A Key-revocable Attribute-based Encryption

for Mobile Cloud Environments

Tsukasa Ishiguro, Shinsaku Kiyomoto and Yutaka Miyake

KDDI R&D Laboratories Inc. 2-1-15 Ohara, Fujimino, 356-8502 Saitama, Japan

Keywords:

Attribute-Based Encryption (ABE), Access Control, Cloud Computing, Key Revocation, Mobile Cloud.

Abstract:

In this paper, we propose a new Attribute-Based Encryption (ABE) scheme applicable to mobile cloud environ-

ments. A key issue in mobile cloud environments is how to reduce the computational cost on mobile devices

and delegate the remaining computation to cloud environments. We also consider two additional issues: an

efﬁcient key revocation mechanism for ABE based on a concept of token-controlled public key encryption,

and attribute hiding encryption from a cloud server. To reduce the computational cost on the client side, we

propose an efﬁcient ABE scheme jointly with secure computing on the server side. We analyze the security of

our ABE scheme and evaluate the transaction time of primitive functions implemented on an Android mobile

device and a PC. The transaction time of our encryption algorithm is within 150 msec for 89-bit security and

about 600 msec for 128-bit security on the mobile device. Similarly, the transaction time of the decryption

algorithm is within 50 msec for 89-bit security and 200 msec for 128-bit security.

1 INTRODUCTION

1.1 Background

Commercial social network services (SNS) and doc-

ument management systems have been launched in

cloud environments (Google, 2012; Amazon, 2012),

and outsourcing the services of an enterprise system

has come to be considered a potential application

for cloud computing. NIST deﬁnes cloud comput-

ing as (NIST, 2009): “Cloud computing is a model

for enabling convenient, on-demand network access

to a shared pool of conﬁgurable computing resources

(e.g., networks, servers, storage, applications, and

services) that can be rapidly provisioned and released

with minimal management effort or service provider

interaction. ” Cloud computing is becoming more

common and widespread, and it provides several ben-

eﬁts for both cloud service providers and their users.

Here, we look at a data storage service, which

is one of the most common services for cloud envi-

ronments, and consider a situation where a company

stores their data by utilizing the storage service. It

can be assumed that company personnel need to ac-

cess the data using their mobile devices. The system

consists of an outsourcing database in a cloud envi-

ronment and mobile devices. This situation is called

a “mobile cloud environment”.

Security risks associated with cloud environments

are of increasing concern(Cloud Security Alliance,

2009; European Network and Information Security

Agency, 2010). If the cloud service is vulnerable or

the cloud provider has a malicious/curious adminis-

trator, the private information of users and corporate

conﬁdential information is at risk of being leaked.

Furthermore, a ﬁne-grained access control mecha-

nism is needed whenever a database on a cloud ser-

vice is shared by users and an access policy is deﬁned

for each role of users. Accordingly, if we consider

this situation, which is one of the most common sit-

uations for a cloud environment, it can be assumed

that data encryption and access control are mandatory

functions.

Attribute-based encryption (ABE) schemes are an

efﬁcient solution to realize both functionalities: en-

cryption and ﬁne-grained access control. Sensitive

user data are encrypted according to an access pol-

icy in ABE schemes, and a user cannot decrypt the

data if the user does not have an access right satis-

fying the access policy for the data. Generally, the

access policy can be described by user’ attributes,

e.g. afﬁliations and roles. The computational cost of

ABE schemes is still huge in practical terms because

it increases markedly as the number of attributes de-

scribed in the access policy increases. We focus on

the mobile cloud environment and consider accesses

Ishiguro T., Kiyomoto S. and Miyake Y..

A Key-revocable Attribute-based Encryption for Mobile Cloud Environments.

DOI: 10.5220/0004505300510061

In Proceedings of the 10th International Conference on Security and Cryptography (SECRYPT-2013), pages 51-61

ISBN: 978-989-8565-73-0

 2013 SCITEPRESS (Science and Technology Publications, Lda.)

from mobile devices. In the mobile cloud environ-

ment, the computational cost on mobile devices be-

comes problematic in practice. Another issue con-

fronting ABE is key revocation. The system needs to

manage the revocation of users since mobile devices

are easily lost or stolen.

1.2 Related Works

Attribute-based encryption (ABE) has been exten-

sively researched as a cryptographic protocol (Sahai

and Waters, 2005; Bethencourt et al., 2007; Hinek

et al., 2008; Lewko et al., 2010). In Ciphertext-Policy

ABE (CP-ABE) systems (Bethencourt et al., 2007), a

user encrypts data with descriptions of an access pol-

icy. The access policy deﬁnes authorized users, and

their statements consisting of attributes and logical

relationships such as AND, OR, or M of N (thresh-

old gates); for example, users who have the attributes

“Project manager” and “Administration department”

can access the data, of which the access policy is de-

ﬁned as “Project manager ∧ Administration depart-

ment”. The mechanism can prevent a cloud service

provider or an adversary from accessing the secret

information. Another type of ABE is a Key-Policy

ABE (KP-ABE) (Goyal et al., 2006). In KP-ABE, a

user’s personal key corresponds to a combination of

attributes “Project manager ∧ Administration depart-

ment”.

Generally, ABE schemes require huge computa-

tions such as many pairing computations. Several pa-

pers have been published that deal with the imple-

mentation of pairing computations on different de-

vices (Beuchat et al., 2010; Scott, 2011; Aranha et al.,

2010; Naehrig et al., 2010). As shown in these papers,

one pairing computation can be completed in less than

a few milliseconds on a current PC. However, more

computation time is required on other devices that

have less computational power, such as smartphones.

Furthermore, the computational power of the ABE

mechanism increases appropriately as the number of

attributes increases.

Some papers have proposed schemes to remove

heavy computations from a mobile device (Zhou and

Huang, 2011; Green et al., 2011) and delegate them

to cloud servers at a remote site. In (Zhou and Huang,

2011), Zhou et al. divided the encryption step into

two parts, a mobile device part and a cloud server

part. For the ﬁrst part, the mobile device encrypts

data in a constant time; the transaction time of the

ﬁrst encryption function does not depend on the num-

ber of attributes. For the second part, the cloud server

can operate the second encryption function without

plaintext information; no information is revealed to

the cloud server. In the same way, they also divide

the decryption step into two parts. The Zhou et al.

scheme has no key revocation mechanism; thus, this

is an open issue for ABE in mobile cloud environ-

ments. Furthermore, they did not present sufﬁcient

security analyses for their ABE scheme.

Another solution for mobile cloud environments is

outsourcing decryption processes (Green et al., 2011;

Goyal et al., 2006; Waters, 2011) using a proxy server.

A user has a translation key TK along with a secret

key. The user sends the TK to a proxy server, for the

decryption process on the proxy server. An ElGamal-

style ciphertext for the decryption process is used to

avoid revealing any part of a message. The decryption

step is similar to ElGamal decryption, and the compu-

tational cost of decryption imposed on a mobile de-

vice can be reduced by delegating some of the pro-

cesses of decryption to the proxy server, even though

the cost for encryption is still heavy.

From the viewpoint of key management, a revoca-

tion mechanism is also required. However, no key

revocation mechanisms can be found in the litera-

ture for the Zhou et al. scheme(Zhou and Huang,

2011). Some papers have proposed schemes to re-

voke an unauthorized user (Baek et al., 2005; Galindo

and Herranz, 2006; Sadeghi et al., 2010). Token-

controlled public key encryption (TCPKE) is a pub-

lic key encryption scheme in which an entity cannot

decrypt an encrypted message until the entity obtains

additional information called a “token”. Beak et al.

introduced this concept and a concrete algorithm in

(Baek et al., 2005). Galindo et al. formalized a nat-

ural security goal for TCPKEs and proposed an im-

proved TCPKE. Some TCPKE schemes (Galindo and

Herranz, 2006; Sadeghi et al., 2010) exist, but no

schemes directly applicable to mobile cloud environ-

ments have been fully discussed.

1.3 Our Contributions

In this paper, we propose a key-revocable ABE

scheme for a mobile cloud environment, which real-

ize the following functionalities:

•

• User Revocation. Our scheme is based on the

concept of the ABE scheme proposed by Zhou et

al. and achieves efﬁcient key revocation by intro-

ducing a new entity, the Token Service Provider

(TSP). The TSP distributes a “token” to a valid

user when the user requests decryption of a ci-

phertext. However, when the user is unauthorized,

the TSP does not return a valid token, which re-

vokes the user.

SECRYPT2013-InternationalConferenceonSecurityandCryptography

• Attribute Hiding. We realize attribute informa-

tion hiding from a cloud server. The user termi-

nal executes a few computations in order to mask

attribute information.

Furthermore, we optimize the ABE scheme and show

that the scheme is applicable to a current mobile cloud

environment. We evaluate transaction time using an

Android mobile device and a PC, and discuss the fea-

sibility of our scheme. Security analyses based on

four security requirements are presented in this paper.

2 PRELIMINARY

In this section, we deﬁne some notations used in our

scheme.

Deﬁnition 1 (Bilinear Pairing e). Let G

and G

two multiplicative cyclic groups of prime order p. Let

g ∈ G

be the generator of G

and e be a bilinear

map e : G

× G

→ G

. The bilinear map e has the

following properties:

• Bilinearity: ∀u,v ∈ G

,a,b ∈ Z

,e(u

) =

e(u,v)

• Non degeneracy: ∀u ∈ G

,e(u,u) 6= 1

Deﬁnition 2 (Monotone Access Structure). Let

,··· ,P

} be a set of partiesD A collection A =

,···,P

}

is monotone if ∀B,C : if B ∈ A and B ⊆

C, then C ∈ AD An access structure is a collection

A of non-empty subsets of {P

,· · · ,P

}, i.e., A ⊆

,···,P

}

\ {φ}. Sets contained in A are called au-

thorized sets and the sets not in A are called unautho-

rized sets.

Deﬁnition 3 (Access Tree). Let T be an access tree

representing an access structure. Each non-leaf node

of the tree represents a threshold gate, which deﬁnes

a required condition in the child nodes. If a node x is

a non-leaf node of the tree and has num

children and

is its threshold value, then 0 < k

≤ num

. When

= 1, it is an OR gate and when k

= num

, it is an

AND gate. Each leaf node x of the tree is described

by an attribute and a threshold value k

= 1. This ac-

cess structure satisﬁes the conditions for a monotone

access structure.

In this paper, we use functions to describe an

access tree. Child nodes of every node are num-

bered from 1 to num in the access tree. The function

index(x) returns the number of the node x, and att(x)

denotes the attribute associated with the leaf node x in

the tree. The function f(S,W) returns 1 if and only if

a set of attributes S satisﬁes an access policyW, other-

wise it returns 0. We denote the number of attributes

in a tree T by |T |.

"#$

(1) Encrypt

Usr

"#$

(2) Encrypt

Srv

"#$

&',

(

)

(2) GetToken

&',

(

)

(4) Decrypt

Srv

*$+

(3) GetMaskKey

*$+

(5) Decrypt

Usr

/ !

Encryption Decryption

User

CSP

TSP

CSP

User

(1) GetCoupon

(

)

(

/ 0

,-/ !

0/ !

*$+

Figure 1: Outline of Encryption and Decryption Steps.

We assume that the following four prob-

lems(CDH, DDH, BDH, DBDH) are hard in our

scheme:

Deﬁnition 4 (Computational Difﬁe-Hellman Prob-

lem(CDH)(Boneh, 1998)). G denotes a group of a

prime order p. Let choose a,b ∈ Z

at random, and

given g,g

. The CDH is to compute g

Deﬁnition 5 (Decisional Difﬁe-Hellman Prob-

lem(DDH)(Boneh, 1998)). G denotes a group of a

prime order p. Let choose a, b, c ∈ Z

at random, and

given g

, and g

. The DDH is to determine

whether (g

) = (g

Deﬁnition 6 (Bilinear Difﬁe-Hellman Prob-

lem(BDH)(Boneh and Franklin, 2001; Joux, 2004)).

Given g,g

, g

for some a,b,c ∈ Z

, the BDH is

to compute e(g,g)

abc

Deﬁnition 7 (Decisional Bilinear Difﬁe-Hellman

Problem(DBDH)(Boneh and Franklin, 2001)). Let

and G

denotes a group of a prime order p. Let

choose a,b,c ∈ Z

at random and g

∈ G

and given g

, and e(g

)

, where {i, j,k} ∈

{(1,1,1),(1,1,2),(1,2,2),(2,2,2)}. The DBDH is to

determine whethere(g

)

abc

= e(g

)

3 OUR SCHEME

In this section, we explain our key-revocable ABE

scheme for a mobile cloud environment.

3.1 Deﬁnition

Our scheme consists of nine algorithms Setup, Key-

Generation, Encrypt

Usr

, Encrypt

Srv

, Decrypt

Usr

Decrypt

Srv

, GetCoupon, GetToken, GetMask Key.

There are four entities in our scheme: User, Trusted

Key Generator (TKG), Cloud Service Provider (CSP),

and Token Service Provider (TSP). The TSP is

adopted to realize a key revocation mechanism. An

overview of the encryption and decryption steps in

our scheme is shown in Figure 1.

AKey-revocableAttribute-basedEncryptionforMobileCloudEnvironments

Before the encryption and decryption steps, the

TKG generates a public key and users’ private keys by

running two algorithms, Setup and KeyGeneration,

and the TKG securely distributes the keys to users.

The TKG also sends IDs and related information such

as a terminal-ID to the TSP.

In the encryption step, the user ﬁrst decides on a

ciphertext policy and runs Encrypt

Usr

to compute a

temporal ciphertext, then the user sends the temporal

ciphertext and the ciphertext policy to the CSP. As the

second encryption step, the CSP runs Encrypt

Srv

calculate a complete ABE ciphertext.

In the decryption step, the user runs Get-

MaskKey, and sends a query to the TSP to obtain

a token. The TSP checks whether the user is not

revoked, and returns a token to the user by running

GetToken. Note that the GetCoupon is assumed to

be securely computed on the TSP and the user can-

not compute an invalid ciphertext coupon to use an

altered terminal-ID. Thus, the validity of the terminal-

ID is ensured in our scheme. Next, the user requests

the CSP to run Decrypt

Srv

and the user receives a par-

tial ciphertext from the CSP, provided the user has at-

tributes that satisfy the ciphertext policy. Finally, the

user runs Decrypt

Usr

to obtain a plaintext from the

partial ciphertext.

The nine algorithms are denoted as follows;

• Setup(λ,n) → (PK, MK).

The algorithm receives a security parameter λ and

the number of possible attributes n as an input,

and it outputs two keys: a system public key PK

and a master key MK.

• KeyGeneration(MK,PK,S

) → (ID

, SK

Let S be a group of all possible attributes in the

system. A master key MK, a public key PK, the

attributes S

∈ S of the user u, and a terminal-ID

of the user are input to the algorithm. The al-

gorithm outputs a user’s ID ID

, a secret key SK

of the user and token data

• Encrypt

Usr

(PK,M,W) → CT

Usr

The algorithm takes a public key PK, a plaintext

message M, and a decryption policy W as input,

and outputs a temporal ciphertext CT

Usr

• Encrypt

Srv

(PK,W,CT

Usr

) → CT.

From input of data, a public key PK, a decryption

policy W and a user-side ciphertext CT

Usr

, the al-

gorithm outputs a complete ABE ciphertext CT.

• GetCoupon(

C) →

From input a

C, the algorithm returns a ciphertext

coupon

• GetToken(ID

)→ T or ⊥.

A user ID ID

and a ciphertext coupon

are in-

put to the algorithm, and the algorithm outputs a

token T if the user’s ID ID

is not revoked, other-

wise the algorithm outputs ⊥.

• GetMaskKey(SK

,T,b

) → (

The algorithm computes a masked secret key

and a masked value t

from input of a secret key

and a token T.

• Decrypt

Srv

(

,CT) → CT

Srv

The algorithm receives a masked secret key

and a ciphertext CT, and outputs a partial cipher-

text CT

Srv

• Decrypt

Usr

(CT

Srv

,T) → M.

From input of a masked value t

and a partial ci-

phertext CT

Srv

and a token T, the algorithm out-

puts a plaintext M.

3.2 Security Requirements

Our scheme must satisfy the following three require-

ments similar to existing schemes:

• Plaintext Conﬁdentiality. No information about

plaintext is leaked to any adversary including a

malicious operator for a cloud service provider.

Even if all cloud servers collude after correct key

distribution, they are not able to obtain informa-

tion about plaintext.

• Unclonability. The scheme must satisfy unclone-

ability of private keys in order to prevent unautho-

rized use of the private keys. When a malicious

user copies her private key and provides the copy

to another user, the private information of the ma-

licious user is leaked. It implies that private key

cloning by a malicious user is suppressed due to

the violation of the user’s privacy. Thus, a mali-

cious user would not clone the private key.

• Privacy Preserving. A terminal-ID b that is a

unique identiﬁer of a user should be protected,

where a temporal identiﬁer of the user ID

leaked in a cloud service.

Furthermore, the scheme satisﬁes an additional re-

quirement as follows:

• Attribute Hiding. Attribute information of a user

cannot be obtained from transaction data at a rea-

sonable cost, even if other users are compromised.

In this section, we formalize the above security

requirements.

3.2.1 Plaintext Conﬁdentiality

We deﬁne the security game for Plaintext Conﬁden-

tiality as follows;

SECRYPT2013-InternationalConferenceonSecurityandCryptography

System Setup: The challenger runs the Setup

algorithm and gives the public parameters, PK to the

adversary.

Challenge: The challenger initializes empty tables V

and L, and an empty set D. The adversary submits

two equal length messages M

and M

. In addition

the adversary gives a value W

∗

enc

. The challenger

ﬂips a random coin c, and encrypts M

under W

∗

enc

The challenger generates ID

and stores the entry

(0,r,r

) in the table V. The resulting

ciphertext CT

∗

and CT

∗

Srv

, ID

and

are given to

the adversary.

Game: The challenger sets an integer j = 0. The

game is repeated with the restrictions that the adver-

sary cannot

• trivially obtain a private key for the challenge

ciphertext. That is, it cannot issue a corrupt

query that would result in a value S

that satisﬁes

f(S

∗

enc

) = 1 being added to D.

• issue a trivial decryption queries. That is,

Decrypt

Usr

queries will be answered, except in the

case where the response would be either M

, then the challenger responds with the special

message test instead.

Proceeding adaptively, the adversary can repeat-

edly make any of the following queries:

• Create(PK, S

): The challenger sets j := j + 1,

and b

= j. It runs the KeyGeneration algorithm

to obtain SK

,ID

, and

, and then it stores a tu-

ple of j, ID

, and

in the table L. Next, it runs

the GetMaskKey algorithm to obtain the pair

(SK

) corresponding to attributes S

of a

user j, and stores the entry (j,r, r

,SK

)

in the table V. Finally, it returns to the adversary

the value j, the masked secret key

, and the ID

• Corrupt(i): If there exists an i-th entry in table V

and i 6= 0, then the challenger obtains the entry

(i,r, r

,SK

). If S

6= S

, then the chal-

lenger sets D := D∪ {S

} and returns the entry to

the adversary including the private key SK

. If no

such entry exists or S

= S

, then it returns ⊥.

• GetToken(i,

C): Note that

C is included in CT. If

i exists in the table L, then the challenger obtains

the entry (i, ID

) and returns the token T

and

to the adversary. If no such entry exists, then

it returns ⊥.

• Encrypt(i,PK,W

enc

,M): The challenger runs the

algorithms Encrypt

Usr

and Encrypt

Srv

. The

challenger then returns CT, and CT

Usr

• Decrypt

Srv

(

,CT): The challenger returns

the output CT

Srv

of the decryption algorithm

Decrypt

Srv

on input (

,CT) to the adversary.

• Decrypt

Usr

(i,CT

Srv

): If there exists an i-th en-

try in the table V, then the challenger obtains the

entry (i,r,r

,SK

), and it returns to the

adversary the output M of the decryption algo-

rithm Decrypt

Usr

on input (SK, T

,CT). If no

such entry exists, then it returns ⊥.

Guess: The adversary outputs a guess c

of c.

We should consider a security model for ABE that

supports two-stage encryption and decryption on a

client terminal and a cloud server. The general notion

of security against chosen-ciphertextattacks (CCA) is

somewhat too strong and it cannot be directly applied

to the mobile cloud environment. We thus use a re-

laxed security notion called replayable CCA security

(Canetti et al., 2003), which allows modiﬁcations to

the ciphertext but does not allow any changes to the

underlying message in a meaningfulway. The scheme

achieves Plaintext conﬁdentiality, where the scheme

satisﬁes the following deﬁnition.

Deﬁnition 8 (RCCA-secure(Green et al., 2011)).

The ABE scheme is RCCA-secure (or secure against

replayable chosen-ciphertext attacks) under the

selective-ID model, if all polynomial time adversaries

have at most a negligible advantage in the game de-

ﬁned above.

3.2.2 Uncloneability

The scheme can be achieved Unclonability where the

scheme satisﬁes the following deﬁnition.

Deﬁnition 9 (Strong Uncloneability(Hinek et al.,

2008)). A polynomial-time algorithm F exists and it

executes the GetToken oracle, the Decrypt

Srv

oracle,

and the following functions:

{GetToken,Decrypt

Srv

}

(PK,

C, i,

) =

Decrypt

Usr

,Decrypt

Srv

(i,CT),t

,GetToken(i,

C))

If an extractor algorithm χ can compute a user

identiﬁer ID and the terminal-ID b from a given

,CT,ID

C, and T by O(|B|) computation, it is

said that the ABE scheme satisﬁes Strong Unclone-

ability. Note that |B| is the domain of terminal-IDs of

all users.

3.2.3 Privacy Preserving

The scheme can achieve Privacy Preserving where

the scheme satisﬁes the following deﬁnition.

AKey-revocableAttribute-basedEncryptionforMobileCloudEnvironments

Deﬁnition 10 (Privacy Preserving(Hinek et al.,

2008)). Let MK, PK, T, S

be a master key, a pub-

lic key, a token, and all attributes of a user u. If

Pr[b

|PK,MK,ID

,T] = Pr[b

|ID

then the ABE scheme satisﬁes Privacy Preserving.

3.2.4 Attribute Hiding

The objective of an adversary A is to guess at-

tribute values embedded in a ciphertext. For the

sake of simplicity, we consider the case where an

access policy of the ciphertext includes an attribute,

without limiting the generality of the security re-

quirement. The scheme can achieve attribute hid-

ing where the scheme satisﬁes the following deﬁni-

tion. This deﬁnition is similar to a security deﬁni-

tion of password-based key-exchange protocols (Bel-

lare et al., 2000). That is, the adversary cannot engage

in off-line searching of the attribute using transaction

data.

Deﬁnition 11 (Attribute Hiding). Let q

be the num-

ber of decrypt queries. Let the size of S

be N. If the

success probability of attribute guessing by an adver-

sary A is bounded by q

/N, then the ABE scheme

satisﬁes attribute hiding.

3.3 Construction

In this section, we explain our scheme in detail.

Setup(λ) → (PK,MK). Let G

and G

be bilinear

groups of prime order p (where p is a λ bit prime),

e : G

× G

→ G

be a bilinear map, and g be a gen-

erator of G

. With randomly chosen a ∈ Z

, the sys-

tem public key PK and the system master key MK are

given by, PK = (g,e(g,g)

,e,G

),MK = g

KeyGeneration(MK, PK, S

) → (ID

, SK

)

Let H : {0, 1}

∗

→ G

be the collision-resistant hash

function. A random number r ∈ Z

and r

∈ Z

are

assigned to each attribute j ∈ S

. The decryption key

for the user-ID ID

is given by,

= (∀ j ∈ S : D

= g

· H( j)

′

= g

)

The TKG computes

= g

(a+r)

and sends (ID

)

to the TSP.

Encrypt

Usr

(PK,M,T

Usr

) → CT

Usr

. A polynomial

∈ Z

[X],deg(q

) = 1 is randomly chosen, and

s = q

(0),s

= q

(1),s

= q

(2) are calculated. Let

Y be set of leaf nodes of a T with a “DO” node. The

user calculates CT

Usr

as follows;

Usr

= (s

C = g

C = M · e(g,g)

;

∀y ∈ Y : C

= g

(0)

′

= H(att(y))

(0)

)

Encrypt

Srv

(PK,T ,CT

Usr

) → CT. Polynomials q

∈

[X] for all nodes in T without a root node and a

“DO” node are randomly chosen. The polynomials

are chosen in a top-down manner from the start node

θ which is the highest node without a root node and

a “DO” node. For each node x under θ, the degree

of each polynomial q

is assigned a value less than

the threshold value k

; for example, d

= k

− 1. For

the start node θ, a polynomial is selected to satisfy

(0) = s

. Then, for each node under θ, a polynomial

is selected to satisfy q

(0) = q

parent(x)

(index(x)) using

randomly chosen coefﬁcients without constant terms.

Let Y

be set of leaf nodes of a T without a “DO”

node. CT

Srv

is calculated as follows:

Srv

= (∀y ∈ Y

: C

= g

(0)

′

= H(att(y))

(0)

)

For Y that is the set of all leaf nodes of T , CT is

calculated as follows:

CT = (T

Srv

C;∀y ∈ Y : C

= g

(0)

′

= H(att(y))

(0)

)

GetMaskKey(SK

,T,b

) → (

). t

∈ Z

is randomly chosen and

is calculated as follows;

= (∀ j ∈ S

: D

= (g

· H( j)

)

′

= (g

)

GetCoupon(

C) →

For an input C, a ciphertext coupon

is computed

thus:

GetToken(ID

) → T or ⊥. The token server

outputs a token T = e(

) = e(g

a+r

) =

e(g,g)

s(a+r)

where the user-ID ID

is not revoked. If

not, the server outputs ⊥. In our scheme, key revoca-

tion revokes ID

and removes

from the data stored

in the TSP.

Decrypt

Srv

(

,CT

′

) → CT

Srv

. CT

′

is described as

follows:

′

= (T ,

C = M · e(g,g)

∀y ∈ Y

∪Y

: C

= g

(0)

′

= H(att(y))

(0)

)

Let ρ(ℓ) be (ℓ,parent(ℓ),parent(parent(ℓ)),··· , R) for

all ℓ ∈ T . z

ℓ

is calculated as follows:

ℓ

∏

x∈ρ(ℓ),x6=R

∆

i,S

(0),where i = index(x),

∏

x∈ρ(ℓ),x6=R

∏

j∈S

, j6=i

− j

i− j

SECRYPT2013-InternationalConferenceonSecurityandCryptography

Finally, A is calculated as:

A =

∏

ℓ∈L,i=att(ℓ)



e(D

ℓ

)

e(D

′

ℓ

)



ℓ

= e(g,g)

rst

and CT

Srv

= (A,

C) is sent to the user.

Decrypt

Usr

(CT

Srv

,T) → M. M is calculated as

follows:

Me(g,g)

· e(g,g)

(e(g,g)

s(a+r)

)

Me(g,g)

(a+r)s

e(g,g)

(a+r)s

= M

4 ANALYSIS

In this section, we analyze the security and perfor-

mance of the proposed scheme.

4.1 Security Analysis

In this subsection, we present proofs of scheme secu-

rity with regard to three security requirements: Plain-

text Conﬁdentiality, Strong Uncloneability, and Pri-

vacy Preserving.

4.1.1 Plaintext Conﬁdentiality

An objective of the adversary is to output a correct

value of c from a given ciphertext and related transac-

tion data. From the adversary’s viewpoint, challenge

plaintext M

is embedded in

C of CT

∗

Srv

. It is hard

to remove t

from A

of CT

∗

Srv

, if the BDH problem

holds. Thus, the adversary cannot obtain M

from

the ciphertext CT

∗

Srv

to execute the Decrypt

Usr

algo-

rithm in the game. The adversary cannot obtain s

and g

with feasible computational costs in the game,

and it is difﬁcult for the adversary to compute the

value of e(g,g)

. Thus, for the adversary, two cipher-

texts M

e(g,g)

and M

e(g,g)

are indistinguish-

able with non-negligible success probability. First,

we prove that our scheme has plaintext conﬁdentiality

where the decisional BDH assumption holds.

Theorem 1. Our scheme has plaintext conﬁdentiality

under the decisional BDH assumption.

Proof 1. (Sketch) Suppose that we have an adver-

sary A with a non-negligible advantage ε in the

selective-ID game against our construction. We build

a challenger B that plays the decisional BDH prob-

lem. First, the challenger takes on the BDH chal-

lenge g,g

. The challenger outputs w = 0

where Y

is guessed as Y

= (g,g)

αβ

; otherwise out-

puts w = 1. As the system setup, the challenger runs

the setup algorithm and gives PK to the adversary.

The adversary submits two messages M

and M

a challenge. The challenger ﬂips a random coin c

and make CT

∗

and CT

∗

Srv

including

C, and A:

C = g

βr

′

C = M

· e(g

βr

′

), and A = (Y

)

′

, where

′

is a randomly chosen from Z

. The two cipher-

texts CT

∗

and CT

∗

Srv

, ID

, and

are given to the

adversary. The challenger stores the tuple (0, r

′

, M

∗

, CT

∗

Srv

) in the table E. In the game, the chal-

lenger B runs the adversary A at described in 3.2.

For the KeyGeneration queries, the challenger com-

putes D

= g

αr

· H( j)

and

D = (g

αr

· g

)

1/b

for a

randomly chosen r and r

. If the Decrypt

Srv

(

,CT)

is received, the challenger obtains the entry of i = 0

and decrypts CT to obtain M. The challenger then

returns CT

Srv

= ((Y

)

′

,Me(g,g

αr

)

) and the tuple

(0, r

′

, M, CT, CT

Srv

) to the table E. The challenger

returns CT

∗

Srv

stored in the table E to the adversary,

when the adversary sends the Decrypt

Srv

(

,CT

∗

)

to the challenger. Note that the adversary cannot dis-

tinguish whether A = (Y

)

′

or A = e(g,g)

rst

except

in the case where the adversary has obtained t

. For

the Decrypt

Usr

(0,CT

Srv

), the challenger obtains M

from the table E and returns M, if the entry (0, r

′

M, CT, CT

Srv

) exists in the table E; otherwise it re-

turns ⊥. Finally, the adversary outputs c

at the guess

stage. The challenger outputs w = 0 where c

= c;

otherwise outputs w = 1. The adversary outputs a

correct bit c

= c with the non-negligible probabil-

ity ε where Y

= (g,g)

αβγ

; otherwise randomly out-

puts the correct bit with the probability 1/2. The

challenger B can play the decisional BDH game with

non-negligible advantage. This result contradicts the

assumption. Thus, the ABE scheme has plaintext con-

ﬁdentiality under the decisional BDH assumption.

Note on Collusion. The data structures of ciphertext

and a private key in our scheme are the same as those

of tk-CP-ABE proposed by Hinek et al. (Hinek et al.,

2008). Our scheme can be viewed as a variant of tk-

CP-ABE. In our scheme, the access policy consists of

two sub-trees T

and T

. T

contains only a sin-

gle attribute DO to reduce the computational cost. A

user randomly selects a 1-degree polynomial q

and

sets s = q

(0),s

= q

(1),s

= q

(2). Then, the user

sends {s

,T } to CSP. CSP cannot know q

without s

and s

. The servers get e(g,g)

αs

easily since e(g,g)

is a public parameter. A decryption server knows

e(g,g)

′

, e(g,g)

′

, e(g,g)

′

, and e(g,g)

′

through

AKey-revocableAttribute-basedEncryptionforMobileCloudEnvironments

the Decrypt

Srv

function. An encryption server has the

values s

and e(g,g)

αs

, but the values of s

and

s are in unknown. The decryption server obtains all

blinded private keys as well as the blinded private key

′

of user u

′

. Note that

′

is not a valid pri-

vate key since the

is embedded with a random

parameter t

. Since t

is the exponent of the gener-

ator g, the derivation of t

is equivalent for solving

the DLP problem that is considered to be hard. Thus,

the hardness of DLP on G

and G

are given, and

cloud servers cannot derivee(g,g)

αs

or e(g,g)

αs

even

if they collude.

4.1.2 Uncloneability

If a private key is easily copied from an inner user to

an adversary, the adversary can access the user’s data.

Cloning a private key should be prevented. We prove

our scheme has Strong Uncloneability (Hinek et al.,

2008).

Theorem 2. Our scheme has Strong Uncloneability.

Proof 2. (Sketch) First, an extractor χ computes the

plaintext M using the algorithm F . Since the ex-

tractor χ must access GetToken, it can request T =

GetToken(i,

C), and χ computes A = e(g,g)

rst

from

PK, CT, SK

′

. Since M =

, χ tries to check all the

values of b

∈ B until the above equation is satisﬁed.

Thus, χ computes b

within time complexity (|B|) in

the worst case.

4.1.3 Privacy Preserving

Personal information should remain private even if a

key generator is corrupted and colludes with a token

server. We prove that our scheme preserves privacy

(Hinek et al., 2008).

Theorem 3. Our scheme is privacy preserving.

Proof 3. (Sketch) Since PK, MK are chosen indepen-

dently of b

Pr[b

|PK,MK,ID

C] = Pr[b

|ID

holds. Next, recall that

= g

(a+r)

and the order of

G is q. It follows that

Pr[b

|ID

] = Pr[b

|ID

(a+ r)

mod p].

Since a,r,b are independently chosen,

Pr[b

|ID

(a+ r)

mod p] = Pr[b

|ID

]

holds. Thus, our scheme is privacy preserving.

4.1.4 Attribute Hiding

We show that our scheme satisﬁes Attribute Hiding.

Theorem 4. Our scheme satisﬁes Attribute Hiding.

Proof 4. (Sketch) Assume for simplicity there is just

one attribute j

that is needed to decrypt a ciphertext

CT. The value C

′

= H(att(y))

(0)

is denoted as g

Thus, it is difﬁcult to distinguish the attribute j

using

andC

′

where the decisional Difﬁe-Hellman (DDH)

problem is hard. We view an adversary A as trying to

guess the attribute using queries deﬁned in 3.2, and

consider a set of remaining candidate attributes in the

game. The size of the set of remaining attributes de-

creases by at most one with each oracle query. The

adversary decreases the candidate attributes to use

the Decrypt query as follows. First, the adversary ob-

tains a pair of CT

Srv

= (A,

C) for the challenge ci-

phertext CT to use the Decrypt

Srv

query. Next, the

adversary sets a guessed attribute j

′

SK and sends

a Decrypt

Srv

query to an entity. If the entity outputs

the correct pair of CT

Srv

= (A,

C), then j

′

= j

; oth-

erwise the adversary removes j

′

from the candidate

attributes. The success probability of the adversary is

/N where the number of queries is bounded by q

In addition to proofs for the security requirements,

we consider the feasibility of the user revocation pro-

cess.

4.1.5 User Revocation

Our proposal scheme realizes a user revocation. A

system administrator can revoke malicious users by

removing user’s entry(i.e. (ID

)) from the token

server’s database.

is a power of generator g, and

the exponent of

is randomized. Therefore, the user

can not recover the entry because of the discrete log-

arithm problem(DLP). Since a user needs a decryp-

tion token in order to decrypt any ciphertext (using a

private key of the user), the user can not obtain any

ciphertext after the revocation of the user.

4.2 Analysis of Communication Cost

In this section, we analyze communication cost of

our scheme. In the Table 1, we show the parameter

sizes. The parameter h represents the maximum num-

ber of attributes. The symbol |T

| denotes the size of

a tree using h attributes (nearly h|Z

|). The largest

part of the communication cost is the transaction that

involves sending ciphertextCT

Usr

from the user to the

server. The size of CT

Usr

approaches asymptotically

estimated as O(h

|). The communication cost is

proportional to h

similar to that of existing schemes.

SECRYPT2013-InternationalConferenceonSecurityandCryptography

Table 2: Computational cost of our scheme.

Hash Mul G

Exp G

Mul G

Inv G

Exp G

Pairing

Setup - - 1 - - 1 1

KeyGeneration |S

| |S

| 2|S

| + 2 - - - -

Encrypt

Usr

1 - 4 1 - 1 -

Encrypt

Srv

|T | - 2|T | - - - -

Decrypt

Usr

- - - 2 1 1 -

Decrypt

Srv

- - - 2|T | |T | |T | 2|T | + 1

GetToken - - - - - - 1

GetCoupon - - 1 - - - -

GetMaskKey - - |T | - - - -

Table 3: Computational Cost of Zhou’s scheme.

Setup - - 3 - - 1 1

Hash Mul G

Exp G

Mul G

Inv G

Exp G

Pairing

KeyGeneration |S

| |S

| 2|S

| + 1 - - - -

Encrypt

Usr

1 - 3 1 - 1 -

Encrypt

Srv

|T | - 2|T | - - - -

Decrypt

Usr

- - - 2 1 1 -

Decrypt

Srv

- - - 2|T | |T | |T | 2|T | + 1

GetMaskKey - - 1 - - - -

Table 1: Sizes of Data.

Data Size Direction

Public key PK |G

| + |G

| TA → User

Private Key SK |Z

| + 2h|G

| TA → User

Ciphertext CT

Usr

| + h|T

+4|G

| + |G

User → Server

Ciphertext CT

Srv

2|G

| Server → User

Ciphertext CT

h+1

| + 4|G

+|G

Server (local)

Token T |G

| TSP → User

Input of Token

C |G

| User → TSP

4.3 Performance Analysis

Our scheme reduces the computational cost on a mo-

bile device; the computational cost of Encrypt

Usr

Decrypt

Usr

is less than that of the existing scheme

(Hinek et al., 2008).

The function GetMaskKey is pre-computed be-

fore computing Decrypt

Usr

and it requires O(1) com-

putation. The computational cost of Decrypt

Usr

also O(1). Thus, the computational cost of decryp-

tion on a mobile device is O(1).

The total computational cost of the whole process

is O(|T |). The worst case is that where N attributes,

and in that case, the total computational cost is esti-

mated to be O(N). Here we show the estimation of

the computational cost of each operation in Table 2.

The symbol S

is the set of attributes allocated to a

user u.

We show the computationalcost of Zhou’s scheme

in Table 3. The computational costs of functions

KeyGeneration, Encrypt

Usr

, and GetMaskKey in

our scheme are somewhat larger than those in Zhou’s

scheme. GetMaskKey can be pre-computed before

decryption of any data. The increases of other func-

tions are constant time; in the view of an asymptotic

estimation, these increases are negligible. We con-

clude that the increases in computational cost from

adding key revocation are negligibly small in our

scheme.

4.4 Implementation of Primitives

We implemented a Reduced Modiﬁed Tate (RMT)

pairing to estimate the cost of our scheme. Our tar-

get devices are a PC and an Android smartphone as

shown in the Table 5.

Table 4: Parameters.

89 bit security 128 bit security

m 193 509

Irreducible Polynomial f(x) = x

193

− x

+ 1

f(x) = x

509

− x

318

−x

191

+ x

127

+ 1

Oder of Z

p = 3

193

− 3

+ 1 p = (3

509

− 3

255

+ 1)/7

Table 5: Target Devices.

PC Mobile Devise(MD)

Model - HTC Sensation XE

CPU

Intel Xeon

W3680 3.33GHz

Qualcomm Snapdragon

MSM8260 1.5GHz

Core Hexa-core Dual-core

Word length 64-bit 32-bit

Memory 16GB 768MB

OS CentOS6.0 Android 2.3.4

Compiler GCC4.4.4 Android NDK r7

AKey-revocableAttribute-basedEncryptionforMobileCloudEnvironments

Table 6: Transaction Time in 89-bit security per function (msec).

The number of attributes (AND condition) 1 2 3 4 5

Our scheme Encrypt

Usr

: Android 157.29 133.88 149.25 130.10 130.94

Encrypt

Srv

: PC 7.28 15.30 22.72 29.96 32.02

Decrypt

Usr

: Android 29.18 30.40 32.82 32.16 34.28

Decrypt

Srv

: PC 17.46 24.47 26.64 39.56 46.82

CP-ABE(Bethencourt et al., 2007) Encrypt : Android 95.9 140.2 184.5 228.8 273.1

Decrypt : Android 96.9 169.7 242.5 315.3 388.1

Table 7: Transaction Time in 128-bit security per function (msec).

The number of attributes (AND condition) 1 2 3 4 5

Our scheme Encrypt

Usr

: Android 557.99 556.95 586.17 558.71 557.86

Encrypt

Srv

: PC 51.48 90.14 117.89 148.13 184.87

Decrypt

Usr

: Android 185.28 189.24 193.12 184.27 193.00

Decrypt

Srv

: PC 115.54 174.10 244.51 286.07 322.59

CP-ABE(Bethencourt et al., 2007) Encrypt : Android 1079 1599 2119 2639 3159

Decrypt : Android 743 1302 1861 2420 2979

Our implementation is similar to that of Beuchat

et al. (Beuchat et al., 2010). We adopted a design

for the RMT pairing based on supersingular elliptic

curves deﬁned over a ﬁnite ﬁeld of characteristic three

and select the parameters for two security levels: 89-

bit security and 128-bit security.

We consider the supersingular curves E(F

) with

embedding degree k = 6 deﬁned as follows;

E(F

) = {(x,y) ∈ F

× F

| y

= x

− x+ 1} ∪ {∞}.

The order of E(F

), #E(F

) is calculated as

#E(F

) = 3

+ 1 + b

′

(m+1)/2

, where b

′

is deﬁned

as follows:

′



1 (mod 12) if m ≡ 1,11

−1 (mod 12) if m ≡ 5,7

The RMT pairing ˆe

is deﬁned using η

pairing as

follows:

ˆe

(P,Q) = η

(



− µb

′

3m−1



P,Q)

−1

where P, Q ∈ E(F

). The orders of groups G

are #E(F

), #F

∗

respectively.

The η

pairing consists of a main loop and a ﬁnal

exponentiation. We used a loop unrolling technique

(Beuchat et al., 2010) for the main loop, and the ﬁ-

nal exponentiation calculation was carried out accord-

ing to (Shirase et al., 2008). The computational cost

of a multiplication over F

is dominant in the η

pairing. We implemented a window method (Brauer,

1939) that was the fastest multiplication algorithm for

a characteristic three ﬁeld, and selected a window size

of w = 4. We selected the parameters for two security

levels as shown in the Table 4.

4.5 Evaluation Result

We implemented our ABE system on the target de-

vices in Table 5. Two functions, Encrypt

Usr

and

Decrypt

Usr

, were implemented on the smartphone

and two other functions, Encrypt

Srv

and Decrypt

Srv

were implemented on the PC. Evaluation results of

the transaction time of the four functions for 89-bit

and 128-bit security settings are shown in Table 6

and Table 7, respectively. An access policy that de-

ﬁnes an access condition AND of all w attributes

(w = 1,2,3,4,5) was used for the evaluation. The ac-

cess policy is the worst case for the transaction time

where we use w attributes in the system. Constant

transaction time is required to compute two functions

on the smartphone, Encrypt

Usr

and Decrypt

Usr

, and

transaction time of Encrypt

Srv

and Decrypt

Srv

are

proportional to the number of attributes; but are neg-

ligibly small for the PC. We compare our results with

a CP-ABE scheme proposal by Bethencourd et al.

(Bethencourt et al., 2007), which is a conventional

CP-ABE and requires that the smartphone must ex-

ecute all calculations for encryption and decryption.

As evaluation results of primitive functions, the trans-

action times of the encryption and decryption of the

CP-ABE using 5 attributes are estimated to be 271.3

msec and 388.1 msec for 89-bit security and 3159

msec and 2979 msec for 128-bit security respectively.

These results show that our scheme is faster than the

scheme (Bethencourt et al., 2007) where all functions

are implemented on the smartphone, and are applica-

ble to a mobile cloud environment.

5 CONCLUSIONS

In this paper, we proposed a new ABE scheme appli-

cable to mobile cloud computing environments. The

computational cost on a mobile device is O(1), and

cloud services can securely provide most computa-

SECRYPT2013-InternationalConferenceonSecurityandCryptography

tions required for the ABE scheme. Furthermore, the

scheme includes a key revocation mechanism for the

private keys and an attribute hiding mechanism. The

transaction time of our encryption algorithm is within

150 msec for 89-bit security and about 600 msec for

128-bit security on the mobile device, respectively.

Similarly, the transaction time of the decryption al-

gorithm is within 50 msec for 89-bit security and 200

msec for 128-bit security. The evaluation of transac-

tion time demonstrated that our scheme is feasible for

mobile cloud services using current smartphones.

REFERENCES

Amazon (2012). Amazon Web Services. http://aws. ama-

zon.com/.

Aranha, D., L´opez, J., and Hankerson, D. (2010). High-

speed parallel software implementation of the η

pair-

ing. In Topics in Cryptology - CT-RSA 2010, volume

5985 of Lecture Notes in Computer Science, pages

89–105. Springer.

Baek, J., Safavi-Naini, R., and Susilo, W. (2005). Token-

controlled public key encryption. In Information

Security Practice and Experience, volume 3439 of

Lecture Notes in Computer Science, pages 386–397.

Springer.

Bellare, M., Pointcheval, D., and Rogaway, P. (2000). Au-

thenticated key exchange secure against dictionary at-

tacks. pages 139–155. Springer.

Bethencourt, J., Sahai, A., and Waters, B. (2007).

Ciphertext-policy attribute-based encryption. In Pro-

ceedings of the 2007 IEEE Symposium on Security

and Privacy, Security and Privacy 2007, pages 321–

334. IEEE Computer Society.

Beuchat, J., Gonzalez-Diaz, J., Mitsunari, S., Okamoto,

E., Rodriguez-Henriquez, F., and Teruya, T. (2010).

High-speed software implementation of the optimal

Ate pairing over Barreto-Naehrig curves. In Pairing-

Based Cryptography - Pairing 2010, volume 6487

of Lecture Notes in Computer Science, pages 21–39.

Springer.

Boneh, D. (1998). The decision difﬁe-hellman problem.

pages 48–63. Springer.

Boneh, D. and Franklin, M. (2001). Identity-based encryp-

tion from the weil pairing. In Advances in Cryptol-

ogy - CRYPTO 2001, volume 2139 of Lecture Notes

in Computer Science, pages 213–229. Springer.

Brauer, A. (1939). On addition chains. In Bull. Amer. Math.

Soc., volume 45, pages 736–739.

Canetti, R., Krawczyk, H., and Nielsen, J. (2003). Relaxing

chosen-ciphertext security. In Advances in Cryptol-

ogy - CRYPTO 2003, volume 2729 of Lecture Notes

in Computer Science, pages 565–582. Springer.

Cloud Security Alliance (2009). Security guidance

for critical areas of focus in cloud computing.

http://tinyurl.com//ycrchqj.

European Network and Information Security

Agency (2010). Cloud computing risk assess-

ment. http://www.enisa. europa.eu/act/rm/ﬁles/

deliverables/cloud-computing-risk-assessment/at

down

load/fullReport.

Galindo, D. and Herranz, J. (2006). A generic construc-

tion for token-controlled public key encryption. In

Di Crescenzo, G. and Rubin, A., editors, Financial

Cryptography and Data Security, volume 4107 of

Lecture Notes in Computer Science, pages 177–190.

Springer.

Google (2012). Google App for Buiziness. http://

www.google.com/apps/intl/en/business/index.html.

Goyal, V., Pandey, O., Sahai, A., and Waters, B. (2006).

Attribute-based encryption for ﬁne-grained access con-

trol of encrypted data. In Proceedings of the 13th ACM

conference on Computer and communications security,

CCS ’06, pages 89–98. Algorithms and Computation in

Mathematics.

Green, M., Hohenberger, S., and Waters, B. (2011). Out-

sourcing the decryption of ABE ciphertexts. In Pro-

ceedings of the 20th USENIX conference on Security,

SEC’11, pages 34–34. USENIX Association.

Hinek, M. J., Jiang, S., Safavi-Naini, R., and Shahandashti,

S. F. (2008). Attribute-based encryption with key

cloning protection. Cryptology ePrint Archive, Report

2008/478.

Joux, A. (2004). A one round protocol for tripartite

difﬁe?hellman. Journal of Cryptology, 17:263–276.

Lewko, A., Okamoto, T., Sahai, A., Takashima, K., and

Waters, B. (2010). Fully secure functional encryp-

tion: Attribute-based encryption and (hierarchical) in-

ner product encryption. In Advances in Cryptology -

EUROCRYPT 2010, volume 6110 of Lecture Notes in

Computer Science, pages 62–91. Springer.

Naehrig, M., Niederhagen, R., and Schwabe, P. (2010). New

software speed records for cryptographic pairings. In

Progress in Cryptology - LATINCRYPT 2010, volume

6212 of Lecture Notes in Computer Science, pages 109–

123. Springer.

NIST (2009). The nist deﬁnition of cloud comput-

ing. http://csrc.nist.gov/publications/nistpubs/800-145/

SP800-145.pdf.

Sadeghi, A., Schneider, T., and Winandy, M. (2010). Token-

based cloud computing. In Trust and Trustworthy Com-

puting, volume 6101 of Lecture Notes in Computer Sci-

ence, pages 417–429. Springer.

Sahai, A. and Waters, B. (2005). Fuzzy identity-based en-

cryption. In Advances in Cryptology - EUROCRYPT

2005, volume 3494 of Lecture Notes in Computer Sci-

ence, pages 557–557. Springer.

Scott, M. (2011). On the efﬁcient implementation of pairing-

based protocols. Cryptology ePrint Archive, Report

2011/334.

Shirase, M., Takagi, T., and Okamoto, E. (2008). Some efﬁ-

cient algorithms for the ﬁnal exponentiation of η

pair-

ing. IEICE Transactions, 91-A(1):221–228.

Waters, B. (2011). Ciphertext-policy attribute-based encryp-

tion: An expressive, efﬁcient, and provably secure real-

ization. In Public Key Cryptography - PKC 2011, vol-

ume 6571 of Lecture Notes in Computer Science, pages

53–70. Springer.

Zhou, Z. and Huang, D. (2011). Efﬁcient and secure data stor-

age operations for mobile cloud computing. Cryptology

ePrint Archive, Report 2011/185.

AKey-revocableAttribute-basedEncryptionforMobileCloudEnvironments