalable. Nevertheless, the usage of ABE in the real world is still limited. A major reason for this slow spread would be the key-escrow problem: an ABE system needs to maintain a central authority (known as private-key generator (PKG)) for the lifetime of the system that has an ability to decrypt all encrypted data in the system. The existence of such an authority is often unacceptable and has been criticized. Another issue of this model is that the authority remains a single point of failure for the lifetime of the system, that is, once the authority is compromised, all data in the system is exposed to the risk of breach.

[0010] Registered ABE (Reg-ABE) is an emerging variant of ABE that can be captured as a hybrid of ABE and a public key infrastructure. It completely removes the necessity of the authority and has no concerns mentioned above. In a Reg-ABE system, each user generates its own public key and secret key and registers the public key to a key curator in the system together with its attributes such as (Title: Professor, Department: Engineering). Then, the key curator validates the attributes that the user claims and aggregates registered public keys and attributes into a compact master public key (MPK). An encryptor uses the master public key and a policy such as ‘Title: Professor AND Department Economics’ to encrypt data, and the encrypted data can be decrypted only by users whose attributes satisfy the policy. For decryption, a user needs its secret key and a small public information called helper secret key (HSK). The point is that the key curator does not hold any secret information, and its behavior can be completely transparent: anyone can check if the key curator works correctly.

[0011] Various Reg-ABE schemes have been proposed from pairings, lattices, and indistinguishability obfuscation (iO) or witness encryption (WE). From the practical viewpoint, the schemes from iO and WE are prohibitively expensive due to the use of heavy machinery and the non-black-box constructions. The lattice-based schemes are much better than those but still far from practical due to the large modulus: the ciphertext size for 218users would exceed 1GB by conservative estimate. On the other hand, pairing-based constructions are much more efficient. Among the schemes from pairings, the most efficient scheme is arguably the prime-order schemeby Rachit Garg, George Lu, Brent Waters, and David J. Wu (GLWW) because other schemes use inefficient composite-order groups or are redundant due to the dual system constructions. Concretely, the ciphertext size of GLWW for 218users and a policy with a length of 30 attributes is only 42.4KB.

[0012] While GLWW is reasonably efficient, there is still a large gap between the state-of-the-art of practical vanilla ABE and GLWW:

[0013] The size of MPK: In contrast to ABE, the MPK in a Reg-ABE system is updated each time a user join the system, and thus users need to fetch the latest MPK frequently. Therefore, in Reg-ABE systems it is crucial that the MPK size is small. However, the MPK size of GLWW is far from desirable because it depends linearly on the number of attributes used in the system. Considering attributes such as an email address, the number of attributes used in the system may increase linearly in the number of users. For instance, the MPK size would be about 19MB for 218users in such a case.

[0014] The size of ciphertext: The ciphertext size of GLWW is still considerably large compared with FABEO, the state-of-the-art of an ABE scheme. Specifically the ciphertext size of FABEO for a policy with a length of 30 attributes is about 1.34KB, which is more than 30 times smaller than that of GLWW (note that the ciphertext size of FABEO is independent of the number of users).

[0015] Non-monotone policies: GLWW does not allow us to use NOT in policies, i.e., a black-listing access control, which is essential for many applications. For example, Cloudflare deployed a key distribution system named Portunus using ABE as a core technology. This system controls the distribution of customers’ secret key to edge servers by geographic attributes on the request of customers. Given the relationship between Countries A and B, it is realistic that customers in Country A are legally prohibited from storing their secret key in Country B. In such a case, it is necessary to use a policy such as ‘Country: NOT B AND Year: 2025’ so that edge servers with the attribute Country B cannot decrypt encrypted secret keys of customers in Country A. Although there exists a non-monotone Reg-ABE, it is much less efficient than GLWW. On the ABE side, there is a much more efficient non-monotone ABE scheme, which is used in Portunus.CCA-security: The security against chosen ciphertext attacks (CCA-security) is the de facto standard of the required security level of encryption in practice. Including GLWW, there is no CCA-secure Reg- ABE scheme or even no formal definition of the CCA-security of Reg- ABE. Possible techniques to achieve CCA-security would be the FO transformation or the CHK transformation. However, a quick attempt reveals that the CHK transformation and its variant does not work in Reg-ABE. The FO transformation makes decryption inefficient because it makes the decryption algorithm need to run the encryption algorithm. In contrast to public key encryption schemes, encryption algorithms of Reg-ABE is much inefficient because of the powers-of-two construction and the fact that the computational cost of encryption depends on the policy size. On the ABE side, the BK transformation (a variant of CHK) allows us to achieve CCA-secure schemes with a small efficiency loss.

[0016] SUMMARY

[0017] This summary is provided to introduce a selection of concepts in a simplified form that are further described below in the detailed description. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter.

[0018] According to an aspect of the present disclosure, a computer-implemented method for attribute-based encryption is provided. The method includes initializing a registered attribute-based encryption (RABE) scheme by executing a setup algorithm fsSetup(1λ, 1L) of an underlying slotted registered attribute-based encryption (SRABE) scheme to generate a common reference string crs, where A is a security parameter and L = dℓ— 1 is a maximum number of users, d ≥ 2 is a constant parameter, and ℓ is a positive integer. The method includes storing, in a computer memory, a public state aux =

[0019]

[0020] , 풟2, 풟3, mpk), where Pi, P2, and P3 are dictionaries, and mpk = (ctr, mpk0, . . . , mpkℓ−1) is a master public key with ctr being a counter of current users. The method includes generating a public key pk and a secret key sk for a user by executing a key generation algorithm of the SRABE scheme. The method includes registering a user by verifying the public key using a verification algorithm of the SRABE scheme, for each k in a speci-fied range, updating the public state using an aggregation algorithm of the SRABE scheme, and incrementing ctr and updating mpk and aux in the computer memory. The method includes receiving a plaintext message and storing it in the computer memory. The method includes encrypting the plaintext message by parsing mpk = (ctr, mpk0, . . . , mpkℓ−1). setting hdr = ctrct= ctr, determining a set W = {k | mpkk±}, and executing an encryption algorithm fsEnc of the SRABE scheme to compute (ctr, K)

[0021]

[0022] fsEnc((mpkk)k∈W, x, hdr), where x is an attribute, ctr is a ciphertext, and K is an encapsulated key. The method includes storing the encrypted output ctxin the computer memory. The method includes storing the updated public state aux and the master public key mpk in the computer memory.

[0023] According to other aspects of the present disclosure, the method may include one or more of the following features. The underlying slotted registered attributebased encryption (SRABE) scheme may comprise executing the setup algorithm fsSetup(1λ, 1L) to generate the common reference string crs comprising elements in bilinear groups G1, G2, and GTThe SRABE scheme may include executing the key generation algorithm to output a public key pk, and a secret key sk, for a user i. The SRABE scheme may include executing a verification algorithm to verify the public key pk,. The SRABE scheme may include executing the aggregation algorithm fsAgg to compute a master public key mpk and a set of helper secret keys {hskj}^*, where G* is a target set of user indices. The SRABE scheme may include executing the encryption algorithm fsEnc to compute a ciphertext ctxand an encapsulated key K using a matrix M ∈ Zpn×nrepresenting a span program and a labeling function a. The SRABE scheme may include executing the decryption algorithm fsDec to compute the encapsulated key K using a secret key sk,. a helper secret key hsk,. and the ciphertext ctxThe labeling function may map an index £ to a tuple (B^, U, V^), where Bℓ∈ {0, 1} is a bit, Lℓ∈ ℒ is a label, a

[0024]

[0025] nd G V is a value. ℒ may be a label space and 풱 may be a value space. The span program may support general non-monotone policies. Zpmay be a prime field of order p.

[0026] The specified range for updating the public state during user registration may be determined by a function fk(j, &) = j — (j mod dk+1) + bdk, where j is the usercounter, b is a digit in the base-d representation of j, k is an index, and d is a constant parameter.

[0027] Registering a user may further comprise computing

[0028] (mpk'k, {hskk,j}j∈풰) = fsAgg(crs,

[0029]

[0030] , y), 풰k★, 풟3[k], {풟1[k,j]}j∈풰), where fsAgg is the aggregation algorithm of the SRABE scheme, y is an attribute associated with the user, 풰k★is a set of indices determined by the function fk, crs is a common reference string, pkzis a public key, P3 and Pi are dictionaries, and mpk'kand hskk,jare updated master public key and helper secret keys respectively. Registering a user may further comprise updating 풟3[k] = mpk'kand 풟1[k,j] = hskk,jfor j ∈ 풰k★. If k is the minimum digit such that bk

[0031]

[0032] 0 in the base-d representation of the user counter, registering a user may further comprise updating mpkk= s[fc], mpkk, = ± f

[0033]

[0034] or k' ∈ [0, k − 1], and 풟2[k, bk, j] = 풟1[k, j] for j in a subset of 풰k★, where mpkkis the master public key for index k, ± denotes an empty or null value, and P2is another dictionary.

[0035] The method may further comprise generating a helper secret key hsk by parsing the public state aux and a public key pk = (ctrpk, pk'), where aux is the public state, pk is a public key, ctrpkis a counter associated with the public key, and pkzis the actual public key. If ctrpk≤ ctr, the method may include setting hsk = {풟2[k, b, ctrpk]}(k,b)∈[0,ℓ−1]×[d−1], where ctr is the current user counter, t is a positive integer, and P2is a dictionary. Otherwise, the method may include setting hsk = ±, where ± denotes an empty or null value.

[0036] The method may further comprise decrypting a ciphertext ctxusing a secret key sk = (ctrsk, sk') and the helper secret key hsk by parsing ctx= (hdr,...) and hdr = ctrct, where ctxis the ciphertext, hdr is a header, and ctrctis a counter associated with the ciphertext. If ctrsk> ctrct, the method may include outputting ⊥, where ctrskis a counter associated with the secret key. Otherwise, the method may include computing the base-d representations of ctrsk− 1 and ctrct, determining the maximum k such that the fc-th digits of these representations differ, and if hskk,b'≠ ⊥, where

[0037]

[0038] is the fc-th digit of ctrct, outputting fsDec(sk', hskk,b', ctx), where fsDec is the decryption algorithm of the SRABE scheme. Otherwise, themethod may include outputting a special flag getupd indicating the need for an updated helper key.

[0039] According to another aspect of the present disclosure, a system for attributebased encryption is provided. The system includes one or more processors and a computer memory. The system includes a set of instructions stored in the computer memory that, when executed by the one or more processors, cause the system to perform operations comprising initializing a registered attribute-based encryption (RABE) scheme by executing a setup algorithm fsSetup(1λ, 1L) of an underlying slotted registered attribute-based encryption (SRABE) scheme to generate a common reference string crs, where A is a security parameter and L = dℓ— 1 is a maximum number of users, d > 2 is a constant parameter, and t is a positive integer. The operations include storing, in the computer memory, a public state aux = (T>, T>2, T’s, mpk), where Pi, P2)and P3 are dictionaries, and mpk = (ctr, mpk0, . . . , mpkℓ−1) is a master public key with ctr being a counter of current users. The operations include generating a public key pk and a secret key sk for a user by executing a key generation algorithm of the SRABE scheme. The operations include registering a user by verifying the public key using a verification algorithm of the SRABE scheme, for each k in a specified range, updating the public state using an aggregation algorithm of the SRABE scheme, and incrementing ctr and updating mpk and aux in the computer memory. The operations include receiving a plaintext message and storing it in the computer memory. The operations include encrypting the plaintext message by parsing mpk = (ctr, mpk0, . . . , mpkℓ−1), setting hdr = ctrct= ctr, determining a set W = {k | mpkk≠ ⊥}, and executing an encryption algorithm fsEnc of the SRABE scheme to compute (ctx, K) ← fsEnc((mpkk)k∈W, x, hdr), where x is an attribute, ctr is a ciphertext, and K is an encapsulated key. The operations include storing the encrypted output ctxin the computer memory. The operations include storing the updated public state aux and the master public key mpk in the computer memory.

[0040] According to other aspects of the present disclosure, the system may include one or more of the following features. The underlying slotted registered attributebased encryption (SRABE) scheme may comprise executing the setup algorithm fsSetup(1λ, 1L) to generate the common reference string crs comprising elements inbilinear groups G, G2, and GT- The SRABE scheme may include executing the key generation algorithm to output a public key pk, and a secret key skifor a user i. The SRABE scheme may include executing a verification algorithm to verify the public key pk,. The SRABE scheme may include executing the aggregation algorithm fsAgg to compute a master public key mpk and a set of helper secret keys {hski}i∈풰, where 풰★is a target set of user indices. The SRABE scheme may include executing the encryption algorithm fsEnc to compute a ciphertext ctxand an encapsulated key K using a matrix M ∈ Zpn×nrepresenting a span program and a labeling function a. The SRABE scheme may include executing the decryption algorithm fsDec to compute the encapsulated key K using a secret key sk,. a helper secret key hsk,. and the ciphertext ctx. The labeling function may map an index £ to a tuple (B^, Le, Ve), where BeG {0, 1} is a bit, LeG G is a label, a

[0041]

[0042] nd G V is a value. ℒ may be a label space and 풱 may be a value space. The span program may support general non-monotone policies. Zpmay be a prime field of order p.

[0043] The specified range for updating the public state during user registration may be determined by a function fk(j, b) = j — (j mod dk+1) + bdk, where j is the user counter, b is a digit in the base-d representation of j, k is an index, and d is a constant parameter.

[0044] Registering a user may further comprise computing

[0045] (mpk'k, {hskk,j}j∈풰) = fsAgg(crs,

[0046]

[0047] , y), 풰k★, 풟3[k], {풟1[k,j]}j∈풰), where fsAgg is the aggregation algorithm of the SRABE scheme, y is an attribute associated with the user, Ukis a set of indices determined by the functionfc, crs is a common reference string, pkzis a public key, P3 and Pi are dictionaries, and mpk'kand hskk,jare updated master public key and helper secret keys respectively. Registering a user may further comprise updating 풟3[k] = mpk'kand 풟1[k,j] = hskk,jfor j ∈ 풰k★. If k is the minimum digit such that bk

[0048]

[0049] 0 in the base-d representation of the user counter, registering a user may further comprise updating mpkk= s[fc], mpkk, = ± for k' G [0, k — 1], and2[fc,&fe, ] = Pi[fe,j] for j in a subset of ldk, where mpkkis the master public key for index k, ± denotes an empty or null value, and P2is another dictionary.The operations may further comprise generating a helper secret key hsk by parsing the public state aux and a public key pk = (ctrpk, pk'), where aux is the public state, pk is a public key, ctrpkis a counter associated with the public key, and pkzis the actual public key. If ctrpk≤ ctr, the operations may include setting hsk = {풟2[k, b, ctrpk]}(k,b)∈[0,ℓ−1]×[d−1], where ctr is the current user counter, I is a positive integer, and T> is a dictionary. Otherwise, the operations may include setting hsk = ±, where ± denotes an empty or null value.

[0050] The operations may further comprise decrypting a ciphertext ctxusing a secret key sk = (ctrsk, sk') and the helper secret key hsk by parsing ctx= (hdr,...) and hdr = ctrct, where ctxis the ciphertext, hdr is a header, and ctrctis a counter associated with the ciphertext. If ctrsk> ctrct, the operations may include outputting ⊥, where ctrskis a counter associated with the secret key. Otherwise, the operations may include computing the base-d representations of ctrsk− 1 and ctrct, determining the maximum k such that the fc-th digits of these representations differ, and if hskk,b'≠ ⊥, where b'kis the k-th digit of ctrct, outputting fsDec(sk', hskk,b', ctx), where fsDec is the decryption algorithm of the SRABE scheme. Otherwise, the operations may include outputting a special flag getupd indicating the need for an updated helper key.

[0051] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium storing instructions that, when executed by one or more processors, cause the one or more processors to perform operations for attributebased encryption is provided. The operations include initializing a registered attributebased encryption (RABE) scheme by executing a setup algorithm fsSetup(1λ, 1L) of an underlying slotted registered attribute-based encryption (SRABE) scheme to generate a common reference string crs, where A is a security parameter and L = dℓ— 1 is a maximum number of users, d ≥ 2 is a constant parameter, and ℓ is a positive integer. The operations include storing, in a computer memory, a public state aux = (풟1, 풟2, 풟3, mpk), where Pi, P2, and P3 are dictionaries, and mpk = (ctr, mpk0, . . . , mpkℓ−1) is a master public key with ctr being a counter of current users. The operations include generating a public key pk and a secret key sk for a user by executing a key generation algorithm of theSRABE scheme. The operations include registering a user by verifying the public key using a verification algorithm of the SRABE scheme, for each k in a specified range, updating the public state using an aggregation algorithm of the SRABE scheme, and incrementing ctr and updating mpk and aux in the computer memory. The operations include receiving a plaintext message and storing it in the computer memory. The operations include encrypting the plaintext message by parsing mpk = (ctr, mpk0, . . . , mpkℓ−1). setting hdr = ctrct= ctr, determining a set W = {k | mpkk±}, and executing an encryption algorithm fsEnc of the SRABE scheme to compute (ctr, K) G- fsEnc((mpk / J / ,.eyy..r. hdr), where x is an attribute, ctxis a ciphertext, and K is an encapsulated key. The operations include storing the encrypted output ctxin the computer memory. The operations include storing the updated public state aux and the master public key mpk in the computer memory.

[0052] According to other aspects of the present disclosure, the non-transitory computer-readable storage medium may include one or more of the following features. The underlying slotted registered attribute-based encryption (SRABE) scheme may comprise executing the setup algorithm fsSetup(1λ, 1L) to generate the common reference string crs comprising elements in bilinear groups G1, G2, and GTThe SRABE scheme may include executing the key generation algorithm to output a public key pkiand a secret key skifor a user i. The SRABE scheme may include executing a verification algorithm to verify the public key pk,. The SRABE scheme may include executing the aggregation algorithm fsAgg to compute a master public key mpk and a set of helper secret keys {hski}i∈풰, where 풰★is a target set of user indices. The SRABE scheme may include executing the encryption algorithm fsEnc to compute a ciphertext ctxand an encapsulated key K using a matrix M ∈ Zpn×nrepresenting a span program and a labeling function a. The SRABE scheme may include executing the decryption algorithm fsDec to compute the encapsulated key K using a secret key skj, a helper secret key hski, and the ciphertext ctxThe labeling function σ may map an index ℓ to a tuple (Bℓ, Lℓ, Vℓ), where Bℓ∈ {0, 1} is a bit, Lℓ∈ ℒ is a label, and Vℓ∈ 풱 is a value. ℒ may be a label space and 풱 may be a value space. The span program may support general non-monotone policies. Zpmay be a prime field of order p.The specified range for updating the public state during user registration may be determined by a function fk(j, b) = j — (j mod dk+1) + bdk, where j is the user counter, b is a digit in the base-d representation of j, k is an index, and d is a constant parameter.

[0053] Registering a user may further comprise computing

[0054] (mpk'k, {hskk,j}j∈풰*) = fsAgg(crs,

[0055]

[0056] ,y),ld*,'D3[k], {'D1[k,j]}jeU^, where fsAgg is the aggregation algorithm of the SRABE scheme, y is an attribute associated with the user, 풰k⋆is a set of indices determined by the function fk, crs is a common reference string, pkzis a public key, 풟3and 풟1are dictionaries, and mpk'kand hskk,jare updated master public key and helper secret keys respectively. Registering a user may further comprise updating 풟3[k] = mpk'kand T>i[k, j] = hsk^ for j E Uk. If k is the minimum digit such that bk

[0057]

[0058] 0 in the base-d representation of the user counter, registering a user may further comprise updating mpkk= 풟3[k], mpkk, = ± for k' E [0, k — 1], and 풟2[k,bk,j] = 풟1[k,j] for j in a subset of ldk, where mpkkis the master public key for index k, ± denotes an empty or null value, and 풟2is another dictionary.

[0059] The operations may further comprise generating a helper secret key hsk by parsing the public state aux and a public key pk = (ctrpk, pk'), where aux is the public state, pk is a public key, ctrpkis a counter associated with the public key, and pkzis the actual public key. If ctrpk≤ ctr, the operations may include setting hsk =

[0060]

[0061] {풟2[k, b, ctrpk]}(k,b)∈[0,ℓ−1]×[d−1]- where ctr is the current user counter, t is a positive integer,

[0062]

[0063] and is a dictionary. Otherwise, the operations may include setting hsk = ±, where ± denotes an empty or null value.

[0064] The operations may further comprise decrypting a ciphertext ctxusing a secret key sk = (ctrsk, sk') and the helper secret key hsk by parsing ctx= (hdr,...) and hdr = ctrct, where ctxis the ciphertext, hdr is a header, and ctrctis a counter associated with the ciphertext. If ctrsk> ctrct, the operations may include outputting ±, where ctrskis a counter associated with the secret key. Otherwise, the operations may include computing the base-d representations of ctrsk− 1 and ctrct, determining the maximum k such that the fc-th digits of these representations differ, and if hskk,b'

[0065]

[0066] ±, where is the fc-th digit of ctrct, outputting fsDec(skz, hskk,b', ctr),where fsDec is the decryption algorithm of the SRABE scheme. Otherwise, the operations may include outputting a special flag getupd indicating the need for an updated helper key.

[0067] The foregoing general description of the illustrative embodiments and the following detailed description thereof are merely exemplary aspects of the teachings of this disclosure and are not restrictive.

[0068] BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Non-limiting and non-exhaustive examples are described with reference to the following figures.

[0070] FIG. 1 illustrates a block diagram of a registered attribute-based encryption system, according to aspects of the present disclosure.

[0071] FIG. 2 illustrates a flowchart of a slotted conversion process, according to an embodiment.

[0072] FIG. 3 illustrates a flowchart of a registered encryption process, according to aspects of the present disclosure.

[0073] FIG. 4 illustrates a block diagram of a slotted registered attribute-based encryption system, according to an embodiment.

[0074] FIG. 5 illustrates a flowchart of a powers-of-d conversion process, according to aspects of the present disclosure.

[0075] FIG. 6 illustrates a block diagram of a slotted registered attribute-based encryption computing architecture, according to an embodiment.

[0076] FIG. 7 illustrates a block diagram of a registered attribute-based encryption distributed network architecture, according to aspects of the present disclosure.

[0077] FIG. 8 illustrates a comparison table among slotted registered attribute-based key encapsulation mechanism schemes, according to an embodiment.

[0078] FIG. 9 illustrates a comparison table among full-fledged registered attributebased key encapsulation mechanism schemes, according to aspects of the present disclosure.

[0079] DETAILED DESCRIPTION

[0080] The following description sets forth exemplary aspects of the present disclosure. It should be recognized, however, that such description is not intended as a limitationon the scope of the present disclosure. Rather, the description also encompasses combinations and modifications to those exemplary aspects described herein.

[0081] A detailed description of systems, devices, and methods consistent with embodiments of the present disclosure is provided below. While several embodiments are described, it should be understood that disclosure is not limited to any one embodiment, but instead encompasses numerous alternatives, modifications, and equivalents. In addition, while numerous specific details are set forth in the following description in order to provide a thorough understanding of the embodiments disclosed herein, some embodiments can be practiced without some or all of these details. Moreover, for the purpose of clarity, certain technical material that is known in the related art has not been described in detail in order to avoid unnecessarily obscuring the disclosure.

[0082] 1. Reg- ABE Scheme. To fill the gap between ABE and Reg- ABE, we present a practical Reg-ABE scheme with the following properties.

[0083] — In a typical parameter setting with 218users (concrete parameter are given in Tables 1 and 2), the MPK and ciphertext sizes of our scheme are both about 7.5KB and more than 2,000 x and 5x smaller than those of GLWW, respectively. The sizes of HSK and a state (or auxiliary data) maintained by a key curator are also more than 40 x and 70 x smaller than those of GLWW, respectively. The size of common reference string of ours is about a half of that of GLWW. As well as GLWW and other schemes, our scheme is completely unbounded in a sense that we can use any string as an attribute (large universe), and there is no bound on the number of attributes each user owns, policy size, and the maximum number of the same attributes appeared in a single policy. An efficiency disadvantage against GLWW is the number of updates of HSK, which is about 190 times in the lifetime of the system while that of GLWW is 19 times. However, considering the typical update frequency for apps and the fact that the communication cost of each HSK update is about 8KB on average, the disadvantage would barely matter in most applications. (Note that a user basically downloads a HSK ofslotted scheme for each update, and the communication cost of each update of our scheme corresponds to |hskz| in Table 2.)

[0084] — Our scheme can handle the most general type of non-monotone policies expressed by span programs or Boolean formulas, i.e., general non-monotone span programs (GNMS). GNMS is a class of non-monotone span programs that unifies the previous two types of non-monotone span programs.

[0085] — Our scheme satisfies CCA-security in the generic group model and the random oracle model.

[0086] — Our scheme needs a one-time trusted setup to generate a common reference string as well as many other schemes. We emphasize that this is quite different from the authority in ABE because a trusted party is only needed at the beginning to start the system, or we can even eliminate the necessity of the trusted party by relying on multi-party computation to generate the common reference string. 2. Variants. We also present two variants of our main scheme. The first variant is Reg- ABE scheme for monotone policies, i.e., we cannot use NOT in policies. Instead, this variant is simpler and more efficient than our main scheme. A caveat is that this scheme has a limitation such that | (L)| < 1 for all L G £, that is, we can use only labels, the corresponding value of which is uniquely determined for each user, such as age, gender, zip-code, address, etc.

[0087] The second variant is the scheme based on standard assumptions and the standard model. We adapt our main scheme to the dual system construction. The resulting scheme supports completely unbounded general non-monotone span programs and achieves CPA security under the fe-Lin assumption. While this variant is less efficient than our main scheme, it is still much more efficient than other schemes, which is the only known scheme with the same functionality as ours.

[0088] 0.1 More Details of the Scheme

[0089] We elaborate on our new scheme below.

[0090] Attributes. In this paper, we identify an attribute as a pair of a label and a value. For instance, an attribute ‘Title: Professor’ consists of a label ‘Title’ and a value ‘Professor’. Each user is associated with a set of attributes as S = { (Li, Vi),..., (Ln, Vra)}where Lj∈ ℒ, Vi∈ V for some label space ℒ and value space V. Note that we do not require Lj

[0091]

[0092] Ljfor i ≠ j unless otherwise specified. Such a set S of attributes can be represented by a function φ: ℒ → 2Vwhere 2Vis the power set of V, i.e., we can define S = {(L, V) ∈ ℒ × V | V ∈ φ(L)}. We call φ a user attribute (we may omit “user” if it is clear in the context).

[0093] Efficiency Improvement. There are two technical development to achieve our efficient scheme. The first key technique is to separate an attribute into a label and a value as described above. In fact, this treatment of attributes is quite natural in the real world, thinking of something like a relational database. On the other hand, GLWW treats an attribute just as a single element or a string. This is why the sizes of MPK, HSK, and the state size of key curator in GLWW are all linear in the number of attributes used in the system. That is, to handle attributes consisting of a label and a value in a GLWW scheme where L users with user attributes i,...,

[0094]

[0095] are registered, these sizes need to be all linear in a = |{(L, V) ∈ ℒ × V | ∃i ∈ [L], V ∈ φi(L)}|. Considering a label L G £ such as an email address, it is realistic that φ1(L)[1],..., φL(L)[1] are all distinct values in V, where we denote the j-th element of a set by S by S'fj]. In such a case, these sizes increase linearly in the number of users, which is not desirable.

[0096] In contrast to GLWW, our scheme handles a label and a value separately. This handling of attributes allows us to construct a scheme where the MPK, HSK, and state sizes all depend only on the number b of labels used in the system and the maximum number

[0097]

[0098] of attributes with the same label owned by a single user, i

[0099]

[0100] .e., b = |{L ∈ ℒ | ∃i ∈ [L], φi(L) ≠ ∅}| and = maxi∈[L],L∈ℒ|φi(L)|. (Precisely, the MPK, HSK, and state sizes of our scheme all depend linearly on c

[0101]

[0102] = ΣL∈ℒs(L)(ρ(ℓ,L) + 1) where ρ(L) = maxi∈[L]|φi(L)|, and it is easy to see that c ≤ b(μ̄ + 1).) It is reasonable to assume that b and Ji are independent of the number L of users and much smaller than L. Hence, as the number of users increases, our scheme becomes more efficient compared to GLWW. From the viewpoint of scheme design, GLWW can be seen as a special case of our scheme where V = {1}. Hence, we need to handle all attributes in the label space £, which brings the size dependence with the number of attributes used in the system.The second key technique is a generalization of the powers-of-two construction, which is a common technique to lift a slotted Reg-ABE scheme to a full-fledged Reg-ABE scheme. In this construction, the sizes of MPK, HSK, and ciphertext in the Reg-ABE scheme are logL times larger than those in the underlying slotted Reg-ABE scheme, and the number of the HSK updates is at most logL during the lifetime of the system to support L users. (In some schemes, the factor of the size increase and the number of the HSK updates are both logL + 1, but we ignore the +1 here for conciseness.) Our observation is that we can generalize it to the powers-of-d construction where the size increase of MPK and ciphertext is a factor of logdL while the size increase of HSK becomes a factor of (d — 1) logdL. Additionally, the number of the HSK updates becomes (d — l)logdL. For instance, let L = 218and d = 26. Then, the powers-of-d construction enables us to achieve a 6x space efficient scheme than the powers-of-two construction with respect to the sizes of MPK and ciphertext. On the other hand, the HSK size and the number of the HSK updates get worse by factor of about 10. However, considering the fact that the communication frequency of MPK and ciphertext is much higher than that of HSK in the powers-of-two construction, the benefits of this trade-off far outweigh the drawbacks. Note that previous slotted Reg-ABE schemes are not compatible with the powers-of-d construction, and we introduce an extended notion that we call flexible slotted Reg-ABE to make it compatible with the powers-of-d construction.

[0103] Range Policies. Our scheme can also handle range policies efficiently. It is common that a value in an attribute is an element in a totally ordered set V such as a set of integers. In such a case, range policies are very useful that specify a range of acceptable attributes. Concretely, a range policy is a policy that contains a Boolean variable such as ‘ZIP-Code:17000 < X < 25000’, which is satisfied by an attribute ZIP-Code: X such that 17000 < X < 25000. It is known that range policies can be efficiently handled by using a binary tree whose leaf nodes correspond to the elements in V and mapping v G V to a path from the root node to a leaf node corresponding to v. If we apply this technique to GLWW, the MPK, HSK, and state sizes are linear in the number of nodes in all the paths used by users, and thus typically large. In contrast, our scheme only uses one label to handle the binarytree because each user can have multiple values (corresponding to the nodes in the path) associated with a single label, and the additive overhead of the MPK, HSK and state sizes due to the binary tree construction is only O(log |V|).

[0104] Non-Monotone Policies. There have been two types of non- monotone ABE schemes, namely the OSW type and the OT type, and both types have some limitation. Roughly speaking, the OSW type can handle only the case where ℒ = ∅, and the OT type can handle only the case where |

[0105]

[0106] |φ(L)| ≤ 1 or |φ(L)| ≤ π for all L ∈ ℒ where π is a priori fixed constant. As discussed in some works, the OSW type is very inconvenient for systems where attributes used in the system increases dynamically. Having a parameter bound as the OT type is also not desirable for scalable systems because once the parameter is fixed, then user attributes that exceed the bound are never be able to be used, while setting unnecessarily large bound lose the system efficiency. General non-monotone ABE, recently introduced, is a new type of non-monotone ABE that does not suffer from either of limitations. Very recently, a Reg- ABE scheme for general non- monotone policies was presented, but their scheme is quite complex and inefficient. To achieve a practical Reg- ABE scheme for general non-monotone policies, we devise a new method that exploits the construction specific to Reg-ABE. Concretely, in Reg- ABE scheme from the powers-of-d construction, fixed parameters in the underlying slotted scheme can be changed each time a user join the system. Using this fact, we first construct a non-monotone slotted scheme for the OT-type by extending GLWW and then enable our Reg-ABE system to update the current parameter π̄ if the new user attribute to be registered has a parameter π̄' > π̄.

[0107] CCA-security. To achieve CCA-security in Reg-ABE efficiently, we introduce a new methodology. Specifically, we first construct a CCA-secure slotted Reg-ABE scheme and then lift it to a CCA-secure Reg-ABE scheme. Compared with the FO transformation, our approach brings little efficiency loss in decryption. We also show that we can construct a CCA-secure slotted Reg-ABE scheme that is as efficient as CPA-secure slotted Reg-ABE schemes. As a result, our Reg-ABE scheme has almost the same efficiency as the CPA-variant of our scheme. Giving the first formaldefinition of the CCA-security for Reg-ABE and slotted Reg-ABE is also one of our contributions.

[0108] Comparison. We present comparisons of our schemes and previous schemes in the key encapsulation mechanism (KEM) setting in Tables 1 and 2. Table 1 shows a comparison among all known slotted Reg-ABE schemes from pairings that supports large attribute universe. Ours 2 refers to our main scheme, Ours 1 refers to the monotone variant, and Ours 3 refers to the variant from standard assumptions. All our schemes are compatible with the powers-of-d construction.

[0109] Table 2 shows a comparison among full-fledged Reg-ABE schemes. We compare our scheme with the only known Reg-ABK scheme that supports general nonmonotone span programs other than ours, and the most efficient Reg-ABE scheme although it does not support non-monotone policies. We also provide concrete sizes of each element for a typical parameter setting.

[0110] 0.2 Related Works

[0111] The study of registration-based model started with registration-based encryption, which is a registration variant of identity-based encryption. The registration-based variant of functional encryption is also intensively studied. Another line of works that has tried to solve the key-escrow problem in ABE is for multi-authority ABE, in which the power of the authority in ABE is distributed multiple parties, but still each authority has a power to decrypt ciphertexts for some policies. More generalized distributed models are considered in the context of functional encryption, but they are also incomparable to the registration-based model.

[0112] 1 Technical Overview

[0113] Slotted Reg-ABK. We briefly recall slotted Reg-ABK (the KEM version of slotted Reg-ABE. A slotted Reg-ABE scheme is started by generating and publishing common reference string crs. Each user generates a pair of its public and secret keys (pk, sk) from crs. The number L of users who can join the slotted Reg-ABE scheme is fixed in advance, and all users join the system all at once by registering their pk and user attribute (f>. Then, the key curator generates a compact master public key mpkand helper secret keys hsfo for user i in a deterministic manner. An encryptor takes mpk, a policy P such as Boolean formula or span program, and generates ciphertext ct and a key K. Finally, ct can be decrypted to K with sk, and hsfo for user i if and only if P accepts

[0114]

[0115] The main difference between slotted scheme and full-fledged scheme is whether the registration is dynamic. In what follows, we assume that the policy is expressed by a span program.

[0116] Recap of GLWW. Our starting point is the slotted Reg-ABE scheme of GLWW. Let e: G1× G2→ GTbe bilinear groups, and [·]idenotes element-wise exponentiation to gi∈ Gi. As mentioned above, each attribute of GLWW can be seen as an element in fi x V where C = {0, 1}*, V = {1}, and a user attribute for user i can be represented by φ: ℒ → {0, {1}}• In other words, φ(L) = {1} means that user i has an attribute L ∈ {0, 1}*. Let S = {L ∈ ℒ | ∃i ∈ [L], φ(L) ≠ ∅}. The KEM variant of their scheme with slight modification is described as follows:

[0117] crs = ([u, {n }e[L]]i, [{rg, rgv + a}je[L], {wz}zer]2, NT)

[0118] pki = ([nji,

[0119]

[0120] skj = in

[0121] mpk = ([y + Σj∈[L]uj, {Σj∈[L]:φ(L)=∅...}]1, NT)

[0122] ? QL (!)

[0123]

[0124] hskj — [f'i, { Eje[L]\{i}:<y|(L)=0 Eje[L]\{i} Up'ip'jV 0)2

[0125]

[0126] ct [s, §i,..., sni, {m / S T }re[ni]:<7(r)es] 1 ■> K [scjr

[0127]

[0128] Ct£

[0129] where L is the number of slots, ct is for a span program (M, σ) such that M ∈ Zpn×nand σ: [n1] → ℒ, mℓis the ℓ-th row of M, A = {δj}j∈[L]and Γ are sets specified below, and we chose a, a,b,v, s, sg, Sk G- Zpfor (£, fc) G [nJ x [2,n2] and set Tj = aSj, Vj = baSj,wz= baz, s = (

[0130]

[0131] sq, s2,..., sn2). The set A is a set satisfying that δi+ δj∉ 2Skand

[0132]

[0133] δi∉ 2Skfor all i, j, k ∈ [L] such that i ≠ j. Γ is the set such that Γ = {δi+ δj| i, j ∈ A, i ≠ j}. Observe that we have ViVj= wδ+δ, and the sizes of mpk, hsk are linear in |S| where S is the set of attributes used in the system.

[0134] Intuitively, since user i can compute e([s]1, [ηi]2) = ηir + sσr, whether it can compute K = [sα]Tdepends on whether it can compute ηiηT. The only way tocompute

[0135]

[0136] is to find c ∈ ℝmand {tr}r∈Γsuch that

[0137]

[0138] = (1, 0) and compute

[0139] ∏ e([ctℓ]1, [η]2)c= [sr-iV + STi £ «, + £ seriq^T (2) £ET je[L] £ET

[0140]

[0141] Recall that the span program (M, σ) accepts

[0142]

[0143] iff {mℓ}ℓ∈[n]:σ(ℓ)∈Sspan (1,0,...,0). That is, if the span program accepts (, there exist C [m] and {tr}reT satisfying Eq. (2) and ησ(r)= ησ(r)for t G. Hence, user i can compute [sα]Twith ski, hskiand obtain [sα]TLet us consider the simplest case where L = rq = n2= 1 and M = (1) to ease the exposition of our ideas, and GLWW in this case can be described as

[0144] crs = ([T, vi]i, [T + cu]2, NT)

[0145] pk1= [α1]1, sk1= α1

[0146] mpk = ([y + α1, {0}L∈S]1, NT), hsk1= [u + α]2c

[0147]

[0148] ct = [s, s1, {s(τ + α1)}if σ(1)∈S]1, K = [sα]T

[0149] where {·}if prop= x if prop is true, and {·}if prop= 0 otherwise. We also use this notation in what follows. Note that we omit τ1since they are unnecessary if L = 1.

[0150] Expanding Value Space. The modification of expanding the value space V from {1} to Zp, while keeping the size of mpk (and hskj if L > 1) being O(|5|), is quite simple. Specifically, we change GLWW as follows. Note that the user attribute of user 1 is now specified by

[0151]

[0152] V ∪ {0}, and the labeling function in the span program is defined as σ: [n1] → ℒ × V.

[0153] crs = ( [u, TI] i, [u + a]2, NT)

[0154] pkx= [M I, ski = MI

[0155] mpk = ([y + w1, τ1, {−η(L,·)}L∈S]1, NT), hskx= [T + CU]2

[0156] ct = [s, s1, {s(τ + α1) + (V1− φ1(L1))sτ1}if σ(1)∈S]1, K = [sα]Twhere < T(1) = (LX, VX). Recall that the span program (M,a) where M = (1) acceptsXif user 1 has an attribute < T(1) = (LX, VX), i.e., i(Lx) = Vx. Observe that user 1 can compute [ST]T and thus K ifX(LX) = Vxwhile it cannot efficiently compute otherwise. Intuitively, [ST]T is not efficiently computable from [s, u]xin the case LxS, and [(Vx— <^X(LX))SXTX]Xcomputationally hides [su]xin the case LxG 5 butX(LX) 7^ Vx. The general version of the above scheme is basically the monotone variant of our main scheme.

[0157] Multiple Values per Label. Allowing users to have a bounded number of multiple values for a single label is doable in a similar manner in vanilla ABE. Let us consider the caseX: B 2Vand | i(L)| < 2 for all L G £. We modify mpk and ct of the above scheme as follows:

[0158] mpk = ([u + m, { — (<^>x(L) [1] + ^x(L)[2])vx, ^x(L)[l]^x(L)[2]vx}Les]i, NT) ct = [s, sx, {s(u + Ui) + (Vx-X(LX)[1])(VX- ^i(Lx)[2])sXTX}ifL1es]i

[0159] where (!_)[£] denotes the £-th element of i(L), and (f>i (L) [2] is set to 0 if | i(L)| = 1. It is easy to extend the above construction to the case |X(L)| < B for some a priori fixed bound B. As mentioned in the introduction, our critical observation is that even if there is a bound B in the slotted scheme, we can remove this bound when convert it to a full-fledged Reg-ABK scheme via the powers-of-two construction. This is because the bound B is fixed when mpk is generated, and in the full-fledged scheme, mpk is updated each time a user join the system. Furthermore, this idea can be extended to the powers-of-d construction. For simplicity, we stick to the case (f>i: B — V ∪ {0} in what follows.

[0160] Non-monotone Policies. For non-monotone policies, in which we can use nonpossession of an attribute as a Boolean variable, the labeling function is defined as a: [x] — {0, 1} x x V. The span program (M, < T) where M = (1) and (l) = (BX, LX, VX) accepts (f>i if Bx= 1 and user 1 has an attribute (Lx, Vx), i.e.,X(LX) = Vx, or Bx= 0 and user 1 has an attribute for Lx, but its value is not Vx, i.e.,X(LX) 7^ Vxand <^X(LX) 7^ 0. As discussed in prior work, defining non-possession of an attribute as user 1 not having cr(l) = (Lx, Vx) is too strong for the case whereattributes used in the system increase dynamically. This would apply to our schemes, as they can handle any string as an attribute. The scheme that allows non-monotone policies can be achieved as follows:

[0161] crs = ([u, vi]i, [u + cu]2, MT)

[0162] p

[0163]

[0164] kx= ski = MI

[0165] mpk = ([M + Ml, Ml, {- I(L)(M + Ml), -< L) i}Le<s]i, [a]r) hsk| |c | o|2- ct = [s, Si, {cti}if L1es]i, K = [sa]r

[0166] [S(M + MI)(VI - i(Li)) (Bi = 0)

[0167] where cti = <. We can observe that the + Ml) + (Vi — 1(L1))S1M1 (Bl = 1)

[0168] case for Bx= 1 is the same as the monotone scheme, and in the case Bx= 0, ctxreveals no information on sv if i(Lx) = Vx.

[0169] While this construction works for the simplest case, it turns out it does not work for the general case. Let M = (1, 1) and L > 1. Then, ctxfor Bx= 0 will be

[0170] cti = ^2(s(f)j + Uj) + s2j)(Vi - N(Li))

[0171]

[0172] te[L]

[0173] where u, s2are substituted with A,-, s2for security reasons, and

[0174]

[0175] Z)2e[L](^t+w)N(l-i) and

[0176]

[0177] + Uj) can be included in mpk. The problem is that the encryptor cannot compute C =

[0178]

[0179] Z)2e[L] NC-I)A- This is because Sj for j E [L] is chosen by the encryptor, and thus C cannot be included in mpk. We resolve this issue by replace C

[0180]

[0181] with C' = s2IZ2e[L] where Z)2e[L]canbe included in mpk, and [C]i [C"]i given [S2, MI,..., ML]I (note that Vj is given in crs as in Eq. (1)).

[0182] Powers-of-d Construction. The role of the powers-of-two construction, which convert slotted Reg-ABK to Reg-ABK, is to allow users to dynamically join the system without frequent updates of HSK. Suppose L = 2^ℓ − 1 where L is the maximum number of users in the resulting Reg-ABK system by the powers-of-two construction. In the original construction of prior work, we need £ instances of the slotted scheme for L = 2 / ~lusers, but we can optimize it to support almost twice users with a slight modification. Then, the Reg-ABK system executes I slottedschemes where the fc-th scheme has 2k-1slots. When the j-th user joins the system, it is assigned to LS(j)-th scheme where LS(j) is the index of the least significant bit that is 1 in the binary representation of j. At the registration of the user j, users in the schemes with a lower index than LS ) are moved to LS(j)-th scheme and their public keys are aggregated into the MPK of the LS(j)-th scheme. The HSK updates of each user are needed when the location of the user is changed, and the maximum number of HSK updates is at most t because the user location never decreases in this construction. Due to the parallel construction, the sizes of MPK, HSK, ciphertext become £ times larger than those of the underlying slotted scheme.

[0183] Our idea is to reduce the number of parallel instances of slotted scheme by just changing the definition of LS j') as the index of the least significant digit that is not 0 in the base-d representation of j for d > 2. By this “the powers-of-d” construction, we can handle L = dℓd− 1 users by

[0184]

[0185] instances of the slotted scheme and reduce the sizes of MPK, ciphertext of the powers-of-two construction by a factor of logd. The downside of it is the size of HSK and the number of updates become

[0186]

[0187] times worse than the powers-of-two construction.

[0188] A caveat of the “the powers-of-d” construction for d > 2 is that the underlying slotted scheme needs to support partial aggregation, meaning that it can aggregate any number of public keys. We call such slotted Reg-ABK flexible slotted Reg-ABK in this paper. We also remark that the incremental aggregation, which is a technique to reduce the state size of a key curator introduced by prior work, is not compatible with the powers-of-d construction for d > 2 and further modify the slotted scheme to make it compatible with the powers-of-d construction (see Section 2 for details).

[0189] 2 Preliminaries

[0190] Notations. For n,m ∈ N, [m] and [n,m] denotes {

[0191]

[0192] !,..., m} and respectively. A digit string yn... y0in x = (yn...

[0193]

[0194] / o)<£ where yi E [0, d — 1] is the base d representation of x. 0 denotes a zero vector (with sizes corresponding to the context). For a vector v, [v]xfor x E {1, 2, T} denotes element-wise exponentiation to gx. For vectors u = (tq,..., wra), v = (iq,..., vra), u © v = («©!,..., unvn) denotes the element-wise multiplication, and (u,v) = 52 wq denotes the inner product,and e([u]1, [v]2) denotes the computation ∏e([u]1, [v]2) = [(u, v)]T. For elements czi,...,an, t G span(

[0195]

[0196] ni,...,an) O 3Q,...,craG Zp,t = J2ie[ra]•For setS, s S means that s is uniformly chosen from S, and S'fz] means the z-th element of S in the lexicographical order. For a function / , lm( ) is the image of / . For two families of distributions A = {A}, B = {BA}, A ~ B and A «sB mean A and B are computationally and statistically indistinguishable, respectively.

[0197] 2.1 Definitions

[0198] Definition 2.1 (Bilinear Groups). Let {GA}AEN be a family of bilinear groups. Bilinear groups = (p, G1, G2, GT, g1, g2, e) are specified by a prime p, cyclic groups Gi, G2, Gy of order p, generators g1and g2of G1and G2respectively, and a bilinear map e: G1× G2→ GT, which has two properties.

[0199] (Bilinearity): V

[0200]

[0201] / zi G Gi, h2G G2, a, b G Zp, e(h“, h%) = e( / zi, h2)“6.

[0202] (Non-degeneracy): For g1and g2, gT= e(g1,g2) is a generator of GT. In what follows, we omit the index A from GA and abuse notation by denoting a family of bilinear groups {GA}AEN also by G if it is clear in the context.

[0203] There are basically two types of the generic group model, namely, Shoup’s model and Maurer’s model. In this paper, we need an explicit representation of group elements because we compute hash functions on group elements in our constructions. Thus, we employ Shoup’s model.

[0204] Definition 2.2 (Generic Bilinear Group Model). We use the generic (asymmetric) bilinear group model based on Shoup’s model. In what follows, we call this model just the generic group model (GGM). Let p G N be a prime, Q be a set of bit strings where p / \Q\ < negl(A), and G1, G2, GT: Z

[0205]

[0206] p— > (y be random injective labeling functions. In the GGM, parties can access the following oracles.

[0207] Labeling oracle OLab: It takes (x,t) ∈ {1, 2, T} × Zpas input and returns Ga;(t).— Group operation oracle OGrp: It takes (x, t1, t2) ∈ {1, 2, T} × Ω2× Zpas input. If G“x(gi) and Gfx(g2) exist, returns G^tiG^.x(gi ) + t2Gxx(g2)). Otherwise, outputs ±.

[0208] - Pairing oracle OPair: It takes (gi,g2) G Q as input. If G]“x(gi) and G. J1(g2) exist, returns GT(G]”x(gi) • Gfx(g2)). Otherwise, outputs ±.

[0209] In this model, Gx(a) corresponds to gf in bilinear groups for (rr, a) G {1, 2, T} x Zp.

[0210] Lemma 2.1 (Schwartz-Zippel Lemma). Let R be an integral domain, f ∈ R[x1,...,xn] be a non-zero n-variate polynomial over R of degree at most d, and S be a finite subset of R. Then, we have

[0211] Pr[f(x1,...,xn) = 0: x1,...,xn←$ S] ≤ d / |S|

[0212] Lemma 2.2. If R is an integral domain, then the polynomial ring R[ i,...,xn\ in n variables is also an integral domain. Especially, Zp[x1,...,xn] is an integral domain since Zpis a field and thus an integral domain.

[0213] We take the definition of registered ABE with the notation except CCA-security (they consider only CPA-security). We consider KEM instead of encryption since it may be simpler.

[0214] Definition 2.3 ((Bounded) Registered AB-KEM). (If the maximum number of users that can join the system is bounded by a polynomial, it may be called a bounded registered AB-KEM scheme.) Let P: X × Y → {0, 1} be a predicate. Let K be a key space. A registered AB-KEM (Reg-ABK) scheme for P consists of the following algorithms.

[0215] Setup(lA, 1L): It takes a security parameter 1Aand the number of users in unary 1Las input, and outputs a common reference string crs.

[0216] Gen(crs, aux): It takes crs and a public state aux as input, and outputs a public key pk and a secret key sk.

[0217] Reg(crs, aux, pk, y): It takes crs, aux, pk, y ∈ Y as input, and outputs a master public key mpk and updated state aux.Encfmpk. r): It takes mpk, x G as inputs, and outputs a ciphertext ctxand a key K G C

[0218] Upd(crs, aux, pk): It takes (crs, aux, pk) as input and outputs a helper secret key hsk.

[0219] Dec(sk, hsk, e c): It takes (sk,. hsk,. ct, ) as input, and outputs a key K or a symbol 1 or a special flag getupd to indicate the need of an updated helper key.

[0220] Correctness. For all stateful adversary A, the following advantage function may be negligible in A:

[0221] Pr[ / 3 I: crs v- Setup(lA, lL), / 3 = o, 40RegNT(-)’0RegT(-)’0Enc(-)’0Dec(-)(crs)]

[0222] where the oracles work as follows with initial setting aux = ±, 5 = 0,7?. = 0,7 = ±:

[0223] ORegNT(pk, y): run (mpk, aux') ← Reg(crs, aux, pk, y), update aux = aux', append (mpk, y, aux) to TZ and return (|7?.|, mpk, aux);

[0224] ORegT(y*): run (pk*,sk*) ← Gen(crs, aux), (mpk, aux') ← Reg(crs, aux, pk*, y*), update aux = aux', compute hsk* G- Upd(crs, aux, pk*), append (mpk, y*, aux) to 7Z, return (7 = |7?.|, mpk, aux, pk*, sk*, hsk*);

[0225] OEnc(i, x): let R[i] = (mpk, *, *), run (ctx, K) ← Enc(mpk, x). append (x, K,cC) to 8 and return (|£|,ct);

[0226] ODec(j): let S[j] = (xj, Kj, ctx), compute K' ← Dec(sk*, hsk*, ctx), if K' = getupd, run hsk* ← Upd(crs, aux, pk*) and recompute K' ← Dec(sk*, hsk*, ctx). Set β = 1 when K' ≠ Kj;

[0227] with the following restrictions:

[0228] there exists one query to ORegT (we can consider y*, pk*,sk*, hsk* to be global);for query (z,rr) to OEnc, it holds that z

[0229]

[0230] > t, 7?.[z] ± and P(rr, z / *) = 1; for query j to ODec, it holds that 8[j] ±.

[0231] Perfect correctness requires the above probability to equal 1.

[0232] Compactness and Efficiency. (Since we consider only large-universe Reg-ABE in this paper, we use the compactness for large-universe constructions.) Let 1Z be defined as before. Compactness refers to the property that

[0233] |mpk| = poly(λ, log |Y|, log z), |hsk*| = poly(λ, log |Y|, log |R|)

[0234] where we let 7?.[z] = (mpk^z / j, *) for all z G [|7 |]. Furthermore, update efficiency means that the number of invocations of Upd in ODec may be at most O(log |7?.|) and each invocation costs poly(log |7?.|) time in |7?.| (in the RAM model).

[0235] CCA-Security. For all stateful admissible adversaries A, the advantage

[0236] β ←$ {0, 1}; L ← A(1λ); crs ← Setup(1λ, 1L); K1←$ K, x* ( ^ORegCK(-), ORegHK(-), OCor(-), ODec(.) (crs) (ct*, Ko) G- Enc(mpk. r): / 3' G- ^^^(ct*, K^)

[0237]

[0238] may be negligible in A, where the oracles as follows with initial setting aux, mpk = ±, 1Z = 0, Z = 0 and D being a dictionary with D[pk] = 0 for all possible pk:

[0239] ORegCK(pk, y): run (mpk', aux') ← Reg(crs, aux, pk, y), update mpk = mpk', aux = aux', D[pk] = D[pk] ∪ {y}, append pk to Z and return (mpk, aux);

[0240] ORegHK(y): run (pk,sk) ← Gen(crs,aux) and (mpk', aux') ← Reg(crs, aux, pk, y), update mpk = mpk', aux = aux', D[pk] ∪ {y}, append (pk,sk) to TZ and return (|7?.|, mpk, aux, pk);

[0241] OCor(z): let 7Z[i] = (pk,sk), append pk to Z and return sk; and

[0242] - ODec(i, ctx): let R[i] = (pk,sk) and return K = Dec(sk, Upd(crs, aux, pk), ctx):with the following restrictions

[0243] — A may be allowed to query ORegCK and ORegHK at most L times in total;

[0244] — for query i to OCor, it holds that 7

[0245]

[0246] l[i] ±;

[0247] - for all y ∈ ∪pk∈ZD[pk], it holds that P(x*, y) = 0; and

[0248] — after A being given (ct*, K^), it cannot query ODec on (*,ct*).

[0249] The CPA security of Reg- ABE is defined the same as above except that ODec is not available to A.

[0250] In previous works, they first construct a simpler cryptosystem called slotted reg- istered ABE (sReg-ABE), and then lift it to a full-fledged registered ABE by the "powers-of-two" construction. We basically follow this roadmap, but make several major modifications to sReg-ABE as described below. We call the modified scheme flexible slotted registered AB-KEM (fsReg-ABK): we consider KEM instead of encryption as mentioned above. For reference, we present the definition of original sReg-ABE in Definition 5.1.

[0251] — The aggregation algorithm Agg in fsReg-ABK allows partial aggregation, that is, it can aggregate public keys for any sets U C [L] into a master public key and helper secret keys. This is in contrast to sReg-ABE that aggregates public keys only for all slots [L], The purpose of this modification is to make it compatible with the powers-of-d construction presented in Section 4.1, which is the generalization of the powers-of-two construction.

[0252] — The aggregation algorithm Agg can sequentially aggregate public keys. In par- ticular, for any disjoint sets U and U such that WUW C U* where U* is a target set, we can first aggregate {pk }-^ into a master public key mpk and helper secret keys {hsk }e^* with respect to Z7, and then we can aggregate {pk }jej / together with (mpk, {hsk }jeM*) for U into a master public key mpkzand helper secret keys {hsk'}jeW* with respect to U UW. This functionality is a generaliza- tion of the incremental aggregation, which makes the state size of a key curatorsmaller. We introduce this modification to make the incremental aggregation compatible with the powers-of-d construction.

[0253] — The encapsulation algorithm Enc can encrypt a key with respect to multiple master secret keys and can include a header information such as metadata into ciphertexts. The purpose of this modification is to achieve efficient CCA-secure Reg-ABK. The standard method to achieve CCA-security would be the Fujisaki- Okamoto transformation, but it may not be so efficient in the context of Reg- ABE. This is because the decryption algorithm needs to run the encryption algorithm in the transformed scheme, while encryption of Reg- ABE schemes may not be so efficient: encryption time is linear in the size of the policy and the number of parallel instances in the powers-of-two or d construction. On the other hand, we first construct a CCA-secure fsReg-ABE scheme and then lift it to a CCA-secure Reg-ABE scheme. In this transformation, there may be no additional costs compared with the powers-of-two or d construction in the CPA-security setting. Furthermore, our CCA-secure fsReg-ABE has almost the same efficiency as the CPA-secure counterpart: additional cost for achieving CCA-security is only one time evaluation of a hash function in encapsulation and decapsulation. Note that a quick thought reveals that the CHK transformation and its variants may not work for Reg-ABE schemes.

[0254] Definition 2.4 (Flexible Slotted Registered AB-KEM). Let P: X × Y → {0, 1} be a predicate. Let £ be a key space. A flexible slotted registered AB-KEM (fsReg-ABK) scheme for P consists of the following algorithms.

[0255] Setup(1λ, 1L): It takes a security parameter 1λand the number of slots 1Las input, and outputs a common reference string crs.

[0256] Gen(crs, z): It takes crs and an index i ∈ [L] as input, and outputs a public key pk, and a secret key skz.

[0257] Ver(crs, i, pki): It takes crs, i, pkias input, and outputs 1 if pk, is valid, and 0 otherwise.Agg(crs, {pk^}^, / *, mpk, {hsk^j-jg / *): It takes crs, a set of pairs of pk^ and attribute yi G y of newcomers corresponding to a set U of indices, and a target set Z7* s.t. U UrC [L], It optionally takes a current master public key mpk' and current helper secret keys {hsk'}ieM* as input, and outputs an (updated) master public key mpk and a set of (updated) helper secret keys hskj for i G Z7*. This algorithm is deterministic.

[0258] Enc(mpk1,..., mpkn, x, hdr): It takes a set of master public keys mpk1,..., mpkn, x E X, and a header hdr G {0, 1}* as inputs, and outputs a ciphertext etc and a key K G A.

[0259] Dec(ski, hski, ctx): It takes ski, hski, ctxas input, and outputs a key K or a symbol T.

[0260] Completeness. For all A, L E N, i ∈ [L], we have

[0261] Pr[Ver(crs, i, pki) = 1: crs ← Setup(1λ, 1L); (pki, ski) ← Gen(crs, i)] = 1

[0262] Header Retrievability. For all n ∈ N, mpk1,..., mpkn, hdr ∈ {0,1}*, x ∈ X, ctxcontains hdr in the clear for all ctx← Enc(mpk1,..., mpkn, x, hdr).

[0263] Aggregation Correctness. For all, L G N, W* C [L], 11,11 U' s.t. U n U = 0, crs E- Setup(lA, 1L),

[0264]

[0265] {pk^} such that Ver(crs, j, pk ) = 1, and

[0266]

[0267] e-Kwehave mpk = mpk" and hsk., = hsk" for j E 11* where

[0268] (mpk, {hskj ew*) = Agg(crs, {pk^z / J^^, W*) and (

[0269]

[0270] mpk', {hsk'}JeW*) = Agg^rsJpk^z / J^,^);

[0271] (mpk", {hsk"}eW*) = Agg(crs, {pk,. yj}^, U*, mpk', {hsk' }j&a)

[0272] Correctness. For all X,n, L, E N, hdr G {0, 1}*, U E U' E [L], i E U, y1E [n], {mpk }e[ ]\{ / }G {0, 1}*, {pk ew p} such that Ver(crs, j, pk,) = 1, x E X,and {yj E y}jeu such that P(, y ) = 1, we have

[0273] crs E- Setup(

[0274]

[0275] lA, 1L), (pki;sk;) E- Gen(crs, i) Pr Dec(skj, hskj, ctx) = K (mpk,, {hskJjeW*) = Agg(crs, {pki. yj}^,

[0276]

[0277] (ctr, K) E- Enc(mpkx,..., mpkra, x, hdr)

[0278] = 1 - negl(A)

[0279] Perfect correctness requires the above probability to equal 1.

[0280] Compactness. For all A

[0281]

[0282] , L E N, U ⊆ U*C [L], y, E y for j E U, i E U*, the sizes of mpk and hskj obtained from Agg(crs, {pk, j / }jeW, Z7*) are both poly(A, log |J^|, log |W*|).

[0283] CCA-Security. For all stateful admissible adversaries A, the following advantage AdvAfsRegABE(λ) is negligible in A:

[0284] 0 E- {0, 1}; L E- A(1A); crs E- Setup(lA, 1L); Ki E- K,pr / 3 = / 3,. {{pk*,^}JWM, W*U[ra],x^ hdr* ^ A0G- {(mpkM, {hskMj}JeW*) = Agg(crs, {pk*, y^u,, ^)}Me[«] (ct*, Ko) E- Enc(mpkx,..., mpk,,.. / *. hdr*); ft E- K^)

[0285]

[0286] 1 ~ 2

[0287] where Djand Z are dictionaries that are initially empty, OGen(j) runs (pk,sk) E-Gen(crs, j), set 풟3[pk] = sk and returns pk, OCor(, pk) returns

[0288]

[0289] [pk] and set Z = Z U {(j, pk)}, and ODec(j, pk, hsk, ctx) returns Dec( [pk], hsk, ctx)

[0290]

[0291] if T>, [pk] ±. A is admissible if its queries satisfy

[0292] Dj[pkj*] = ⊥ ⇒ Ver(crs, j, pk) = 1

[0293] (

[0294]

[0295] j. pk’) t ZW, [pk*] = ± P(.r.Vj) = 0

[0296] and ODec(*, *, *, ct}) is not made after A is given (ct}, Kg). The CPA security of fsReg-ABE is defined the same as above except that ODec is not available to A.Definition 2.5 (General Non-monotone Span Programs). A Reg-ABK scheme for general non-monotone span programs is a Reg-ABK scheme that supports the following predicate P: X x y — {0, 1}. To define P, we first define a subpredicate P': X' x y — {0, 1} as follows:

[0297] X' = {0, 1} × L × V, Y = (2V)L

[0298] P'((b, L, v), φ) = (b = 0 ∧ v ∉ φ(L)) ∨ (b = 1 ∧ v ∈ φ(L))

[0299] where £ = {0, 1}* is the label space, V = Zp\{0} is the value space, 2Vdenotes the power set of V, and (2V)£denotes all maps from £ to 2V. Then, P is defined as follows:

[0300] x = (J iz;,xjx A'1’1).

[0301]

[0302] ij'eN

[0303] P((M, <z), ) = 1 => (1, 0) e span({mi}i: P / ((T(i))< )=i)

[0304] where X'[z]denotes all maps from [z] to X', miis the i-th row of M, and span({mi}) is the space spanned by {mi}. Similarly, we call fsReg-ABK for P fsReg-ABK for general non-monotone span programs.

[0305] Definition 2.6 (Unbounded Span Programs). A Reg-ABK for unbounded span programs is a special case of the Reg-ABK for general non-monotone span programs in Definition 2.5. Specifically, it is defined the same as general non-monotone Reg-ABK except that the subpredicate P': X' × Y → {0, 1} is defined as follows:

[0306] X' = L × V, Y = (V ∪ {0})L

[0307] P'((L, v), φ) = v ∈ φ(L)

[0308] where £ and V is the same as in Definition 2.5, and (VU{0})£denotes all maps from £ to V ∪ {0}. We can similarly define fsReg-ABK for unbounded span programs. Remark 2.1 ( Completely Unbounded Span Programs). The predicate defined in Definition 2.6 is less expressive than the standard definition of completely unboundedspan programs, where y is defined as (2V)£rather than (V ∪ {0})£. In other words, one can take multiple values for each label as user’s attribute. The first reason that we employ the less expressive definition in Definition 2.6 is that it allows simpler fsReg-ABE construction as shown in Section 3.1 than that for traditional completely unbounded span programs, which would be suitable for a step to follow our more complicated fsReg-ABE scheme for general non-monotone span programs presented in Section 3.2. The second reason is that Reg-ABK for unbounded span programs as per Definition 2.6 can be easily converted to that for completely unbounded span programs, while some parameters such as the sizes of mpk and hskjget worse. Specifically, we can convert x' = (L, v) ∈ X' for completely unbounded span programs into x = (L, v) ∈ L × V = X' for unbounded span programs and f: £, — 2Vfor completely unbounded span programs into

[0309]

[0310] : £ —>■ VU{0} for unbounded span programs where <}>( ( L, <f>' ( L) [z] ) ) = 1 for all i

[0311]

[0312] G N if ^z(L)[z] G V and < X( L, L) [z] ) ) = 0 otherwise.

[0313] Definition 2.7 (Progression-free and Double-free Sets). A set An⊂ N where |An| = n is progression-free and double-free if for all i, j, k ∈ An∪ {0} such that i ≠ j, we have i

[0314]

[0315] + j 2k.

[0316] Lemma 2.3. There exists an efficiently-computable family of progression and double-free sets {An} where max An= n1+O(1 / √log n).

[0317] 3 Our fsReg-ABK for General Non-monotone Span Programs

[0318] 3.1 Warm-up: Our fsReg-ABK for Unbounded Span Programs

[0319] As a warm-up, we present our fsReg-ABK scheme for unbounded span programs, which is a special case of our fsReg-ABK for general non-monotone span programs presented in Section 3.2. Let G = {Gλ}λ∈Nbe a family of bilinear groups where Gλ=(p, G1, G2, GT, g1, g2, e). Let Hi: {

[0320]

[0321] {0, 1}* → {0, 1}p(λ)and H2: {0, 1}* → {0, 1}p(λ)be hash functions where p1, p2are some polynomial. We construct fsReg-ABK scheme for unbounded span programs as follows.

[0322] Setup(1λ, 1L): Let A = {δj}j∈[L]be an efficiently computable progression-free and double-free set of size L. In what follows, we define / (z, j) = + 5j and T ={ / (h b) I L b € [L], i V j}- It outputs crs as follows:

[0323] α, a, b, v ← Zp, rj= aδ, vj= baδ, wz= baz

[0324] crs = ([u, {vj}j∈[L]]1, [{rj, rjvj+ α}j∈[L], {wz}z∈T]2, [α]T)

[0325] Gen(crs, i): It chooses ui← Zpand outputs pkiand skias follows:

[0326] pkj

[0327]

[0328] (N]l, l{uirj } 2 ), skj Ui

[0329] Ver(crs, i, pki): It parses pki= ([Ni]1, [{pi,j}j∈[L]\{i}]2). It outputs 1 if ∀j ≠ i:

[0330] e([Ni]1, [pi,j]2) = e([1]1, [πi,j]2), and outputs 0 otherwise.

[0331] Agg(crs, {pki, <ji}ieM, W*, mpk / , {hsk'}ieM*): It parses pk, = (N]i, [{pzy} e[L]\p}]2)- If it additionally takes mpkz, { hskjNzz- as input, it parses

[0332] mpk' = (S', { }Les', [N {Q'L, O> V. I VCN I NT)

[0333] hsk' = (h', S', { }Les', h, nn + a, h', {h'i fi, Tz'^ikesN)

[0334] and otherwise it sets S' = 0, c = v, h = 0. Let 5" = { L G {0, 1 }* | 3J6W: (L) 7^ 0}, i.e., S” is the set of labels used by newcomers, and 5 = S' U S”. For (, L) G U x S, if (L) = 0, it sets CJ(L = 0. Otherwise, it sets C

[0335]

[0336] J(L = — 0j(L). It sets Q

[0337]

[0338] L0= QL i = / ?L 0= i = 0 for L G 5\5Zand outputs mpk as

[0339] mpk = (5, { }L& S, q, {VL, O, QL, I}LG< S]I, NT)

[0340] where (q, jL)o, <? L, I) = (Pj, 9, LO', O') + (?', V. O VL. I)

[0341]

[0342] tewand hskj for i G W* as

[0343] hskj = (Hi(mpk), ',5, { }Le5, [, v + a, h, {hi)L)o, / z^ikesh

[0344] Cj. L W(i J) > W(M))G W*W) + W, h'i L 0, h-)L;1) where (h, hi)L,o, W,i) = <

[0345] + (h'> h'i L 0, h-)L;1)

[0346] (z G Z7*\Z7 and if Agg took the optional input) (z G Z7*\Z7 and if Agg did not take the optional input)

[0347]

[0348] Enc((mpk )e[ ], (M, ), hdr): It parses mpk^ =

[0349]

[0350] {^,L}LesM, [q, {(? / 1, L>o,? / 1, L>i)}L6S(1]i[a]T) for / / G [n]. Let W C [n] be the index set such that mpk^ for / j, G W satisfies the above format. If W = 0, outputs hdr. Let M G Zp1X"2and a(T) = (U, V^). It chooses s

[0351]

[0352] Z^2-1, s, sM;i,..., s^niZpfor fj, G W, sets s = sq, s), and computes h = J / i(mpk ) for / j, G W and

[0353] [0]i (L^ 5M)

[0354] [CW] i

[0355] [(me, s) + s^q^o + V^; L<,;i)]i (U G 5M)

[0356]

[0357] for ( / / ,€) G W x [ i], where mg is the £-th row of M. Then, it outputs

[0358] ct = (hdr, {

[0359]

[0360] hM}MeW, M, a, [s, {s^g, ctM^}(M)^e>yx[ni]]i), K = H2(ct, [SO;]T)

[0361] Dec(skj, hskj, ct): It parses

[0362] hskj =

[0363]

[0364] (h, cf)i, S, {dL}Les, [n, + o. h, {hi)L,o, ^pikesh)

[0365] ct (hd r

[0366]

[0367] , { h„, M, u. [s, {s^g, ctP;^ j'^pefn] x [ni]] i )Let μ' ∈ [n] be the smallest index such that h = hμ'. If such! does not exist, then outputs ± and halts. For conciseness, we denote

[0368]

[0369] ctp / y by sg, cR, respectively in what follows. It computes C [m] and {G}reT such that

[0370]

[0371] = (1, 0) and P'(cr(£), < M = 1 for t G where Pzis the subpredicate defined in Definition 2.6 (such

[0372]

[0373] exist if P((M,cr), j) = 1). Then, for t G, it computes

[0374] M]T = e([ctr]i, KMMMk + VA, L,, I]2)

[0375] [w]T= e([s]i, [rpj + a]2) / / e([s]i, [nskj + h]2)

[0376]

[0377] .ter

[0378] and outputs H2(ct, [M]T).

[0379] Since this scheme is the special case of the scheme in Section 3.2, we omit the analysis of correctness, security, etc. More precisely, we can basically obtain the above scheme by setting v

[0380]

[0381] = Σj∈[L]δjwj= v2,j, w2= wz, rjvj+ α = rjv1,j+ α + Σj∈[L]\{i}in the scheme in Section 3.2.

[0382] 3.2 Our fsReg-ABK for General Non-monotone Span Programs

[0383] Let G = {Gλ}λ∈Nbe a family of bilinear groups where Gλ=(p, G1, G2, GT, g1, g2, e). Let H

[0384]

[0385] H1: {0, 1}* → {0, 1}p(λ)and H2: {0, 1}* → {0, 1}p(λ)be hash functions where p1, p2are some polynomial. We construct a fsReg-ABK scheme for general non-monotone span programs as follows.

[0386] Setup(lA, 1L): Let A = {5 }je[L] be an efficiently computable progression-free and double-free set of size L. In what follows, we define f(i, ) =

[0387]

[0388] + 6j and T = { / (z, ) I [L], i 7^ j}- It outputs crs as follows:

[0389] a, a, bi, b2, G- Zp, rj = adj,vltj= b\a’'. r2j= b2aSj,witZ= biaz,w2>z= b2azc

[0390]

[0391] crs = ([{u1,j, u2,j}j∈[L]]1, [{rj, rjv1,j+ α, rjv2,j+ α}j∈[L], {w1,z, w2,z}z∈T]2, [α]T)

[0392] Gen(crs, i): It chooses ui← Zpand outputs pkiand skias follows:

[0393] pkj

[0394]

[0395] ( [ttj] i, [{ICT2}je[L]\{»}]2) ’sk»Ver(crs, z, pk: It parses pk^ = (Mi, [{Piy} e[L]\{o]2)-

[0396]

[0397] outputs 1 if V / V z: e([pz]i, [oh) =e([l]u Pi,j\2), and outputs 0 otherwise.

[0398] Agg(crs, {pki,i}ieW, W*, mpk', {hsk'}ieW*): It parses pk^ = ([o]b[{piyjV[L]\p}]2). If it additionally takes mpk', {hsk'}ieb, as input, it parses

[0399] mpk' = (S', {d'L}L∈S', [{Q'L,k, Q̄'L,k}(L,k)∈S'×[0,d']]1, [α]T) h

[0400]

[0401] sk' = (h', (f)i, S', {<}L& S', [O, {h'i> L>k, h'i> L>k}^,k)eS'x[o,d'L]\2)'

[0402] and otherwise it sets S' = 0. Let S

[0403]

[0404] " = {L e {0,!}• I 3; e U: <fe(L) 0}, i.e., S" is the set of labels used by newcomers, and S = S' ∪ S". For L ∈ S, let d

[0405]

[0406] dL= max{maxj∈U|φj(L)|, d'L} where d'L= 0 for L ∉ S', i.e., dLis the maximum number of values for label L held by each user. For (, L) G U x S, if (L) = 0, it sets CJ(L, O = • • • = CyL,<iL= 0. Otherwise, it computes CJ(L, O, • • • Xj,,dLsuch that

[0407]

[0408] Ci^kXk= JJ (x - 0j(L)[fc])

[0409] fee[o,dL] fee[o,dL]

[0410] where x is a formal variable a

[0411]

[0412] nd 0j(L)[fc] = 0 for k > |<^j(L)|. Let S = {L G S' 0 S" | d'L< d\_}. For X G {q, q}, Y G {h, h}, L G S, k G [d, i G Z7*, it defines

[0413] (L G S A d\_ — d'L< k < d[_)

[0414] (L G S'\S)

[0415] 0 (otherwise)

[0416] (L G S A d\_ — d'L< k < d\_)

[0417] (L G S'\S)

[0418] (otherwise)

[0419]

[0420] It outputs mpk as

[0421] mpk — (S, Ws, {QL,k, QL,fe}(L,fe)esx[o,<iL] where Vfe, V) = + Pj, V2,j) + (V’ Cfe)

[0422]

[0423] and hskj for i G W* as

[0424] hsk, = (#i(mpk),0', S, {dL}Les, A, + a, { / h, L,fe> ^, L,fe}(L,fe)e5x[o,<zL]2©, L,fe(wl, / (M) + Pj,i’ e W*\W) jeu + (^L,fe> ^L,fe) where (hi,\_,k, hit]_,k) = < + Pj,iiw2,f(i,j)) (p kPj j& AP} + (^L,fe> ^L,fe)

[0425] (z G U*\U and if Agg took the optional input) (z G and if Agg did not take the optional input)

[0426]

[0427] Enc((mpk )e[ ], (M, u). hdr): It parses mpk^ = (‘S(tt, {d(ti)L}Lesl, [{(^)L)fe, ^)L)fe)}(L)fe)eslx[o)dl,L]]i[a]T) for p. G [n]. Let W C [n] be the index set such that mpk^ for / j, G W satisfies the above format. If W = 0, outputs hdr. Let M G and a(£) = (Be, Le, Ve). It chooses s A- Zp2-1, s, sM)b..., s^niZpfor / / G W, sets s = (s, s), qM; L;fc= (gM,L,fe>fr, LA> • • ■ > Q^X,k)

[0428] n2-l for ( / / , L, k~) G W x x [0, and computes hM= / ^(mpk ) lor / / G W and

[0429] [O]1 (U 5M) [CW]1 =<EM0 / W^Vr(mr © s),qM;M]i (L^ G / \ Be = 0)

[0430] [((mi © s), + £fce[0;(Wj s^q^k\r(U G SpA B£= 1)

[0431] for (A,^) G W x [zii], where m£is the £-th row of M. Then, it outputs

[0432]

[0433] Ct ( h d r, { hM}^yy ■> M, <7, [s, S, {s^e, Ct^}(^)gyyx[ni]]l) ■> K = H2(ct, [sa]r)Dec(skj, hskj, ct): It parses

[0434] hskj

[0435]

[0436] (h, M, < S, {d|_ } LE< S, [©, A cv, {hi,\_,k ■> hi, L,k }(L,fe)esx [O, C? L ] ] 2 ) Ct (hd r

[0437]

[0438] , { hM} jtxcjn], M, © [s, S, } (^,^)e[n] x [ni]] 1)

[0439] Let! G [n] be the smallest index such that h = h / . If such p! does not exist, then outputs ± and halts. For conciseness, we omit p' in subscripts and denote such as

[0440]

[0441] ctM / / by cR in what follows. It computes C [m] and {A}reT such that

[0442]

[0443] = (1, 0) and P'(cr(£),0j) = 1 for k G T where Pzis the subpredicate defined in Definition 2.5 (such {A}reT exist if P((M, a), M) = 1). It sets hi;L,fe = (hi,\_,k, ■ ■ ■, / ©[_,£, ) for (L, fc) G < S x [0, d[_\. Then, it computes

[0444]

[0445] n2-l

[0446] e([cR]i, [M2) (B, = 0) _ 1 _ / 1 T f \ o 1 ru 1 \V« \ nfc£[0,d| ] (Vd— < / >i(Ld)[fc]) / ]_]_ e(H © s]i, [hi; LM2)efee[0AJ M]T — < e([ct^]i, [n]2) / e([m^ © s]i, [hi; L<,AJ2) (Br = 1) ■ 1 1 e(|s<]i, |©t.©]2)

[0447] [a?]T= e([s]b[r©i;i+ a]2) /

[0448]

[0449] JET

[0450] where s = (s,s), and outputs / / 2(ct. MT)-

[0451] 4 From fsReg-ABE to Reg- ABE

[0452] 4.1 Construction

[0453] We construct a Reg-ABE scheme for a predicate P from a fsReg-ABE scheme for the same predicate P as follows. Let d > 2 be a constant parameter in N. Let fsReg-ABE = (fsSetup, fsGen, fsVer, fsAgg, fsEnc, fsDec) be a fsReg-ABE scheme. Wlog, we assume L = dl— 1 to be the maximum number of users in the Reg-ABE scheme. We define a function fk: [L] x [0, d — 1] — N for k G [0,£ — 1] as

[0454] fk j, = j - (j mod dk+1) + bdk= (bt,_ ■ ■ ■ bk+ibO • • • 0)d(3)where j = (bℓ-1··· b0)d. Our construction is basically the generalization of the "powers-of-two" construction in prior work to the powers-of-d construction. Intuitively, the fc-th system handles at most (d — l)dfcusers. The Reg-ABE system maintains a public state aux = (PX, P2, P3, mpk), which is specified as follows:

[0455] — the dictionary D1that maps (k,j) for k ∈ [0,ℓ— 1] and j ∈ [L] to a (preparatory) helper secret key of the underlying fsReg-ABE scheme;

[0456] — the dictionary D2that maps (k, b, j) for k ∈ [0,ℓ — 1], b ∈ [d — 1], and j ∈ [L] to an (activated) helper secret key of the underlying fsReg-ABE scheme;

[0457] — the dictionary D3that maps k for k ∈ [0,ℓ— 1] to a (preparatory) master public key of the underlying fsReg-ABE scheme; and

[0458] — the current master public key mpk = (ctr, mpk0, . . . , mpkℓ−1) where ctr G N specifies the number of current users and mpkkfor k G [0,£ — 1] is an (activated) master public key of the underlying fsReg-ABE scheme.

[0459] Initially, the system sets D1, D2, D3= ∅ and mpk = (0, ⊥,..., ⊥).

[0460] Setup(lA, 1L): It outputs crs G- fsSetup(1λ, 1L).

[0461] Gen(crs, aux): It fetches ctr from mpk in aux. It computes (pk', sk') ← fsGen(crs, ctr + 1), sets ctrpk= ctrsk= ctr + 1 and outputs

[0462] pk = (ctrpk, pk'), sk = (ctrsk,sk')

[0463] Reg(crs, aux, pk, t / ): It parses aux = (Px, D2, 풟3, mpk), mpk = (ctr, mpk0,..., mpk^, pk = (ctrpk, pk'). If ctrpk= ctr + 1 and fsVer(crs, ctrpk, pk') = 1, it does the following steps for k ∈ [0,ℓ — 1] satisfying ctrpk∈ [fk(ctrpk, 0) + 1, fk(ctrpk, d — 1)]; otherwise halts and outputs (mpk, aux):

[0464] - lets c

[0465]

[0466] trpk= (^_i • • • &0)d, = [ / fc(ctrpk,0) A l, / fc(ctrpk,d - 1)], and Uk= [fk(ctrpk, 0) + 1, fk(ctrpk, bk)];

[0467] — computes

[0468] (mpk'k, {hskfc}jeW*) = fsAgg(crs, (pk', y), U^ P {Pi[fe, j]}eM*)

[0469] and updates P

[0470]

[0471] s[fc] = mpk'kand Pi[fc, j] = hsk^j for j— if k is the minimum digit such that bk 0, updates mpkk= 풟3[k], mpkk'= ⊥ for k' ∈ [0, k − 1], and 풟2[k,bk, j] = 풟1[k,j] for j ∈ 풰kand

[0472] — if k is the minimum digit such that bk

[0473]

[0474] 0 and bk = d— 1, updates 풟3[k] = ⊥ and 풟1[k, j] = ⊥ for j ∈ 풰k*.

[0475] It finally sets ctr = ctr + 1 and updates mpk = (ctr, mpk0, . . . , mpkℓ−1) and aux = (" Di, T>2, 풟3, mpk) and outputs (mpk, aux).

[0476] Enc(mpk. r): It parses mpk = (ctr, mpk0, . . . , mpkℓ−1) and sets hdr = ctrct= ctr. Let W = {k | mskfe ±}. It outputs (ctr, K) G- fsEnc((mpkk)fceW, x, hdr).

[0477] Upd(crs, aux, pk): It parses aux = (P T>2, 풟3, mpk), mpk = (ctr, mpk0,..., mpk / _x), and pk = (ctrpk, pk'). It outputs hsk = {D2[k, b, ctrpk] }(fc;fc)e[oy-1]x [d-i] if ctrpk< ctr and ± otherwise.

[0478] Dec(sk, hsk, ctx): It parses sk = (ctrsk, sk'), hsk = {hskk,b}(k,b)∈[0,ℓ−1]×[d−1], ctx= (hdr,...), and hdr = ctrct. If ctrsk> ctrct, outputs ⊥. Otherwise, let ctrsk− 1 = (bℓ−1...b0)dand ctrct= (b'ℓ−1...b'0)d. It computes the maximum k such that bk≠ b'kand does the followings:

[0479] — hskfc;6 / fe7^ ±, outputs fsDec(sk', hskk,b', ctx);

[0480] — otherwise, output getupd.

[0481] Compactness. Let m

[0482]

[0483] pk^ = (z, mpki 0,..., mpkℓ-1), and hsk* = {hsk^)6}(fc,6)e[o / -i]x[d-i]- Observe that mpki;fc= ± for (z, k~): dk— 1 > i and hsk^6= _L for (k,b~): bdk— 1 > \TZ\. Thanks to the compactness of fsReg-ABE, the sizes of mpki fcand hsk / . / , for k G [0,£ — 1] are poly(A, log | fV|, log(d — l)dfc). Hence, we have

[0484] |mpki| = poly(λ, log |풴|, log i) and |hsk*| = poly(λ, log |풴|, log |ℛ|)

[0485] Update Efficiency. By construction, once hsk*k,bis generated, it will never be updated in the entire system life. This follows from the understanding that hsk*k,b= 풟2[k, b, t] is deterministically generated by fsAgg(crsk, {pkj,k, yj}j∈풰) for any (t, k) ∈ [L] × [0, d − 1] such that t ∈ 풰*k. Thus, the maximum number of updates in hsk* is ℓ(d − 1), which is O(log L).

[0486] The update operation only fetches O(logL) elements of size poly(logL) from 'D2- Thus, this can be done in poly(logL) time in the RAM model.5 Slotted Registered ABE

[0487] Definition 5.1 (Slotted Registered ABE). Let P: 풳 × 풴 → {0, 1} be a predicate. Let t be a message space. A slotted registered attribute-based encryption (fsReg-ABE) scheme for P consists of the following algorithms.

[0488] Setup(1λ, 1L): It takes a security parameter 1λand the number of slots 1Las input, and outputs a common reference string crs.

[0489] Gen(crs, i): It takes crs and an index i ∈ [L] as input, and outputs a public key pkiand a secret key ski.

[0490] Ver(crs, i, pki): It takes crs, i, pkias input, and outputs 1 if pkiis valid, and 0 otherwise.

[0491] Agg(crs, {pki, yi}i∈[L]): It takes crs, a set of pairs pki, and yi∈ 풴 for i ∈ [L] as input, and outputs a master public key mpk and a set of helper keys hskifor i ∈ [L]. This algorithm is deterministic.

[0492] Enc(mpk, x, M): It takes mpk, x ∈ 풳, and a message M ∈ ℳ as inputs, and outputs a ciphertext ctx.

[0493] Dec(ski, hski, ctx): It takes ski, hski, ctxas input, and outputs a message M or a symbol ⊥.

[0494] Completeness. For all λ, L ∈ ℕ, i ∈ [L], we have

[0495] Pr[Ver(crs, i, pki) = 1: crs ← Setup(1λ, 1L); (pki, ski) ← Gen(crs, i)] = 1

[0496] Correctness. For all λ, L ∈ ℕ, i ∈ [L], crs ← Setup(1λ, 1L), {pkj}j∈[L]\{i}such that Ver(crs, j, pkj) = 1, x ∈ 풳, y1,..., yL∈ 풴 such that P(x, yi) = 1, and M ∈ ℳ, we have

[0497] (pki, ski) ← Gen(crs, i)Pr[Dec(ski, hski, ctx) = M: (mpk, {hskj}j∈[L]) ← Agg(crs, {pkj, yj}j)] = 1ctx← Enc(mpk, x, M)

[0498]

[0499] Compactness. For all λ, L ∈ ℕ, i ∈ [L], yi∈ 풴 for i ∈ [L], the sizes of mpk and hskiobtained from Agg(crs,

[0500]

[0501] {pki, yi}i∈[L]) are poly(λ, |풴|, log L).(CPA-) Security. For all stateful admissible adversaries A, the following advantage AdvfsRegABE(A) is negligible in λ:

[0502] L ← A(1λ); crs ← Setup(1λ, 1L)Pr[β = β': (mpk, {hski}i∈[L]) ← Agg(crs, {pk*i, β

[0503]

[0504] {0, 1}; ctx← Enc(mpk, x*, Mβ); β' ← A(ctx)]

[0505] where 풟1and 풵 are dictionaries that are initially empty, OGen(i) runs (pk, sk)

[0506]

[0507] Gen(crs, i), set 풟1[pk] = sk and returns pk, and OCor(i, pk) returns 풟1[pk] and set 풵 = 풵 ∪ {(i, pk)}. A is admissible if its queries satisfy

[0508] 풟1[pk*j] ≠ ⊥ = Ver(crs, j, pk*j) = 1

[0509] 0

[0510]

[0511] , pk*) G Z V P3[pk*] = ± P(x,^) = 0

[0512] 6 fsReg-ABE for General Non-monotone Span Programs from Standard Assumptions

[0513] 6.1 Preliminaries

[0514] Notations. For matrices A, B where AB is defined, [AB]Tis efficiently computable from [A]1and [B]2. We denote this computation by e([A]1, [B]2).

[0515] Definition 6.1 (MDDH Assumption). Let {픾} be a family of bilinear groups. We consider the following distribution, for any n > k and m ∈ ℕ: A ← Zpn×k, R ←Z

[0516]

[0517] Zpm×k, Z0= RA, Z1← Zpm×k. 풫i,β= (픾, [A]1, [Zβ]i). We say that the MDDHkassumption holds with respect to {픾} if 풫i,0~c풫i,1for i ∈ {1,2}.

[0518] Definition 6.2 (QA-NIZK). Quasi-adaptive non-interactive zero knowledge argument (QA-NIZK) for linear space over bilinear groups G consists of the four algorithms.

[0519] LGen(1λ, [A]1): It takes a security parameter 1λand [A]1∈ 픾1n×mas input and outputs a common reference string crs and a trapdoor td.

[0520] LProve(crs, [X]1, V): It takes crs, [X]1∈ 픾1n×ℓwith a witness V ∈ Zpm×ℓas input and outputs a proof π.LVerify(crs, [X]1, π): It takes crs, [X]1, π as input and outputs β ∈ {0, 1}.

[0521] LSim(crs, td, [X]1): It takes crs, td, [X]1and outputs a simulated proof π̃

[0522] Perfect Completeness. For all n, m, ℓ, λ, A, V, X such that X = AV,

[0523]

[0524] (crs, td) ← LGen(1λ, [A]1)

[0525] Pr[LVerify(crs, [X]1, π) = 1:] = 1

[0526]

[0527] π ← LProve(crs, [X]1, V)

[0528] Perfect Zero-knowledge. For all n, m, ℓ, λ, A, V, X such that X = AV, LProve(crs, [X]1, V) and LSim(crs, td, [X]1) are identically distributed where (crs, td) ← LGen(1λ, [A]1). Stronger Unbounded Simulation Soundness. For all PPT adversaries A and n, m E N, the following advantage of A is negligible in A:

[0529] ([X*]1, π*) ∉ ℒ ∧ ∄V: X* = AV: (crs, td) ← LGen(1λ, [A]1)

[0530] ∧ LVerify(crs, [X*]1, π*) = 1: ([X*]1, π*) ← ALSim(crs,td,·)(1λ, crs, A)

[0531]

[0532] where is a list of pairs of A’s query to LSim and the corresponding response.

[0533] A QA-NIZK scheme that satisfies the above properties from MDDH is given in prior work.

[0534] Definition 6.3 (Target Collision Resistance). Let ℋ = {ℋλ}λ∈ℕbe a family of functions such that ℋλconsists of functions H: {0, 1}* → {0, 1}τ(λ)for some polynomial τ. We say H is target collision resistant hash functions (TCR) if the following probability is negligible in A for all stateful adversaries A

[0535]

[0536] 6.2 Construction

[0537] Let 픾 = {픾λ}λ∈ℕbe a family of bilinear groups where 픾λ= (p, G1, G2, GT, g1, g2, e).

[0538] Let H = {Hλ}λ∈ℕbe TCR. Let Π = (LGen, LProve, LVerify, LSim) be a QA-NIZK scheme. We construct a fsReg-ABE scheme for general non-monotone span programs as follows.Setup(1λ, 1L): It outputs crs as follows:

[0539] A ← Zpk×(2k+1)B z(fc+1)xfc, k Z2fc+1, V„ W, ^2k+1^^k+1\ H HxFL,- zj)2fc+2')x('2fc+1\ rj Zp, (crsjjtdj) LGen(lA, [Aj]) where Aj = ) / {crsj}je£, hf, [A, {Rj, AVj, AWj}je[£]]i \ crs = I I

[0540]

[0541] \|{BrJ. VjBrJ + kT}je|t|, {V, BrJ, W. BrJ

[0542] Gen (crs, z): It outputs pk, and sk, as follows:

[0543] U„ y- z(2fc+1)x(fc+1), X, = AjUj = ( ) U„ 7T, y- L Prove (crs,. [X^U,)

[0544] pk sk, = Uj

[0545]

[0546] Ver(crs, i, pk: It parses pk, =

[0547] ([Ti, Qi]i, [{p7.}e[ / ]\{i}]2, TT^). It outputs 1 if LVerify(crSi, [( )]i, 7Ti) = 1 and Vj z.:f | A| |. [p^ ]2) = e([Tj]i, [Br ]2), and outputs 0 otherwise.

[0548] Agg(crs, {pki, ^}ieM, W*, mpk / , {hsk'}ieM*): It parses pk, = ([Ti;Qi]i, [{p.}e[L]\{i}]2, 7Fi).

[0549] If it additionally takes

[0550]

[0551] mpkz, {hsk(}iez / * as input, it parses

[0552] mpk' - (S', {cakes', [{NL,fe> N / L;fc}(L)fc)eS / x[o)(i'L]]i, | AkT|- / -) h

[0553]

[0554] sk' = [Br^ViBr^ + kT, {h'TL fc, h'TL)fc}(L)fc)es'x[o4]]2)

[0555] and otherwise it sets S' = 0. Let S" = {l e {0, 1}- I Bj e U: *(L) Z 0}. i.e., S" is the set of labels used by newcomers, and 5 = S' U S". For L G S, let d

[0556]

[0557] \_ = max{maxjeW\(f>j (L) |, d'L} where d'L= 0 for L S', i.e., d\_ is the maximum number of values for label L held by each user. For (, L) G U x S, if (L) = 0, it sets CJ(L, O = • • • = CyL,<zL= 0. Otherwise, it computes CJ(L, O, • • •,cj, L,dLsuch that

[0558]

[0559] Ci^kXk= JJ (x - < ML>])

[0560] fee[o,<zL] fee[o,<zL]where x is a formal variable and,(L)[fc] = 0 for k > |<(>,(L)|. Let S = {L G S'nS" | dzL< d\_}. For X G {N, N}, Y G {h, h}, L G S, k G [d\_], i G Id*, it defines

[0561] (L G 5 A d\_ — d\_ < k < d\_)

[0562] (L G S'\S) (otherwise)

[0563] (d\_— d'\_ (L G S A d\_ — d'L< k < dL~)

[0564] (L G S'\S)

[0565] (otherwise)

[0566]

[0567] It outputs mpk as

[0568] mpk = S, {d]_}]_es,

[0569] (L,fe)& Sx[0,dL] J

[0570] where (NL;fc, NL;fc) = c3^k(AV3+ T,, AW,) + (N"k, N"fc)

[0571]

[0572] tew

[0573] and hskj for i G Id* as

[0574] hsk, = (#(mpk) V S, {4}L& S, Bi\T, ViBi\T+ kT, {h E q, L,t(V, Br,T+ pj,, WjBp ) (i e U'\U) j& A + (h„L,fe> h''L;fc) where (hJL fc, hJLEC,)L)fc(V, BrV pL, W, Brr

[0575] h"

[0576]

[0577] ’ntTL,

[0578] (z G ld*\U. and if Agg took the optional input)

[0579] (z G ld*\U. and if Agg did not take the optional input)

[0580]

[0581] Enc((mpkVe[ ], (M,hdr): Ztparses mpk^ =

[0582]

[0583] (SM, [{NftL.fc, N(ti;L)fc}(L,fc)esAlx[o,dAl,L]]i, [AkT]T) for p. G [n]. Let W C [n]be the index set such that mpk^ for / / G W satisfies the above format. If W = 0, outputs hdr. Let M G Zp1X"2and < T(£) = (B {^,, V^). It chooses N^L^ (A = 1) NM)L;fc(i G [2,n2j) for (p., L, k) G W x x [0, and computes hp= hf(mpkM) for / j, G W and

[0584] (U [ctMy]i —

[0585] Efee[o,dM,L<,] Z\e[n2] (U G St, A B / — 0)

[0586] (U G A Bz— 1)

[0587]

[0588] iC[n2] + 2^fee[o,dMiL<,

[0589] for ( / / ,£) G W x [«i], where mytis the (£, t)-th element of M. Then, it outputs

[0590] ct = (hdr, {hM}MeW, M, a, [siA,..., s„2A, {SM / A, ct, }(M,r)eWx[m]]i)

[0591]

[0592] Cl CnoCL£.£

[0593] K = [siAkT]T

[0594] Dec(skj, hskj, ct): It parses

[0595] hsk, = (h,^,5, {dL}Les, [Br, ViBr + kT, {hJL>fc, hJL;fc}(L;fc)eS><[0A]]2) ct (hdr,

[0596]

[0597] M, cr, [ci i •

[0598]

[0599] • • i Cn2i {c^y, Ct^yl^yjg^jxjnjj]!)

[0600] Let fj,' G [n] be the smallest index such that h = h / . If such fj,' does not exist, then outputs ± and halts. For conciseness, we omit / j,' in subscripts and denote such as c / y,ct / y by c^,cL in what follows. It computes C [m] and li}ie'T such that

[0601]

[0602] = (1, 0) and P'(cr(£),0i) = 1 for t G T where Pzis the subpredicate defined in Definition 2.5 (such {tr}reT exist if P((M, a), (pi) = 1). Ithj,l_£,k (A = 1) sets ht)i)L€)fcfor (£, k) E [«i] x [0,dM)i_]. Then, it computes hi;|_£,k (L e [2,n2])

[0603]

[0604] _ e([cti]l,[Br7 ]2) _ (B, = 0) nfce[o,dL<,] ILe[„2] AKWhJhT ^J2)V£ M]T — <

[0605] _ e([ctl]l,[BrT ]2) _ nte[„2] e([w, A]l,[hTAJ2) nfce[o,dL<,] hMlJVfhTLM]2) (Br = 1)

[0606] MT = e([c1]1, [WBr^ + kT]2) / / e([ciski]i, [Br,T]2)

[0607]

[0608] JET and outputs T-

[0609] Completeness and Header Retrievability. It is trivial from the construction.

[0610] Aggregation Correctness. We can confirm it similar to the construction in Section 3.2.

[0611] Correctness. Let ct = (hdr, {h } / xe[n], • • •)• The probability that

[0612]

[0613] H(mpk ) for all

[0614]

[0615] E W1is overwhelming where W1= { / i G [n]\{ / / } | mpk^ mpk^,} as otherwise we can construct an adversary that breaks target collision resistance of H from Gen and Agg. If the above event occurs, mpk^, and hskj are the part of the output of Agg(crs, {pk,

[0616]

[0617] In decryption for user i E U, we have for I E T such that Be= 0,

[0618] _^2ke[o,d^] ^e[™2] W)tstNt)L,)fcBr7 - Efce[0Aj V^fcEte[„2] W)tcth^; L^fcnfce[0Aj(V^ “ E^. T,LJVr Ete[„2] W)t(stNt)L,;fcBr7 - cthTL<sfc)=- - v - \Fk - 2^fee[o,dL<,] _Efce[o)(Wj VEi. L^Umr, (siA(Vi + U^Br^, s2AWiBr7,...,sra2AWiBrE)

[0619] Efee[o,dL<,]

[0620]

[0621] = (m., (s! A(Vj + U,)Br7, s2AWtBr,T,..., s„2AW Br ))In the third equality, we use the fact that Ap = T Br. On the other hand, we have for I G T such that = 1,

[0622] te[n2] fee[o,dLJ - - 12V^CATL, A te[n2] fee[o,dLJ = (m., (sxA(Vj + U,)Br7, s2AWtBr,T,..., s„2AW Br ))+V^. AW. Br^

[0623] fee[0AJ

[0624]

[0625] = (m., (sxA(Vj + U,)Br7, s2AWtBr,T,..., s„2AW Br ))

[0626] where in the second equality we use

[0627]

[0628] = 1 and in the third equality we use Sfee[odL] G, L,feV=0 which follows from V / G i(U). Hence, we have

[0629] J = sxA(V, Br,T+ kT) - sxA(Vi + UjBrJ + sxAU, Br,T= sxAkT

[0630] Remark 6.1. As well as the construction in Section 3.2, perfect correctness can be achieved by including corresponding {mpk^} and mpk instead of the hash values of these in ct and hsky respectively, while this makes these sizes larger.

[0631] Compactness. It is not hard to see that |mpk| = poly(A, J2LeSd ) and |hskj| = poly(A, J2|_es ). Since J2LeSd\_ < |J^|, our scheme satisfies compactness.

[0632] Registered Attribute-Based Encryption System Overview

[0633] Referring to FIG. 1, a registered encryption system 100 implements a registered attribute-based encryption (RABE) scheme that eliminates the need for a central authority to manage secret keys. The registered encryption system 100 includes a setup module 102, a key generation module 104, a user registration module 106, an encryption module 108, a decryption module 110, and a public state storage 112.

[0634] The setup module 102 initializes the RABE scheme by executing a setup algorithm fsSetup(1λ, 1L) of an underlying slotted registered attribute-based encryption (SRABE) scheme to generate a common reference string crs. The setup module 102 takes both a security parameter A and the number of users in unary 1Las input, enabling bounded-user scheme configurations. In some cases, L = de— 1 represents amaximum number of users, where d > 2 is a constant parameter and £ is a positive integer.

[0635] With continued reference to FIG. 1, the key generation module 104 produces public keys and secret keys based on the common reference string crs and an index parameter identifying a slot position. The key generation module 104 generates a public key pk and a secret key sk for a user by executing a key generation algorithm of the SRABE scheme. The public key pk may be distributed to other users, while the secret key sk may be retained by the user for decryption operations.

[0636] The user registration module 106 handles the registration of users into the registered encryption system 100. The user registration module 106 may receive a public key pk and an attribute y from a user and update the public state accordingly. The user registration module 106 may interact with the public state storage 112 to maintain current registration information.

[0637] The encryption module 108 implements a key encapsulation mechanism (KEM) instead of direct encryption for simplified security analysis. The encryption module 108 may receive a master public key and a policy x as inputs and output a ciphertext cG along with an encapsulated key K. The use of KEM may provide advantages in security proofs and efficiency compared to direct encryption approaches.

[0638] The decryption module 110 receives a secret key, a helper secret key, and a ciphertext as inputs. The decryption module 110 may output the encapsulated key K when the user’s attributes satisfy the policy encoded in the ciphertext, or may output a symbol ± when decryption fails.

[0639] The public state storage 112 maintains a public state aux = (풟1, 풟2, 풟3, mpk) in computer memory. The dictionaries 풟1, 풟2, and 풟3may store mappings between user identifiers, public keys, and attributes. The master public key mpk = (ctr, mpk0, . . . , mpkℓ−1) includes a counter ctr of current users and a sequence of component master public keys indexed from 0 to £ — 1. The counter ctr may be incremented when new users register with the registered encryption system 100.

[0640] The components of the registered encryption system 100 may interact through defined interfaces. The setup module 102 may provide the common reference string crs to the key generation module 104 and the user registration module 106. The userregistration module 106 may update the public state storage 112 when new users join the system. The encryption module 108 may retrieve the master public key from the public state storage 112 to perform encapsulation operations. The decryption module 110 may access helper secret keys that are derived from information stored in the public state storage 112.

[0641] Referring to FIG. 2, a slotted conversion process 200 illustrates a sequence of operations for transforming a flexible slotted registered attribute-based key encapsulation mechanism (SRABE) scheme into a full-fledged registered attribute-based key encapsulation mechanism. The process 200 includes multiple sequential steps that enable efficient management of user registrations and cryptographic key aggregation.

[0642] The process 200 begins with a slot initialization step 202. During slot initialization step 202, the system establishes a predetermined number of slots L that define the maximum capacity for user registrations. The slot initialization step 202 may configure parameters for the SRABE scheme, including generation of a common reference string crs through execution of a setup algorithm.

[0643] Following slot initialization step 202, the process 200 proceeds to a user assignment step 204. The user assignment step 204 maps incoming users to available slots within the system. During user assignment step 204, each user receives a slot index i ∈ [L] that determines the user’s position within the slot hierarchy. The user assignment step 204 may generate a public key pk, and a secret key sk, for each user through execution of a key generation algorithm.

[0644] With continued reference to FIG. 2, the process 200 advances to a key aggregation step 206. The key aggregation step 206 combines public keys from multiple users into aggregated cryptographic structures. During key aggregation step 206, the system produces a master public key mpk and helper secret keys hskjfor users within a target set Z7*. The key aggregation step 206 operates deterministically to ensure consistent master public key and helper secret key generation across different execution instances.

[0645] The process 200 then flows to a dynamic restructuring step 208. The dynamic restructuring step 208 manages changes to the slot occupancy as users join or leavethe system. During dynamic restructuring step 208, the system may relocate users between slots and update the public state aux accordingly.

[0646] Following dynamic restructuring step 208, the process 200 proceeds to a partial aggregation step 210. The partial aggregation step 210 enables public keys to be aggregated for any subset U of slots rather than requiring aggregation over the complete set of slots [L], During partial aggregation step 210, the aggregation algorithm accepts a set of pairs of public keys pkiand attributes yj corresponding to a newcomer set IA, along with a target set Z7* where U U' C [L], The partial aggregation step 210 outputs an updated master public key mpk and a set of updated helper secret keys hsk., for j U*.

[0647] The process 200 concludes with a sequential aggregation step 212. The sequential aggregation step 212 enables incremental aggregation where new public keys can be aggregated with existing master public keys and helper secret keys without recomputing from scratch. During sequential aggregation step 212, for disjoint sets 1A and IA such that LA AA ⊆ U*, the system first aggregates {pk }

[0648]

[0649] into a master public key mpkzand helper secret keys {hsk'}jei / * with respect to LA. The sequential aggregation step 212 then aggregates {pk }jeWtogether with (mpk', {hsk'}jeM*) to produce an updated master public key mpk" and updated helper secret keys {hsk"}jeW* with respect to LA U LA.

[0650] The aggregation correctness property ensures that sequential aggregation produces identical results to batch aggregation for the same set of public keys. Specifically, the master public key mpk and helper secret keys hsk obtained from batch aggregation over LA IA equal the master public key mpk" and helper secret keys hsk" obtained from sequential aggregation.

[0651] Registering a user may involve verifying the public key using a verification algorithm of the SRABE scheme. For each; in a specified range, the system updates the public state using an aggregation algorithm of the SRABE scheme. The registration process includes incrementing ctr and updating mpk and aux in computer memory to reflect the newly registered user.

[0652] Referring to FIG. 3, a registered encryption process includes multiple steps arranged in a sequence showing interactions between different modules of a registeredattribute-based encryption system. The process illustrates the complete flow from system initialization through encryption and decryption operations.

[0653] A step SI executes a setup algorithm to generate a common reference string (crs). The setup algorithm takes a security parameter 1λand a number of slots 1Las input. The step SI outputs the crs, which the step S1 sends to subsequent steps for use in key generation and encryption operations.

[0654] With continued reference to FIG. 3, a step S2 involves generating a public key pk and a secret key sk for each user. The step S2 receives the crs from the step S1 and an index i ∈ [L] as input. The step S2 outputs a public key pk, and a secret key ski corresponding to the user at index i.

[0655] A step S3 requests public key verification. A verification processor validates public keys using a verification algorithm that checks key validity before aggregation operations. The step S3 takes the crs, an index i, and a public key pk, as input. The step S3 outputs 1 if the public key pk, is valid, and outputs 0 otherwise. The step S3 sends the verification result back to the process for determining whether to proceed with aggregation.

[0656] A step S4 executes an aggregation algorithm over a specified range determined by a function fk. The specified range for updating the public state during user registration is determined by a function fk(j, b) = j — (j mod dk+1) + bdk, where j is the user counter, b is a digit in the base-d representation of j, k is an index, and d is a constant parameter. The step S4 aggregates public keys and attributes into a master public key and helper secret keys.

[0657] As further shown in FIG. 3, a step S5 requests a master public key mpk. The step S5 retrieves the aggregated master public key from the aggregation performed in the step S4. The master public key mpk may be parsed as mpk = (ctr, mpk0, . . . , mpkℓ−1).

[0658] A step S6 involves setting a header hdr and executing an encryption algorithm. The step S6 receives a plaintext message and stores the plaintext message in computer memory. The step S6 encrypts the plaintext message by parsing mpk = (ctr, mpk0, . . . , mpkℓ−1). setting hdr = ctrct= ctr, determining a set W = {k | mpkk

[0659]

[0660] and executing an encryption algorithm fsEnc of the SRABEscheme to compute (cG, K) y- fsEnc((mpkk)fceW, x, hdr), where x is an attribute, ctxis a ciphertext, and K is an encapsulated key.

[0661] With continued reference to FIG. 3, a step S7 stores the encrypted output ctxin computer memory. The step S7 also stores the updated public state aux and the master public key mpk in computer memory. The step S7 maintains the public state information for subsequent encryption and decryption operations.

[0662] A step S8 retrieves sk, hsk, and ctxfrom storage. The step S8 obtains the secret key, helper secret key, and ciphertext for use in decryption operations.

[0663] A step S9 compares counters and computes base-d representations. The step S9 determines whether the helper secret key requires updating based on the counter values. The step S9 computes the base-d representation of the user counter j to identify which components of the helper secret key may require updates.

[0664] A step S10 executes a decryption algorithm fsDec to recover the encapsulated key K. The step S10 takes the secret key ski, helper secret key hski, and ciphertext ctxas input. A decryption module may return a special getupd flag to indicate when an updated helper key is needed before successful decryption can occur. When the decryption module returns the getupd flag, the process runs an update algorithm to obtain an updated helper secret key and recomputes the decryption. A correctness property ensures that decryption succeeds with probability one minus negligible when the predicate evaluates to true, meaning when P(

[0665]

[0666] x, yi) = 1 for the attribute x in the ciphertext and the attribute yiassociated with user i.

[0667] Referring to FIG. 4, a slotted RABE system 300 may implement a flexible slotted registered attribute-based key encapsulation mechanism (SRABE) scheme. The slotted RABE system 300 may include a setup module 302, a key generation module 306, an aggregation module 312, an encryption module 318, and a decryption module 324. The slotted RABE system 300 may support general non-monotone span programs for access control policies.

[0668] The setup module 302 may include a common reference string generator 304. The common reference string generator 304 may execute a setup algorithm fsSetup(1λ, 1L) to generate a common reference string crs. The common reference string crs may comprise elements in bilinear groups i, G2, and GT- The setup algorithm maytake a security parameter 1λand a number of slots 1Las input. The bilinear groups may satisfy bilinearity and non-degeneracy properties as described above.

[0669] With continued reference to FIG. 4, the key generation module 306 may include a public key generator 308 and a secret key generator 310. The key generation module 306 may execute a key generation algorithm to output a public key pk, and a secret key sk, for a user i. The public key generator 308 may generate the public key pk, based on the common reference string crs and an index i ∈ [L], The secret key generator 310 may generate the corresponding secret key skj. A verification algorithm may verify the public key pk, by taking the common reference string crs, the index i, and the public key pk, as input and outputting 1 if the public key pk, is valid and 0 otherwise.

[0670] The aggregation module 312 may include a partial aggregation unit 314 and a sequential aggregation unit 316. The aggregation module 312 may execute an aggregation algorithm fsAgg to compute a master public key mpk and a set of helper secret keys {hskj}j∈U*, where Z7* is a target set of user indices. The partial aggregation unit 314 may aggregate public keys for any subset U ⊆ U*⊆ [L] into the master public key mpk and the helper secret keys. The sequential aggregation unit 316 may perform sequential aggregation where, for disjoint sets U and U such that

[0671]

[0672] ⊆ U*, the sequential aggregation unit 316 may first aggregate public keys for L and then aggregate public keys for U together with previously computed results to obtain updated master public key and helper secret keys with respect to U U U.

[0673] As further shown in FIG. 4, the encryption module 318 may include a header generator 320 and a ciphertext generator 322. The encryption module 318 may execute an encryption algorithm fsEnc to compute a ciphertext ctxand an encapsulated key K using a matrix M ∈ Zpn×nrepresenting a span program and a labeling function cr. The prime field Zpmay have order p. The encryption module 318 may support encapsulation with respect to multiple master public keys simultaneously, enabling multi-authority encryption scenarios. The header generator 320 may include metadata information in ciphertexts that can be retrieved in the clear without decryption. The ciphertext generator 322 may generate the ciphertext ctxbased on the master public keys, an access policy x, and a header hdr.The labeling function σ may map an index t to a tuple (B^, Le, Ve), where BeG {0, 1} is a bit, R G is a label, and W G V is a value. The label space £ may comprise bit strings. The value space V may comprise elements of Zp\{0}. The span program may support general non-monotone policies. A predicate may evaluate whether a target vector (1, 0) is in the span of matrix rows mℓcorresponding to indices t where the labeling function σ satisfies specified conditions with respect to user attributes.

[0674] The decryption module 324 may include a helper key manager 326 and a decapsulation unit 328. The decryption module 324 may execute a decryption algorithm fsDec to compute the encapsulated key K using a secret key sk,, a helper secret key hsk,, and the ciphertext ctx. The helper key manager 326 may manage helper secret keys and may request updated helper secret keys when indicated. The decapsulation unit 328 may recover the encapsulated key K when the user attributes satisfy the access policy encoded in the span program. User attributes may be represented as maps (p from the label space £ to the value space V or to the power set of the value space 2Vfor unbounded span program support.

[0675] Referring to FIG. 5, a powers-of-d conversion process 400 may be implemented to transform a flexible slotted registered attribute-based key encapsulation mechanism (SRABE) scheme into a full-fledged registered attribute-based key encapsulation mechanism (RABE) scheme. The process 400 generalizes a powers-of-two construction by employing a configurable base parameter d rather than a fixed base of two. The process 400 may achieve size reduction factors of logdL for master public key and ciphertext sizes, where L represents the number of users, while trading off helper secret key size and update frequency.

[0676] The process 400 includes a slot initialization 402 that establishes the foundational structure for user slot management. Within the slot initialization 402, a parameter d selection 404 determines the base value d used throughout the conversion process. The parameter d selection 404 may select values of d greater than two to reduce the number of parallel SRABE instances compared to the powers-of-two construction. A slot hierarchy creation 406 within the slot initialization 402 establishes a hierarchical arrangement of slots based on the selected parameter d. The slot hierarchy creation406 may create logdL levels of slot groupings, where each level corresponds to a digit position in the base-d representation of user indices.

[0677] With continued reference to FIG. 5, the process 400 includes a user assignment 408 that manages the mapping of users to slots within the hierarchical structure. The user assignment 408 contains a user index mapping 410 that converts user identifiers into base-d representations. The user index mapping 410 may compute the base-d representation (bn...b0)dof a user counter, where each digit bk∈ [0, d − 1] determines slot assignments at corresponding hierarchy levels. A slot assignment function 412 within the user assignment 408 communicates bidirectionally with the user index mapping 410 to determine specific slot placements. The slot assignment function 412 may implement a function

[0678]

[0679] that determines a set of indices I. for each hierarchy level k.

[0680] The process 400 includes a key aggregation 414 that performs cryptographic operations on public keys and generates helper secret keys. A public key aggregator 416 within the key aggregation 414 executes aggregation computations across designated slot sets. The public key aggregator 416 may compute (mpk′k, {hskk}j∈U*) = fsAgg(crs, (pk′,

[0681]

[0682] where fsAgg is the aggregation algorithm of the SRABE scheme, y is an attribute associated with the user, U−is a set of indices determined by the function

[0683]

[0684] crs is a common reference string, pkzis a public key, P3 and 풟1are dictionaries, and mpk′kand hskkare updated master public key and helper secret keys respectively. A helper secret key generator 418 within the key aggregation 414 interacts bidirectionally with the public key aggregator 416 to produce helper secret keys for users within aggregated slot sets.

[0685] Following the aggregation computation, the process 400 may update dictionary entries such that

[0686]

[0687] = mpk′kand D1[k, j] = hskk,jfor j E 풰k⋆When k is the minimum digit such that bk

[0688]

[0689] 0 in the base-d representation of the user counter, the process 400 may update mpkk= 풟3[k], mpkk, = ± for k' E [0, k — 1], and

[0690]

[0691] j] = D1[k, j] for j in a subset of where mpkkis the master public key for index k, ± denotes an empty or null value, and D3is another dictionary.

[0692] As further shown in FIG. 5, the process 400 includes a dynamic restructuring 420 that manages slot occupancy and user relocations as the system evolves. A slotoccupancy monitor 422 within the dynamic restructuring 420 tracks the population of users across slot hierarchies. The slot occupancy monitor 422 may maintain counters and state information to determine when restructuring operations become appropriate. A user relocation unit 424 within the dynamic restructuring 420 receives information from the slot occupancy monitor 422 via a connection indicated by a dashed line. The user relocation unit 424 may relocate users between slots to maintain efficient slot utilization and aggregation properties.

[0693] The process 400 achieves compactness where master public key and helper secret key sizes are polynomial in the security parameter, logarithm of attribute space size, and logarithm of slot count. The compactness property may be expressed as |mpk| = poly(A,log |J^|, log L) and |hsk| = poly(A,log |J^|, log L), where A is the security parameter, y is the attribute space, and L is the number of slots or users.

[0694] The update efficiency of the process 400 ensures that the number of helper key update invocations during decryption is at most logarithmic in the number of registered users. The update efficiency may be bounded by O(logdL) invocations of the update algorithm, where each invocation costs poly(logL) time in the RAM model. The powers-of-d construction generalizes the powers-of-two construction for transforming slotted RABE to full RABE by allowing selection of the base parameter d to balance between the number of parallel instances, helper secret key sizes, and update frequencies.

[0695] Referring to FIG. 6, a slotted RABE computing architecture 600 may implement registered attribute-based encryption operations through multiple interconnected subsystems. The architecture 600 may include a cryptographic processing subsystem 602 positioned at an upper portion of the architecture 600. The cryptographic processing subsystem 602 may implement bilinear group operations using cyclic groups G1, G2, GTof prime order p with bilinearity and non-degeneracy properties. The bilinearity property may satisfy ∀g1∈ G1, h2∈ G2, a, b ∈

[0696]

[0697] Zp, e(h“, h^) = e(hi, h2)“6. The non-degeneracy property may ensure that for generators g1and g2, the element e(g1,

[0698]

[0699] g2) is a generator of GT. The cryptographic processing subsystem 602 may contain a key generation processor 604. The key generation processor 604 may generate public keys pk and secretkeys sk for users in the system. The key generation processor 604 may feed into an encapsulation engine 606 and a decapsulation engine 608 via directional connections. The encapsulation engine 606 may perform encryption operations to generate ciphertexts ctxand encapsulated keys K ∈ K. The decapsulation engine 608 may perform decryption operations to recover encapsulated keys from ciphertexts.

[0700] With continued reference to FIG. 6, the cryptographic processing subsystem 602 may further include an aggregation module 610 and a verification processor 612 arranged in parallel. The aggregation module 610 may perform partial and sequential aggregation of public keys into master public keys mpk and helper secret keys hsk. The verification processor 612 may verify the validity of public keys using the verification algorithm Ver(crs, i, pki)

[0701] The system may operate in the generic bilinear group model using Shoup’s model with random injective labeling functions G1, G2, GT: Zp— Q for explicit group element representation. A labeling oracle OLab may take a group type indicator (τ) ∈ {1, 2, T} and a field element t ∈ Zpas input and may return the corresponding group element label Gτ(t). A group operation oracle OGrp may perform linear combinations of group elements by computing weighted sums in the exponent, taking (

[0702]

[0703] rr, gi, g2, ti, G) G {1,2, T} x Q2x Zpas input and returning G GG“x(gi ) + t2Gxx(g2)). A pairing oracle OPair may compute bilinear pairings by multiplying the discrete logarithms of input elements and returning the target group element GT(G]"1(gi) • Gij- x(g2))- As further shown in FIG. 6, a secure key memory subsystem 614 may be positioned below the cryptographic processing subsystem 602. The secure key memory subsystem 614 may contain a secret key storage 616, a helper key buffer 618, and a counter register 620 arranged in a grid pattern. The secret key storage 616 may store secret keys sk = (ctrsk, sk′) where ctrskis a counter associated with the secret key and skzis the actual secret key. The helper key buffer 618 may store helper secret keys hsk generated during aggregation operations. The counter register 620 may maintain the current user counter ctr for tracking user registrations.

[0704] A public state storage subsystem 622 may be positioned below the secure key memory subsystem 614. The public state storage subsystem 622 may contain astate controller 624 at an upper portion, with an MPK storage 626 and an auxiliary data store 628 positioned below. The state controller 624 may manage updates to the public state aux. The MPK storage 626 may store master public keys mpk generated through aggregation. The auxiliary data store 628 may store auxiliary state information including dictionaries D2used for helper key generation.

[0705] With continued reference to FIG. 6, the architecture 600 may support generating a helper secret key hsk by parsing the public state aux and a public key pk = (ctrpk, pk'), where aux is the public state, pk is a public key, ctrpkis a counter associated with the public key, and pkzis the actual public key. If ctrpk≤ ctr, the system may set hsk = {D2[k, b, ctrpk]}(k,b)∈[0,ℓ-1]×[d-1], where ctr is the current user counter, t is a positive integer, and D2is a dictionary. Otherwise, the system may set hsk = ±, where ± denotes an empty or null value.

[0706] An attribute-based access control subsystem 630 may be positioned below the public state storage subsystem 622. The attribute-based access control subsystem 630 may contain a policy evaluator 632 at an upper portion, with an attribute parser 634 and a slot index manager 636 positioned below. The policy evaluator 632 may evaluate predicates P: A × Y → {0, 1} to determine whether decryption is authorized. The attribute parser 634 may parse user attributes y ∈ Y and encryption policies x ∈ X. The slot index manager 636 may manage slot indices i ∈ [L] for user assignment.

[0707] The system may use progression- free and double-free sets An⊂ N where |An| = n. For progression-free and double-free sets, no three elements i, j, k ∈ An∪ {0} such that i ≠ j may satisfy the arithmetic progression condition i + j = 2k.

[0708] As further shown in FIG. 6, a communication interface 638 may be positioned at a lower portion of the architecture 600. The communication interface 638 may contain a network interface 640 and a protocol handler 642 arranged in parallel. The network interface 640 may handle network communications for distributed operations. The protocol handler 642 may manage cryptographic protocols for secure message exchange.

[0709] A system bus 644 may be positioned on a right side of the architecture 600. The system bus 644 may connect to the cryptographic processing subsystem 602,the secure key memory subsystem 614, the public state storage subsystem 622, the attribute-based access control subsystem 630, and the communication interface 638 via horizontal connections, enabling communication between subsystems.

[0710] The architecture 600 may support decrypting a ciphertext ctxusing a secret key sk = (ctrsk, sk′) and the helper secret key hsk by parsing ctx= (hdr,...) and hdr = ctrct, where ctxis the ciphertext, hdr is a header, and ctrctis a counter associated with the ciphertext. If ctrsk> ctrct, the decapsulation engine 608 may output ±, where ctrskis a counter associated with the secret key. Otherwise, the decapsulation engine 608 may compute the base-d representations of ctrsk− 1 and ctrct. The decapsulation engine 608 may determine the maximum k such that the fc-th digits of these representations differ. If hskk,b'

[0711]

[0712] ±, where b'kis the fc-th digit of ctrct, the decapsulation engine 608 may output fsDec(skz, hsk / , / ,-, ctx), where fsDec is the decryption algorithm of the SRABE scheme. Otherwise, the decapsulation engine 608 may output a special flag getupd indicating the need for an updated helper key.

[0713] Referring to FIG. 7, a RABE distributed network architecture 700 provides a distributed computing environment for implementing registered attribute-based encryption operations across multiple interconnected systems. The architecture 700 may support deployment of RABE schemes in cloud-based and enterprise environments where encryption and decryption operations are distributed across multiple computing nodes.

[0714] The architecture 700 includes a key management infrastructure 702 positioned on the left side of the diagram. The key management infrastructure 702 may coordinate generation, distribution, and lifecycle management of cryptographic keys used throughout the RABE system. Within the key management infrastructure 702, a key distribution server 704 may handle secure transmission of key material between system components. A registration authority 706 may validate user identities and authorize registration of new users into the RABE system. A public key directory 708 may maintain a searchable repository of public keys pk associated with registered users. A revocation service 710 may process key revocation requests and propagate revocation status throughout the architecture 700.With continued reference to FIG. 7, a RABE cloud services module 712 provides cloud-based cryptographic operations. The RABE cloud services 712 includes an aggregation service 714 that may execute aggregation algorithms of the SRABE scheme to combine public keys and generate master public keys and helper secret keys. An encapsulation service 716 may perform key encapsulation operations using the encryption algorithm fsEnc of the SRABE scheme. A verification gateway 718 may validate public keys using the verification algorithm of the SRABE scheme before registration proceeds. A state synchronization module 720 may coordinate updates to the public state aux across distributed storage nodes.

[0715] The architecture 700 includes a secure storage services module 722 that provides persistent storage for cryptographic data. An MPK store 724 may store master public keys mpk = (ctr, mpk0, . . . , mpkℓ−1) where ctr represents the counter of current users. A ciphertext repository 726 may store encrypted outputs ctxgenerated by the encryption operations. An auxiliary state DB 728 may maintain the public state aux = T>i, T>2, T’S, mpk) where T>i, T>2, and T>3 are dictionaries. A helper key cache 730 may provide temporary storage for helper secret keys hsk to reduce latency during decryption operations.

[0716] A RABE compute services module 732 provides computational resources for cryptographic operations. A setup VM 734 may execute the setup algorithm fsSetup(1λ, 1L) of the underlying SRABE scheme to generate the common reference string crs, where A is a security parameter and L = dℓ— 1 is a maximum number of users, d > 2 is a constant parameter, and t is a positive integer. An aggregation container 736 may provide isolated execution environments for running aggregation operations. A crypto functions module 738 may implement low-level cryptographic primitives including bilinear pairing operations and group element computations.

[0717] The architecture 700 includes a RABE client systems module 740 that provides client-side interfaces for users. An encryptor client 742 may generate ciphertexts by executing encryption operations where the encryption algorithm computes (ctr, K) y- fsEnc((mpkk)fceW, rr, hdr) with x being an attribute, ctxbeing a ciphertext, and K being an encapsulated key. A decryptor client 744 may recover encapsulated keys from ciphertexts using secret keys and helper secret keys. A key gen client 746may generate public key pk and secret key sk pairs by executing the key generation algorithm of the SRABE scheme. An attribute client 748 may manage user attributes y ∈ Y associated with registered users.

[0718] A RABE server systems module 750 provides server-side management functions.

[0719] A setup server 752 may coordinate initialization of the RABE scheme across the distributed architecture 700. A registration server 754 may process user registration

[0720] requests by verifying public keys using the verification algorithm of the SRABE

[0721] scheme and updating the public state using the aggregation algorithm. During registration, for each k in a specified range determined by a function

[0722]

[0723] =

[0724] j — (j mod dk+1) + bdkwhere j is the user counter, b is a digit in the base-d representation of j, k is an index, and d is a constant parameter, the registration server 754

[0725] may update the public state. A policy server 756 may manage access control policies

[0726] defined by span programs. An audit server 758 may log cryptographic operations

[0727] for compliance and security monitoring.

[0728] A secure data flow module 760 coordinates data movement between components

[0729] of the architecture 700. A key queue 762 may buffer key generation requests for processing by the key management infrastructure 702. A batch aggregation module

[0730] 764 may group multiple aggregation operations for efficient processing. A stream

[0731] encrypt module 766 may handle continuous encryption of data streams. A key sync

[0732] pipeline 768 may propagate key updates across the distributed storage nodes.

[0733] The architecture 700 may achieve CCA security by constructing CCA-secure

[0734] slotted RABE first and then lifting to full RABE, avoiding Fujisaki-Okamoto transformation overhead. The architecture 700 may support completely unbounded span

[0735] programs through conversion where multiple values per label are encoded as separate

[0736] label-value pairs.

[0737] During encryption operations, the encryptor client 742 may parse mpk = (ctr, mpk0,..., mpkZ| ). set hdr = ctrct= ctr, and determine a set W = {k | mpkky _!_} before executing

[0738] the encryption algorithm. The encrypted output ctxmay be stored in the ciphertext

[0739] repository 726, and the updated public state aux and master public key mpk may

[0740] be stored in the auxiliary state DB 728 and MPK store 724 respectively.A non-transitory computer-readable storage medium may store instructions that, when executed by one or more processors of the architecture 700, cause the one or more processors to perform the operations described above for attribute-based encryption. The instructions may be distributed across the setup VM 734, aggregation container 736, and crypto functions module 738 to enable parallel execution of cryptographic operations. The computer memory for storing the public state, plaintext messages, and encrypted outputs may be distributed across the secure storage services 722.

[0741] Referring to FIG. 8, a comparison table illustrates efficiency characteristics among black-box slotted registered attribute-based key encapsulation mechanism (Reg-ABK) schemes from pairings supporting a large attribute universe. The comparison table omits elements other than group elements for clarity of comparison. The comparison table may be divided into two sections, with a first section covering monotone slotted Reg-ABE schemes and a second section covering general non-monotone slotted Reg-ABE schemes.

[0742] The comparison table presents several parameters for evaluating scheme efficiency. A common reference string size |crs| represents the size of the common reference string crs generated by executing the setup algorithm fsSetup(1λ, 1L). The common reference string crs may comprise elements in bilinear groups G1, G2, and GTA master public key size | mpk| represents the size of the master public key mpk computed by executing the aggregation algorithm fsAgg. A helper secret key size |hsk| represents the size of helper secret keys in the set {hs^}^*, where G* is a target set of user indices. A ciphertext size |ct| represents the size of the ciphertext cG computed by executing the encryption algorithm fsEnc.

[0743] With continued reference to FIG. 8, the scheme parameters relate to user attributes through specific mathematical relationships. A first parameter

[0744] Ji =

[0745]

[0746] maxie[£] |_ez: |0i(L)| represents a maximum cardinality of attribute values associated with a label L across users indexed by i ∈ [L], where £ is a label space. A second parameter d2= niaxie[L] |{L G £ | i(L) 0} | represents a maximum number of labels having non-empty attribute values for any user. The label space £ and avalue space V define the attribute structure for the underlying slotted registered attribute-based encryption (SRABE) scheme.

[0747] The comparison table includes schemes supporting general non-monotone policies. The span program may support general non-monotone policies through a matrix M G Zp1X"2representing the span program and a labeling function a. The labeling function a maps an index t to a tuple (B^, Lg, Vg), where B / G {0, 1} is a bit, Lg

[0748]

[0749] G is a label, and

[0750]

[0751] G V is a value. The parameters ng and2specify the size of the span program matrix M used in encryption, where Zpis a prime field of order p.

[0752] As further shown in FIG. 8, progression-free and double-free sets satisfy a relationship /

[0753]

[0754] (Ik) = L1+O(A, where f(Ik) represents the maximum element of progression-free and double-free sets of size L. The progression-free and double-free set property ensures that for indices i, j, k in the set including zero, where i j, the relationship i + j 2k holds. This property may be used in constructing efficient cryptographic schemes.

[0755] The comparison table further shows parameter relationships for different scheme variants. For AT24 schemes, parameters cui = a2= fi2+ 1,

[0756]

[0757] = h2(fii + 1) + 1, and CU4 = fi2(3fii + 2) + 1 define size relationships. For GLWW schemes, a parameter « = |{(L, V) G Z: x V | 3 / G [L], V G i(L)}| represents the number of label- value pairs used in the system. For disclosed schemes supporting unbounded span programs, a parameter b = |{L G £ | 3 / G [L], i(L) 0} | represents the number of labels having non-empty attribute values. For disclosed schemes supporting general non-monotone span programs, a parameter c =

[0758]

[0759] I2Le£-s(L)yo(fi'C-) + 1) where < / (L) = maxi£|L| |0i(L) | represents aggregate attribute complexity.

[0760] The underlying SRABE scheme may comprise executing the key generation algorithm to output a public key pk, and a secret key sk, for a user i, and executing a verification algorithm to verify the public key pk,. The underlying SRABE scheme may further comprise executing the decryption algorithm fsDec to compute the encapsulated key K using a secret key sk,. a helper secret key hsk,. and the ciphertext ctx.

[0761] As described previously, registering a user may further comprise computing (mpk'k, {hskk,j}j∈풰) = fsAgg(crs, pL',y), U*,'D3[k], {'Dg[k,j]}j^k'), where fsAgg isthe aggregation algorithm of the SRABE scheme, y is an attribute associated with the user, U−is a set of indices determined by the function fk, crs is a common reference string, pkzis a public key, TA, and D are dictionaries, and mpk'kand hskk,jare updated master public key and helper secret keys respectively. Registering the user may further comprise updating 풟3[k] = mpkzfcand T>i[k, j] = hskfcfor j E Uk. If k is the minimum digit such that bk

[0762]

[0763] 0 in the base-d representation of the user counter, registering the user may comprise updating mpkk=

[0764]

[0765] 73>3[fc], mpkk, = ± for k

[0766]

[0767] ' E [0, k — 1], and j] = 'Dilk, j] for j in a subset of where mpkkis the master public key for index k, ± denotes an empty or null value, and 풟2is another dictionary.

[0768] Referring to FIG. 9, a comparison table illustrates performance characteristics among full-fledged registered attribute-based key encapsulation mechanism (Reg-ABK) schemes from pairings supporting a large attribute universe. The comparison table in FIG. 9 presents three schemes: GLWW24 with powers-of-two and incremental aggregation, AT24-GNMS with powers-of-two, and a disclosed scheme (Ours 2) with powers-of-d construction. For each scheme, FIG. 9 displays cryptographic parameter sizes and operational characteristics including the size of the common reference string |crs|, the size of the master public key |mpk|, the size of the helper secret key |hsk|, the size of the ciphertext |ct|, the size of the auxiliary state |aux|, the number of updates, the underlying security assumption and security model, and whether the scheme supports non-monotone policies.

[0769] With continued reference to FIG. 9, the comparison table provides concrete size examples for two user population scenarios: L' = 218(approximately 262,144 users) and L1= 212(4,096 users). For the GLWW24 scheme at L1= 218, the sizes are 102GB for |crs|, 18.9MB for | mpk|, 68.7MB for |hsk|, 42.4KB for |ct|, and 30.0TB for |aux|, with 19 updates. The AT24-GNMS scheme at L1= 218shows sizes of 864TB for |crs|, 56.5MB for |mpk|, 308MB for |hsk|, 73.4MB for |ct|, and 188TB for |aux|, with 19 updates. The disclosed scheme (Ours 2) at L' = 218— 1 shows reduced sizes of 50.9GB for |crs|, 7.64KB for |mpk|, 1.54MB for |hsk|, 7.56KB for |ct|, and 409GB for |aux|, with 189 updates.The powers-of-d construction achieves reduced sizes of approximately 7.64KB for the master public key and 7.56KB for the ciphertext compared to prior schemes. The GLWW24 scheme produces a master public key of 18.9MB and a ciphertext of 42.4KB, while the AT24-GNMS scheme produces a master public key of 56.5MB and a ciphertext of 73.4MB. The disclosed scheme reduces the master public key size by approximately three orders of magnitude compared to GLWW24 and approximately four orders of magnitude compared to AT24-GNMS. The ciphertext size reduction is approximately one order of magnitude compared to GLWW24 and approximately four orders of magnitude compared to AT24-GNMS.

[0770] As shown in FIG. 9, a trade-off exists between the number of updates and the sizes of cryptographic parameters. The powers-of-two approach used in GLWW24 and AT24-GNMS results in 19 updates for L' = 218users, while the powers-of-d construction results in 189 updates. The increased number of updates in the powers-of-d construction enables the reduced sizes of the master public key, helper secret key, and ciphertext. The auxiliary state size |aux| for the disclosed scheme is 409GB, which is larger than the 30.0TB for GLWW24 but smaller than the 188TB for AT24-GNMS when considering the ratio to the common reference string size.

[0771] The disclosed scheme may generate a helper secret key hsk by parsing the public state aux and a public key pk = (ctrpk, pk'), where aux is the public state, pk is a public key, ctrpkis a counter associated with the public key, and pkzis the actual public key. If ctrpk≤ ctr, the helper secret key may be set as hsk = 'D2\k. b, ctrpk]}(fe,6)e[oy-i]x[d-i])where ctr is the current user counter, t is a positive integer, and D2is a dictionary. Otherwise, the helper secret key may be set as hsk = ±, where ± denotes an empty or null value.

[0772] The disclosed scheme may decrypt a ciphertext ctxusing a secret key sk = (ctrsk, sk') and the helper secret key hsk by parsing ctx= (hdr,...) and hdr = ctrct, where ctxis the ciphertext, hdr is a header, and ctrctis a counter associated with the ciphertext. If ctrsk> ctrct, the decryption outputs ±, where ctrskis a counter associated with the secret key. Otherwise, the decryption computes the base-d representations of ctrsk− 1 and ctrct. The decryption determines the maximum k such that the fc-th digits of these representations differ. If hskk,b'

[0773]

[0774] ±, where is thefc-th digit of ctrct, the decryption outputs fsDec(skz, hskfc;yfe, ct, where fsDec is the decryption algorithm of the SRABE scheme. Otherwise, the decryption outputs a special flag getupd indicating the need for an updated helper key.

[0775] Registered Attribute-Based Encryption System in Streaming Applications

[0776] In some cases, a registered attribute-based encryption (RABE) system may be implemented for secure content distribution, such as streaming media services. The RABE system may extend traditional attribute-based encryption (ABE) schemes by eliminating the need for a central authority, which may enhance security and reduce administrative overhead.

[0777] The RABE system may utilize a slotted conversion process to transform a slotted registered attribute-based encryption (SRABE) scheme into a full RABE scheme. This conversion process may involve a parameter ’d’, which may be any integer greater than or equal to 2. The flexibility in choosing ’d’ may allow the system to balance efficiency and security requirements based on specific implementation needs.

[0778] In some implementations, the RABE system may operate as follows:

[0779] 1. Initialization: The system may execute a setup algorithm fsSetup(1λ, 1L) to generate a common reference string crs. Here, A represents a security parameter, and L = de— 1 denotes the maximum number of users, where d > 2 is a constant parameter and I is a positive integer.

[0780] 2. Key Generation: For each user, the system may generate a public key pk and a secret key sk using a key generation algorithm of the underlying SRABE scheme.

[0781] 3. User Registration: The system may register users by verifying their public keys and updating the public state. This process may involve an aggregation algorithm that operates over a specified range determined by a function fk(j, b) = j — (j mod dk+1) + bdk, where j is the user counter, b is a digit in the base-d representation of j, and k is an index.

[0782] 4. Encryption: To encrypt a plaintext message, the system may parse the master public key mpk, set a header hdr, and execute an encryption algorithm fsEnc of the SRABE scheme. This process may generate a ciphertext ctxand an encapsulated key K.5. Decryption: The system may decrypt a ciphertext using a secret key sk, a helper secret key hsk, and the ciphertext cX.x. This process may involve comparing counters, computing base-d representations, and executing a decryption algorithm fsDec of the SRABE scheme.

[0783] The RABE system may offer several advantages for content distribution services: 1. Enhanced Security: By eliminating the need for a central authority, the system may reduce the risk of key escrow and single points of failure.

[0784] 2. Reduced Administrative Overhead: The absence of a central authority may simplify system management and reduce operational costs.

[0785] 3. Flexible Access Control: The system may support complex access policies through the use of attributes, allowing fine-grained control over content access.

[0786] 4. Scalability: The slotted conversion process may enable the system to efficiently handle a large number of users.

[0787] In some implementations, the RABE system may utilize bilinear groups i, 2, and GT to perform cryptographic operations. The system may also employ a span program represented by a matrix M G Z"| X"- and a labeling function <7 to define access policies.

[0788] The flexibility of the ’d’ parameter in the conversion process may allow content distributors to optimize the system for their specific needs. For example, a larger ’d’ value may reduce the size of certain cryptographic components at the cost of increased update frequency for helper keys.

[0789] In some cases, the RABE system may be particularly beneficial for streaming media services. It may enable these services to securely distribute content to users based on attributes such as subscription level, geographic location, or device type, without relying on a trusted central authority to manage keys.

[0790] The efficiency trade-offs inherent in the RABE system may be outweighed by the administrative benefits in many commercial applications. While the system may require more frequent updates of certain components compared to traditional ABE schemes, it may significantly reduce the complexity and risk associated with maintaining a central key authority.In some implementations, the RABE system may support partial and sequential aggregation of public keys. This feature may allow for more efficient key management in dynamic environments where users frequently join or leave the system.

[0791] The inclusion of header information in ciphertexts may enable additional functionality, such as versioning or metadata attachment, which may be useful in content distribution scenarios.

[0792] Overall, the RABE system may provide a flexible and secure framework for attribute-based access control in content distribution applications, offering a balance between security, efficiency, and administrative simplicity.

[0793] Slotted Conversion Process

[0794] The slotted conversion process may be a key component of the RABE system, enabling the transformation of a slotted RABE (SRABE) scheme into a full RABE scheme. This process may involve several steps:

[0795] 1. Initialization: The system may set up a series of slots, where the number of slots is determined by the parameter ’d’ and the maximum number of users. The slots may be organized in a hierarchical structure, with each level corresponding to a power of ’d’.

[0796] 2. User Assignment: As new users join the system, they may be assigned to slots based on their registration order. The assignment process may use a function that maps user indices to specific slots.

[0797] 3. Key Aggregation: The system may aggregate public keys and attributes of users within each slot to generate master public keys and helper secret keys for that slot.

[0798] 4. Dynamic Restructuring: As slots fill up, the system may restructure the slot hierarchy, moving users between slots to maintain efficiency.

[0799] The flexibility in choosing the ’d’ parameter may allow system administrators to optimize the conversion process for their specific use case. A larger ’d’ value may result in fewer slots and potentially smaller master public keys, but may require more frequent helper key updates.In some implementations, the slotted conversion process may support partial aggregation, allowing the system to efficiently handle scenarios where only a subset of users need to be included in a particular operation.

[0800] The conversion process may also enable sequential aggregation, where new users can be added to the system without requiring a complete re-computation of all cryptographic components. This feature may be particularly useful in dynamic environments, such as streaming media platforms where user bases may change frequently.

[0801] Commercial Applications in Content Distribution

[0802] The RABE system may have significant implications for commercial content distribution services. By eliminating the need for a central authority, the system may offer several advantages:

[0803] 1. Reduced Infrastructure Costs: Content distributors may be able to simplify their key management infrastructure, potentially reducing operational costs.

[0804] 2. Enhanced Privacy: Without a central authority holding all keys, user privacy may be better protected, which may be a selling point for privacy-conscious consumers.

[0805] 3. Scalability: The system’s ability to handle a large number of users efficiently may make it suitable for large-scale content distribution platforms.

[0806] 4. Flexible Access Policies: Content distributors may be able to implement complex access control policies based on user attributes, enabling more granular content monetization strategies.

[0807] In the context of streaming media, the RABE system may enable scenarios such as:

[0808] 1. Geographically Restricted Content: Access to certain content may be restricted based on a user’s location attribute.

[0809] 2. Tiered Access: Different levels of content access may be granted based on a user’s subscription tier attribute.

[0810] 3. Device-Specific Streaming: Content may be encrypted in ways that allow playback only on specific types of devices, based on device attributes.

[0811] 4. Temporary Access: Time-limited attributes may be used to grant temporary access to content, facilitating rental or promotional offers.The efficiency trade-offs inherent in the RABE system may be justified by these enhanced capabilities and the reduced administrative burden. While the system may require more frequent updates of helper keys compared to traditional ABE schemes, it may offer greater flexibility and security in content distribution scenarios.

[0812] In some cases, the RABE system’s support for partial and sequential aggregation may be particularly beneficial for streaming platforms that experience frequent user churn or need to quickly provision access for new users.

[0813] The inclusion of header information in ciphertexts may also enable additional features valuable in content distribution, such as attaching metadata about content ratings, audio tracks, or subtitle information directly to the encrypted content.

[0814] Overall, the RABE system may provide content distributors with a powerful tool for implementing secure, flexible, and efficient access control in their platforms, potentially enabling new business models and enhancing user experience while maintaining strong security guarantees.

[0815] Computing Architecture for Registered Attribute-Based Encryption System

[0816] The registered attribute-based encryption (RABE) system may be implemented using a distributed computing architecture optimized for secure content distribution services, such as streaming media platforms. This architecture may comprise several interconnected components and subsystems, each designed to support the specific requirements of the RABE framework.

[0817] Hardware Components

[0818] The core infrastructure may consist of a cluster of high-performance server nodes, each equipped with multi-core processors such as Intel Xeon Scalable or AMD EPYC series. These processors may be chosen for their ability to efficiently handle complex cryptographic operations, particularly those involving bilinear groups G1, G2, and GT. Each node may be configured with a minimum of 256GB of ECC DDR4 or DDR5 RAM to support rapid data processing and key management operations.

[0819] Storage infrastructure may utilize a tiered approach, combining NVMe SSDs for high-speed access to frequently used data (such as user attributes, public keys, and the public state aux) with larger capacity HDDs for archival storage of encryptedcontent. This storage system may be managed by a distributed file system such as Ceph or GlusterFS, providing scalability and redundancy.

[0820] Specialized cryptographic accelerators, such as Intel QuickAssist Technology or dedicated FPGA-based solutions, may be employed to offload computationally intensive operations like bilinear pairing computations and operations involving the span program matrix M

[0821]

[0822] G

[0823] Software Components

[0824] The RABE system may operate on a Linux-based operating system, such as Red Hat Enterprise Linux or Ubuntu Server, optimized for high-performance computing environments. Containerization technologies like Docker or Kubernetes may be utilized to ensure consistent deployment and scalability of system components.

[0825] Software components may include:

[0826] 1. A custom-developed RABE library implemented in a low-level language like C++ or Rust for optimal performance, incorporating cryptographic primitives from established libraries such as the Pairing-Based Cryptography (PBC) library for operations in bilinear groups.

[0827] 2. A distributed key- value store such as Apache Cassandra or Redis for managing the public state aux and dictionaries P1, P2, and P3.

[0828] 3. Apache Kafka or RabbitMQ for handling event-driven operations like user registration and key updates, particularly useful for implementing the dynamic restructuring aspect of the slotted conversion process.

[0829] 4. A high-performance web server like NGINX or Apache Traffic Server to handle incoming requests for encryption and decryption operations.

[0830] 5. Custom middleware developed in languages like Go or Java to orchestrate the various components of the RABE system and implement the slotted conversion process, including the function fk(j, &) = j — ( mod dk+1) +bdkfor user assignment to slots.

[0831] Network Infrastructure

[0832] The network infrastructure may be designed to support high-throughput, low-latency communications between system components and end-users. This may include:1. 100 Gigabit Ethernet or InfiniBand interconnects between server nodes for rapid data transfer and distributed computations.

[0833] 2. Software-defined networking (SDN) controllers, such as OpenDaylight or ONOS, to dynamically manage network traffic and security policies.

[0834] 3. Load balancers (e.g., HAProxy or F5 BIG-IP) to distribute incoming requests across multiple server nodes, ensuring optimal resource utilization and fault tolerance.

[0835] 4. Content Delivery Networks (CDNs) integrated with the RABE system to efficiently distribute encrypted content to end-users while maintaining the security properties of the encryption scheme.

[0836] Data Flow and Processing Pipelines

[0837] The RABE system may implement several key data processing pipelines:

[0838] 1. Initialization Pipeline: This pipeline may execute the setup algorithm fsSetup(1λ, 1L) to generate the common reference string crs and initialize the slot structure based on the chosen parameter d.

[0839] 2. User Registration Pipeline: This pipeline may handle the verification of user public keys pk, updating of the public state aux, and execution of the aggregation algorithm. It may utilize the function

[0840]

[0841] to determine the appropriate slot for each user.

[0842] 3. Key Aggregation Pipeline: This pipeline may aggregate public keys and attributes of users within each slot to generate master public keys mpk and helper secret keys hsk for that slot.

[0843] 4. Encryption Pipeline: This pipeline may parse the master public key mpk, set the header hdr, determine the active SRABE instances, and execute the encryption algorithm fsEnc. It may be optimized to handle high volumes of concurrent encryption requests.

[0844] 5. Decryption Pipeline: This pipeline may process decryption requests, comparing counters, computing base-d representations, and executing the decryption algorithm fsDec. It may include logic to handle cases where helper key updates are required.These pipelines may be implemented using a combination of stream processing frameworks like Apache Flink or Apache Beam, and workflow orchestration tools like Apache Airflow or Netflix Conductor.

[0845] Security Measures and Protocols

[0846] The RABE system may implement multiple layers of security:

[0847] 1. All data at rest, including encrypted content and system state information, may be encrypted using AES-256 in GCM mode.

[0848] 2. Communications between system components and with end-users may be secured using TLS 1.3 with perfect forward secrecy.

[0849] 3. The system may employ a Hardware Security Module (HSM) for secure generation and storage of critical system parameters and root keys.

[0850] 4. Access to system components may be controlled through a combination of role-based access control (RBAC) and multi-factor authentication (MFA).

[0851] 5. Regular security audits and penetration testing may be conducted to identify and address potential vulnerabilities.

[0852] 6. The system may implement secure multi-party computation (MPC) protocols to distribute trust when generating system-wide parameters, further reducing reliance on a central authority.

[0853] 7. Attribute-based policies, represented by the span program matrix M and labeling function, may be securely stored and evaluated to enforce fine-grained access control.

[0854] This architecture may provide a flexible and scalable foundation for implementing the RABE system, capable of supporting large-scale content distribution services while maintaining the security and efficiency properties of the underlying cryptographic scheme. The modular design and the flexibility in choosing the parameter d may allow for easy upgrades and optimizations as new technologies and cryptographic techniques become available, enabling content distributors to balance efficiency, security, and administrative simplicity based on their specific needs.

[0855] Machine readable storage including machine-readable instructions, when executed, to implement a method or realize an apparatus in any of the examples of the present application.Throughout this disclosure, various terms and phrases are used to describe features of the disclosed technology. It is to be understood that these terms and phrases may encompass a variety of meanings and definitions, as is common in the Held of technology, cryptography, and patent law. The definitions of these terms may vary depending on the context in which they are used, the specific embodiment being described, or the interpretation of the technology by those skilled in the art.

[0856] In various embodiments, certain variable names, symbols, or labels may be used in the claims to represent various elements, components, or steps of the described methods, systems, and apparatuses. These variable names, symbols, or labels are provided for convenience and clarity in describing the claimed subject matter. However, it should be understood that the use of such variable names, symbols, or labels in the claims does not necessarily limit these elements, components, or steps to being the same specific entities described in the specification or in other parts of the disclosure. The variable names, symbols, or labels used in the claims should be interpreted broadly and may encompass various implementations, variations, or equivalents of the described elements, components, or steps, unless explicitly stated otherwise or clearly limited by the context of the claim. As such, the scope of the claims is not confined to the specific examples or embodiments described in the specification, but rather extends to the full breadth of the inventive concepts disclosed herein.

[0857] For instance, terms such as "computing device," "processor," "memory," "network," "key," "ciphertext," and "attribute" may refer to a wide range of devices, components, systems, data structures, and configurations known in the art, and their specific definitions may differ based on the implementation or design of the system. Similarly, phrases like "securely storing," "computing a vector," "generating a message," "aggregating public keys," "encrypting a plaintext," and "executing an algorithm" may involve various methods, techniques, and processes that achieve the same or similar outcomes but may be executed in different manners.

[0858] It is also to be understood that the use of terms in the singular or plural form is not intended to limit the scope of the claims. For example, the mention of "a computing device" does not preclude the presence of multiple computing devices within a system. Likewise, references to "a network" may include various interconnectednetworks or a single network comprising multiple segments or layers. Similarly, the mention of "a key" does not preclude the presence of multiple keys, and references to "a dictionary" may include various data structures or a single data structure comprising multiple entries or mappings.

[0859] Furthermore, the use of the term "may" in relation to an action or feature indicates that the action or feature is possible, but not necessarily mandatory. This term is used to describe optional or alternative aspects of the disclosed technology that provide flexibility in how the technology may be implemented or utilized.

[0860] The definitions provided herein are intended to serve as examples and are not exhaustive. Those skilled in the art may ascribe different meanings to these terms based on the context, the specific technology being described, or the advancements in the Held. Therefore, the definitions of the terms and phrases used in this disclosure and the claims are to be interpreted broadly and in a manner consistent with the understanding of those skilled in the relevant art.

[0861] The use of the word "a" or "an" when used in conjunction with the claims herein is to be interpreted as including one or more than one of the element it introduces. Similarly, the use of the term "or" is intended to be inclusive, such that the phrase " A or B" is intended to include A, B, or both A and B, unless explicitly stated otherwise.

[0862] Reference throughout the specification to "one embodiment," "another embodiment," "an embodiment," and so forth, means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the present disclosure, and may not necessarily be present in all embodiments. Furthermore, the particular features, structures, or characteristics may be combined in any suitable manner in one or more embodiments without limitation.

[0863] The use of the terms "first," "second," and the like does not imply any order or sequence, but are used to distinguish one element from another, and the terms "top," "bottom," "front," "back," "leading," "trailing," and the like are used for descriptive purposes and are not necessarily to be construed as limiting.As used herein, the term "processor" refers to any computing entity capable of executing instructions to perform a specific set of operations, whether implemented in hardware, firmware, software, or any combination thereof. This definition includes a broad range of processing technologies and architectures. The term encompasses general-purpose processors such as Central Processing Units (CPUs), specialized processors such as Graphics Processing Units (GPUs), as well as highly specialized hardware accelerators such as Neural Processing Units (NPUs) for artificial intelligence applications and Tensor Processing Units (TPUs) for machine learning workloads. The term also encompasses cryptographic coprocessors and accelerators designed for performing cryptographic operations, including but not limited to Hardware Security Modules (HSMs), Trusted Platform Modules (TPMs), pairing-based cryptography accelerators for bilinear group operations, elliptic curve cryptography accelerators, and dedicated encryption / decryption engines. The term further encompasses secure enclaves and trusted execution environments such as Intel SGX and ARM TrustZone. The term also encompasses reconfigurable computing architectures such as Field-Programmable Gate Arrays (FPGAs) for applications requiring specialized processing configurations, Application-Specific Integrated Circuits (ASICs), Digital Signal Processors (DSPs), Systolic Array Processors, and emerging computing paradigms such as Quantum Processors that leverage principles of quantum mechanics. System on Chip (SoC) designs, heterogeneous computing systems, Edge Computing Processors for distributed network applications, cloud-based and distributed processors, multi-core and parallel processors, and Neuromorphic processors that draw inspiration from biological neural architectures are all encompassed within this definition. The term "processor" also encompasses the associated memory hierarchies, including primary memory (such as RAM), secondary storage (such as hard drives and SSDs), secure memory regions, and cache memory, which work in conjunction with the processor to store and retrieve data necessary for executing instructions. In this patent application, any reference to a "processor" should be interpreted broadly to include any type of processing unit capable of performing the described functions, regardless of its specific implementation, architecture, or physical form.As used herein, the term "cryptographic key" or "key" refers to any data element used in cryptographic operations to control the transformation of plaintext to ciphertext, ciphertext to plaintext, or to enable other cryptographic functions. This definition encompasses a broad spectrum of key types and formats. The term includes public keys that may be freely distributed, secret keys (also referred to as private keys) that are kept confidential, master public keys that aggregate or represent multiple individual keys, helper secret keys that assist in decryption operations, encapsulated keys that are protected within ciphertexts, session keys for temporary use, and any derived or intermediate keys used in cryptographic protocols. The term further encompasses symmetric keys used in symmetric encryption schemes, asymmetric key pairs used in public-key cryptography, group elements in bilinear groups or elliptic curve groups, vectors or matrices of field elements, and any other mathematical objects that serve as keys in cryptographic constructions. Keys may be represented in various formats including raw binary data, encoded strings, group element representations, or structured data objects containing multiple components. The term also encompasses key material from which keys are derived, key shares in threshold or distributed cryptographic schemes, and any metadata or auxiliary information associated with keys such as counters, identifiers, or validity periods.

[0864] As used herein, the term "algorithm" refers to any finite sequence of well-defined instructions, computational procedures, or operations designed to perform a specific task or solve a particular problem. In the context of cryptographic systems, the term encompasses setup algorithms that initialize system parameters and generate common reference strings, key generation algorithms that produce public keys and secret keys, verification algorithms that validate the correctness or authenticity of keys or other data, aggregation algorithms that combine multiple keys or data elements into compact representations, encryption or encapsulation algorithms that transform plaintext messages into ciphertexts and generate encapsulated keys, decryption or decapsulation algorithms that recover plaintext messages or keys from ciphertexts, and update algorithms that modify system state or key material. The term also encompasses hash functions, pseudorandom functions, commitment schemes, zeroknowledge proof protocols, and any other cryptographic primitives or protocols.Algorithms may be deterministic or randomized, may operate in polynomial time or other complexity classes, and may be implemented in hardware, software, firmware, or any combination thereof.

[0865] As used herein, the term "dictionary" or "data structure" refers to any organized collection of data elements that supports storage, retrieval, modification, and management of information. This definition encompasses associative arrays, hash tables, hash maps, key- value stores, lookup tables, symbol tables, and any other data structures that map keys or indices to values. The term includes arrays, lists, trees, graphs, heaps, stacks, queues, and any hierarchical or relational data organizations. In the context of this disclosure, dictionaries may store mappings between indices and cryptographic keys, between user identifiers and attributes, between slot positions and aggregated key material, or any other associations relevant to the cryptographic system. The term encompasses both in-memory data structures and persistent storage representations, distributed data structures spanning multiple computing nodes, and any abstractions or interfaces that provide dictionary-like functionality regardless of underlying implementation.

[0866] As used herein, the term "attribute" refers to any characteristic, property, quality, or piece of information associated with an entity such as a user, device, role, or resource. In the context of attribute-based cryptographic systems, the term encompasses labels that identify categories or types of attributes, values that specify particular instances within those categories, and label- value pairs that together define specific attributes. The term includes user attributes that describe characteristics of users such as roles, permissions, organizational affiliations, geographic locations, time periods, or any other descriptive information. Attributes may be represented as strings, integers, field elements, bit vectors, or any other data formats. The term also encompasses attribute sets containing multiple attributes, attribute functions or mappings that associate labels with values or sets of values, and any metadata or auxiliary information associated with attributes. Attributes may be static or dynamic, may be assigned by authorities or self-asserted by users, and may be verified or unverified.As used herein, the term "policy" or "access policy" refers to any specification, rule, condition, or criterion that determines whether access to encrypted data or resources should be granted. This definition encompasses Boolean formulas using AND, OR, and NOT operations, threshold gates, linear secret sharing schemes, span programs represented by matrices and labeling functions, and any other mathematical or logical structures that encode access conditions. The term includes monotone policies that use only positive attributes (AND and OR operations), non-monotone policies that additionally use negation (NOT operations), and general non-monotone policies that support arbitrary combinations of positive and negative attribute conditions. Policies may be expressed in various forms including Boolean circuits, access trees, attribute-based formulas, or matrix representations. The term also encompasses policy evaluation algorithms that determine whether a given set of attributes satisfies a policy, and any transformations or encodings of policies used in cryptographic constructions.

[0867] As used herein, the term "counter" or "index" refers to any numerical value, identifier, or pointer used to track position, sequence, state, or quantity within a system. This definition encompasses integer counters that increment or decrement to track the number of users, operations, or events, slot indices that identify positions within arrays or hierarchical structures, user indices that uniquely identify registered users, and any other numerical identifiers used for addressing, sequencing, or state management. The term includes counters associated with keys, ciphertexts, or other cryptographic objects that indicate temporal ordering or version information. Counters and indices may be represented as integers, bit strings, field elements, or any other numerical formats, and may be stored, transmitted, compared, or manipulated as part of cryptographic protocols.

[0868] As used herein, the term "messages" may refer to any form of data or information that can be processed, transmitted, or stored in a digital format. Messages may include arbitrary-length plaintext messages, pre-hashed messages, concatenated messages, binary data, network protocol messages, database records, and time-stamped messages. In cryptographic contexts, the term encompasses plaintext messages to be encrypted, ciphertext messages resulting from encryption, encapsulated keys, head-ers containing metadata, and any auxiliary data transmitted alongside encrypted content. Messages may be composed of characters, symbols, or binary data and may represent various forms of content such as text, numbers, multimedia, executable code, or any other data that can be digitally encoded. Messages may be used as input for cryptographic functions, such as keyed hash functions, where they are transformed into a fixed-size hash value influenced by a secret cryptographic key. The term "messages" encompasses a wide range of data types and structures, from simple text strings to complex structured data, and may include metadata, headers, footers, or other information that facilitates the processing, transmission, or interpretation of the content. Messages may be generated by users, systems, or processes and may be intended for various purposes, including communication, authentication, verification, logging, or any other function that involves the use of digital data. Messages may also include data formats specific to artificial intelligence and machine learning applications, such as tensors, feature vectors, embeddings, model parameters, activation maps, training examples, and inference requests. In distributed and edge computing contexts, the term "messages" further extends to include event streams, state updates, service requests, synchronization messages, and smart contract transactions used in blockchain platforms.

[0869] As used herein, the terms "store," "storing," "storage," or variants thereof refer to any means, methods, systems, or processes for recording, retaining, or preserving data in a retrievable format. This terminology encompasses a broad spectrum of technologies and mechanisms that may be employed to maintain information for future access or reference. The term "storing" or "storage" as used in this specification may encompass both persistent and transient data retention. In some cases, the storage may be entirely ephemeral, lasting only for the duration of a specific operation or process. The use of these terms does not imply any particular time period for data retention or any level of permanence. Storage and storing may be as brief as a few microseconds or indefinitely long, depending on the specific implementation and requirements of the system. The term includes traditional electronic storage technologies such as magnetic storage (including hard disk drives, magnetic tape, and floppy disks), optical storage (including optical discs, holographic storage, and opti-cal tape), and solid-state storage (including solid-state drives, flash memory, static random-access memory, dynamic random-access memory, and read-only memory). It also encompasses emerging storage technologies such as DNA storage, molecular storage, quantum storage, and photonic storage. In the context of cryptographic systems, the term encompasses secure key storage for maintaining secret keys, public key storage for distributing public keys, public state storage for maintaining system state information such as dictionaries and counters, helper key storage for retaining helper secret keys, ciphertext storage for retaining encrypted data, and any other storage of cryptographic material or metadata. Storage terminology may refer to various architectural organizations and hierarchies of data repositories. This includes primary storage (main memory, cache memory) designed for rapid access during processing operations; secondary storage providing non-volatile retention of larger data volumes; and tertiary storage for archival purposes. The terminology extends to distributed storage architectures such as network-attached storage (NAS), storage area networks (SAN), direct-attached storage (DAS), and object storage systems. It also includes cloud-based storage configurations, including public, private, and hybrid cloud storage implementations; edge storage systems located at network peripheries; and fog storage systems distributed between centralized and edge locations. The definition encompasses storage virtualization technologies that abstract physical storage resources and present them as logical storage units, including virtual disks, software-defined storage, and storage hypervisors. It also includes storage orchestration systems that manage data placement, replication, and migration across distributed infrastructures. The terminology extends to various data organization and management paradigms. This includes file systems that organize data into files and directories; block storage systems that manage data as fixed-sized blocks; object storage systems that handle data as discrete objects with metadata; and content-addressable storage systems that retrieve data based on content rather than location. It also includes specialized storage structures such as databases, data lakes, data warehouses, and knowledge repositories. Storage terminology encompasses various operational characteristics and capabilities of storage systems. This includes persistent storage that maintains data integrity across power cycles; volatile storage thatrequires continuous power to retain data; and non-volatile storage that preserves data without power. It also includes immutable storage that prevents modification of stored data; append-only storage that allows additions but not modifications; and version-controlled storage that maintains historical states of data. The term further encompasses encrypted storage that protects data confidentiality; redundant storage that duplicates data to prevent loss; and resilient storage that maintains availability despite component failures. In specialized computing contexts, storage terminology may refer to domain-specific storage mechanisms. For blockchain and distributed ledger technologies, this includes on-chain storage within the blockchain itself and off-chain storage that maintains references to externally stored data. For neural networks and artificial intelligence systems, it includes weight storage for maintaining learned parameters and activation storage for intermediate computational results. For quantum computing systems, it refers to quantum state storage that preserves quantum information, while for edge computing, it includes transient storage for temporary data processing at network boundaries. The term "storage" also encompasses the protocols, interfaces, and access methods used to interact with stored data. This includes file access protocols (such as NFS, SMB, and HDFS), block access protocols (such as iSCSI, Fibre Channel, and ATA), and object access protocols (such as S3, Swift, and CDMI). It also includes direct memory access mechanisms, memory- mapped file interfaces, and storage controller interfaces.

[0870] The term "database" should be construed to mean a blockchain, distributed ledger technology, key-value store, document-oriented database, graph database, time-series database, in-memory database, columnar database, object-oriented database, hierarchical database, network database, or any other structured data storage system capable of storing and retrieving information. This may include traditional relational database management systems (RDBMS), NoSQL databases, NewSQL databases, or hybrid database systems that combine multiple database paradigms. The database may be centralized, distributed, or decentralized, and may employ various data models, indexing strategies, and query languages to organize and access the stored information. It may also incorporate features such as ACID (Atomicity, Consistency, Isolation, Durability) compliance, eventual consistency, sharding,replication, or partitioning to ensure data integrity, availability, and scalability. The database may be hosted on-premises, in the cloud, or in a hybrid environment, and may support various access methods including direct queries, API calls, or event-driven architectures. The term "database" further encompasses specialized data storage and management systems designed for particular domains or use cases. This includes blockchain and distributed ledger technologies used for secure, decentralized transaction records, edge databases optimized for resource-constrained environments, vector databases for high-dimensional data, time-series databases for temporal data management, knowledge graphs for representing interconnected information, federated databases for integrating autonomous systems, and emerging paradigms such as quantum databases that leverage quantum computing principles.

[0871] The terms "connected," "coupled," or any variant thereof, mean any direct or indirect connection or coupling between two or more elements, and may encompass the presence of one or more intermediate elements between the two elements that are connected or coupled to each other. In the context of modern computing architectures and network topologies, these terms may also refer to various connection modalities. This includes physical connections through wired or wireless interfaces, logical connections operating independently of the physical layer, API connections allowing software components to communicate, and microservice connections in distributed architectures. The terminology extends to edge-to-cloud connections for distributed processing environments, blockchain connections for distributed ledger systems, quantum connections for secure communication, and neural network connections for artificial intelligence systems.

[0872] As used herein, the term "display" or "displaying" refers to any means, method, apparatus, or process for visually presenting or otherwise conveying information to a user. The term includes traditional display technologies such as liquid crystal displays (LCDs), light-emitting diode (LED) displays, organic light-emitting diode (OLED) displays, micro-LED displays, and electronic paper displays. It also encompasses projection systems, head-mounted displays (HMDs), virtual reality (VR) headsets, augmented reality (AR) glasses, mixed reality (MR) systems, and holographic displays. The definition also encompasses non-visual display modalities in-eluding auditory displays such as speech output systems, haptic displays that communicate through tactile feedback, and multimodal displays that combine multiple sensory channels. The term further encompasses the software and computational components involved in rendering information, including rendering engines, graphics processing pipelines, graphical user interfaces (GUIs), and accessibility technologies such as screen readers and braille displays.

[0873] The description of the embodiments of the present disclosure is intended to be illustrative, and not to limit the scope of the claims. Many alternatives, modifications, and variations will be apparent to those skilled in the art. A number of implementations have been described. Nevertheless, it will be understood that various modifications may be made without departing from the spirit and scope of the disclosure. Accordingly, other implementations are within the scope of the following claims.

Claims

CLAIMS1. A computer-implemented method for attribute-based encryption, the method comprising:(a) initializing, by one or more processors, a registered attribute-based encryption (Reg-ABE) scheme by executing a setup algorithm fsSetup(1λ, 1L) of an underlying slotted registered attribute-based encryption (fsReg-ABE) scheme to generate a common reference string crs, where A is a security parameter and L = dℓ— 1 is a maximum number of users, d > 2 is a constant parameter, and £ is a positive integer;(b) storing, in a computer memory, a public state aux =(Zb, P2,mpk), where Pi, T>2, and T>3 are dictionaries, and mpk = (ctr, mpk0, . . . , mpkℓ−1) is a master public key with ctr being a counter of current users;(c) generating, by the one or more processors, a public key pk and a secret key sk for a user by executing a key generation algorithm of the fsReg-ABE scheme; (d) registering a user by:(i) verifying the public key using a verification algorithm of the fsReg-ABE scheme,(ii) for each: in a specified range, updating the public state using an aggregation algorithm of the fsReg-ABE scheme,(iii) incrementing ctr and updating mpk and aux in the computer memory;(e) receiving a plaintext message and storing it in the computer memory;(f) encrypting the plaintext message by:(i) parsing mpk = (ctr, mpk0,..., mpk^,(ii) setting hdr = ctrct= ctr,(iii) determining a set W = {k | mpkk±},(iv) executing an encryption algorithm fsEnc of the fsReg-ABE scheme to compute (cR, K) y- fsEnc((mpkk)fceW, x, hdr), where x is an attribute, ctxis a ciphertext, and K is an encapsulated key;(g) storing the encrypted output ctxin the computer memory;(h) storing the updated public state aux and the master public key mpk in the computer memory.

2. The method of claim 1, wherein the underlying slotted registered attribute-based encryption (fsReg-ABE) scheme comprises:(a) executing the setup algorithm fsSetup(1λ, 1L) to generate the common reference string crs comprising elements in bilinear groups G, G2, and G ',(b) executing the key generation algorithm to output a public key pk, and a secret key ski for a user z;(c) executing a verification algorithm to verify the public key pky(d) executing the aggregation algorithm fsAgg to compute a master public key mpk and a set of helper secret keys {hskz}ze / / ,, where I * is a target set of user indices; (e) executing the encryption algorithm fsEnc to compute a ciphertext ctxand an encapsulated key K using a matrix M G Z"xrepresenting a span program and a labeling function <7;(f) executing the decryption algorithm fsDec to compute the encapsulated key K using a secret key sk,, a helper secret key hsk,, and the ciphertext ct^; wherein:(i) the labeling function maps an index t to a tuplewhere B / G {0, 1} is a bit, G £ is a label, and G V is a value;(ii) £ is a label space and V is a value space;(iii) the span program supports general non-monotone policies; and(iv) Zpis a prime Held of order p.

3. The method of claim 1, wherein the specified range for updating the public state during user registration is determined by a function fk(j, &) = j — ( mod dk+1) +bdk, where j is the user counter, b is a digit in the base-d representation of j, k is an index, and d is a constant parameter.

4. The method of claim 1, wherein registering a user further comprises:(a) computing (mpk'k, {hskk,j}j∈풰*) = fsAgg(crs, (pk',? / ), 2?3[A:], where fsAgg is the aggregation algorithm of the fsReg-ABE scheme, y is an attributeassociated with the user, LA^ is a set of indices determined by the function fk, crs is a common reference string, pkzis a public key, P3 and T>i are dictionaries, and mpkzfcand hskfe are updated master public key and helper secret keys respectively;(b) updating 풟3[k] = mpkzfcand T [k, j] = hskfcfor j G lAk\(c) if k is the minimum digit such that bk0 in the base-d representation of the user counter, updating mpkk=3[fc], mpkk, = ± for k' G [0, k — 1], and 2I bk, j] = T>i[k, j] for j in a subset of lAk, where mpkkis the master public key for index k, ± denotes an empty or null value, and D2is another dictionary.

5. The method of claim 1, further comprising generating a helper secret key hsk by: (a) parsing the public state aux and a public key pk = (ctrpk, pkz), where aux is the public state, pk is a public key, ctrpkis a counter associated with the public key, and pkzis the actual public key;(b) if ctrpk< ctr, setting hsk ={D2[k, b, ctrpk] x [rf-i], where ctr is the current user counter, I is a positive integer, and D2is a dictionary;(c) otherwise, setting hsk = ±, where ± denotes an empty or null value.

6. The method of claim 1, further comprising decrypting a ciphertext ctxusing a secret key sk = (ctrsk,skz) and the helper secret key hsk by:(a) parsing ctx= (hdr,...) and hdr = ctrct, where ctxis the ciphertext, hdr is a header, and ctrctis a counter associated with the ciphertext;(b) if ctrsk> ctrct, outputting ±, where ctrskis a counter associated with the secret key;(c) otherwise, computing the base-d representations of ctrsk— 1 and ctrct;(d) determining the maximum k such that the fc-th digits of these representations differ;(e) if hskk,b'7^±, where is the fc-th digit of ctrct, outputting fsDec(skz, hskk,b', ctr), where fsDec is the decryption algorithm of the fsReg-ABE scheme;(f) otherwise, outputting a special flag getupd indicating the need for an updated helper key.

7. A system for attribute-based encryption, the system comprising:(a) one or more processors;(b) a computer memory;(c) a set of instructions stored in the computer memory that, when executed by the one or more processors, cause the system to perform operations comprising: (i) initializing a registered attribute-based encryption (Reg-ABE) scheme by executing a setup algorithm fsSetup(1λ, 1L) of an underlying slotted registered attribute-based encryption (fsReg-ABE) scheme to generate a common reference string crs, where A is a security parameter and L = de— 1 is a maximum number of users, d > 2 is a constant parameter, and t is a positive integer; (ii) storing, in the computer memory, a public state aux = (x, T>2, ^3, mpk), where T>i, T>2, and T>3 are dictionaries, and mpk = (ctr, mpk0, . . . , mpkℓ−1) is a master public key with ctr being a counter of current users;(iii) generating a public key pk and a secret key sk for a user by executing a key generation algorithm of the fsReg-ABE scheme;(iv) registering a user by:(a) verifying the public key using a verification algorithm of the fsReg-ABE scheme,(b) for each: in a specified range, updating the public state using an aggregation algorithm of the fsReg-ABE scheme,(c) incrementing ctr and updating mpk and aux in the computer memory; (v) receiving a plaintext message and storing it in the computer memory;(vi) encrypting the plaintext message by:(a) parsing mpk = (ctr, mpk0,..., mpk^,(b) setting hdr = ctrct= ctr,(c) determining a set W = {k | mpkk±},(d) executing an encryption algorithm fsEnc of the fsReg-ABE scheme to compute (cR, K) y- fsEnc((mpkk)fceW, x, hdr), where x is an attribute, ctxis a ciphertext, and K is an encapsulated key;(vii) storing the encrypted output ctxin the computer memory;(viii) storing the updated public state aux and the master public key mpk in the computer memory.

8. The system of claim 7, wherein the underlying slotted registered attribute-based encryption (fsReg-ABE) scheme comprises:(a) executing the setup algorithm fsSetup(1λ, 1L) to generate the common reference string crs comprising elements in bilinear groups G, G2, and G ',(b) executing the key generation algorithm to output a public key pk, and a secret key ski for a user z;(c) executing a verification algorithm to verify the public key pky(d) executing the aggregation algorithm fsAgg to compute a master public key mpk and a set of helper secret keys {hskz}ze / / ,, where I * is a target set of user indices; (e) executing the encryption algorithm fsEnc to compute a ciphertext ctxand an encapsulated key K using a matrix M G Z"xrepresenting a span program and a labeling function <7;(f) executing the decryption algorithm fsDec to compute the encapsulated key K using a secret key sk,, a helper secret key hsk,, and the ciphertext ct^; wherein:(i) the labeling function maps an index t to a tuplewhere B / G {0, 1} is a bit, G £ is a label, and G V is a value;(ii) £ is a label space and V is a value space;(iii) the span program supports general non-monotone policies; and(iv) Zpis a prime Held of order p.

9. The system of claim 7, wherein the specified range for updating the public state during user registration is determined by a function fk(j, &) = j — ( mod dk+1) +bdk, where j is the user counter, b is a digit in the base-d representation of j, k is an index, and d is a constant parameter.

10. The system of claim 7, wherein registering a user further comprises:(a) computing (mpk'k, {hskk,j}j∈풰*) = fsAgg(crs, (pk',? / ), 2?3[A:], where fsAgg is the aggregation algorithm of the fsReg-ABE scheme, y is an attributeassociated with the user, LA^ is a set of indices determined by the function fk, crs is a common reference string, pkzis a public key, TA, and T>i are dictionaries, and mpkzfcand hskfe are updated master public key and helper secret keys respectively;(b) updating 풟3[k] = mpkzfcand T [k, j] = hskfcfor j G lAk\(c) if k is the minimum digit such that bk0 in the base-d representation of the user counter, updating mpkk=3[fc], mpkk, = ± for k' G [0, k — 1], and 2I bk, j] = T>i[k, j] for j in a subset of lAk, where mpkkis the master public key for index k, ± denotes an empty or null value, and D2is another dictionary.

11. The system of claim 7, wherein the operations further comprise generating a helper secret key hsk by:(a) parsing the public state aux and a public key pk = (ctrpk, pkz), where aux is the public state, pk is a public key, ctrpkis a counter associated with the public key, and pkzis the actual public key;(b) if ctrpk< ctr, setting hsk = {D2[k, b, ctrpk] }(fc)6)e[0,£-i]x[rf-i], where ctr is the current user counter, I is a positive integer, and D2is a dictionary;(c) otherwise, setting hsk = ±, where ± denotes an empty or null value.

12. The system of claim 7, wherein the operations further comprise decrypting a ciphertext ctxusing a secret key sk = (ctrsk,skz) and the helper secret key hsk by: (a) parsing ctx= (hdr,...) and hdr = ctrct, where ctxis the ciphertext, hdr is a header, and ctrctis a counter associated with the ciphertext;(b) if ctrsk> ctrct, outputting ±, where ctrskis a counter associated with the secret key;(c) otherwise, computing the base-d representations of ctrsk— 1 and ctrct;(d) determining the maximum k such that the fc-th digits of these representations differ;(e) if hskk,b'7^±, where is the fc-th digit of ctrct, outputting fsDec(skz, hskk,b', ctr), where fsDec is the decryption algorithm of the fsReg-ABE scheme;(f) otherwise, outputting a special flag getupd indicating the need for an updated helper key.

13. A non-transitory computer-readable storage medium storing instructions that, when executed by one or more processors, cause the one or more processors to perform operations for attribute-based encryption, the operations comprising:(a) initializing a registered attribute-based encryption (Reg- ABE) scheme by executing a setup algorithm fsSetup(1λ, 1L) of an underlying slotted registered attributebased encryption (fsReg-ABE) scheme to generate a common reference string crs, where A is a security parameter and L = dℓ— 1 is a maximum number of users, d > 2 is a constant parameter, and t is a positive integer;(b) storing, in a computer memory, a public state aux = (T>, T>2, *3, mpk), where T>i, T>2, and T>3 are dictionaries, and mpk = (ctr, mpk0, . . . , mpkℓ−1) is a master public key with ctr being a counter of current users;(c) generating a public key pk and a secret key sk for a user by executing a key generation algorithm of the fsReg-ABE scheme;(d) registering a user by:(i) verifying the public key using a verification algorithm of the fsReg-ABE scheme,(ii) for each: in a specified range, updating the public state using an aggregation algorithm of the fsReg-ABE scheme,(iii) incrementing ctr and updating mpk and aux in the computer memory;(e) receiving a plaintext message and storing it in the computer memory;(f) encrypting the plaintext message by:(i) parsing mpk = (ctr, mpk0,..., mpk^,(ii) setting hdr = ctrct= ctr,(iii) determining a set W = {k | mpkk±},(iv) executing an encryption algorithm fsEnc of the fsReg-ABE scheme to compute (ctr, K) y- fsEnc((mpkk)feev, x, hdr), where x is an attribute, ctxis a ciphertext, and K is an encapsulated key;(g) storing the encrypted output ctr in the computer memory;(h) storing the updated public state aux and the master public key mpk in the computer memory.

14. The non-transitory computer-readable storage medium of claim 13, wherein the underlying slotted registered attribute-based encryption (fsReg-ABE) scheme comprises:(a) executing the setup algorithm fsSetup(1λ, 1L) to generate the common reference string crs comprising elements in bilinear groups G, G2, and G ',(b) executing the key generation algorithm to output a public key pk, and a secret key sly for a user z;(c) executing a verification algorithm to verify the public key pky(d) executing the aggregation algorithm fsAgg to compute a master public key mpk and a set of helper secret keys {hskz}ze / / ,, where I * is a target set of user indices; (e) executing the encryption algorithm fsEnc to compute a ciphertext ctxand an encapsulated key K using a matrix M G Z"xrepresenting a span program and a labeling function <7;(f) executing the decryption algorithm fsDec to compute the encapsulated key K using a secret key sk,, a helper secret key hsk,, and the ciphertext ct^; wherein:(i) the labeling function maps an index t to a tuplewhere B / G {0, 1} is a bit, G £ is a label, and G V is a value;(ii) £ is a label space and V is a value space;(iii) the span program supports general non-monotone policies; and(iv) Zpis a prime Held of order p.

15. The non-transitory computer-readable storage medium of claim 13, wherein the specified range for updating the public state during user registration is determined by a function fk(j, b) = j — (j mod dk+1) + bdk, where j is the user counter, b is a digit in the base-d representation of j, k is an index, and d is a constant parameter.

16. The non-transitory computer-readable storage medium of claim 13, wherein registering a user further comprises:(a) computing (mpk'k, {hskk,j}j∈풰*) = fsAgg(crs, (pk',? / ), 2?3[A:], where fsAgg is the aggregation algorithm of the fsReg-ABE scheme, y is an attribute associated with the user, Ukis a set of indices determined by the function fk,crs is a common reference string, pkzis a public key, P3 and Th are dictionaries, and mpkzfcand hskfe are updated master public key and helper secret keys respectively;(b) updating T>3[k] = mpkzfcand T\[k, j] = hskfcj for j G(c) if k is the minimum digit such that bk0 in the base-d representation of the user counter, updating mpkk=3[fc], mpkk, = ± for k' G [0, k — 1], and T^IA bk, j] = T>i[k, j] for j in a subset of Uk, where mpkkis the master public key for index k, ± denotes an empty or null value, and D2is another dictionary.

17. The non-transitory computer-readable storage medium of claim 13, wherein the operations further comprise generating a helper secret key hsk by:(a) parsing the public state aux and a public key pk = (ctrpk, pkz), where aux is the public state, pk is a public key, ctrpkis a counter associated with the public key, and pkzis the actual public key;(b) if ctrpk< ctr, setting hsk ={D2[k, b, ctrpk]x[rf-i], where ctr is the current user counter, I is a positive integer, and D2is a dictionary;(c) otherwise, setting hsk = ±, where ± denotes an empty or null value.

18. The non-transitory computer-readable storage medium of claim 13, wherein the operations further comprise decrypting a ciphertext ctxusing a secret key sk = (ctrsk,skz) and the helper secret key hsk by:(a) parsing ctx= (hdr,...) and hdr = ctrct, where ctxis the ciphertext, hdr is a header, and ctrctis a counter associated with the ciphertext;(b) if ctrsk> ctrct, outputting ±, where ctrskis a counter associated with the secret key;(c) otherwise, computing the base-d representations of ctrsk— 1 and ctrct;(d) determining the maximum k such that the fc-th digits of these representations differ;(e) if hskk,b'7^ ±, where b'kis the fc-th digit of ctrct, outputting fsDec(skz, hskk,b', ct, where fsDec is the decryption algorithm of the fsReg-ABE scheme;(f) otherwise, outputting a special flag getupd indicating the need for an updated helper key.

Images