Hidden Ciphertext Policy Attribute-Based Encryption Under Standard Assumptions

We propose two new ciphertext policy attribute-based encryption (CP-ABE) schemes where the access policy is defined by AND-gate with wildcard. In the first scheme, we present a new technique that uses only one group element to represent an attribute, while the existing ABE schemes of the same type need to use three different group elements to represent an attribute for the three possible values (namely, positive, negative, and wildcard). Our new technique leads to a new CP-ABE scheme with constant ciphertext size, which, however, cannot hide the access policy used for encryption. The main contribution of this paper is to propose a new CP-ABE scheme with the property of hidden access policy by extending the technique we used in the construction of our first scheme. In particular, we show a way to bridge ABE based on AND-gate with wildcard with inner product encryption and then use the latter to achieve the goal of hidden access policy. We prove that our second scheme is secure under the standard decisional linear and decisional bilinear Diffie-Hellman assumptions.

I. Introduction

Access control (i.e., authentication and authorisation) plays an important role in many information systems. Among all the existing cryptographic tools, Attribute Based Encryption (ABE) has provided an effective way for fine-grained access control. ABE, which is an extension of identity-based encryption (IBE) [4], [23], allows an access structure/ policy to be embedded into the ciphertext (this is referred to as ciphertext-policy ABE, or CP-ABE) or user secret key (this is referred to as key-policy ABE, or KP-ABE). In a CP-ABE, the user’s attributes used for key generation must satisfy the access policy used for encryption in order to decrypt the ciphertext, while in a KP-ABE, the user can only decrypt ciphertexts whose attributes satisfy the policy embedded in the key. We can see that access control is an inherent feature of ABE, and by using some expressive access structures, we can effectively achieve fine-grained access control. Since its introduction in the seminal work of Sahai and Waters [21], ABE has been extensively studied in recent years (e.g., [2], [3], [7], [8], [11], [12], [17], [26]). There are different ways to define an access structure/policy for ABE. The fuzzy IBE given by Sahai and Waters [21], which can be treated as the first KP-ABE, used a specific threshold access policy. Later, the Linear Secret Sharing Scheme (LSSS) realizable (or monotone) access structure has been adopted by many subsequent ABE schemes [3], [11], [12], [26]. In [7], Cheung and Newport proposed another way to define access structure using AND-Gate with wildcard. To be more precise, for each attribute in the universe, there are two possible values: positive and negative. A user’s attributes are then defined by a sequence of positive and negative symbols w.r.t. each attribute in the universe (assuming that the attributes are placed in order in the universe). An access structure is also defined by a sequence of positive and negative symbols, plus a special wildcard (i.e., “don’t care”) symbol. Cheung and Newport showed that by using this simple access structure, which is sufficient for many applications, CP-ABE schemes can be constructed based on standard complexity assumptions. Subsequently, several ABE schemes [6], [9], [20], [28] were proposed following this specific access structure.