Policy-based Revolutionary Ciphertext-policy Attributes-based Encryption

Ciphertext-policy Attributes-based Encryption (CP-ABE) is an encouraging cryptographic mechanism. It behaves an access control mechanism for data security. A ciphertext and secret key of user are dependent upon attributes. As a nature of CP-ABE, the data owner defines access policy before encrypting plaintext by his right. Therefore, CP-ABE is suitable in a real environment. In CP-ABE, the revocation issue is demanding since each attribute is shared by many users. A policy-based revolutionary CP-ABE scheme is proposed in this paper. In the proposed scheme, revocation takes place in policy level because a policy consists of threshold attributes and each policy is identified as a unique identity number. Policy revocation means that the data owner updates his policy identity number for ciphertext whenever any attribute is changed in his policy. To be a flexible updating policy control, four types of updating policy levels are identified for the data owner. Authorized user gets a secret key from a trusted authority (TA). TA updates the secret key according to the policy updating level done by the data owner. This paper tests personal health records (PHRs) and analyzes execution times among conventional CP-ABE, other enhanced CP-ABE and the proposed scheme.

1. Introduction

Today, a lot of information and private data are outsourcing into cloud servers. Some of the cloud service providers are Google App Engine, Amazon Web Service (AWS), Drive HQ, Microsoft Azure, and others. The proposed system tests PHRs to store it in the cloud server of Microsoft Azure. Data confidentiality is a major threat to security providers in the cloud environment. CP-ABE is observed to manage confidential information for cloud storage data. Figure 1 shows an illustration of conventional CP-ABE. CP-ABE has an imperative security aspect as well as collusion-resistance. The main challenge for data sharing and protecting its security is a collusion attack. Key information can be leaked by collusion attack into an assemble pattern upon users’ attributes. It is mainly critical to large-scale data sharing system. The PHRs sharing system is used to demonstrate the proposed CP-ABE scheme. Overall system architecture is illustrated in Figure 2 . The proposed scheme improves conventional CP-ABE by granting policy revocation. Any revocation was not regarded by traditional CP-ABE. As soon as an attribute or any single user revocation occurs in the system, it can have forced the other users. In this PHRs sharing system, there are many attributes in each PHR such as PatientID, PatientName, Gender, Age, Address, Phone, DiseaseName, PolicyID, Role, Field, Hospital and so forth. Among them, PolicyID is a unique identifier that is used to represent an access policy for each PHR. An administrator of PHRs defines PolicyID of each PHR for authorized users. Policy revocation occurs when PHRs’ administrator updates a unique identity of an access policy or PolicyID for PHR. The revoked/unauthorized users, who have been revoked policy, should not be gained permission for corresponding PHR. In the proposed scheme, a distinct secret key is combined with PatientID or a unique PHR content identification number. User authentication, key management, and policy management are provided in the proposed scheme.