![](bg8.png)
Our scheme can realize a regionally restricted con-
tent distribution service. In Japan, there are 47 pre-
fectures, so we assign them to possible values for
ˆ
A
1
. We also allow two kinds of membership, general
and premium, as possible values for
ˇ
A
1
, two kinds
of contract information, payer and non-payer, as pos-
sible values for
ˇ
A
2
, and two genders, male and fe-
male, as possible values for
ˇ
A
3
. For example, when
a service provider encrypts a piece of content with
the policy
ˆ
W
1
= {Tokyo, Kanagawa, Saitama, Chiba,
Gunma, Tochigi, Ibaraki}, which means the Kanto
region, a user who has the attribute
ˆ
L
1
= Tokyo can
decrypt the content but a user who has the attribute
ˆ
L
1
= Osaka cannot decrypt the content. In this case,
n = 4 and θ = 0.25. Therefore, the decryption cost is
5P in the modified scheme of (Nishide et al., 2008)
and 3P in our scheme, respectively, which means that
our scheme can reduce the decryption cost by 40%
in comparison with the modified scheme of (Nishide
et al., 2008).
For attribute
ˇ
A
1
, a service provider must encrypt
content with either
ˇ
W
1
= general or
ˇ
W
1
= premium.
If the service provider allows both general members
and premium members to decrypt a content, they must
transmit two corresponding ciphertexts to users (For
the other attributes
ˇ
A
2
and
ˇ
A
3
, the service provider
must do the same as the above.). If the number of
possible values for an attribute is large, the wildcard
functionality is effective. On the other hand, if the
number of possible values for an attribute is small, the
service provider should employ such a trivial scheme
rather than use wildcards to reduce total costs. That
is, the service provider should transmit as many ci-
phertexts as possible attribute values to users.
Table 2 is a numerical comparison of the schemes
described in Table 1. Several parameters are set
according to the above content distribution service:
|G| = 176 (bits), |G
T
| = 1056 (bits), M
G
= 5 (msec),
M
G
T
= 8 (msec), P = 10 (msec), n = 4, ˆn = 1, ˇn = 3,
θ = 0.25, n
s
= 53, m
s
= 10, ˆn
s
= 47, ˆm
s
= 7, ˇn
s
= 6,
and ˇm
s
= 3. As shown in Table 2, our scheme is more
efficient than the modified scheme of (Nishide et al.,
2008).
6 CONCLUSIONS
We proposed a partially wildcarded CP-ABE scheme.
We compared our scheme with conventional CP-ABE
schemes and described a content distribution service
as an application of our scheme. The result showsthat
our scheme can reduce the decryption cost in compar-
ison with the conventional CP-ABE schemes.
Table 2: Numerical comparison of our scheme and conven-
tional CP-ABE schemes. M-NYO08 denotes the modified
scheme of (Nishide et al., 2008) and EMNOS09 denotes the
scheme in (Emura et al., 2009).
M-NYO08 EMNOS09 Ours
|PK| (bits) 10,560 10,736 10,560
|SK| (bits) 880 352 528
|CT| (bits) 2,992 1,408 2,640
Enc (msec) 63 33 33
Dec (msec) 50 20 30
REFERENCES
Bethencourt, J., Sahai, A., and Waters, B. (2007).
Ciphertext-policy attribute-based encryption. In IEEE
Symposium on Security and Privacy, pages 321–334.
Cheung, L. and Newport, C. (2007). Provably secure ci-
phertext policy abe. In ACMCCS’07, pages 456–465.
Emura, K., Miyaji, A., Nomura, A., Omote, K., and Soshi,
M. (2009). A ciphertext-policy attribute-based en-
cryption scheme with constant ciphertext length. In
ISPEC, pages 13–23.
Goyal, V., Pandey, O., Sahai, A., and Waters, B. (2006).
Attribute-based encryption for fine-grained access
control of encrypted data. In ACMCCS, pages 89–98.
Katz, J., Sahai, A., and Waters, B. (2008). Predicate encryp-
tion supporting disjunctions, polynomial equations,
and inner products. In Eurocrypt, pages 146–162.
Lewko, A., Okamoto, T., Sahai, A., Takashima, K., and
Waters, B. (2010). Fully secure functional encryp-
tion: Attribute-based encryption and (hierarchical) in-
ner product encryption. In Eurocrypt, pages 62–91.
Nishide, T., Yoneyama, K., and Ohta, K. (2008). Attribute-
based encryption with partially hidden encryptor-
specified access structures. In ACNS, pages 111–129.
Okamoto, T. and Takashima, K. (2010). Fully secure func-
tional encryption with general relations from the deci-
sional linear assumption. In Crypto, pages 191–208.
Ostrovsky, R., Sahai, A., and Waters, B. (2007). Attribute-
based encryption with non-monotonic access struc-
tures. In ACMCCS, pages 195–203.
Sahai, A. and Waters, B. (2005). Fuzzy identity-based en-
cryption. In Eurocrypt, pages 457–473.
Waters, B. (2011). Ciphertext-policy attribute-based en-
cryption: An expressive, efficient, and provably se-
cure realization. In PKC, pages 53–70.
Zhang, Y., Kanayama, N., and Okamoto, E. (2008). Java
implementation of pairing on elliptic curves over F
2
m
(in japanese). In CSS, pages D2–1.
SECRYPT2013-InternationalConferenceonSecurityandCryptography
346