Attribute-Based Encryption for IoT Cloud Data Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional attribute-based encryption (ABE) schemes for IoT scenarios face challenges such as impractical single attribute authority systems, decryption burden on resource-limited devices, key leakage, and inadequate accountability, particularly in cloud-assisted IoT environments where massive data storage and secure data sharing are critical.
Innovation Solution
An ABE method with multiple tracing attribute authorities is introduced, involving system initialization, key pair generation, symmetric encryption, access structure-based encryption, outsourcing decryption, and white-box traceback for key leakage identification, which relieves decryption burden and ensures secure, efficient data sharing and privacy protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single attribute authority controls all attributes in the system, then the system structure is simplified, but the system efficiency deteriorates and security blind spots are caused
Solution Approach 1:
The patent divides the single attribute authority into multiple attribute authorities, each managing specific attributes independently. This segmentation allows parallel attribute management operations, improving system efficiency while maintaining a distributed security architecture that eliminates single-point blind spots.
2Reliability
If ABE is directly performed on plaintext data, then security is ensured, but encryption efficiency deteriorates
Solution Approach 1:
The patent introduces a symmetric key as an intermediary between the plaintext data and the ABE encryption process. The symmetric key efficiently encrypts the plaintext, and then ABE is applied to the key rather than the entire data set, significantly improving encryption efficiency while maintaining security through the layered encryption approach.
3Ease of operation
If decryption is performed on resource-limited IoT devices, then data access is enabled, but the decryption burden overwhelms the devices
Solution Approach 1:
The patent extracts the computationally intensive decryption operations from resource-limited IoT devices and relocates them to more powerful servers or cloud infrastructure. The IoT devices retain only lightweight verification and data retrieval functions, dramatically reducing their energy consumption and computational burden while maintaining full data access capability.
4Quantity of substance
If data is stored in cloud storage center, then storage capacity is improved, but security problems arise from outsourced storage
Solution Approach 1:
The patent applies preliminary encryption to data before it is stored in the cloud storage center. By encrypting data with symmetric keys and then applying ABE encryption to these keys, the system ensures that even if the cloud storage is compromised, the encrypted data remains protected. This preliminary security action eliminates vulnerabilities associated with outsourced storage.
Data Source
AI summary
An ABE method with multiple tracing attribute authorities: performing, by a central authority, system initialization to generate a public parameter and disclosing the public parameter; performing, by each of attribute authorities, initialization to generate a key pair, and disclosing a public key in the key pair; performing, by a data owner, symmetric encryption on plaintext data, performing ABE on a symmetric key based on a hidden access structure, and generating an integrity verification value; requesting, by a data user, a decryption key to the attribute authority according to an own attribute; restoring, by the data user in response to decryption, an access structure, generating an outsourcing decryption key, sending the outsourcing decryption key to a cloud storage center for semi-decryption; generating, by the cloud storage center, a semi-decrypted ciphertext, and feeding the semi-decrypted ciphertext back to the data user; fully decrypting the semi-decrypted ciphertext according to a private decryption key.