Internati
o
nal
Journal of Ele
c
trical
and Computer
Engineering
(IJE
CE)
V
o
l. 6,
N
o
.
3
,
Ju
n
e
201
6,
p
p
.
9
1
5
~
924
I
S
SN
: 208
8-8
7
0
8
,
D
O
I
:
10.115
91
/ij
ece.v6
i
3.8
925
9
15
Jo
urn
a
l
h
o
me
pa
ge
: h
ttp
://iaesjo
u
r
na
l.com/
o
n
lin
e/ind
e
x.ph
p
/
IJECE
Cloud Secu
rity i
n
Crypt Databa
se Server
Using Fine Grained
Access Contr
o
l
Krishna Keer
thi Chennam
1
, M.
Akk
a
L
a
kshmi
2
1
Department of
Computer Scien
ce
Engineering
,
Re
search
Scholar, Gitam Univers
i
ty
, H
y
d
e
rab
a
d, I
ndia
2
Department of
Information Technolog
y
,
HOD,
Gitam University
, H
y
der
a
bad
,
In
dia
Article Info
A
B
STRAC
T
Article histo
r
y:
Received Aug 28, 2015
Rev
i
sed
No
v
24
, 20
15
Accepte
d Dec 8, 2015
Information sharing in the clo
ud, powered by
good pattern
s
in cloud
techno
log
y
,
is r
i
sing as a
guar
a
nte
e
ing pro
ced
ure for p
e
rm
itti
ng users to
advant
ageous
l
y
acc
es
s
inform
ation
.
However
,
the growing
number of
e
n
te
rprise
s a
nd c
u
stome
r
s who
store
s
th
eir info
rmation in clou
d servers is
progressively
challenging users’ privac
y and t
h
e s
ecurit
y
of i
n
form
ation
.
T
h
i
s
p
a
p
e
r c
o
nc
e
n
t
r
a
t
e
s
o
n
p
r
o
v
i
d
i
n
g
a
de
p
e
n
d
a
b
l
e
a
n
d
se
cu
r
e
c
l
oud
inform
ation sha
r
ing servic
es th
at perm
its user
s d
y
nam
i
c
acc
e
ss to their
information. In
order to
ach
iev
e
this,
w
e
propose an
effective, adaptab
l
e
and
flexible priv
acy preserving info
rmati
on polic
y
with sem
a
ntic s
ecuri
t
y
,
b
y
using Cipher tex
t
Policy
Attr
ibute Base
d Encr
y
p
tion (CP-ABE) consolidated
with Character
Based Encr
yption (CBE) s
y
stems. To
en
sure strong
inform
ation shar
ing securi
t
y
,
the
polic
y
succeeds
in protecting th
e privacy
of
cloud users
and
supports efficient and
secur
e
d
y
namic oper
a
tio
n
s, but no
t
constrain
e
d to, f
ile cr
eation, user
revo
cat
ion. S
e
c
u
rit
y
ana
l
y
s
is
dem
ons
trates
that
the proposed policy
is secur
e
under
th
e gen
e
ric bi-
lin
ear gro
up model in
the random
oracle m
odel and enforces fine-gr
a
ined a
ccess co
ntrol, ful
l
collusion resistance and r
e
trogr
essive
secrecy
. Furthermore,
performance
anal
ys
is
and exp
e
rim
e
nta
l
res
u
l
t
s
dem
ons
trate
tha
t
the
overh
eads
are
as
lig
h
t
as possible.
Keyword:
CBE
CP-ABE
Fi
ned
G
r
ai
ne
d
Access C
o
nt
rol
Security
Copyright ©
201
6 Institut
e
o
f
Ad
vanced
Engin
eer
ing and S
c
i
e
nce.
All rights re
se
rve
d
.
Co
rresp
ond
i
ng
Autho
r
:
Krish
n
a
Keerthi Ch
enn
a
m
,
Depa
rt
m
e
nt
of
C
o
m
put
er Sci
e
nce E
n
gi
nee
r
i
n
g,
Gita
m
Un
iv
ersity,
R
u
d
r
aram
, Hy
dera
ba
d,
In
di
a
Em
a
il: k
r
ish
n
a
k
eert
h
ich
l
@gmail.co
m
1.
INTRODUCTION
C
l
ou
d com
put
i
ng i
s
c
u
r
r
e
n
t
l
y
devel
opi
ng
as a t
ech
nol
og
y
i
n
w
h
i
c
h cl
o
ud
ser
v
i
ce p
r
o
v
i
d
e
r
s (C
S
P
)
o
f
fer efficien
t
d
a
ta sto
r
ag
e an
d
co
m
p
u
tin
g
facilities
to
a wo
rl
d
w
i
d
e cu
st
omers. Th
e m
a
i
n
n
ecessity fo
r
a u
s
er
is a conn
ected term
in
al. By
u
tilizin
g
a com
b
in
atio
n
of
virtu
a
lizatio
n
meth
od
s, serv
ice o
r
ien
t
ed co
m
p
u
ting
,
cl
ou
d com
put
i
n
g
,
can be o
r
d
e
red i
n
t
o
t
h
ree t
y
pes [1]
X as
an adm
i
nistration (XaaS
), pay
-
as-y
ou
-g
o Ser
v
ices
:
the Platform
a
s
a Service (PaaS) m
odel, e.g. Micr
os
oft
Azur
e (M
IC
)
,
whe
r
e use
r
s
can sen
d
t
h
e
i
r ow
n
part
i
c
ul
a
r
a
ppl
i
cat
i
ons a
n
d
t
o
ol
s t
o
t
h
e cl
ou
d ,
I
n
f
r
ast
r
uct
u
re as a
Se
rvi
c
e
(Iaa
S
)
,
e.
g.
A
m
azon EC
2
(
A
M
A
)
,
w
h
er
e clien
t
s
can
u
s
e cloud ad
m
i
n
i
str
a
tio
n
s
g
i
v
e
n
b
y
th
e CSP to
sen
d
self
-
a
sser
t
i
v
e
p
r
o
g
r
a
mmi
n
g
and
Soft
ware
as a
Ser
v
i
ce (
S
aaS)
,
e.
g.
G
o
ogl
e
Ap
p
En
gi
ne
(
GAE
),
w
h
e
r
e
cl
i
e
nt
s use
ap
p
l
i
cat
i
ons gi
ve
n
by
t
h
e
CSS that
run
on the cl
oud
foundation. St
oring
data
in t
h
e cloud
offe
rs
us
ers
the
accommodation
of
access
wi
t
h
o
u
t
re
qui
r
i
ng i
m
m
e
di
ate kn
owl
e
d
g
e
of t
h
e
depl
oy
m
e
nt
and adm
i
ni
st
rat
i
on of t
h
e
har
d
ware
or
in
frastru
ct
u
r
e. In
sp
ite o
f
th
e fact th
at clo
u
d
co
m
p
u
tin
g
is su
bstan
tially
m
o
re effective th
an
ind
i
v
i
du
alized
com
put
i
ng, i
t
bri
ngs
ne
w p
r
o
t
ect
i
on an
d sec
u
ri
t
y
chal
l
e
n
g
e
s
, as us
ers
rel
i
n
q
u
i
s
h co
nt
r
o
l
by
o
u
t
s
o
u
rci
n
g
t
h
ei
r
dat
a
t
h
ey
no
l
o
nge
r
ha
vi
n
g
ph
y
s
i
cal
ow
ners
h
i
p o
f
i
t
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
SN
:
2
088
-87
08
IJEC
E
V
o
l
.
6,
No
. 3,
J
u
ne 2
0
1
6
:
91
5 – 9
2
4
91
6
Inform
atio
n
h
o
ld
ers requ
est elev
ated
am
o
u
n
ts o
f
se
cu
rity an
d
con
f
i
d
en
ti
ality wh
en
th
ey o
u
t
source
th
e inform
atio
n
to a cl
o
u
d
[2], alth
ou
gh
t
h
ey g
e
n
e
rally
encryp
t th
ei
r
d
a
ta wh
ile storing it in
a cl
o
u
d
serv
er,
th
ey still
wan
t
co
n
t
ro
l ov
er i
t
. Direct e
m
p
l
o
y
m
e
n
t
o
f
traditio
n
a
l cryp
tograph
i
c primitiv
es can
't at
tain
to
th
e
i
n
f
o
rm
at
i
on securi
t
y
neede
d
.
Subse
q
uent
l
y
,
a consi
d
era
b
l
e
am
ount
of
wo
rk
has bee
n
co
nt
rol
l
e
d t
o
wa
r
d
s
g
u
a
ran
t
eein
g
t
h
e
p
r
o
t
ection
an
d secu
rity of
rem
o
tely sh
ared
d
a
ta,
u
tilizin
g
a v
a
riety of
syste
m
s an
d secu
rity
m
odel
s
. These
ha
ve m
a
i
n
l
y
foc
u
se
d
on
pr
eservi
ng
u
s
ers
’
pri
v
acy
w
h
i
l
e
real
i
z
i
n
g
de
si
red
secu
ri
t
y
goal
s
,
with
ou
t in
t
r
odu
cing
ex
cessively h
i
g
h
lev
e
ls o
f
co
m
p
lex
ity
to
th
e u
s
ers at
th
e
d
ecryp
ti
o
n
stag
e.
To illu
min
a
te
th
ese issu
es, scien
tists h
a
v
e
eith
er used
Key- Po
lic
y
Attri
bute Base
d E
n
cry
p
tio
n (
K
P
-
ABE)
[3]
fo
r
secure
access control
or em
ployed
Hierarchi
cal
Attribute Base
d E
n
cryption (HABE)
[4] for information security. On
t
h
e ot
her
han
d
,
t
h
e H
A
B
E
-
b
a
s
ed
pl
an
uses
vari
ous l
e
vel
e
d enc
r
y
p
t
i
o
n t
o
g
u
a
r
ant
ee
da
t
a
securi
t
y
i
n
a
cl
ou
d,
y
e
t
t
h
i
s
pre
s
ent
s
t
o
o m
a
ny
pri
v
at
e key
s
f
o
r
e
ach
user
t
o
be
m
a
naged
ef
fect
i
v
el
y
.
In summ
ary, these
plans either ha
ve
security im
perfections
or provide security at the c
o
st
of
execut
i
o
n.
T
h
e
r
ef
ore
,
t
h
e c
h
a
l
l
e
nge
of ac
hi
e
v
i
n
g t
h
e
d
u
al g
o
a
ls of
pr
iv
acy-
p
r
eser
ving with
effective cloud
dat
a
sha
r
i
n
g re
m
a
i
n
s un
resol
v
ed. T
o
u
n
d
erst
and a
po
we
rf
ul
, ada
p
t
a
bl
e an
d
pri
v
acy
prese
r
vi
n
g
dat
a
i
m
part
i
n
g
serv
ices in
cl
ou
d co
m
p
u
ting
,
th
e
fo
llowing d
i
fficu
lties n
e
ed
to b
e
m
e
t firstly, in
fo
rm
at
io
n
ho
ld
ers
o
u
g
h
t
t
o
have
the
capac
ity to assign
other clou
d users with distincti
v
e access
privi
l
eg
es t
o
their
data, sec
o
ndly, the
cl
ou
d sh
o
u
l
d
have t
h
e capa
c
i
t
y
t
o
hel
p
el
em
ent
dem
a
nds so t
h
at
i
n
f
o
r
m
at
i
on hol
ders
can ad
d o
r
re
vo
ke
access pri
v
ileges to diffe
re
nt clients perm
itting them
to
m
a
ke or erase the
i
r inform
ati
on, thirdly, the clients'
security m
u
st be ens
u
re
d a
g
ainst the
cloud s
o
that they ca
n cove
r thei
r pr
i
v
ate data
while
accessing the
cloud
and
fi
nal
l
y
, us
ers sh
o
u
l
d
hav
e
t
h
e capaci
t
y
t
o
im
part
i
n
f
o
rm
ati
on i
n
t
h
e
cl
ou
d t
h
ro
u
gh
joi
n
ed t
e
c
h
n
o
l
ogi
e
s
with
low co
m
p
atib
ility, fo
r exa
m
p
l
e, sm
art p
h
o
n
e
s and
tab
l
ets.
A fine
grained access control
policie
s is proposed
for privacy- preser
ving data shari
ng
in the cloud
th
at en
sures both
sem
a
n
tic
se
cu
rity an
d
effectiv
e av
aila
b
ility o
f
u
s
er d
a
ta. To
p
r
eserv
e
priv
acy and
gu
aran
tee
d
a
ta con
f
i
d
en
tiality ag
ain
s
t th
e clo
u
d
,
em
p
l
oys a cryp
tograp
h
i
c
p
r
im
itiv
e, n
a
m
e
d
Ci
p
h
e
r-tex
t
Po
licy Attrib
u
t
e
-b
ased
En
cryp
t
i
o
n
(CP-ABE)
[5
] an
d co
m
b
ines it with
a C
h
aracter-Base
d
Encry
p
tion (C
BE) technique
. Eac
h
data file is describe
d by a set of
m
eaningful
ele
m
ents, allowing each
user
to be assigned an access structure
that defi
nes the scope of
data files they can ha
ve acces
s.
To
protect use
r
privacy, it does not nee
d
to
updat
e
user sec
r
et ke
y so that it prevents cl
oud users’ acces
s struct
ure.
To
re
duce t
h
e key
managem
e
nt issue, t
h
e
i
n
f
o
rm
at
i
on h
o
l
der
basi
cal
l
y
assi
gns
s
ecret keys to
users
via
the cloud.
The fundam
ental
commi
tments can be
com
p
ressed a
s
follows:
1.
We propose a
b
out the e
ffe
ctive, scala
b
le encryptio
n f
o
r a
cl
ou
d dat
a
s
h
a
r
i
n
g ser
v
i
ce t
h
at
sim
u
l
t
a
neou
sl
y
ach
iev
e
fu
ll priv
acy-
p
r
eserv
i
n
g
an
d d
a
ta con
f
i
d
en
tiality.
2.
The
perform
a
nce a
n
alysis incurs
a
sm
all ove
rhead
com
p
are
d
to exis
t
i
ng
schem
e
s,e,
t
h
e e
xpe
ri
m
e
nt
al
results
dem
ons
trate that the
overhea
d
s a
r
e as
light as
possi
ble.
2.
RELATED WORK
An
At
t
r
i
b
ut
e -
B
ased Enc
r
y
p
t
i
on (
A
B
E
) sy
st
em
was fi
rst
pr
o
pose
d
by
Shahai
a
nd
Wat
e
rs [
6
]
.
It
i
s
essentially a sim
p
lified CBE syste
m
with only a single
ele
m
ent. In an
ABE schem
e
, the sende
r enc
r
ypts the
message with
a set of elem
ents and
specifie
s
a num
b
er
d;
a recipient ca
n only
d
ecrypt t
h
e e
n
crypte
d
message
i
f
t
h
ey
ha
ve at
l
east
d of t
h
e
gi
ve
n El
em
ents. B
a
sed
on t
h
ese pri
n
ci
pl
es
pr
o
pose
d
a
n
A
B
E schem
e
wi
t
h
fi
ne
-
grai
ned
data access cont
rol that supports m
o
not
onic access
structures, s
u
c
h
as AND, OR
and
other t
h
re
shol
d
gates. Ostrovs
k
y etal [7] propos
ed a
n
enha
nced sc
hem
e
that also supports
non-m
onot
onic access structures,
i
.
e.,
NOT
gat
e
s. M
u
l
l
e
r et
a
l
[8]
prese
n
t
e
d a
di
st
ri
b
u
t
e
d
At
t
r
i
b
ut
e ba
sed sc
hem
e
, b
a
sed
on
an
ef
fi
ci
ent
con
s
t
r
uct
i
o
n
t
h
at
dem
a
nds a c
onst
a
nt
num
ber
of
o
p
erat
i
o
ns
at the
decrypti
on stage
.
T
h
e a
ccess policy form
ats
have t
o
be e
x
p
r
esse
d as a di
s
j
unct
i
v
e
n
o
rm
al fo
rm
(DNF
);
there
f
ore, t
h
e ciphe
r text
size is p
r
op
ortio
nal to
th
e
num
ber
of
co
n
j
unct
i
v
e
cl
ause
s
i
n
t
h
e
D
N
F
.
Ch
ase
[9
] i
n
tro
d
u
c
ed
a m
u
l
ti-au
tho
r
ity ABE sch
e
m
e
in wh
ich sev
e
ral au
tho
r
ities co
op
erate to
manage the El
e
m
ents. Each
authority
m
a
nages a dom
a
in
of El
em
ent
s
and
di
st
ri
b
u
t
e
s
t
hose El
em
ent
s
and
secret keys to
the use
r
s. T
h
e
main i
ssu
e affectin
g
th
is sche
m
e
is th
at i
t
i
s
n
o
t
p
r
actical to
h
a
v
e
on
e tru
s
ted
cen
tral au
t
h
ority. An
enh
a
n
c
ed
m
u
lti-au
th
ority ABE sch
e
me was su
bsequ
e
n
tly p
r
op
osed
b
y
th
at rem
o
v
e
th
e
trusted a
u
thority, in orde
r to
preserve
user
privacy, each
a
u
t
h
ority has to a
ssign at least one Elem
ent to each
user
.
Lewk
o and
Water
s
[10
]
pr
ov
id
ed
a d
ecentr
a
lized
ABE
sch
e
m
e
th
at do
es
no
t requ
ire a tru
s
ted
authority, but
still
main
tains pri
v
acy. In the
i
r schem
e
, the access stru
ct
ure for any
give
n use
r
is only known
by the sende
r
.
Decent
r
alized
mechanism
is
not s
u
itable for cloud com
puting. The s
c
hem
e
propose
d
by
Yu et
al
. [1
1]
expl
oi
t
s
KP
-AB
E
,
by
com
b
i
n
i
ng i
t
wi
t
h
p
r
o
x
y
re- e
n
cr
y
p
t
i
on a
nd l
a
zy
re-enc
ry
pt
i
o
n
.
It
si
m
u
ltaneously
achieves fi
ne- graini
ness’, scalability a
nd data confide
n
tiality for data access cont
rol. The
in
fo
rm
atio
n
h
o
ld
er can
d
e
legate
m
o
st o
f
th
e co
m
p
u
t
atio
n
task
s, su
ch
as u
s
er revo
cation
,
to
th
e clo
ud serv
er
Evaluation Warning : The document was created with Spire.PDF for Python.
I
J
ECE
I
S
SN
:
208
8-8
7
0
8
Cloud Security
in
Cry
p
t
Databas
e Server Us
ing Fi
ne
Gr
ained Acces
s Cont
rol (Krishna Keerthi C.)
9
17
with
ou
t
d
i
sclosin
g
an
y d
a
ta t
o
th
e
un
tru
s
ted clo
u
d
,
b
y
dele
gating these ta
sks,
som
e
user attribute a
nd
s
ecret
k
e
ys m
a
y
leak
in
to
th
e cl
o
u
d
.
Th
e related
ciph
er tex
t
m
u
st b
e
re-en
c
ry
p
t
ed
, allo
wing
it to
b
e
rev
ealed to
n
on-
rev
o
k
ed
use
r
s.
To
di
sco
v
e
r
t
h
e
pr
oxy
re-e
n
c
ry
pt
i
o
n t
ech
ni
que
s ap
pl
i
e
d i
n
C
P
-
A
B
E
by
Wan
g
et
al
.
[1
0]
,[
11]
pr
o
v
i
d
e
d
a sec
u
re cl
ou
d st
o
r
a
g
e sch
e
m
e
for heal
t
h
rec
o
r
d
s
i
n
cl
ou
d c
o
m
put
i
ng
by
usi
n
g
C
h
ase an
d C
h
ow
’
s
m
u
l
ti-au
th
ority
ABE
sch
e
m
e
to
d
i
v
i
d
e
u
s
ers in
to
d
i
fferen
t
do
m
a
in
s, th
is sch
e
m
e
is an
iso
l
ated
case and
i
s
no
t
gene
ral
l
y
ap
pl
i
e
d i
n
cl
o
u
d
c
o
m
put
i
ng.
Vim
e
rcati [12] presents a form
al access
cont
rol
m
odel on outs
ource
d
data,
whe
r
e
each file is
encry
p
ted
with a symmetric key and ea
ch
us
er is assigne
d
a secret key, the c
o
m
p
lex
ity
o
f
op
eration
s
of
file
creatio
n and
user
g
r
an
t/revo
c
atio
n
is lin
ear to
th
e
nu
m
b
er o
f
user
s,
w
h
i
c
h m
a
kes t
h
i
s
schem
e
unsca
l
a
bl
e.
M
o
re
ove
r,
Sa
m
a
rat
i
[1
3]
di
s
c
usses
som
e
m
a
i
n
pri
v
acy
i
ssues
t
o
be a
d
dress
e
d
i
n
dat
a
o
u
t
s
o
u
r
c
i
n
g,
ra
ngi
ng
fro
m
d
a
ta co
nfid
en
tiality to
d
a
ta u
tility, d
a
ta p
r
o
t
ectio
n an
d priv
acy
o
v
er ou
tso
u
r
ced d
a
tab
a
se
scen
ario
s.
Wang et al. [11] propose
d
a hierarc
h
ical fine-graine
d
access control
sche
me that relies
on
Hierarc
h
ica
l
CBE
and CP-ABE.
The a
r
c
h
itecture of
th
is sch
e
me is arrang
ed
i
n
a h
i
erarch
ical way
with a
root m
a
ster and s
e
veral
dom
ain
m
a
ster
s
to ge
nerate keys
for use
r
s, because
a
la
rge num
b
er of
keys are
require
d
for eac
h e
n
tity, the
syste
m
are com
p
licated.
3.
THEORITICAL WORK
3.
1.
CP
–AB
E
Met
h
od
ol
o
g
y
The
fram
e
work m
odel as i
ndi
cated in
Figure
1
Requ
ires
four
p
a
rties in a sy
ste
m
:
1.
Th
e i
n
fo
r
m
ati
o
n m
a
n
a
g
e
r
,
w
h
o
h
a
s i
n
fo
rmatio
n
sto
r
ed in
th
e clou
d and
r
e
lies up
on
t
h
e cloud for
in
fo
rm
atio
n
sup
port.
2.
In
fo
rm
at
i
on h
o
l
der ca
n
be e
n
t
e
rp
ri
ses
or
i
n
di
vi
d
u
al
cl
i
e
nt
s.
3.
The i
n
f
o
rm
at
ion
co
ns
um
er, wh
o
g
o
es t
h
r
o
ug
h t
h
e i
n
f
o
r
m
at
i
on im
part
ed
by
t
h
e i
n
f
o
rm
ati
on m
a
nager
,
do
w
n
l
o
a
d
s i
n
f
o
rm
at
i
on of i
n
t
e
rest
and dec
r
y
p
t
s
i
t
usi
ng h
i
s secret
key
s
. The cl
ou
d ser
v
er (C
S
)
gi
ves
a
high- quality service
using
va
rious se
rve
r
s
with
significant
stora
g
e space a
n
d com
putation
powe
r.
4.
Th
e secret
k
e
y
g
e
n
e
rator
(SKG) is a tru
s
ted
th
ird p
a
rty
that
proces
ses
by c
o
m
p
arin
g pr
iv
ate k
e
ys for
u
s
ers.
3.
2.
T
h
e Ri
val
M
o
del
Th
e rival
m
o
d
e
l co
nsid
ers
m
o
st th
reats to
clo
u
d
inform
at
io
n
confid
en
tiality
as
m
a
lic
io
u
s
.
Int
e
re
st
i
ngl
y
,
t
h
e C
S
i
n
t
h
e
m
odel
i
s
a sem
i
-t
rust
ed
(al
s
o
kn
ow
n a
s
p
a
ssi
ve)
,
i
n
t
h
at
i
t
act
s appr
op
ri
at
el
y
maj
o
rity of ti
me, h
o
wev
e
r, i
n
sp
ecific circu
m
stan
ces
an
en
tity
m
i
g
h
t
su
bj
ectiv
ely
d
e
v
i
ate fro
m
th
e
p
r
o
t
o
c
o
l
specifications and the CS m
a
y atte
m
p
t to se
cure as m
u
ch
secret inform
ation as po
ssi
ble. It proposes de
spite
o
n
th
e
fact th
at th
e sem
i
-tru
sted
ri
v
a
l m
o
d
e
l is weak
er t
h
an
th
e m
a
l
i
cio
u
s m
o
d
e
l; it is o
f
ten
a m
o
re
realistic
m
odel. The t
h
ree types
of t
h
re
ats can
be cate
g
orized as
foll
ows:
1.
Internal t
h
reats
(from
the CSS and
u
s
er
s
wh
o m
a
y acq
u
i
re un
appr
ov
ed
d
a
ta)
,
and
ex
ter
n
al t
h
r
eats
(
fro
m
una
p
p
r
o
ved
as
saul
t
e
rs a
n
d
ou
t
s
i
d
e f
o
es
bey
o
n
d
t
h
e
sy
st
em
dom
ai
n).
2.
Activ
e attack
s (wh
e
re
u
n
a
pp
rov
e
d
u
s
ers in
fu
se m
a
lev
o
l
en
t files in
to
th
e clo
ud), and
p
a
ssiv
e attacks
(
w
h
e
r
e
un
ap
pro
v
e
d
u
s
er
s eavesd
rop
o
n
conver
s
atio
n b
e
t
w
een
u
s
ers an
d the clo
ud)
.
3.
C
o
l
l
u
si
o
n
bet
w
een t
h
e C
SS a
nd
user
s (t
o ac
cess una
p
p
roved
in
fo
rm
atio
n with
th
e end
g
o
a
l of h
a
rvestin
g
file con
t
en
ts).
3.
3.
Security Requirements
As for sec
u
re i
n
form
ation sha
r
in
g and i
n
formation access
cont
rol in
the c
l
oud, t
h
e prim
a
r
y objective
of propose
d
m
odel is to protect th
e cloud inform
ation from
being accessed
by inne
r intruders
,
including the
cloud a
n
d from
external attacker
s an
d un
ap
pro
v
e
d
ou
tsid
e
user
s.
Fi
gu
re
1.
Sy
st
em
M
odel
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
SN
:
2
088
-87
08
IJEC
E
V
o
l
.
6,
No
. 3,
J
u
ne 2
0
1
6
:
91
5 – 9
2
4
91
8
4.
PROP
OSE
D
SCHE
ME
Fram
ewor
k ha
s
t
h
e fol
l
o
wi
n
g
re
qui
rem
e
nt
s:
1.
In
Fine
-
grai
ne
d access control eve
r
y
user should only be
able to ac
cess
the data t
h
ey a
r
e
perm
itted to,
with no
access to
una
p
prove
d inform
ation.
2.
In
C
o
l
l
u
si
on
s
a
fet
y
, use
r
s
sh
oul
d
not
be
ab
l
e
t
o
c
o
l
l
ude
w
i
t
h
som
e
ot
he
r
use
r
,
o
r
t
h
e
cl
ou
d,
wi
t
h
t
h
e
e
n
d
goal
of s
h
ari
n
g their sec
r
et
ke
y to access
una
p
prove
d i
n
formation.
3.
In Retrogressi
ve secrecy, the info
rm
ation access control approach sh
ould
have the functionality to
gua
ra
nt
ee t
h
at
users
are
n
o
t
a
b
l
e
t
o
ac
cess t
h
e cl
ou
d i
n
f
o
rm
at
i
on
once
t
h
ei
r
pri
v
i
l
e
ge
s
ha
ve
been
re
v
oke
d.
In
o
r
der
t
o
i
m
pr
o
v
e
pri
v
acy
and
sec
u
ri
t
y
f
o
r
dat
a
s
h
ari
n
g
i
n
cl
ou
d c
o
m
p
u
t
i
ng,
a sc
hem
e
i
s
pro
p
o
se
d
that com
b
ines
CP-ABE
and
CBE. Figure
2
portrays
a
st
rea
m
l
i
n
ed
w
o
r
k
p
r
oces
s of
t
h
e pr
op
ose
d
pl
an
.
In
vi
ew o
f
t
h
e sy
st
em
m
odel
,
t
h
e pr
o
pose
d
s
c
hem
e
i
s
descr
i
bed i
n
det
a
i
l
.
The m
a
i
n
obje
c
t
i
v
e of o
u
r
pr
op
ose
d
works is t
h
e a
u
thorized
use
r
s t
o
access
and re
store file
effectively.
Fi
gu
re 2.
Si
m
p
l
i
f
i
e
d Wor
k
fl
o
w
of Pr
o
pose
d
Schem
e
4.
1.
Access Policy
Access policy can be
comm
unicated w
ith attributes at leaves and lo
gic
gates
e.g. AND (^), OR
(n)
as in
term
ed
iate nod
e
represen
ted in
ABE.
An
y access t
r
e
e
can
be
c
o
n
v
e
rt
ed i
n
t
o
t
h
e
B
ool
ea
n
fo
rm
ul
a. A
ny
access tree A c
a
n be c
o
nve
rte
d
ove
r
to a Linear Secr
et Sha
r
ing Sc
hem
e
(
L
SSS) fram
ework M. LSSS a
ccess
st
ruct
u
r
es a
r
e m
o
re general
,
and ca
n
be as r
e
sol
v
e
d
structure re
prese
n
tations a
s
Boolean equations
. There a
r
e
st
anda
rd m
e
t
hods t
o
c
h
an
ge
ove
r a
n
y
B
o
ol
ean
fo
rm
ul
a i
n
t
o
a com
p
a
r
i
n
g LSS
S
g
r
i
d
. T
h
ere a
r
e s
t
anda
rd
techniques to
conve
r
t any Boolea
n
fo
rm
u
l
a in
to
a co
rresp
ond
ing
LSSS
m
a
trix
. Th
e nu
m
b
er o
f
ro
ws in
th
e
corres
ponding
LSSS m
a
trix will be sa
m
e
as the num
b
er of l
eaf nodes in
t
h
e access tree.
In LSSS, e
v
e
r
y piece
is a vector ove
r
som
e
finite field,
and e
v
ery
set in the acce
ss struct
ure
re
constructs t
h
e
secret usi
ng a
linear
com
b
ination
of the
c
o
ordi
nates of its
pieces
. Di
ffe
rent
from
ABE, a m
e
s
s
age M
is
e
n
crypted
with a
n
LSSS
access struct
ure (M,
ƿ
) where
ƿ
is a p
e
rm
u
t
atio
n
fun
c
tion th
at
m
a
p
s
rows of M to
attribu
t
es in
A.
Th
e u
s
er
who
only
has t
h
e secret keys
for a s
u
bset of
rows M
x
of M
s
u
c
h
t
h
a
t
(
1
,
0
,
0
)
i
s
i
n
the s
p
an of the
s
e rows ca
n
decry
p
t the m
e
ssage acc
urately.
4.
1.
1.
Initia
liza
t
io
n
The inform
ation
holder
picks a la
rge p
r
i
m
e P, t
w
o
gr
o
u
p
s G
1
,
G
2
o
f
or
der
P, an
d a
m
a
p e:
G1
×G1
→
G
2
a
n
d
a hash
fu
nct
i
on
G
1
, G
2
w
h
i
c
h m
a
ps a user
ID t
o
an
el
em
ent
of G1
. At
t
h
at
p
o
i
n
t
t
h
e
inform
ation holde
r
cha
r
acterizes a
set
of
at
t
r
i
but
es A
fo
r sha
r
i
n
g i
n
fo
rm
ati
on rec
o
r
d
s a
nd c
h
o
o
s
es t
w
o
arbitra
r
y exam
ples
β
i,
γ
ii Zp for each attributes in
A. So th
e
pri
v
ate key
Prk for t
h
e system is
The
p
ubl
i
c
key
Pu
K
o
f t
h
e sy
st
em
i
s
pu
bl
i
s
he
d:
Evaluation Warning : The document was created with Spire.PDF for Python.
I
J
ECE
I
S
SN
:
208
8-8
7
0
8
Cloud Security
in
Cry
p
t
Databas
e Server Us
ing Fi
ne
Gr
ained Acces
s Cont
rol (Krishna Keerthi C.)
9
19
4.
1.
2.
En
cry
pt
io
n
Th
e inform
atio
n
ho
ld
er ch
aracterizes a set o
f
attrib
u
t
es
I
∈
A fo
r each
d
a
t
a
file. Th
e co
nfigu
r
ation
s
of
access policy can
be re
prese
n
ted as
n×
l
LSSS m
a
trix M with a
function
ρ
map
p
i
ng
its rows to attribu
t
es. The
i
n
f
o
rm
at
i
on h
o
l
der
pr
ocesse
s
t
h
e m
e
ssage M
as f
o
l
l
o
ws:
Ran
d
o
m
ly sele
ct a Zp
, a rando
m
v
ecto
r
with
th
e first en
try as s. Let
where M
x
is
row
x
of
M.
Random
ly sele
ct a vect
or
with
th
e
first en
try as 0 and
a seed
. Let
en
cry
p
t th
e m
e
ssag
e
M
with (M,
ρ
) as fo
llows:
Whe
r
e
p(
x
)
i
s
a pe
rm
ut
at
i
on f
unct
i
o
n m
a
ppi
ng
M
x
t
o
at
t
r
i
b
ut
e, a
n
d
is a symme
tric en
cry
p
tio
n
un
de
r key
s
. Fi
n
a
lly, th
e i
n
form
at
io
n
h
o
l
d
e
r
up
lo
ad
s th
e en
cryp
tio
n
file
to
th
e cloud
serv
ers.
4.
1.
3.
Key Gener
a
ti
on An
d Distri
bution
Th
e in
fo
r
m
ati
o
n ho
ld
er
o
b
t
ain
s
user
ID
(I
Du
) fr
om
Secret Key
Generator and as
s
i
gns a
set
of
at
t
r
i
but
es I
u
fo
r user
Uu
. The
n
t
h
e i
n
f
o
rm
at
ion
hol
der
calculates the private key co
m
p
onent Pri,
u for
IDu of
at
t
r
i
but
e
i
bel
o
ngi
ng
t
o
use
r
U
u
The private ke
y
for use
r
Uu is
. Pr(u) is encryp
ted
b
y
th
e u
s
er
pu
b
lic key
(I
Du
) an
d del
i
vere
d t
o
t
h
e u
s
er vi
a t
h
e cl
ou
d ser
v
er
, suc
h
t
h
at
onl
y
t
h
at
user
(I
Du
) can
decry
p
t
i
t
usi
ng
hi
s
pri
v
ate key.
4.
1.
4.
Decrypti
o
n
User Uu recei
ves a cipher t
e
xt
and H (I
Du
) fr
om
the
clou
d
and selects constants s
u
c
h
t
h
at
(
1
, 0,
0
)
. Th
e
pr
iv
ate
k
e
y of
U
u
is
. The
n
U
u
calculates and obtain the m
e
s
s
age
. Usi
n
g t
h
e pr
o
p
o
s
ed sc
hem
e
, t
h
e i
n
form
ati
on hol
d
e
r
en
cry
p
ts files an
d
st
o
r
es t
h
em in
to
th
e cloud
, wh
ile th
e
users decry
p
t the c
i
phe
r text C us
ing thei
r own s
ecret
key
s
.
4.2.
D
y
n
a
m
i
c O
p
er
a
t
io
n
The i
n
form
ation m
a
nager s
t
ores t
h
e inform
ation
int
o
t
h
e cloud se
rver,
whe
r
e t
h
e
cloud
data
d
y
n
a
m
i
call
y
c
h
ang
e
s. Th
is is
m
o
re app
licab
le for so
m
e
static ap
p
licatio
n
scen
ario
s like lib
raries sin
c
e th
e
i
n
f
o
rm
at
i
on h
o
l
der st
o
r
es t
h
e
dat
a
i
n
t
o
cl
ou
d ser
v
e
r
, r
a
th
er th
an
ph
ysically p
o
s
ing
it, the d
y
n
a
m
i
c d
a
ta an
d
user ope
r
ations
are
quite challengi
ng.
4.
2.
1.
File creati
on
I
n
clou
d d
a
ta
sh
ar
i
n
g, th
er
e
ar
e cases wh
en
info
r
m
atio
n
h
o
l
d
e
r up
lo
ad
s n
e
w
d
a
ta in
t
o
th
e cloud
serve
r
s.
Wh
e
n
the inf
o
rm
ation
h
o
lde
r
wa
n
t
s t
o
creat
e a
new
fi
l
e
,
he c
h
o
o
ses a
u
n
i
q
ue I
D
a
n
d
de
f
i
nes t
h
e
attrib
u
t
e set I fo
r t
h
e n
e
w file. Th
en
th
e informatio
n
h
o
l
d
e
r
en
cry
p
ts th
e fil
e
u
s
ing
th
e
p
r
op
o
s
ed
al
g
o
rithm an
d
upl
oads the encrypted file and LSSS m
a
trix with signat
u
re
correctly to the cloud.
If
veri
fying the signa
t
ure
co
rrectly, th
e clo
u
d
sto
r
es the n
e
w file. After u
p
l
oad
i
n
g
th
e en
cry
p
ted
file in
to
th
e clo
u
d
, th
e in
fo
rm
atio
n
hol
der can go
offline at a
n
y time.
4.
2.
2.
File deletio
n
Som
e
t
i
m
e
s, som
e
ant
i
quat
e
d cl
ou
d i
n
f
o
rm
ati
on o
u
ght
t
o
b
e
erased. T
h
e del
e
t
e
ope
rat
i
o
n co
nsi
d
e
r
e
d
here i
s
st
rai
ght
fo
rwa
r
d. J
u
st
t
h
e i
n
f
o
rm
ati
o
n
m
a
nager
has
t
h
e be
nefi
t
t
o
del
e
t
e
hi
s st
o
r
ed fi
l
e
. At
t
h
e
poi
nt
wh
en
t
h
e info
rmatio
n
m
a
n
a
g
e
r
n
eed
s to
d
e
l
e
te an
an
tiqu
a
te
d
file, h
e
sen
d
s th
e
file ID and
h
i
s sign
ature to
the
clo
u
d
.
Af
ter
v
e
r
i
f
y
in
g th
e
signatu
r
e
on
th
is
f
ile ID
, t
h
e cloud d
e
letes th
e an
t
i
q
u
a
ted f
ile.
4.
2.
3.
User oper
ati
o
ns
From
user
s’
pe
rspect
i
v
e
,
t
o
p
r
eserve
t
h
e cl
ou
d
dat
a
secu
ri
t
y
, ne
w
user
s wi
l
l
joi
n
an
d
out
dat
e
d
use
r
s
need
t
o
be re
vo
ked
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
SN
:
2
088
-87
08
IJEC
E
V
o
l
.
6,
No
. 3,
J
u
ne 2
0
1
6
:
91
5 – 9
2
4
92
0
4.
2.
4.
User Addi
tion
From
the use
r
’s perspective
,
there a
r
e s
o
m
e
new
use
r
s
who wa
nt to
join the system
to access the
share
d
data.
When a
ne
w use
r
Uu joins t
h
e
syste
m
, the
inform
ation h
o
ld
er first
obtains
the use
r’s
ID
(I
D
u
)
from
the SKG, assigns the att
r
ibute
set Iu
and
calcu
lates the
cor
r
es
po
n
d
i
n
g
pri
v
at
e
key
f
o
r t
h
i
s
ne
w
use
r
. T
h
e
i
n
f
o
rm
at
i
on h
o
l
d
e
r
t
h
e
n
se
n
d
s t
h
e
p
r
i
v
at
e
key
an
d
hi
s
si
gnat
u
re t
o
t
h
e cl
ou
d se
rve
r
. A
f
t
e
r
veri
fy
i
ng t
h
e
signat
u
re, the
cloud se
nds the secret key and related s
ecret in
form
atio
n
to
th
e
n
e
w
j
o
in
in
g u
s
er.
The u
s
er
d
ecry
p
ts th
e messag
e
to
g
e
t his secret k
e
y in th
e syst
e
m
. T
h
e inform
ation hol
der fi
rst obtains the ne
w user ID
(I
Du
)
fr
om
PKG, as
si
g
n
s a
se
t
of at
t
r
i
but
es
Iu for
Uu and c
a
lculates the
private key
for
ID
u.
Th
en
i
t
enc
r
y
p
t
s
t
h
e
secret
key
,
at
t
r
i
but
e
set
an
d t
h
e c
o
rres
p
on
di
n
g
h
a
sh
val
u
e
H
(I
D
u
)
wi
t
h
use
r
’
s
I
D
, de
not
i
n
g as
D. Fi
nal
l
y
i
t
send
s ci
ph
er t
e
xt
D a
nd
user
’
s
ID
to the cl
oud.
After recei
ving t
h
e m
e
ssage fr
om
the inform
ation holde
r
, the CS
veri
fies
the signature
. If failed in si
g
n
a
t
u
re v
e
rificatio
n
,
th
e C
S
d
e
letes th
e receiv
ed ciph
er tex
t
D to th
e
j
o
i
n
ing
user.
Th
e jo
in
i
n
g
u
s
er first ob
tain
s
his p
r
iv
ate
key
SK[
u
]
f
r
om
PKG
.
A
f
t
e
r
decr
y
p
t
i
ng t
h
e ci
ph
er t
e
xt
D usi
n
g pri
v
at
e
Pr
(u
),
he
ve
rifies the
signature
Finally,
the joining user
acce
pts
as his
acc
ess attribute se
t, secret
key a
n
d us
er
ID
corres
ponding has
h
val
u
e. Aft
e
r
recei
ving the secret keys
, the
newly join
e
d
user ca
n acc
ess the m
a
tched file
s
cor
r
ect
l
y
. The
cl
oud se
rve
r
onl
y
o
b
t
a
i
n
s t
h
e use
r’s
ID
and sy
st
em
publ
i
c
key
but
n
o
secret
key
s
.
Thus
,
pri
v
acy and se
curity can be
a
c
hieve
d
.
4.
2.
5.
User Re
voc
ati
o
n
At tim
e
s, the i
n
form
ation hol
d
er m
a
y renounce s
o
m
e
users to
gain
acce
ss privileges
.
After bei
n
g
revoked, these
use
r
s a
r
e
not
perm
itted to access the cl
ou
d inform
ation anym
ore. In
som
e
early works,
t
h
e
inform
ation
manage
r overha
uls the secret keys co
m
p
aring to
the attributes
that the revoked use
r
process
e
s. At
t
h
at
poi
nt
t
h
e
i
n
fo
rm
ati
on hol
der re
- enc
r
y
p
t
s
t
h
e rel
a
t
e
d fi
l
e
s and c
i
rcul
at
es t
h
e n
e
w key
s
t
o
t
h
e no
n-
ren
o
unce
d
user
s by
m
eans of t
h
e cl
o
ud se
r
v
er
. Des
p
i
t
e
t
h
e fact th
at it is ad
d
itio
n
a
lly su
itab
l
e fo
r t
h
e propo
sed
p
l
an
, it un
cover
s
u
s
er
s’
r
i
ght to
th
e cl
o
u
d
an
d br
in
gs m
o
re c
o
m
put
at
i
on
ove
rh
ead
. T
h
ere
i
s
an
o
p
t
i
m
i
z
i
n
g
m
e
thod to deal
with user re
vocation.
The inform
ation hol
der just re-enc
rypts a piece of the ciphe
r text and
th
u
s
th
er
e is
no
n
e
ed
to update th
e co
rr
espo
nd
ing
pr
iv
ate k
e
y.
W
h
en
ther
e ex
ists a
u
s
er
to b
e
r
e
vo
ked
,
t
h
e
in
fo
rm
atio
n
hold
e
r
first d
e
termin
es th
e set of attribu
t
es
I
u
whi
c
h
u
s
er U
u
pos
sess. The
n
, he
ra
n
dom
l
y
cho
o
ses
a new vector
of. Now the new first entry
of vector
is
. A new
is
calculated for
each LSSS m
a
trix row
x c
o
r
r
esp
o
ndi
ng t
o
at
t
r
i
but
es bel
o
ng t
o
I
u
. T
h
e
in
fo
rm
atio
n
hold
e
r re
calcu
lates
th
e n
e
w v
a
lu
es o
f
and as
.
Fi
nal
l
y
he sen
d
s fi
l
e
I
D
f a
nd
u
s
er’s
ID al
o
n
g
with
the n
e
w en
cryp
ted
file,
to
th
e cloud
.
After
ve
rify
in
g
the si
gnat
u
re
th
e CS
d
e
letes
th
e o
l
d
en
cry
p
ted
file and
IDu from
the
UL.
It stores the new
recei
ve
d one
on the
bas
e
of
file ID. Si
nce we
do
not
update the sec
r
et keys
for non-revoke
d
users
,
they a
ccess the
cl
o
u
d
dat
a
j
u
st
as
gi
ve
n i
n
Sect
i
on
4.
2.
To
p
r
e
v
ent
t
h
e re
v
o
k
e
d u
s
er
eaves
drop the
comm
unication, t
h
e clou
d can
use non
-r
evok
ed u
s
er
s’ public k
e
y to
en
cryp
t th
e n
e
w
encr
yp
ted
file. In
t
h
e stag
e of
d
ecryp
ti
o
n
, on
ly th
e user ob
tain
s t
h
e
exact
C
1
,
x ca
n dec
r
y
p
t
t
h
e
m
e
ssage M
,
w
h
i
c
h ca
n
pre
v
e
n
t
the re
voke
d use
r
from
accessing
the
cloud file.
4.
3.
Security Analysis
Th
e secu
rity an
alysis fo
cu
ses on
th
e security requ
i
r
em
ent
s
of
t
h
e
pr
o
pos
ed sc
hem
e
. In
t
h
i
s
schem
e
,
assign
flexi
b
le and
differe
n
t access privileges for eac
h use
r
to ac
hieve fine
grai
ned acce
ss control
.
Mean
wh
ile, the sch
e
m
e
ach
i
e
v
e
s fu
lly co
llu
sion
secure
wh
ich
is i
m
p
o
r
tan
t
wh
en
several u
s
ers co
llu
d
e
an
d
share
their secret keys to acce
ss the
unaut
h
orized data
. It also ac
hiev
e use
r
access
privilege
confi
d
entiality.
4.
3.
1.
F
i
n
e
-
g
ra
in
e
d
a
c
c
e
s
s
co
nt
ro
l
In this sc
hem
e
, each us
er
rece
ives a
flexi
b
le
access
structure from
the inform
ation hol
der.
Eac
h
use
r
U
u
has
b
e
en
assig
n
e
d
a set
o
f
attr
ib
u
t
es
f
o
r
t
h
e i
n
fo
r
m
atio
n
ow
ner
.
Su
ppose a
f
ile h
a
s an attr
ib
u
t
e i
,
so
it
h
a
s
a corre
spondi
ng row rb in the
LSSS m
a
trix.
Howe
ver, if
the user Uu does
not ha
ve
the attribute i, he cannot
receive t
h
e
pri
v
ate key
Pr (i, u) for attribut
e i. In
a
d
dition, i
n
the
decry
p
tion st
age
as
Uu cannot fi
nd the
co
rr
esp
ond
ing cx o
f
r
o
w
r
t
o
satisf
y
Evaluation Warning : The document was created with Spire.PDF for Python.
I
J
ECE
I
S
SN
:
208
8-8
7
0
8
Cloud Security
in
Cry
p
t
Databas
e Server Us
ing Fi
ne
Gr
ained Acces
s Cont
rol (Krishna Keerthi C.)
9
21
th
e
d
ecry
p
tio
n p
r
o
c
edu
r
e
will fail.
There
f
ore, a u
s
er w
ho d
o
es
not
ha
ve t
h
e
at
t
r
i
but
e i
cannot
cal
cul
a
t
e
. Thus
, the us
er cannot
decry
p
t
t
h
e
un
aut
h
ori
z
e
d
m
e
ssage.
O
u
r
sc
hem
e
onl
y
di
s
c
l
o
ses
decry
p
t
i
on
key
s
t
o
a
u
t
h
ori
z
e
d
u
s
er
s, t
h
us
una
ut
h
o
r
i
zed
u
s
ers a
n
d
t
h
e cl
ou
d se
r
v
er ca
n
not
dec
r
y
p
t
.
B
u
t
o
u
r
p
r
op
ose
d
sc
hem
e
can hel
p
t
h
e i
n
f
o
r
m
at
i
o
n
hol
der to
realize fine
-graine
d
access control
of the cl
oud
da
ta.
4.
3.
2.
Fully
Co
llusion
Secure
The sc
hem
e
is fully collusion
secure
whe
n
us
ers
co
llud
e
. M
o
r
e
ov
er
, sin
c
e
th
e cloud
an
d
u
s
er
s
d
o
no
t
have t
h
e
pri
v
at
e key
s
for
una
ut
h
o
r
i
zed
dat
a
, t
h
ey
are
una
ware o
f
any
i
n
fo
rm
at
ion i
n
re
ga
rds
t
o
t
h
e
una
ut
h
o
r
i
zed
d
a
t
a
, eve
n
i
f
t
h
e
y
col
l
ude
eac
h
ot
he
r. T
h
e
r
ef
or
e, sc
hem
e
achi
e
ves
ful
l
y
col
l
usi
o
n sec
u
re.
4.
3.
3.
Retr
ogressive
secrecy
Retrogressi
ve secrecy can be rea
lized
in
th
e pr
opo
sed
sch
e
m
e
. Th
at i
s
, th
e u
s
er
w
h
o
is r
e
vo
ked
cannot dec
r
ypt
the inform
ation
whic
h
was
pre
v
iously abl
e
to be access
e
d. Sc
hem
e
will update pa
rt of the
ci
phe
r t
e
xt
C
(
1
,
x) aft
e
r som
e
l
e
gi
t
i
m
a
t
e
users are re
v
oke
d
.
Si
nce C
(
1
, x
)
, whi
c
h de
pe
nd
s on t
h
e ra
nd
o
m
s, i
s
recalculated a
n
d not sent to the re
voke
d use
r
, the re
voke
d
user is not abl
e
to recover
an
d dec
r
y
p
t
th
e m
e
ssag
e
.
Th
erefo
r
e, th
e sch
e
m
e
is with
retrogre
ssive
secrecy, the e
x
isting wo
rks
,
and t
h
e information
need
s t
o
re-
d
i
s
t
r
i
but
e key
s
f
o
r n
o
n
-re
v
oke
d
users t
o
guara
n
tee retrogress
i
ve secr
ecy. T
h
e re
distribution
will
d
i
sclo
se
u
s
ers’
p
r
i
v
ate k
e
y t
o
t
h
e cloud
an
d ad
d add
itio
nal co
mm
u
n
i
catio
n
co
st.
4.
3.
4.
User
access
pr
ivilege c
o
nfide
n
tiality
Th
e
p
r
op
o
s
ed
sch
e
m
e
d
o
e
s
no
t d
i
sclose an
y
attr
ib
u
t
e
o
f
a
u
s
er attr
ib
u
t
e
set to
th
e cloud serv
er
s. In
our key
gene
ration algorithm
,
users’ access struct
ures
a
nd
pri
v
ate key
s
are assi
gned by the
information
h
o
l
d
e
r. Th
u
s
, t
h
e cloud
h
a
s no
clu
e
abo
u
t
user
s’
pr
iv
ate
keys an
d
do
es
no
t po
ssess an
y
P
r (i, u)
. There
f
ore, the
cloud cannot deri
ve any use
r’s access
privilege inform
ati
on s
o
that
use
r
s’
pri
v
acy is protected a
g
ainst the
clo
u
d
.
Mor
e
o
v
er
, in
u
s
er
r
e
vo
catio
n
and
attr
ib
u
t
e ch
ang
e
sch
e
m
e
s, it’
s n
o
t
n
ecessar
y
to
up
d
a
te th
e non
revok
ed users’ secret
k
e
ys. Th
e cl
o
u
d
will tran
sm
it th
e n
e
w C
1, x
an
d C
0
t
o
no
n-
re
vo
ke
d
use
r
s.
Acc
o
rdi
n
g
t
o
the above a
n
alysis, see that t
h
e
propose
d
s
c
hem
e
can
achiev
e
th
e
d
e
sired
secu
rity requ
irem
en
ts, i.e., fin
e
-
grai
ned access
control, coll
usion re
si
stance
, and
retrogres
s
ive secrecy. Fu
rt
herm
ore, the inform
ation hol
der
and
use
r’s i
d
e
n
tity is public
in this schem
e
, but it is
suppose
d
to be hidden unde
r som
e
circu
m
stances.
Th
ou
g
h
i
t
m
i
ght
i
n
c
r
ease s
o
m
e
l
o
cal
com
put
at
i
on;
i
t
doe
s n
o
t
si
gni
fi
cant
l
y
augm
ent
t
h
e ove
r
h
ead o
f
com
put
at
i
on a
n
d
o
f
c
o
m
m
uni
cat
i
on.
5.
RESULT AND DIS
C
USSI
ON
In t
h
i
s
sect
i
o
n
,
t
h
e pe
rf
o
r
m
a
nce o
f
pr
op
os
ed sc
hem
e
i
s
anal
y
zed
by
com
p
ari
ng
wi
t
h
ot
he
r dat
a
shari
ng sc
hem
e
s t
h
at
rel
y
on
C
P
AB
E.
W
e
eval
uat
e
t
h
e c
o
m
put
at
i
on and
com
m
uni
cat
i
on o
v
er
hea
d
, a
n
d o
u
r
pr
o
pose
d
sy
st
e
m
wi
ll
gi
ve
det
a
i
l
descri
pt
i
o
n
abo
u
t
t
h
e
ci
p
h
e
r
t
e
xt
si
ze i
n
t
h
e p
r
o
p
o
sed
sc
h
e
m
e
.
5.
1.
Co
mputatio
na
l complex
i
ty
Analyze the c
o
m
putation
overhea
d
of the
propo
sed sc
he
m
e
according to the
enc
r
yption a
n
d
decry
p
t
i
on al
g
o
ri
t
h
m
s
i
n
t
h
i
s
sect
i
on.
I
n
t
h
e
pr
o
pose
d
sc
he
m
e
, t
h
e m
a
i
n
com
put
at
i
on
op
erat
i
ons i
n
vol
v
e
d i
n
encry
p
t
i
on a
n
d
decry
p
t
i
o
n al
go
ri
t
h
m
s
are pai
r
i
ng a
nd s
cal
ar m
u
ltiplication. Recall
th
at th
e sch
e
m
e
c
h
oo
ses
ellip
tic cu
rv
e g
r
o
u
p
s
G1
an
d
G2
o
f
ord
e
r q. Th
e cip
h
e
r tex
t
o
f
th
e
p
r
op
o
s
ed
sch
e
me is Y
. Pai
r
i
n
g i
s
t
h
e
m
o
st
expens
i
v
e ope
rat
i
o
n.
For eac
h di
f
f
e
rent
fi
l
e
, h
o
w
eve
r
,
i
n
f
o
rm
at
i
on ho
l
d
er an
d use
r
s
onl
y
nee
d
t
o
ca
l
c
ul
at
e e (g1,
g
1
)
once i
n
t
h
e
begi
nni
ng
. Si
n
ce bot
h t
h
e pr
o
pos
ed
schem
e
and KP-AB
E
base
d schem
e
s have t
h
e sam
e
num
be
rs
of pai
r
i
n
g
operat
i
on
, do
not
i
n
vol
ve i
n
pai
r
i
n
g
ope
rat
i
o
n
ove
r
h
ead
w
h
e
n
c
o
m
put
at
i
on com
p
l
e
xi
t
y
o
f
t
h
e
p
r
o
p
o
sed
sc
hem
e
com
p
ares
wi
t
h
t
h
e
KP-
A
B
E
base
d
schem
e
s. In the com
putation com
p
lexity analysis, it
takes account of scalar m
u
lt
iplication ope
ration. During
encry
p
ting, all encryption
op
eratio
n
s
are at th
e in
fo
rm
atio
n
ho
ld
er sid
e
.
Th
e inform
atio
n
ho
ld
er n
e
ed
s to
do
two
scalar m
u
ltip
licatio
n
s
to
calcu
late C1
, x, on
e scalar m
u
ltip
licatio
n
for
an
d
on
e fo
r
C
3
,
x
fo
r eac
h
ro
w i
n
LSSS
m
a
t
r
i
x
. There
f
ore,
t
h
e
i
n
f
o
rm
at
i
on h
o
l
der
nee
d
s at
m
o
st
scalar m
u
lt
ip
licatio
n
s
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
SN
:
2
088
-87
08
IJEC
E
V
o
l
.
6,
No
. 3,
J
u
ne 2
0
1
6
:
91
5 – 9
2
4
92
2
0
1
2
3
4
5
6
7
8
10
20
30
40
CP
‐
CB
E
KP
‐
ABE
Y
Fi
gu
re
3.
The
ove
r
h
ead
o
f
ke
y
gene
rat
i
o
n al
go
ri
t
h
m
s
The com
putation c
o
m
p
lexity
of in
form
ation hol
der c
o
nve
r
t the access structure to a
n
LSSS m
a
trix is
where
the num
ber of attributes about the a
ccess stru
ct
ure
.
Th
us,
t
h
e c
o
m
put
at
i
on com
p
l
e
xi
t
y
o
f
encry
p
tion is
in
th
e d
ecry
p
tio
n
stag
e, th
e decryp
tion
op
eratio
n
is si
m
ila
r on
ly fo
r
u
s
ers. To
recov
e
r
ci
phe
r t
e
xt
,
t
h
e use
r
need
s at
m
o
st
anot
her
scalar
m
u
ltip
licati
o
n
s
to
cal
cu
late
, so
th
e tim
e c
o
m
p
lex
ity is al
so
. The
com
put
at
i
on c
o
m
p
l
e
xi
t
y
of C
P
-
C
B
E
an
d
KP-
A
B
E
-
b
ase
d
sc
hem
e
s i
s
gi
ven
i
n
Ta
bl
e1
.
0
2
4
6
8
10
12
10
20
30
40
CP
‐
CB
E
KP
‐
AB
E
X
Ti
m
e
Y
Fi
gu
re
4.
The
ove
r
h
ead
o
f
e
n
cry
p
t
i
o
n s
p
eed
Table
1. C
o
m
putation c
o
m
p
lexity require
d
i
n
pre
v
ious sche
m
e
s
and
use
r
access
policy
Sche
m
e
Encryption
(Info
r
m
a
tio
n
ho
l
d
er)
Decryption
(User)
KP
-CB
E
CP- CBE
5.
2.
Rev
o
c
a
ti
on C
o
st
Whe
n
use
r
re
vocat
i
o
n i
s
re
qui
red
,
t
h
e
ci
p
h
er
t
e
xt
needs
t
o
be r
e
-e
ncr
y
pt
ed i
n
o
u
r
s
c
hem
e
. The
inform
ation holder
will choose a ne
w see
d
s random
l
y an
d recalc
u
late C0 and C
1
,
x. suppose t
h
e revoke
d
user i
s
Uu
. P
a
i
r
i
ng
(e (
g
1
,
g1
))
has be
e
n
cal
cul
a
t
e
d,
so
th
e informatio
n
ho
ld
er
only needs
one
scalar
m
u
ltiplication to recalculate
C0. For eac
h at
tribute
x
Iu
, there are an
o
t
h
e
r two
scalar m
u
ltip
licatio
n
s
to
up
d
a
te C
1
,
x
.
Th
erefo
r
e, th
ere are to
tally
scal
ar m
u
l
tipl
i
cat
i
ons t
o
re
-enc
ry
pt
t
h
e ci
phe
r t
e
xt
b
y
t
h
e i
n
f
o
rm
ati
on
hol
der.
F
o
r t
h
e
no
n-
re
vo
ke
d
users
,
t
h
ey
d
o
not
nee
d
t
o
do
any
c
o
m
put
at
i
on. M
o
re
o
v
e
r, t
h
e
inform
ation holder
nee
d
s to s
e
nd the
ne
w ci
phe
r te
xt to
t
h
e cloud, while
the cloud
just
replaces the
out
d
ated
cip
h
e
r tex
t
and d
o
e
s
no
t n
e
ed
to
tran
sfer it to th
e no
n
-revo
ked
u
s
ers,
so
t
h
e ad
d
ition
a
l commu
n
i
catio
n
co
sts is
X T
I
ME
Evaluation Warning : The document was created with Spire.PDF for Python.
I
J
ECE
I
S
SN
:
208
8-8
7
0
8
Cloud Security
in
Cry
p
t
Databas
e Server Us
ing Fi
ne
Gr
ained Acces
s Cont
rol (Krishna Keerthi C.)
9
23
Data. Co
m
p
ared
with
p
r
o
p
o
s
ed
sch
e
m
e
, th
is b
r
ing
s
an
ab
und
an
ce o
f
add
itio
nal
com
put
at
i
on a
n
d
com
m
uni
cat
i
on
ove
r
h
ead
.
The
pr
o
p
o
s
ed
schem
e
can ac
com
p
l
i
s
h t
h
i
s
dy
nam
i
c reque
st
wi
t
h
l
i
ght
wei
g
ht
c
o
m
put
at
i
on com
p
l
e
xi
t
y
.
Fi
gu
re 5.
The
ove
r
h
ead
o
f
de
cry
p
t
i
o
n
al
g
o
r
i
t
h
m
6.
CO
NCL
USI
O
N
In t
h
i
s
pa
per
,
a pri
v
acy
-
pres
ervi
ng an
d sec
u
re i
n
fo
rm
at
i
o
n sha
r
i
n
g sche
m
e
i
n
cl
oud com
put
i
ng b
y
expl
oi
t
i
ng C
P
-
AB
E an
d c
o
n
s
ol
i
d
at
i
ng i
t
wi
t
h
m
e
t
hod o
f
C
B
E i
s
di
spl
a
y
e
d. T
h
e
pr
op
ose
d
sch
e
m
e
guar
a
nt
ees
fine-grained data access cont
rol,
retrogressi
ve secrecy
and security agains
t collusion of
us
ers with
the cloud
and s
u
p
p
o
rt
s cl
i
e
nt
expa
nsi
o
n,
deni
al
and cha
r
act
eri
s
t
i
c
al
t
e
rat
i
ons. B
e
si
des
,
pr
op
ose
d
sch
e
m
e
does not
u
nvei
l
any ele
m
ents of
use
r
s to the
cloud
s
o
that
it keeps the
privacy of t
h
e
users away from th
e cloud. Security
an
alysis d
e
m
o
n
s
trates t
h
at the p
r
op
osed sche
m
e
is se
m
a
n
t
i
cally secu
red in
th
e non
sp
ecific b
ilin
ear g
a
t
h
eri
ng
m
odel
,
m
odel
i
ng
H as a rand
om
oracl
e. Li
kewi
se,
acc
ess the execut
i
on of the
p
r
o
pos
ed sc
hem
e
abo
u
t
com
put
at
i
on c
o
m
p
l
e
xi
t
y
. The resul
t
dem
onst
r
at
es t
h
at
t
h
e p
r
op
ose
d
s
c
hem
e
i
s
l
o
w ove
r
h
ead a
n
d
hi
g
h
l
y
efficien
t. Em
u
l
atin
g
th
e flow research
, it will i
m
p
l
e
m
en
t th
e p
r
opo
sed
p
r
i
v
acy- preserv
i
n
g
an
d
effective clo
u
d
inf
o
rm
ation sh
arin
g se
rvice i
n
a
real CSP
pl
atform
fo
r
fut
u
re
wo
rk
.
ACKNOWLE
DGE
M
ENTS
I t
h
a
n
k t
o
m
y
Gui
d
e a
n
d
t
h
e
Or
ga
ni
zat
i
on
wh
o s
u
pp
o
r
t
e
d
m
e
t
o
pu
bl
i
s
h
m
y
wor
k
i
n
y
o
u
r
j
o
ur
nal
.
REFERE
NC
ES
[1]
M.
Armbrust,
et al.
, “Above th
e
clouds: a B
e
rkeley
v
i
ew of cloud
computing [Technical re
port]
,” Berkeley
, EECS
Department, University
of
Califo
r
nia, 2009.
[2]
Erwa
y C.
,
et al.
, “D
y
n
amic pro
v
able data possession,” in
Proceedings of the 16
th AC
M
conference on
computer
and communications security (
CCS)
, ACM, 2006, pp
. 213e22
.
[3]
Goy
a
l V.,
et a
l
.
, ”Attribute-based encr
y
p
tion for
fine-grain
ed
access control of encr
y
p
ted data,” in
Pr
oceedings
o
f
the 13
th ACM
co
nference on
com
put
er and
communications
secur
ity (
CCS)
, 2006.
[4]
Boneh D.,
et a
l
.
,
“
H
ierarchi
ca
l id
entit
y
based
encr
ypt
i
on
with
cons
tant size
ciph
er text,” in
Advan
c
e
s
in Cryptolog
y
,
eEUROCRYPT, Springer, 2009.
[5]
Betten
c
ourt J.
,
et al.
, “
C
iphert
ex
t-polic
y
at
tri
bute based encr
y
p
tio
n,” in
I
E
EE Sym
posium on security and privacy
(S
P
)
,
IEEE, 200
7, pp
. 321e34
.
[6]
Sa
ha
i A.,
et
al
.
,
“
F
uzz
y
ident
i
t
y
-
b
as
ed en
cr
ypt
i
o
n
. In:
Advanc
es
in cr
yp
tolog
y
,
”
i
n
EUROCR
YPT
, Springer, 2005,
pp. 557e73
.
[7]
Ostrovsky
R
., “
A
ttribute-based
encr
y
p
tion
with non-monotonic access
structures
,”
in
Proceeding
s of the 14
th
AC
M
conferen
ce on
computer and
co
mmunications security (
CCS)
,
2007, pp
. 195e203
.
[8]
M
u
¨
l
l
e
r S
.
, “
D
i
s
tributed
at
tribu
t
e-bas
e
d
en
cr
ypt
i
on,”
in
Information security a
nd crypto
logy (
I
CISC)
,
Springer,
2009.
[9]
Chase M., “
M
ulti-autho
r
it
y a
ttr
i
bute based encr
ypt
i
on,
” in
Theory of cryptography (
T
CC
)
,
Springer, pp. 515e34
,
2007.
[10]
Lewko A.
and
W
a
ters B.
, “
D
ec
entra
liz
ing attrib
ute-based
encr
yption,” in
Advan
ces
in Cr
yp
tolog
y
EUROCR
YPT
,
Springer, 2011
,
pp. 568e88
.
[11]
Y
u
S
.,
et al.
,
“
A
chieving s
e
c
u
re, s
c
al
able
,
a
nd fine-gr
a
ined
data access cont
rol in
cloud
computing,” in
International co
nference on
co
m
puter communications (
I
NFOCOM)
,
IEEE, 2010
, pp. 1e9.
[12]
S
.
D
.
C
.
d
i
V
i
m
e
r
c
a
t
i
,
et al.
, “Over-encr
y
p
tion:
manageme
nt of access control evolu
tion on outs
ourced data,” in
ACM
, 2007
.
[13]
Sam
a
rati P. and
De Capitan
i
di
Vim
e
r
cati S
.
, “
D
ata prot
ect
ion
in
outsourcing scenar
ios: issues and directions,”
in
Proceed
ings of
the 5th
ACM S
y
mposium on in
formati
on, com
puter and com
m
unications sec
u
rity (
A
SIACCS
)
,
ACM, 2010, pp
.
1e14.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
SN
:
2
088
-87
08
IJEC
E
V
o
l
.
6,
No
. 3,
J
u
ne 2
0
1
6
:
91
5 – 9
2
4
92
4
BIOGRAP
HI
ES OF
AUTH
ORS
Krishna Keerth
i Chennam obtained Bachelor
'
s
de
gree in
computers science en
gineer
ing from
JNTU, Hy
d
e
rab
a
d in 2005, received the Master
s
Degree in
Embedded S
y
stems from JNTUH, in
2012 and pursuing PhD in CSE
from Gitam Uni
v
er
sity
, H
y
der
a
b
a
d campus. Res
earch
inter
e
sts
includ
e Cloud
Computing, Cloud security
.
Curre
ntly
work
ing as Assistant Professor in
Computer Scien
ce & Eng
i
neering Department
at Muffakham Jah Colleg
e
of
Engineering &
Techno
log
y
,
Ba
njarah
ills,
and
Hyder
a
bad
.
Dr.M.Akkalaksh
m
i received Ph
D from Osmania Un
iversity
in
2008. Her r
e
s
earch
focus in
Network Security
, C
l
oud Computing, Cloud Securi
ty
, B
i
g Data. She is presently
working as
Professor and IT-HOD in Gitam University
,
H
y
de
rabad Campus.
She is th
e author of several
research
pap
e
rs in the ar
ea of
Network Security
and Cloud
computing.
Evaluation Warning : The document was created with Spire.PDF for Python.