Discretionary User Revocation in Cloud Data Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud storage solutions face challenges in user revocation within attribute-based encryption systems, particularly in CP-ABE, due to the lack of effective mechanisms for revoking individual users when they share attributes with others, leading to potential security breaches and management complexities.
Innovation Solution
The implementation of DUR-CP-ABE (Discretionary User Revocation in Ciphertext Policy Attribute-Based Encryption) allows data owners to enforce identity-based revocation without updating private keys, enabling batch revocation of affiliated users and integrating with Identity and Access Management systems for efficient identity management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If attribute-based encryption is used for cloud storage access control, then fine-grained access control is achieved, but user revocation becomes impossible when users share attributes
Solution Approach 1:
The patent segments the revocation mechanism by introducing a separate revocation list that is independent of the attribute-based encryption structure. Instead of revoking attributes directly, the system maintains a distinct revocation list that tracks revoked user identities, allowing revocation without affecting the underlying ABE scheme or requiring attribute updates.
Solution Approach 2:
The patent introduces a revocation list as an intermediary component between the attribute-based encryption system and the user revocation requirement. This revocation list acts as a mediator that enables individual user revocation by checking against revoked identities during decryption, without modifying the core ABE cryptographic operations or requiring private key updates.
2Ease of operation
If traditional PKI systems are used for user revocation, then individual user revocation is possible, but attribute sharing among users cannot be supported
Solution Approach 1:
The patent merges the strengths of both PKI and ABE systems by combining identity-based revocation (from PKI) with attribute-based access control (from ABE). The system maintains user identities for revocation tracking while simultaneously supporting attribute sharing for access control, creating a hybrid approach that achieves both individual revocation and attribute sharing capabilities.
3Ease of operation
If attribute revocation is implemented in ABE systems, then user revocation is attempted, but it affects all users sharing the same attribute
Solution Approach 1:
The patent applies local quality by making revocation specific to individual user identities rather than affecting all users with the same attribute. The revocation list stores individual user identifiers, allowing selective revocation of specific users while leaving other users with the same attributes unaffected, thus achieving fine-grained revocation precision.
4Ease of operation
If private key updates are performed for revocation in ABE systems, then user revocation is achieved, but computational overhead increases significantly
Solution Approach 1:
The patent performs preliminary action by pre-establishing the revocation list before revocation is needed. The revocation list is maintained and updated independently, allowing rapid revocation decisions without requiring computationally intensive private key regeneration. This pre-prepared structure enables efficient revocation operations.
Solution Approach 2:
The patent uses copying by maintaining a separate revocation list that copies minimal revocation information (user identifiers) rather than replicating entire private keys. This lightweight copying approach allows revocation tracking without the computational burden of generating and distributing updated cryptographic keys to all users.
Data Source
AI summary
A method for a data owner to enforce attribute-based and discretionary access control over a cloud-based data store by specifying an access policy, creating a plurality of users with attributes that satisfy the access policy, and revoking one or more of the plurality of users by embedding their respective identities as revoked into a ciphertext, whereby only those of the plurality of users whose attributes satisfy the access policy and that are not revoked can decrypt the ciphertext.