EAC: Encryption Access Control Scheme for Policy Revocation in Cloud Data

Since a lot of information is outsourcing into cloud servers, data confidentiality becomes a higher risk to service providers. To assure data security, Ciphertext Policy Attributes-Based Encryption (CP-ABE) is observed for the cloud environment. Because ciphertexts and secret keys are relying on attributes, the revocation issue becomes a challenge for CP-ABE. This paper proposes an encryption access control (EAC) scheme to fulfill policy revocation which covers both attribute and user revocation. When one of the attributes in an access policy is changed by the data owner, the authorized users should be updated immediately because the revoked users who have gained previous access policy can observe the ciphertext. Especially for data owners, four types of updating policy levels are predefined. By classifying those levels, each secret token key is distinctly generated for each level. Consequently, a new secret key is produced by hashing the secret token key. This paper analyzes the execution times of key generation, encryption, and decryption times between non-revocation and policy revocation cases. Performance analysis for policy revocation is also presented in this paper.

1. Introduction

Currently, the use of cloud-based storage services is an enormous growth because they offer rentable frameworks based on pay per use pattern. During the use of cloud storage data, the lack of data control for the data owner can occur among the communications of the parties. Hence, data security for cloud storage is solved by studying the cryptographic techniques. Since the encryption technique is critical for the cloud data sharing system among the organizations, some of the existing encryption techniques can be applied for retrieving cloud data against unauthorized accesses. However, the traditional cryptographic techniques are not enough to be perfect security for cloud data because the data should be controlled by the data owner rather than the Cloud Service Providers (CSPs) [3]. Moreover, the access policies, which are controlled by the data owner, can be frequently updated according to several situations among the parties [10]. Mostly, access policies are specified as the values of the attributes of cloud users. Therefore, the researchers are interested in CP-ABE for retrieving the cloud storage data. Since the CP-ABE will grant the data owner the right to define access policy control, it is adopted by the cloud users as access control based on attributes. Despite the CP-ABE is popular in access control for the cloud environment, the attributes management is still at a critical point [1]. More policy changes can be more complex in key management [7]. Especially, the key management is essential for access policy changes when the data owner manages attributes for his authorized users. In this paper, a policy revocation is proposed for enhancing traditional CP-ABE because the traditional CP-ABE did not consider any revocation. In the rest of the paper, section 2 deals with the related works of CP-ABE. The research background is explained in section 3. The proposed EAC scheme is presented in section 4. The performance analysis and experimental results are shown in section 5. The conclusion and future work are included in section 6.