190 likes | 317 Views
Improving Privacy and Security in Multi-Authority Attribute-Based Encryption. Advanced Information Security April 6, 2010 Presenter: Semin Kim. Overview. History of Attribute-Based Encryption Introduction of Paper Single Authority ABE Multi Authority ABE Conclusions. Overview.
E N D
Improving Privacy and Security in Multi-Authority Attribute-Based Encryption Advanced Information Security April 6, 2010 Presenter: Semin Kim
Overview • History of Attribute-Based Encryption • Introduction of Paper • Single Authority ABE • Multi Authority ABE • Conclusions
Overview • History of Attribute-Based Encryption • Introduction of Paper • Single Authority ABE • Multi Authority ABE • Conclusions
History of Attributed-Based Encryption • 1977, RSA • Rivest, Shamir and Adleman • Public/Private(Secret) Key • 1985, IBE(Identity-Based Encryption) • Shamir • Allows for a sender to encrypt message to an identity without access to a public key certificate Encrypted by Address, Name
History of Attributed-Based Encryption • 2005, Fuzzy IBE • Sahai and Waters • A user having identity ω can decrypt a ciphertext with public key ω’. (|ω – ω’| < threshold distance) • Two interesting new applications • Uses biometric identities. • Ex) a fingerprint of human can be changeable by pressure, angle and noisy • Attributed-Based Encryption (ABE) • Suppose that a party wish to encrypt a document to all users that have a certain set of attributes • Ex) {School, Department, Course} -> {KAIST, ICE, Ph.D}
Overview • History of Attribute-Based Encryption • Introduction of Paper • Single Authority ABE • Multi Authority ABE • Conclusions
Introduction of paper • Title • Improving Privacy and Security in Multi-Authority Attribute-Based Encryption • Conference • In CCS'09: Proceedings of the 16th ACM conference on Computer and communications security. ACM, New York, NY, USA, 2009 • Authors • Melissa Chase (Microsoft Research) • Sherman S.M. Chow (New York University)
Background of paper • Motivation • In single authority Attribute-Based Encryption (ABE), there exist only one trusted server who monitors all attributes. • However, this may not be entirely realistic. • Goal • To provide an efficient scheme to resolve the above problem by multi-authority ABE
Overview • History of Attribute-Based Encryption • Introduction of Paper • Single Authority ABE • Multi Authority ABE • Conclusions
Preliminaries • Basic Idea of ABE • Attributes of Human are different and changeable. • Thus, it is difficult to find a perfect set of attributes according to various situations. Soccer Red Reading Soccer Soccer Action Drama Red Blue Reading Music A B
Preliminaries • Lagrange Polynomial (from Wikipedia)
Single Authority ABE • Step One – Feldman Verifiable Secret Sharing • Init: First fix y ← Zq, where q is a prime. • Secret Key (SK) for user u: Choose a random polynomial p such that p(0) = y and the degree of p is d-1. SK: {Di = gp(i)} ∀i∈Au,where Au is a attribute set of user u and g is a costant • Encryption: E = gym, where m is a message • Decryption: Use d SK elements Di to interpolate to obtain Y = gp(0) = gy. Then m = E/Y
Single Authority ABE • Step Two – Specifying Attributes • Let G1 be a cyclic multiplicative group of prime order q generated by g. • Let e(•, •) be a bilinear map such that g ∈ G1, and a, b ∈ Zq, e(ga, gb) = e(g, g)ab • Init: First fix y, t1,…,tn ←Zq, Let Y = e(g, g)y • SK for user u: Choose a random polynomial p such that p(0) = y. . SK: {Di = gp(i)/ti} ∀i∈Au • Encryption for attribute set Ac: E=Ym and {Ei = gti} ∀i∈AC • Decryption: For d attributes i∈Ac∩Au, compute e(Ei, Di) = e(g, g)p(i). Interpolate to find Y = e(g, g)p(0) = e(g, g)y.Then m = E/Y.
Single Authority ABE • Step Three – Multiple Encryptions • To encrypt multiple times without the decryptor needing to get a new secret key each time. • Init: First fix y, t1, …, tn← Zq. • Public Key (PK) for system: T1 = gt1 … Tn = gtn, Y = e(g, g)y. PK = {Ti}1 ≤ I ≤ n,Y • SK for user u: Choose a random polynomial p such that p(0) = y. SK: {Di = gp(i)/ti} ∀i∈Au • Encryption for attribute set Ac: E=Ys=e(g, g)ysm and {Ei = gtis} ∀i∈AC • Decryption: For d attributes i∈Ac∩Au, compute e(Ei, Di) = e(g, g)p(i)s. Interpolate to find Ys = e(g, g)p(0)s = e(g, g)ys.Then m = E/Ys.
Overview • History of Attribute-Based Encryption • Introduction of Paper • Single Authority ABE • Multi Authority ABE • Conclusions
Multi Authority Attribute Based Encryption • Encryption • Attribute Set {A1C, …, ANC), pick s ∈R Zq. • Return (E0 = mYs, E1 = g2s, {Ck, i = Tsk,i} • Decryption • For each authority k ∈ [1, …, N] • For any dk attributes i ∈AkC ∩ Aku, pair up Sk,i and Ck,i compute e(Sk,i, Ck,i) = e(g1, g2)spk(i). • Interpolate all the values e(g1, g2)spk(i) to get Pk = e(g1, g2)spk(i) = e(g1, g2)s(vk- ∑Rkj) • Multiply Pk’s together to get Q = e(g1, g2)s(vk- ∑Ru) = Ys/ e(g1Ru, g2s) • Compute e(Du, E1)Q = e(g1Ru, g2s)Q = Ys • Recover m by E0/Ys
Overview • History of Attribute-Based Encryption • Introduction of Paper • Single Authority ABE • Multi Authority ABE • Conclusions
Conclusion • Contribution • Multi-authority attributed-based encryption enables a more realistic deployment of attribute-based access control. • Novelty • An attribute-based encryption scheme without the trusted authority was proposed
Q&A Thank you! Any questions?