Puncturable Attribute-Based Encryption for Secure Data Delivery in Internet of Things

While the Internet of Things (IoT) is embraced as important tools for efficiency and productivity, it is becoming an increasingly attractive target for cybercriminals. This work represents the first endeavor to develop practical Puncturable Attribute Based Encryption schemes that are light-weight and applicable in IoTs. In the proposed scheme, the attribute-based encryption is adopted for fine grained access control. The secret keys are puncturable to revoke the decryption capability for selected messages, recipients, or time periods, thus protecting selected important messages even if the current key is compromised. In contrast to conventional forward encryption, a distinguishing merit of the proposed approach is that the recipients can update their keys by themselves without key re-issuing from the key distributor. It does not require frequent communications between IoT devices and the key distribution center, neither does it need deleting components to expunge existing keys to produce a new key. Moreover, we devise a novel approach which efficiently integrates attribute-based key and punctured keys such that the key size is roughly the same as that of the original attribute-based encryption. We prove the correctness of the proposed scheme and its security under the Decisional Bilinear Diffie-Hellman (DBDH) assumption. We also implement the proposed scheme on Raspberry Pi and observe that the computation efficiency of the proposed approach is comparable to the original attribute-based encryption. Both encryption and decryption can be completed within tens of milliseconds.

I. Introduction

In recent years we have witnessed a remarkable proliferation of networked intelligent devices - collectively known as the Internet of Things (IoT). The IoT is a digitization of the physical world by embedding physical devices with electronics, sensors, actuators, and network connectivity that enable them to collect and exchange data without human intervention, and be controlled remotely across existing network infrastructure. It presents vast opportunities for organizations to improve efficiencies, gain a competitive advantage, and build new business models. More IoT devices are coming online each and every day. Experts estimate that the IoT will grow from 12 billion devices in 2015 to more than 50 billion by 2020 [1]. While IoT is embraced as important tools for efficiency and productivity, it is becoming an increasingly attractive target for cybercriminals. Securing IoT is fundamentally challenging due to the vast number of networked devices that are often resource-constrained and exposed in unprotected environment.