SABE: A Selective Attribute-based Encryption for an Efﬁcient Threshold

Multi-level Access Control

Nesrine Kaaniche and Maryline Laurent

SAMOVAR, CNRS, Telecom SudParis, University Paris-Saclay,

Member of the Chair Values and Policies of Personal Information, Paris, France

Keywords:

Multi-level Access Control, Ciphertext-policy Attribute-based Encryption, Flexible Access Policies, Data

Secrecy.

Abstract:

With the emergence of decentralized systems and distributed infrastructures, access control to outsourced data

becomes more complex, as it should be ﬂexible and distinguishable among users with different access rights.

In this paper, we present SABE, a Selective Attribute-based Encryption scheme, as a new threshold multi-

level access control mechanism based on an original use of attribute based encryption schemes. Our proposal

is multi-fold. First, it ensures ﬁne-grained access control, supporting multi-security levels with respect to

different granted access privileges for each outsourced data ﬁle. Second, SABE is proven secure against

selective non-adaptive chosen ciphertext attacks in the generic group model. Third, our construction is proven

to provide efﬁcient processing and communication complexities, compared to most closely related schemes.

1 INTRODUCTION

The emergence of decentralized systems and distri-

buted infrastructures has increased the complexity of

access control to outsourced data and has given rise to

encrypted access schemes. These mechanisms, refer-

red to as Attribute based Encryption (ABE) mecha-

nisms, are used to encrypt data ﬁles with respect to an

access policy computed on a set of attributes.

Let us take a simple example for illustrating the

need for a multi level access tree for ABE. During the

reviewing process of scientiﬁc papers submitted to a

conference, access to the papers can be provided to

general chairs, program committee, publicity chairs

or to the registration manager for the validation of re-

gistered papers. This can be formalized by an access

policy based on users’ attributes, which assigns dif-

ferent access rights to each part of the scientiﬁc pa-

per to the actors. For instance, reviewers should not

have access to identifying information of the authors

(e.g; name, afﬁliation, ···), registration staff should

not have access to the paper contents, while general

chairs have access to the whole research paper’s con-

tent. Thus, to enable access to encrypted data, the

encryptor is assumed to create an access structure for

each part of the scientiﬁc paper which is then encryp-

ted, w.r.t. each group of authorized entities. Depen-

ding on the attributes comprising each access struc-

ture, there might be a strong overlapping of attribu-

tes between access structures, thus leading to duplica-

ted efforts when encrypting and decrypting each part

of the data content. In addition, the management of

access control policies becomes more complex and

the burden of enciphering keys’ management rises

mainly with the dynamicity of users groups.

In this paper, we present SABE, Selective

Attribute based Encryption, a novel and efﬁcient

threshold encryption scheme relying on attribute

based mechanisms, and provided with the following

features:

(1) SABE ensures a selective access to data based on

users’ granted privileges. A party willing to encrypt

a data ﬁle only speciﬁes one single access structure

and certain security levels assigned to different data

blocks of the enciphered ﬁle. Thus, a user is next

able to decipher a sub-set of data blocks associated to

a security level k if the secret keys of that user satisfy

the related k

sub-sets of attributes.

(2) SABE is a threshold access-control scheme

associated to multi-security levels, i.e. each security

level deﬁnes the threshold number k

of related

sub-sets of attributes that need to be satisﬁed.

(3) Relying on an attribute based encryption mecha-

nism, users sharing the same access privileges are not

required to collaborate to extract the secret encrypting

key. Thus, the complexity of key management is

Kaaniche, N. and Laurent, M.

SABE: A Selective Attribute-based Encryption for an Efﬁcient Threshold Multi-level Access Control.

DOI: 10.5220/0006855501550167

In Proceedings of the 15th International Joint Conference on e-Business and Telecommunications (ICETE 2018) - Volume 2: SECRYPT, pages 155-167

ISBN: 978-989-758-319-3

155

minimized, providing an efﬁcient processing and

communication overhead, and the deﬁnition of access

control policies is ﬂexible and distinguishable among

users with different privileges to access data.

(4) SABE is proven secure against non-adaptive

chosen ciphertext attacks.

Paper Organization – Section 2 discusses related

works, presents the problem statement and highlights

security and functional requirements. Section 3 intro-

duces our deﬁnitions and gives background on access

structures and Lagrange Interpolation. Section 4 de-

tails our system and threat models and section 5 pre-

sents the concrete construction.The security of our

scheme is discussed in section 6. Finally, The scheme

performances are evaluated in section 7 The potential

of SABE technique to support security and privacy

in concrete networking and computing applications in

section 8 before concluding in section 9.

2 RELATED WORKS AND

SECURITY REQUIREMENTS

ANALYSIS

Sharing data contents between different involved ac-

tors is often an issue, due to the complexity of access

control policies’ management. This issue becomes

more complex when involved actors do not share the

same access privileges to each part of the data ﬁle.

In the following, we ﬁrst detail related works in sub-

section 2.1. Then, we present the problem statement

based on a real-world use case, in subsection 2.2. Af-

terwards, we introduce the security and functional re-

quirements for the design of the SABE mechanism in

subsection 2.3.

2.1 Related Work

Fine-grained access control based on selective en-

cryption is a novel approach that enables selective

access to encrypted data while supporting a compel-

ling key management process. Indeed, different de-

ciphering keys can be distributed to different users

that are allowed to access the corresponding data con-

tent, with respect to their granted privileges. Howe-

ver, the translation of an access control list into an

equivalent multi-level policy remains the main issue

of these schemes. To ban access to some parts of the

data, some processes propose to cover out or remove

these chunks. These mechanisms are known by re-

daction tools. They generally rely on malleable cryp-

tographic primitives (e.g; chameleon hash functions

instead of the conventional hash functions) to ena-

ble redactors, based on their own respective private

keys to modify some portions of the originally en-

crypted ﬁle. Although these mechanisms allow se-

lective access to some parts of the originally encryp-

ted ﬁle, they are also still inefﬁcient with multi-level

access privileges.

In 2010, Di Vimercati et al. (Di Vimercati et al.,

2010) introduce a selective authorization policy mo-

del based on graph theory in order to ensure read pri-

vilege. The authors consider a dynamic group of users

sharing data stored in remote cloud servers and as-

sume that each data content may only be accessed by

a subset of users. That is, (Di Vimercati et al., 2010)

proposal is based on the use of both a key agreement

algorithm and a key derivation function that enable a

key to be derived from another key and a public to-

ken. The combination of these two algorithms per-

mits to correctly convert access policies deﬁned by

data owners into encryption policies. Later, in 2013,

Di Vimercati et al. (di Vimercati et al., 2013) propose

another approach to support modiﬁcation of outsour-

ced data ﬁles. The main idea of (di Vimercati et al.,

2013) proposal relies on the association of each con-

tent with a write tag. The remote server permits a user

to perform the write operation on a data ﬁle if he cor-

rectly shows the corresponding write tag. A crucial

concern of the (di Vimercati et al., 2013) scheme is

that the keys used to encrypt the write tags have to be

shared between authorized users and the server. Alt-

hough the attractive advantages of the proposed solu-

tions (Di Vimercati et al., 2010), (di Vimercati et al.,

2013) to support selective access control, they do not

support multi-level access structure on the same data

content.

Along with the different emerging techniques sup-

porting selective access control to encrypted data, At-

tribute based Encryption (ABE) has been often pre-

sented as a solution to provide ﬂexible data sharing

(Sahai and Waters, 2005) (Bethencourt et al., 2007).

In order to ensure ﬁne grained access control to

outsourced data, several constructions relying on

ABE have been proposed (Kaaniche and Laurent,

2017b), (Hur and Noh, 2011),(Yu et al., 2010),(Jahid

et al., 2011), (Horv

ath, 2015), (Huang et al., 2016),

(Belguith et al., 2016). Indeed, Hur et al. proposed an

access control scheme based on CP-ABE in data out-

sourcing systems such as cloud computing (Hur and

Noh, 2011). Horvath proposed a ﬁne-grained access

control scheme for securely sharing data in cloud en-

vironments (Horv

ath, 2015). To guarantee an efﬁ-

cient revocation scheme, this construction relies on an

identity based user revocation mechanism to manage

access rights . The proposed extension is based on

SECRYPT 2018 - International Conference on Security and Cryptography

156

multiple independent attribute authorities which ma-

kes the revocation of speciﬁc users (e.g. based on

users’ identities) from the system is possible without

updates of public and private keys. However, these

schemes only focus on data sharing, at one single se-

curity level and cannot support selective access privi-

leges to outsourced data.

In (Huang et al., 2016), Huang et al. propose a

data collaboration scheme, such that authorized users

can share data in a collaborative manner. In fact, the

data owner encrypts data with respect to a selected

access policy based on CP-ABE, while the coope-

rative user re-encrypts the modiﬁed data and signs

a collaboration request with his attributes. As such,

only the users whose attributes satisfy the access po-

licy can modify outsourced data. (Huang et al., 2016)

employs a delegation mechanism based hierarchical

ABE, which contains a central authority and a number

of independent domains. Each domain holds a dom-

ain authority that requests a secret parameter from the

higher level authority and generates attribute secret

keys for its domain users. The (Huang et al., 2016)

proposal introduces a partial decryption and signing

construction, where users are able to outsource most

of the decryption and signing computation overhead

to the service provider.

Afterwards, Khan et al. presented a multi-level

access control scheme, proving a single ciphertext

over a global access policy (Khan et al., 2016). The

data owner can deﬁne limited users’ privileges to dif-

ferent chunks of the whole data D. However, the

enciphering symmetric key sk is deﬁned as a vector

of different sub-keys sk = [s

]

i∈[1,n+1]

, where each s

is the related encrypting key of m

, such that D =

,··· ,m

} and s

n+1

is the enciphering key of

the whole data D. Thus, the (Khan et al., 2016) con-

struction requires heavy computation and communi-

cation costs. Recently, in 2017, Kaaniche and Lau-

rent proposed a multi-level access control scheme ba-

sed on attribute based mechanisms for e-health appli-

cations (Kaaniche and Laurent, 2017a). Their con-

struction permits the enciphering party to encrypt a

data ﬁle, while specifying an access structure and a

certain number of security levels. Thus, a user can

decrypt a sub-set of data chunks associated to a secu-

rity level k if that user’s private keys satisfy the sub-set

of attributes related to the k-security level. Nonethe-

less, the (Kaaniche and Laurent, 2017a) proposal does

not offer a threshold multi-level access, such that the

deciphering entity has to satisfy a precise set of at-

tributes to be able to decrypt a given sub-sets of data

blocks w.r.t. a given security level. In addition, the

encrypting entity has to encipher each sub-set of data

blocks associated with a given security level, using on

a different secret.

Although these schemes proposed efﬁcient soluti-

ons to protect data contents from unauthorized access,

they are still inefﬁcient with multi-level access poli-

cies, where users must share the same data content

with different access rights to distinct data chunks.

In addition, these schemes mainly provide interes-

ting computation and communication costs at the re-

ceiving entity side, w.r.t to the decryption procedure,

while it is important to focus on the processing over-

head at the data owner side, responsible for deﬁning

different access policies to different parts of outsour-

ced data ﬁles.

2.2 Problem Statement

In real-world data sharing scenarios, different orga-

nisations and actors can be involved. The shared data

must be protected from unauthorized access while en-

suring ﬁne grained access control for different aut-

horized actors. For preserving data conﬁdentiality

against malicious users, encryption should be applied

while supporting ﬂexible sharing of encrypted data

among dynamic groups of users, with ﬁne-grained

access control policies.

Let us consider the case of the reviewing process

of scientiﬁc papers: the website administrator mana-

ges access to the encrypted versions of submitted pa-

pers with respect to three different groups of users:

reviewers, sub-reviewers and PC chair. Indeed, ac-

cording to their related credentials, some entities can

have access to the paper content as well as the name

of authors and their personal information, while ot-

hers may have access to only anonymized versions of

the submitted papers, referred to as blinded papers.

Thus, the aforementioned group of users deﬁne se-

veral access control policies as follows:

• access to the blinded paper – [((reviewer or sub-

reviewer) and research track) and (computer sys-

tems or network security)] or [(computer systems

or network security) and PC chair] or [((revie-

wer or sub-reviewer) and research track) and PC

chair] ;

• access to the paper and identifying information –

((reviewer or sub-reviewer) and research track)

and (computer systems or network security) and

(PC chair);

To enable access to encrypted data, the available

option related to the use of ABE mechanisms is ba-

sed on the naive computing approach referred to as

NC in the following. In NC, the data owner, i.e; the

website administrator, is assumed to create an access

structure for each part of the scientiﬁc paper which is

SABE: A Selective Attribute-based Encryption for an Efﬁcient Threshold Multi-level Access Control

157

then encrypted, with respect to every group of autho-

rized users. Concretely, the blinded version of the pa-

per and the whole paper content including identifying

information have to be enciphered with respect to dif-

ferent access structures. However, it is worthy notice-

able that (i) these access structures share several leaf

nodes, corresponding to redundant required attributes

and (ii) each data content is encrypted several times

under different access policies. In fact, this use-case

points out that there might be overlapping between

access structures for the same data share, thus leading

to complex access structures. In addition, the mana-

gement of access policies becomes more complex and

the burden of enciphering keys’ derivation for every

data chunk rises mainly with groups of users having

different access privileges. That is why we propose

a multi-level access control mechanism for the same

data content, based on an ABE aggregate access tree.

2.3 Security and Functional

Requirements

The proposed SABE scheme has to fulﬁll the follo-

wing security properties and functional features:

• data conﬁdentiality – even in case of collusions,

SABE has to ensure the secrecy of encrypted data

contents against malicious entities, namely unaut-

horized and revoked users.

• multi-level ﬁne grained access control – SABE

should support ﬂexible multi-level security poli-

cies among groups of users with different granted

privileges.

• threshold support – SABE should ensure the

threshold feature, such that each deﬁned security

level may encompass several sub-trees.

• low processing and communication costs –

SABE encrypted data ﬁle should be short-sized

as the transmission overhead is essential in the

emerging infrastructure context. In addition, the

encryption and decryption processes should have

a low computation cost in order to reduce the im-

pact of heavy cryptographic mechanisms on the

efﬁciency of the intended algorithms.

3 PRELIMINARIES

3.1 Mathematical Background

In this section, we introduce our prerequisites, namely

multi-leveled pairing functions, access structures and

Lagrange interpolation, deﬁned as follows:

Deﬁnition 1. (Leveled Multilinear Maps (Hohenber-

ger et al., 2013) (Garg et al., 2013))

Let G be a group generator G(1

,k), where κ is a

security parameter and k is the number of allowed

pairing operations. G(1

,k) outputs a sequence of

groups such that

G = [G

,· ·· ,G

], each of prime or-

der p > 2

. Let g

be a canonical generator of G

We assume the existence of a set of bilinear maps

i, j

: G

× G

−→ G

i+ j

|i, j ≥ 1, i + j ≤ k}. The map

i, j

satisﬁes the following relation:

i, j

) = g

i+ j

, ∀a,b ∈ Z

Deﬁnition 2. (Access Structure (Beimel, 2011))

Let P = {P

,· ·· ,P

} be a set of parties, and a col-

lection A ⊆ 2

,···,P

}

is called monotone if ∀B,C ⊆

,···,P

}

: if B ∈ A and B ⊆ C then C ∈ A. An

access structure is a collection A of non-empty sub-

sets of {P

,· ·· ,P

} ; i.e. A ⊆ 2

,···,P

}

\ {

0}.

The sets in A are called authorized sets, and the sets

not in A are called unauthorized sets.

Deﬁnition 3. (Lagrange Interpolation)

Given a set of (k + 1) distinct points

{(x

),· ·· ,(x

)}, the Lagrange polynomial

is a linear combination L(x) =

∑

j=0

(x) of

Lagrange coefﬁcients δ

(x) =

∏

0≤i6= j≤k

x−x

−x

3.2 Cryptographic Assumptions

For our construction, we consider the following com-

plexity assumptions:

• Discrete Logarithm Problem (DLP) – Let G be a

multiplicative cyclic group of a prime order p, and

g is a generator of G. The DLP problem is, given

the public element y = g

∈ G, there is no efﬁcient

probabilistic algorithm A

DLP

that can compute the

integer x.

• Computational Difﬁe Hellman Assumption

(CDH) – Let G be a group of a prime order p,

and g is a generator of G. The CDH problem

is, given the tuple of elements (g,g

), where

{a,b}

←− Z

, there is no efﬁcient probabilistic

algorithm A

CDH

that computes g

4 OVERVIEW

Our Selective Attribute based Encryption (SABE)

enables a group of users to access different parts of an

encrypted data ﬁle in a threshold manner with respect

to their different granted privileges. The main idea

behind SABE relies on ABE such that users’ keys

SECRYPT 2018 - International Conference on Security and Cryptography

158

and decryption capabilities are related to the attribu-

tes they possess. Indeed, the SABE scheme considers

that the plaintext is composed of a set of messages and

users’ credentials (i.e; certiﬁed attributes) settle which

subset of data blocks may be deciphered. It provides

the ability to strike a balance between security and

processing demands.

Accurately, the encrypting entity deﬁnes an access

structure with respect to n attributes, while specifying

multi-threshold levels {k

}

l∈[1,c]

, where k

is the k

security level and c is the number of deﬁned security

levels. Note that each security level k

corresponds to

sub-trees that permit to reconstruct a secret key v

required to decipher the subset of data blocks associ-

ated to the security level k

4.1 System Model

A selective attribute-based encryption scheme

(SABE) for a message space M and an access struc-

ture space G relies on four randomized algorithms,

deﬁned as follows:

• setup – it is executed the master entity (i.e; attri-

bute authority) to set up the system. The setup

algorithm takes as input the security parameter κ

and outputs the public parameters pp and the mas-

ter key mk.

• encrypt – it is performed by the encryptor. The

encrypt algorithm takes as input the public pa-

rameters pp, an access structure Γ over the uni-

verse of attributes S and the set of security levels

}

l∈[1,c]

, where c is the number of security le-

vels and a message M = {m

}

l∈[1,c]

. It encrypts

the message M w.r.t. c security levels and out-

puts a ciphertext CT = {Γ, ∀k

: CT

}, such that

l ∈ [1,c] and each security level has to be satis-

ﬁed by at least n

root subtrees. This algorithm is

performed such that only a user that holds a set

of certiﬁed attributes w.r.t. a security level k

that

satisﬁes the access structure Γ can decipher the

encrypted message CT

• keygen – it is run by the attribute authority. This

algorithm takes as input the public parameters pp,

the master key mk and a set of attributes S and

outputs the related secret key sk.

• decrypt – it is performed by the deciphering en-

tity. The decrypt algorithm takes as input the pu-

blic parameters pp, the ciphertext CT , which con-

tains an access policy Γ, the security level k

and

the secret key sk associated to the set of attributes

S. Recall that S has to satisfy Γ, w.r.t. a security

level k

, to be able to decrypt the corresponding

ciphertext CT

and retrieve the message m

The correctness property requires that for all

security parameter κ, all universe descriptions S,

all (pp,mk) ∈ setup(κ), all S ⊆ S, all M ∈ M ,

all Γ ∈ G, all sk ∈ keygen(pp,mk,S ), all k

∈

K (K is the security level space) and all CT ∈

encrypt(pp,Γ, M,{k

}

l∈[1,c]

), if S satisﬁes Γ w.r.t. a

security level k

, then decrypt (pp,CT,k

,sk) algo-

rithm outputs m

4.2 Selective CCA-1 Security Model

Let Π = (setup, encrypt,keygen,decrypt) be a SABE

scheme for a message space M and an access struc-

ture space G. To prove the resistance of SABE against

selective chosen ciphertexts attacks, we consider a se-

curity game, referred to as G

S−CCA

), between a

challenger C and an adversary A. That is, A deﬁnes

a challenge access structure Γ

∗

, such that he can ask

for any private keys generation of a set of attributes

S as well as decryption queries of ciphertexts CT that

do not satisfy Γ

∗

. G

S−CCA

) is formally deﬁned as

follows:

INIT — C executes the setup algorithm, gives the

public parameters pp to A and keeps secret mk.

QUERIES — A can repeatedly make any of the

following queries for each session j:

• obtain : A queries for the secret jets {sk

}

j∈[1,t]

w.r.t. a set of attributes {S

}

j∈[1,t]

related to the

security level {k

l, j

• cordec : A sends the pair (CT

) and asks for

the decryption of a selected ciphertext CT

, based

on the private key associated to the set of attributes

. Note that if C has not previously extracted sk

related to S

, then C does the extraction based on

the obtain algorithm and outputs the result of the

decryption of CT

w.r.t. {k

l, j

} selected security

levels.

CHALLENGE — A submits two equal length mes-

sages M

and M

, gives the access policy Γ

∗

and the

set of security levels {k

}

∗

, such that none of the pre-

vious quiered sets {S

}

j∈[1,t]

satisﬁes Γ

∗

for {k

}

∗

Consequently, C ﬂips a coin b and encrypts M

un-

der Γ

∗

, w.r.t. {k

}

∗

. The resulting ciphertext CT

∗

then submitted to A.

GUESS — A outputs a guess b

of b. The output

of G

S−CCA

) is 1 if and only if b = b

Deﬁnition 4. SABE security w.r.t. G

S−CCA

)

A SABE scheme Π is selectively CCA secure (i.e;

selectively secure against chosen-ciphertext attacks)

for attribute universe S if for all probabilistic

polynomial-time adversaries A, there exists a negligi-

ble function ε, such that Pr[G

S−CCA

) = 1] =

±ε.

SABE: A Selective Attribute-based Encryption for an Efﬁcient Threshold Multi-level Access Control

159

5 SABE CONSTRUCTION

In this section, we ﬁrst introduce the access tree mo-

del (subsection 5.1) before detailing our SABE con-

crete construction (subsection 5.2).

5.1 Access Tree Model

In SABE, we consider that each access structure, re-

ferred to as Γ is deﬁned with respect to two levels:

• Level 1 – the ﬁrst level encompasses the root node

and its direct children. The root node is deﬁned as

-out-of-c security levels. Each security level k

requires at least p

subsets of attributes and n

sub-

trees of the root node for the reconstruction of the

corresponding secret key v

• Level 2 – it corresponds to interior nodes as well

as leaf nodes. Each interior node of the tree is a

threshold gate and the leaves are associated with

attributes, as detailed in Bethencourt et al. con-

struction (Bethencourt et al., 2007).

Note that the same notation as (Bethencourt et al.,

2007), is used to describe the access tree. Each

non-leaf node of Γ is expressed w.r.t. the number

of its children num

and a threshold value t

, where

1 ≤ t

≤ num

. As introduced in (Bethencourt et al.,

2007), three additional functions are deﬁned namely

parent(x), att(x) and index(x). The parent(x)

function denotes the parent of the node x, the att(x)

denotes the attributes associated with the leaf node x

and the index(x) denotes a number associated with

the node. We denote by Γ

the subtree of Γ rooted at

the node x. If a set of attributes S = {a

}

i∈[1,l]

, where

l is the number of attributes and l ≥ t

, satisﬁes the

access tree Γ

, it is referred to as Γ

(S) = 1.

Hence, Γ is rooted by the root node r. For in-

stance, depending on the number of the attributes l

and the number of subtrees n

rooted by the root node,

the user may decrypt CT

, w.r.t. k

, such that:

if ∃x

i∈[1,n

]

such that Γ

(S) = 1, then Γ

(S) = 1

where Γ

is the access tree for the security level k

5.2 Concrete Construction

SABE construction is based on the following algo-

rithms:

setup(κ) – this algorithm ﬁrst selects leveled 4-

linear maps. In fact, it deﬁnes two symmetric pairing

functions ˆe

and ˆe

, such that ˆe

: G

× G

→ G

and

ˆe

: G

× G

→ G

, where G

, G

and G

are three

multiplicative groups of prime order p. It also selects

three random generators g, h and f of G

, G

and G

respectively, such as ˆe

(g,g) = h and ˆe

(h,h) = f .

The setup algorithm deﬁnes for each security level

∈ K (i.e; K is the security level universe), an ele-

ment X

such as ∀k

= ˆe

(h,h)

, where i ∈ [1,n]

∈ Z

and n is the maximum number of security le-

vels. The public parameters pp are deﬁned as follows:

pp = {G

, ˆe

,g,h, f , p, n,{X

}

i∈[1,n]

}

The master key mk is the set of generators {h

}

i∈[1,n]

encrypt(pp,Γ, M,{k

}

l∈[1,c]

) – it ﬁrst selects a po-

lynomial q

for each node x and sets the degree d

each polynomial, to be less than the threshold value

such that d

= t

− 1 (i.e; t

is the threshold value of

the node x).

Let q

be the polynomial associated to the root

node and deﬁned as q

(x) = s + a

x + · · · + a

where d

= t

− 1. In the following, we denote by

the secret s.

Subsequently, for each security level k

, the

encrypt algorithm calculates t

− n

auxiliary con-

stants such as:

= {X

−a

,· ·· ,X

−a

−n

}

The ciphertext is presented as follows:

CT = {Γ, ∀k

= m

· X

,Σ

∀y : C

= g

(0)

= H (att(y))

(0)

}

where Y is the set of leaf nodes and H is a hash

function, such that H : {0,1}

∗

→ G

keygen(pp,mk,S ) – it chooses a random r ∈ Z

and a set of random values {r

} ( i.e; j is the number

of attributes of S). The private key sk associated to S

is deﬁned as:

sk = { ∀k

∈ K : D

= h

−1

∀a

∈ S : D

= g

· H ( j)

= g

}

decrypt(pp,CT, k

,sk) – for the decryption algo-

rithm, we assume that the decryptor satisﬁes the k

security level with n

sub-trees of Γ being satisﬁed.

This latter proceeds as follows:

• Level 2 – it works in a recursive manner, re-

lying on the DecryptNode function as presented

in (Bethencourt et al., 2007), resulting in F

ˆe

(g,g)

(0)

, for each node x that belongs to Level

2 of Γ.

• Level 1 – Let S

be the set of a n

-sized set of child

nodes x of the root node. Referring to the gene-

ralization of Shamir’s threshold scheme (Shamir,

SECRYPT 2018 - International Conference on Security and Cryptography

160

) (Hassler et al., 1993), the decryption algorithm

computes two vectors~y and ~a, such as

~y = {y

}

i∈[1,n

]

= {q

(index(x

))}

i∈[1,n

]

= {q

(0)}

i∈[1,n

]

and ~a = {a

}

i∈[0,d

]

, where a

are the coefﬁcients

of the root polynomial of degree d

Then, the decrypting entity deﬁnes a matrix U =

i j

} = {u

}, such as u

= index(x

) and ~y =

U ·~a.

Afterwards, the algorithm takes the ﬁrst and the

last n

− 1 columns of U and creates a sub-matrix

such that U

= {u

}, where i = 1, ··· , n

and

j = 0,t

− n

+ 1,t

− n

+ 2, ··· ,d

. Afterwards,

the decrypt algorithm computes the inverse ma-

trix of U

, referred to as U

−1

= {v

i j

}. The inverse

matrix is then used to form the following modi-

ﬁed system of equations: U

−1

·~y = U

−1

·U ·~a.

The ﬁrst equation of this system is of the form

= a

+ a

+ ·· · + a

−n

, where s

∑

j=1

1 j

To extract the deciphering key, the decrypt algo-

rithm computes F

such as:

∏

∈S

[ ˆe

(g,g)

(0)

]

(1)

= ˆe

(g,g)

∑

∈S

(0)v

(2)

= ˆe

(g,g)

(3)

The decrypt algorithm can now decrypt the cip-

hertext with respect to the k

-security level, such as:

ˆe

)

∏

k∈[1,t

−n

],z

∈Σ

· X

= m

(4)

6 SECURITY ANALYSIS

In this section, we ﬁrst prove the correctness of our

SABE scheme, in section 6.1. Then, we discuss the

security of our proposed scheme with respect to the

security model detailed in section 4.2.

6.1 SABE Correctness

The correctness of our proposition relies on the cor-

rectness of Equation 5:

ˆe

)

∏

k∈[1,t

−n

],z

∈Σ

= m

, (5)

where F

∏

∈S

[ ˆe

(g,g)

(0)

]

Upon receiving the ciphertext CT , the decrypting

entity proceeds as follows based on two levels:

• Level 2 – the decrypt algorithm works in a re-

cursive manner, relying on the algorithm Decrypt-

Node as presented in (Bethencourt et al., 2007).

For each non-leaf node x, having z child nodes,

the DecryptNode algorithm outputs F

such as :

∏

z∈S

i,S

(0)

= ˆe

(g,g)

(0)

where: S

is an arbitrary k

sized set of child no-

des z such that F

6= ⊥, i = index(z) and S

{index(z) : z ∈ S

}. We note that if no such S

ex-

ists then the node is not satisﬁed and the function

returns ⊥.

• Level 1 – after executing the DecryptNode algo-

rithm for all child-nodes of the root node, the

decrypt algorithm proceeds as follows: for the

ﬁrst level, we suppose that the deciphering entity

satisﬁes the k

-security level. Recall that for each

security level k

, S

is the n

-sized set of child

nodes x of the root node r. To extract the de-

ciphering key, the decrypting entity ﬁrst deﬁnes

the vectors ~a and ~y and the matrices U , U

and

−1

, with respect to k

as explained in section 5.

Then, it deﬁnes the equation s

= a

+ a

·· ·+a

−n

, where s

∑

j=1

1 j

and com-

putes F

as detailed in Equation 1.

For ease of presentation, we denote by r the quan-

tity

ˆe

)

∏

k∈[1,t

−n

],z

∈Σ

. Finally, the decrypt

algorithm deciphers the ciphertext with respect to the

-security level as follows:

r =

ˆe

−1

, ˆe

(g,g)

)

∏

k∈[1,t

−n

],z

∈Σ

ˆe

(h,h)

ˆe

(h,h)

−α

∑

k∈[1,t

−n

]

ˆe

(h,h)

−

∑

k∈[1,t

−n

]

)

· X

, (a

= s)

= m

6.2 Selective CCA-1 Security

The resistance of the SABE scheme against is se-

lective chosen ciphertexts attacks relies on Theorem

6.1.

Theorem 6.1. Our SABE scheme is secure against se-

lective non-adaptive chosen ciphertext attacks in the

Generic Group Model (GGM), under the DLP and the

CDH assumptions, with respect to the G

S−CCA

) se-

curity game.

SABE: A Selective Attribute-based Encryption for an Efﬁcient Threshold Multi-level Access Control

161

Proof. One of the main challenges to design our

SABE scheme was to prevent collusion attacks among

users. Hence, as our scheme is based on the CP-ABE

construction of Bethencourt et al. (Bethencourt et al.,

2007), it randomizes, in the same way, users’ private

keys such that they cannot be combined. In fact, each

secret element D

, related to an attribute j, encom-

passes a random value r associated to the user, and

related to the attribute j, which prevents colluding

users to override their rights. Subsequently, SABE is

resistant to collusion attacks. In addition, to decrypt

a ciphertext w.r.t. a security level k

, A must recover

= ˆe

(h,h)

·s

, where the secret sharing key s is

embedded in the ciphertext. For this purpose, A has

to retrieve the corresponding

and the related pri-

vate key element D

from the user’s private key.

To prove that our scheme is secure against

selective non-adaptive chosen ciphertext attacks, we

ﬁrst consider that A is running the G

S−CCA

expe-

riment with an entity B. This latter is running the

Exp

Bethencourt et al. security game (Bethencourt

et al., 2007), with C . The objective of this proof is to

show that the advantage of A to win the G

S−CCA

)

security game is equivalent to the advantage of B to

win the Bethencourt et al. security game (Bethen-

court et al., 2007). Hereafter, A and B proceed as

follows:

INIT — C executes setup, gives pp to B and keeps

secret mk. Consequently, B sends pp to A.

QUERIES — B sets an empty table T and repea-

tedly make the following queries, such that for each

session j:

• obtain : A queries {sk

}

j∈[1,t]

w.r.t. a set of

attribute {S

}

j∈[1,t]

associated to {k

l, j

} security

levels. That is, B uses C to derive and send

the queried secret keys to A. The private keys

{sk

}

j∈[1,t]

are returned to B. Subsequently, B

sets a new entry with the pair {sk

}

j∈[1,t]

and

returns {sk

j,GID

}

j∈N

to A.

• cordec : A sends (CT

) and queries for the

decryption result of the ciphertext CT

, w.r.t. S

Indeed, B checks if an entry sk

for S

does exist

in T w.r.t. {Γ

∗

l, j

} and retrieves sk

. Then, B

deciphers CT

and sends the result to A.

CHALLENGE — A submits two equal length messa-

ges M

and M

and gives the access policy Γ

∗

and

the set of security levels {k

}

∗

, such that none of

the previous sets {S

}

j∈[1,t]

satisﬁes Γ

∗

w.r.t. {k

}

∗

Consequently, B selects Γ

such that Γ

⊆ Γ

∗

. We

have to emphasize that all pre-identiﬁed subtrees ST

required to satisfy the security level {k

}

∗

have to be

included in the selected access structure Γ

Afterwards, B sends the access structure Γ

and the

two equal length messages M

and M

, deﬁned by A.

C ﬂips a coin b, encrypts M

under Γ

and sends the

resulting ciphertext {CT

}

∗

to A.

We distinguish two different cases for the

S−CCA

) game, as follows:

Case 0: we set only one security level k

∗

, during the

INIT phase such as the public parameter n deﬁned

by C is equal to 1. That is, all queried secret keys

are associated to the set of attributes S

that decrypt

ciphertexts, encrypted w.r.t. k

∗

, for each session i.

As such, we notice that the two ﬁrst steps INIT and

QUERIES of the G

S−CCA

) are similar to the (Be-

thencourt et al., 2007) experiment. Additionally, the

challenge access structure selected by A is equivalent

to the access policy deﬁned by B (i.e; Γ

= Γ

∗

where all sub-trees of Γ

∗

have to be included in Γ

Case 1: during the INIT phase, C deﬁnes several se-

curity levels, where n 6= 1. Thus, we point out two

sub-cases as follows:

• Case 1-a : during QUERIES, a single security le-

vel is selected, such that all queried cordec have

to return response w.r.t. the pre-ﬁxed k

∗

, whereas

queried private keys are encoded under different

security levels, for each session i. That is, B has

to select Γ

where subtrees ST

required to satisfy

each selected security level {k

}

∗

of Γ

∗

have to be

included in Γ

• Case 1-b: during QUERIES, the attacker A sends

cordec queries to the challenger C with respect

to different security levels {k

l,i

} for each different

session i and a ciphertext CT

. We note that CT

may be encoded under different security levels.

During the challenge phase, A sends two diffe-

rent messages M

and M

and asks C to encipher

the selected message under a security level k

∗

that

has never been queried during QUERIES. Hence,

B chooses Γ

such that identiﬁed subtrees ST

re-

quired to satisfy the security level {k

}

∗

of Γ

∗

have

to be included in Γ

In the G

S−CCA

) security game, including Case 0

and Case 1, the challenge ciphertext has a component

which is either M

· X

or M

· X

(i.e; s is

the enciphering secret key). Hence, we consider

a modiﬁed game, deﬁned in (Bethencourt et al.,

2007), in which

is either ˆe

(h,h)

·s

or ˆe

(h,h)

where θ is selected uniformly at random. A has to

guess which is the case. The adversary’s advantage

is obviously equal to ε in the original security game.

In fact, no efﬁcient adversary A can output b

= b,

SECRYPT 2018 - International Conference on Security and Cryptography

162

in the security experiment Exp

), better than a

random guess. Recall that a random guess b

by A is

equal to b, with a probability 1/2. Thus, we call ε the

advantage of A if b

= b with the probability 1/2 ± ε.

As such, in the modiﬁed game, the adversary

advantage is at least ε/2, while considering two

equivalent sub-cases: when A has to distinguish

between M

· X

and ˆe

(h,h)

and when A has to

distinguish between M

·X

and ˆe

(h,h)

. Hereafter,

we consider A’s advantage in the modiﬁed game.

S−CCA

) Game Analysis – As introduced in

(Bethencourt et al., 2007) (Boneh et al., 2005), each

element of G

, G

and G

is encoded as a uni-

que random. The encoding properties of elements in

is presented by ξ

0,i

: Z

→ {0,1}

∗

that maps all

a ∈ Z

to the representation ξ

0,i

(a) of g

∈ G

and

T,i

: Z

→ {0, 1}

∗

that maps all a ∈ Z

to the repre-

sentation ξ

T,i, j

(a) of ˆe

(g,g)

∈ G

(i ∈ {1,2,3} and

j ∈ {1,2}). The adversary communicates with the

oracles to perform actions in G

, G

, ˆe

and ˆe

based on ξ

0,i

and ξ

T,i, j

representations.

For Case 0, during the INIT phase, C sets n = 1, choo-

ses α ∈ Z

and sends the public parameters ξ

0,1

(1) =

g,ξ

0,2

(1) = h and ξ

T,3,2

(α) to the adversary. Subse-

quently, B initializes an empty table T . Then, du-

ring QUERIES, A queries several times obtain and

cordec algorithms. For each obtain query, C si-

mulates the H oracle function for each string i ∈ S

queried in session j. The H oracle outputs g

for

each different queried i. In the sequel, for a session j,

obtain selects a random r

( j)

, computes D

= h

α/r

( j)

Then, for each i ∈ S

, it provides D

= g

( j)

and

= g

( j)

. Then, B sets these computed values as

new entries in T, and sends them to A.

Then, for the cordec oracle, A submits (S

,CT

)

and asks for the decryption of CT

, w.r.t. the pre-

deﬁned security level k

∗

. Hence, B performs the

decryption of CT

( j)

for each session j and provides

a message M

or an error message if the set of at-

tributes does not satisfy the access policy w.r.t. the

pre-deﬁned security level. Clearly, the SABE con-

struction is close to the CP-ABE construction propo-

sed by Bethencourt et al. (Bethencourt et al., 2007).

The main difference consists in the derivation of the

embedded shared secret, obfuscated in the exponent

of the related pairing function. Indeed, in addition to

Lagrange interpolation proposed by the (Bethencourt

et al., 2007) scheme, in our proposal, the processing

of Level 1 of an access structure Γ, with respect to

∗

requires pointing out the correct public element

∗

(h,h)

, which is different for each level.

As such, to prove that Case 0 is close to the

(Bethencourt et al., 2007) construction, we consider

an absurdum reasoning, where A can win Exp

with non-negligible probability. To do so, we con-

sider that the root polynomial in Exp

is equal to

r,Exp

(x) =

∑

i=0

, where a

= s. In the sequel, we

easily verify that there exists one polynomial q

r,Exp

such that q

r,Exp

∑

i=0

and

∑

j=1

∑

i=0

= s.

To do, we consider p − 1 random values a

, where

i ∈ [1, p−1]. As such, we have the following equality:

∑

j=1

∑

i=0

= s =

∑

j=1

p−1

∑

i=0

∑

j=1

(6)

Following Equation 6, we notice that:

s −

∑

j=1

∑

p−1

i=0

∑

j=1

(7)

From Equation 6 and Equation 7, it is worth noti-

cing that the polynomial q

r,Exp

exists. Consequently,

A receives the challenge ciphertext CT

. If the ad-

versary A can win the Exp

experiment with a non-

negligible probability, then A can guess b

which is

therefore sent to B. As such, B can win the secu-

rity game Exp

, introduced in (Bethencourt et al.,

2007) with a non-negligible probability. This contra-

dicts our assumption that (Bethencourt et al., 2007)

is proved secure in GGM. Additionally, for Case 0

of G

S−CCA

), the INIT, QUERIES and CHALLENGE

phases relies on one single security level, such that M

contains one single data block w.r.t. the k

security le-

vel, this ﬁrst case follows the selective CCA-security

of the Bethencourt et al.’s CP-ABE scheme (Bethen-

court et al., 2007). In the sequel, the advantage of A is

at most equal to O(

), where p is the order of an ad-

ditive group F

and q is a bound on the total number

of group elements received by any adversary A from

its interaction with the G

S−CCA

) game.

For Case 1, during the INIT phase, C deﬁnes n and

sends the public parameters ξ

0,1

(1) = g,ξ

0,2

(1) = h

and ∀ j ∈ [1, n],ξ

T,3,2

(α

) to B. Let us notice that

Case 1 can be modeled in multi-user setting, such

that there are multiple public keys and multiple chal-

lenge ciphertexts that can be dependent. In our case,

the public keys correspond to the security levels’ pu-

blic parameters X

and challenge ciphertexts consist

of the different chuncks of the challenge message

∗

= {m

∗

}

l∈[1,c

∗

]

. Hence, Case 1 is a generaliza-

tion of selective CCA security in the multi-user set-

ting and the adversary A, having access to n different

public keys, can perform multiple Left-or-Right que-

ries. These challenge ciphertexts must be created with

the same selector b; i.e; all ciphertexts are encryption

SABE: A Selective Attribute-based Encryption for an Efﬁcient Threshold Multi-level Access Control

163

of the left input, or all ciphertexts are encryption of

the right input.

During the CHALLENGE phase, we distinguish

Case 1-a, where A sends two messages M

and M

the access structure Γ

∗

and a security level k

∗

; and

Case 1-b where A sends two messages M

and M

and the access structure Γ

∗

, which has to be encryp-

ted with respect to a set of security levels {k

∗

First, for Case 1-a, as the encryption is performed

w.r.t. a single security level k

∗

, then the challenge

message has to be composed of one single data block

and the cardinal of the set of auxiliary constants is

equal to 0 (i.e; |Σ

| = 0 ). As the sequel, the progress

of the CHALLENGE phase of Case 1-a is similar to

Case 0, leading us to an adversary advantage equal at

most to O(

Second, for Case 1-b, when A asks for the encryp-

tion of the challenge message, C does the following.

C ﬁrst chooses a random s ∈ F

and uses the linear se-

cret sharing scheme associated with the access struc-

ture Γ

∗

to construct the shares σ

and λ

of s for all

relevant sub-trees k and attributes i, respectively. As

detailed in (Bethencourt et al., 2007), both λ

and σ

shares have to be chosen uniformly and independently

at random values from F

. Subsequently, the simu-

lation chooses µ randoms θ

∈ F

, where l ∈ [1, µ]

and µ is the cardinal of the set of security levels

∗

}

l∈[1,µ]

. Finally, C outputs the encryption of the

challenge message such that: for each security level

, we have

= ˆe

(h,h)

and Σ

= {ξ

T,3,2

(α

)

−σ

where t ∈ [1,t

− n

] and l ∈ [1, µ] (cf; section 5.2).

For each relevant attribute i, we have C

= g

and

= g

. These values are then sent to the advers-

ary. We state that if A asks for a decryption key for a

set of attributes that satisfy Γ

∗

w.r.t. any security le-

vel, then C does not issue the key. Similarly, if A asks

for Γ

∗

, w.r.t. any security level, such that one of the

keys is already issued then the simulation aborts. In

the sequel, the advantage of the adversary is at most

equal to O(µ

), due to the randomness of the choice

of variable values in the simulation.

In fact, knowing that this randomization is requi-

red for generating the ciphertext, A is led to break the

CDH assumption. The G

S−CCA

) security is then

considered with respect to the CDH-assumption. In-

tuitively, here, B relies on the capabilities of A to

forge a ciphertext C

obtained from interactions with

C in Exp

. Since A and B algorithms are based on

coin tosses, the ﬁrst condition for B to succeed is that

it does not abort the game before A. In (Ahn et al.,

2012), this probability has been shown to be

if the

probability for the coin ﬂipping to be 0 is

, where

is the number of ciphertexts’ queries. The other

condition of the attacker is to be able to identify the

value of λ

for each C

or to guess the value θ

to a security level k

. After a time t

, this probability

is equal to

. This shows that B can violate the

CDH-assumption with a probability equal to

e(ξ

+1)

which conﬂicts the fact that G

is a (t,ε)-CDH group.

Indeed, the adversary’ view in this simulation is iden-

tically distributed for all security levels. In fact,

despite the multi-user setting environment, the en-

cryptions of data blocks of the challenge message M

are completely independent, thanks to the use of the

encoding function ξ

T,3,2

. As such, Case 1-b can be

considered as µ random repetitions of Case 0 simula-

tion, with respect to µ security levels.

As such, we prove that our SABE construction is

secure against selective non-adaptive chosen cipher-

texts attacks in the Generic Group Model (GGM), un-

der the DLP and the CDH assumptions, with respect

to Exp

) experiment.

7 SABE PERFORMANCES

DISCUSSION

In this section, we discuss the functional properties

as well as the processing, communication and storage

cost of our SABE construction compared to the naive

computing approach NC introduced in section 2.2 and

two of the most closely related schemes (Kaaniche

and Laurent, 2017a), (Khan et al., 2016). That is, we

ﬁrst present a theoretical performance analysis, ba-

sed on mathematical operations’ complexities, in sub-

section 7.1. Then, we discuss measurement results of

different mathematical operations’ computation and

present an estimation of the different SABE algo-

rithms calculation times, relying on the cpabe toolkit

. Finally, we discuss the support of the threshold fe-

ature when designing multi-level access control sche-

mes in subsection 7.3.

7.1 Theoretical Performance Analysis

For our theoretical performance analysis, we assess

the theoretical complexity where the encrypting en-

tity has to create k different access control policies,

associated to k different security levels, for the naive

approach. To this purpose, we deﬁne, in Table 1 the

following costs:

Table 2 presents detailed computation, communi-

cation and storage overhead comparison, based on the

processing cost of the encryption and decryption al-

gorithms and the size of the ciphertext. Note that the

http://acsc.cs.utexas.edu/cpabe/index.html

SECRYPT 2018 - International Conference on Security and Cryptography

164

Table 1: Notations.

Notations Description

cost of two group elements’ multiplication in a multiplicative group

cost of an exponentiation in a multiplicative group

cost of a symmetric pairing function computation

cost of a leveled multi-linear map computation

|MT | size of an aggregate access tree, referred to as master tree

|AT| size of an access tree for an access policy k

number of auxiliary elements associated to a security level k

number of leaves of the master access tree

number of interior nodes of the master access tree

number of leaves of an access tree, with respect to an access policy k

number of interior nodes of an access policy associated to a security level k

|E| size of a multiplicative group element

communication and storage overhead are both refer-

ring to the size of the ciphertext.

It is worth noticing that the size of the master access

tree, proposed in our SABE construction, is lower

than the size of the set of access trees related to k

access policies introduced by the naive approach NC.

This is mainly due to the involved number of attri-

butes (access tree leaves), that should be duplicated

for different access trees in NC. Obviously, the num-

ber of leaves of the master tree Y

is lower than the

sum of leaves of access trees related to k access struc-

tures of NC, such that Y

≤

∑

. As such, our

SABE approach presents competitive communication

and storage costs, compared to the NC approach. No-

tice that the ciphertext size of our SABE scheme

is comparable to the (Khan et al., 2016) proposal.

Otherwise, our SABE construction presents larger

ciphertext-sizes compared to (Kaaniche and Laurent,

2017a), due to additional auxiliary elements associa-

ted with security levels. Indeed, these group elements

permit our SABE scheme to provide the threshold fe-

ature, which is not supported by either (Kaaniche and

Laurent, 2017a) nor (Khan et al., 2016) schemes.

In addition, based on the NC approach, the encip-

hering entity has to create an access tree AT to each

different security level. Thus, he has to assign dif-

ferent polynomials to each node of each access tree,

during the encryption phase. Consequently, the pro-

cessing and communication costs introduced by the

SABE approach are considerably optimized, where

the number of polynomials, that have to be assigned

to each node of an access tree, is reduced compa-

red to NC, thanks to the use of an aggregate access

structure. For the decrypt algorithm, SABE introdu-

ces merely the same computation cost generated by

the decryption procedure of (Kaaniche and Laurent,

2017a) and (Khan et al., 2016), except with only one

extra multi-linear map calculation. This processing

overhead remains interesting and attractive thanks to

the support of threshold feature offering more ﬂexi-

bility for access policies’ deﬁnition, as discussed in

subsection 7.3.

7.2 Numerical Performance Analysis

Referring to the cpabe toolkit

proposed in (Be-

thencourt et al., 2007), the computation costs of the

key generation, encryption and decryption algorithms

are mainly depending on the number of attributes.

The cpabe toolkit provides a set of programs imple-

menting CP-ABE schemes (Bethencourt et al., 2007),

using the PBC library

for the algebraic operati-

ons. The code is split into two packages, libbswabe

(i.e; a library implementing the core cryptographic

operations) and cpabe (i.e; higher level functions

and user interface), proving four main algorithms,

namely cpabe − setup, cpabe − keygen, cpabe − enc

and cpabe − dec. To give some information on the

performance achieved by our scheme, some experi-

ments are conducted, for several mathematical opera-

tions (i.e; exponentiation, multiplication and pairing

functions) on an Intel E5-1650-v3 6 cores, where each

core relies on 1200 MHz. We set the security para-

meter to λ = 112, based on the super-singular curve

= x

+x over a ﬁnite ﬁeld and we run 1000 samples

for getting an average duration.

Our measurements show that the computation of

a symmetric pairing function requires approximately

6 ms, exponentiations and multiplications take about

1.2 ms and 0.5 ms, respectively. In addition, as stated

above, based on the cpabe toolkit, the calculation of

the cpabe − keygen algorithm, similar to the keygen

algorithm of our proposed algorithm, is perfectly li-

near to the number of attributes. It takes about 1

second for generating a private key containing around

30 attributes (Bethencourt et al., 2007). Moreover,

it is worth noticing that our encrypt algorithm fol-

lows the (Bethencourt et al., 2007) construction, ex-

cept for the generation of auxiliary elements, depen-

ding on the execution of exponentiations and multi-

plications in a multiplicative group. In the sequel,

the running time of the decrypt algorithm is also al-

most perfectly linear to the number of attributes invol-

ved in the access policy, where the execution time of

cpabe − enc algorithm takes 1.5 seconds for 60 gates

(i.e; leaf nodes).

7.3 Threshold Support

Unlike (Kaaniche and Laurent, 2017a), (Khan et al.,

2016) schemes and the NC approach, our SABE con-

struction provides the threshold feature, as shown in

Table 2. This property aims at offering more ﬂexibi-

lity while deﬁning multiple access policies.

http://acsc.cs.utexas.edu/cpabe/index.html

https://crypto.stanford.edu/pbc/

SABE: A Selective Attribute-based Encryption for an Efﬁcient Threshold Multi-level Access Control

165

Table 2: Theoretical Performance Comparisons.

Scheme Processing cost Ciphertext size Threshold

encrypt decrypt support

(Kaaniche and Laurent, 2017a) kγ

+ 2k(1 +Y

)γ

(η

)[2γ

+ γ

] + (zη

+ 2)γ

+ γ

{|MT|,2(k +Y

)|E|} 7

(Khan et al., 2016) 2(k + 1)γ

+ 2(k + 1)(1 +Y

)γ

(η

)[2γ

+ γ

] + (zη

+ 2)γ

+ γ

{|MT|,2(k + 1)|E| + 2Y

|E|} 7

NC kγ

+ 2k(1 +Y

)γ

(η

)[2γ

+ γ

] + (zη

+ 2)γ

+ γ

{k|AT|,2k(1 +Y

)|E|} 7

SABE kγ

+ 2[k(2 + η

) + Y

]γ

(η

)[2γ

+ γ

] + (zη

+ 2)γ

+ γ

{|MT|,[k(2 + η

) + 2Y

]|E|} X

Nonetheless, our approach is not convenient when

deﬁning different independent access policies under

the same master access tree (i.e; there is no duplicated

attributes for each deﬁned security level k). Hence, in

such use-cases, the NC approach is much more appro-

priate in terms of processing (i.e; encryption process)

and communication costs, mainly due to {η

}

, the

set of auxiliary elements that has to be associated to

each message m

enciphered with respect to a security

level k, where k ∈ [1,c].

Furthermore, it is still inappropriate for hierarchi-

cal scenarios that require restrictive privileges, such

as for military services. That is, these use cases of-

ten rely on encapsulated access structures, deﬁned by

hierarchical levels of security, such that each higher

level of security k +1 introduces additional attributes,

compared to the security level k, that have to be satis-

ﬁed with respect to the related access policy AT

k+1

Finally, thanks to the use of a threshold approach

for access policies’ deﬁnition, SABE presents interes-

ting computation, communication and storage over-

head in collaborative use cases, where each security

level requires the deﬁnition of several combinations

of sub-access policies.

8 POSSIBLE APPLICATIONS

Our SABE scheme comes as an alternative that aims

at providing sufﬁcient security with an important gain

in processing and communication overhead. In the

following, we discuss a set of potential applications

for selective attribute based encryption mechanisms,

namely monitoring encrypted content, database

search as well as mobile communications.

Monitoring Encrypted Content – this case highlig-

hts situations when encrypted contents are usable for

monitoring. For example, several applications such as

military images, media audience or video surveillance

where some faces have to be scrambled, require iden-

tifying partially encrypted data ﬁles with no need to

decrypt the whole contents. Indeed, our SABE me-

chanism permits to decrypt parts of the enciphered

contents with respect to assigned credentials under

different security levels.

Database Search – nowadays, databases hold a

critical concentration of sensitive information and

their volume is increasing very quickly. In such

cases, database outsourcing is becoming increasingly

popular. Clients’ databases are stored at an external

service provider that should provide mechanisms

for securing access to these contents, mainly by

encrypting the outsourced data. However, the

problem consists in ensuring a selective retrieval

over encrypted data. Several existing access control

mechanisms, designed for distributed applications,

operate on client-server architectures with respect

to the basic assumption that the remote server is

in charge of deﬁning and enforcing access control

policies. As such, our SABE scheme addresses the

problem of enforcing access control by following

up data encryption. The idea is concretely to use

different encryption keys for different security levels

as proposed, for example, for XML documents. To

access such encrypted data, users have to decrypt

them by using the appropriate deciphering key. If dif-

ferent users know different keys, with respect to their

assigned credentials, they have different access rights.

Mobile Communication – mobile phones, PDAs

and various mobile terminals are more and more often

used for multimedia communication that require efﬁ-

cient access control mechanisms. Resource consump-

tion is the main limiting factor for the development

and deployment of such security mechanisms. This is

mainly due to the nature of the smart things, which are

resource-impoverished nodes where the implementa-

tion of heavy cryptographic primitives is unfeasible.

The resource consumption in mobile communications

is tied up to the amount of data being processed, sto-

red, and transmitted. As such, reducing the amount

of processed and transmitted data can effectively save

energy. Our SABE mechanism can be considered as

a promoting solution that permits to save computing

and storage capabilities of mobile terminals by remo-

ving redundant processed information within the net-

work ﬂow. For example, our selective attribute based

encryption technique should be a candidate for pro-

tecting content in a home multimedia network where

some of the receiving devices are expected to be mo-

bile (i.e., resource-constrained) or meant to be very

inexpensive. So that, saving computational complex-

ity is very important.

SECRYPT 2018 - International Conference on Security and Cryptography

166

9 CONCLUSION

In this paper, we propose a novel cryptographic me-

chanism to ensure multi-level access control, based

on the use of an attribute based encryption scheme.

Our selective attribute based encryption mechanism

SABE, enables the enciphering user to encrypt the

same data content, based on an ABE aggregate access

tree, and the deciphering entity to decrypt the sub-

sets of data blocks with respect to a security level k

Indeed, SABE supports a ﬁne grained access control

mechanism with low processing costs, which is di-

rectly inherited from the expressiveness of ciphertext-

policy attribute based encryption for deﬁning access

policies. Additionally, our proposal is proven secure

against selective, non-adaptive chosen ciphertext at-

tacks in the generic group model. Besides, a quan-

titative comparison of SABE with the naive com-

puting approach shows the gain of our construction

with respect to the processing and communication

costs, especially due to the use of an aggregate access

structure. Finally, we present the potential of SABE

technique to support security and privacy in concrete

networking and computing applications.

REFERENCES

Ahn, J. H., Boneh, D., Camenisch, J., Hohenberger, S., She-

lat, A., and Waters, B. (2012). Computing on authen-

ticated data. In Proc. of TCC, LNCS.

Beimel, A. (2011). Secret-sharing schemes: A survey.

IWCC’11.

Belguith, S., Kaaniche, N., Jemai, A., Laurent, M., and At-

tia, R. (2016). Pabac: a privacy preserving attribute

based framework for ﬁne grained access control in

clouds. In SECRYPT 2016: 13th International Confe-

rence on Security and Cryptography, volume 4, pages

133–146. Scitepress.

Bethencourt, J., Sahai, A., and Waters, B. (2007).

Ciphertext-policy attribute-based encryption. In Pro-

ceedings of the 2007 IEEE Symposium on Security

and Privacy, SP ’07, Washington, DC, USA. IEEE

Computer Society.

Boneh, D., Boyen, X., and Goh, E.-J. (2005). Hierarchical

Identity Based Encryption with Constant Size Cipher-

text. Springer Berlin Heidelberg.

Di Vimercati, S. D. C., Foresti, S., Jajodia, S., Paraboschi,

S., Pelosi, G., and Samarati, P. (2010). Encryption-

based policy enforcement for cloud storage. In Dis-

tributed Computing Systems Workshops (ICDCSW),

2010 IEEE 30th International Conference on, pages

42–51. IEEE.

di Vimercati, S. D. C., Foresti, S., Jajodia, S., Paraboschi,

S., and Samarati, P. (2013). On information leakage

by indexes over data fragments. In Data Engineering

Workshops (ICDEW), 2013 IEEE 29th International

Conference on, pages 94–98. IEEE.

Garg, S., Gentry, C., Halevi, S., Sahai, A., and Waters,

B. (2013). Attribute-based encryption for circuits

from multilinear maps. In Advances in Cryptology–

CRYPTO 2013, pages 479–499. Springer.

Hassler, H., Posch, R., and Risti

c, V. (1993). Unique Keys

Enabling Multithreshold Schemes. IIG-report-series /

Institutes for Information Processing Graz / Institute

fur Informationsverarbeitung Graz: IIG-report-series.

Institutes for Information Processing Graz.

Hohenberger, S., Sahai, A., and Waters, B. (2013). Full

domain hash from (leveled) multilinear maps and

identity-based aggregate signatures. In Advances in

Cryptology–CRYPTO 2013, pages 494–512. Springer.

Horv

ath, M. (2015). Attribute-based encryption optimized

for cloud computing. In SOFSEM 2015: Theory and

Practice of Computer Science, pages 566–577. Sprin-

ger.

Huang, Q., Yang, Y., and Shen, M. (2016). Secure and ef-

ﬁcient data collaboration with hierarchical attribute-

based encryption in cloud computing. Future Genera-

tion Computer Systems.

Hur, J. and Noh, D. K. (2011). Attribute-based access con-

trol with efﬁcient revocation in data outsourcing sys-

tems. IEEE Transactions on Parallel and Distributed

Systems, 22(7):1214–1221.

Jahid, S., Mittal, P., and Borisov, N. (2011). Easier:

Encryption-based access control in social networks

with efﬁcient revocation. In The 6th ACM Symposium

on Information, Computer and Communications Se-

curity, pages 411–415. ACM.

Kaaniche, N. and Laurent, M. (2017a). Attribute based en-

cryption for multi-level access control policies. In SE-

CRYPT 2017: 14th International Conference on Secu-

rity and Cryptography, volume 6, pages 67–78. Scite-

press.

Kaaniche, N. and Laurent, M. (2017b). Data security and

privacy preservation in cloud storage environments

based on cryptographic mechanisms. Computer Com-

munications, 111:120–141.

Khan, F., Li, H., and Zhang, L. (2016). Owner speciﬁed ex-

cessive access control for attribute based encryption.

IEEE Access, 4:8967–8976.

Sahai, A. and Waters, B. (2005). Fuzzy identity-based

encryption. In EUROCRYPT 2005, pages 457–473.

Springer.

Shamir, A. How to share a secret. Commun. ACM, 22(11).

Yu, S., Wang, C., Ren, K., and Lou, W. (2010). Attribute

based data sharing with attribute revocation. In The

5th ACM Symposium on Information, Computer and

Communications Security, pages 261–270.

SABE: A Selective Attribute-based Encryption for an Efﬁcient Threshold Multi-level Access Control

167