Privacy Enhanced DigiLocker using Ciphertext-Policy Attribute-Based
Encryption
Puneet Bakshi and Sukumar Nandi
Department of Computer Science and Engineering, Indian Institute of Technology, Guwahati, Assam, India
Keywords:
DigiLocker, Privacy, CP-ABE.
Abstract:
Recently, Government of India has taken several initiatives to make India digitally strong such as to provide
each resident a unique digital identity, referred to as Aadhaar, and to provide several online e-Governance
services based on Aadhaar such as DigiLocker. DigiLocker is an online service which provides a shareable
private storage space on public cloud to its subscribers. Although DigiLocker ensures traditional security
such as data integrity and secure data access, privacy of e-documents are yet to addressed. Ciphertext-Policy
Attribute-Based Encryption (CP-ABE) can improve data privacy but the right implementation of it has always
been a challenge. This paper pressents a scheme to implement privacy enhanced DigiLocker using CP-ABE.
1 INTRODUCTION
In last decade, Government of India has taken several
e-Governance initiatives such as a unique digital iden-
tity (referred to as Aadhaar (UIDAI, 2009)) for ev-
ery resident, online Aadhaar based authentication and
several online citizen centric services such as eKYC,
eSign, and DigiLocker. At present, most of these ser-
vices are built using traditional Public Key Infrastruc-
ture (PKI) with limited data privacy in which spec-
ifying authorized entities beforehand which are per-
mitted to access data may not be possible and even if
possible, the solution may not scale.
In DigiLocker (GoI, 2015), documents of sub-
scribers are hosted on public cloud which is assumed
to be a trusted entity. However, cloud storage may
not be trustyworthy and may be susceptible to in-
sider attacks. Moreover, instead of providing a re-
active access authorization to a single requester (us-
ing OAuth2 (IETF, 2012)), a subscriber may want to
provide a proactive access authorization to multiple
requester meeting certain criteria of attributes.
Ciphertext-Policy Attribute-Based Encryption
(CP-ABE) (Bethencourt et al., 2007) is a recent
cryptogrpahic mechanism which can improve data
privacy, but the right implementation and efficiency
of it are still some of the major concerns for its
wide deployment. This paper presents a scheme to
implement privacy enhanced DigiLocker based on
CP-ABE.
2 RELATED WORK
Recent developments in cryptography have intro-
duced Attribute-Based Encryption (ABE) (Goyal
et al., 2006) in which encryption is done under a set
of attributes. ABE is classified in Key-Policy ABE
(KP-ABE) (Goyal et al., 2006) and CP-ABE. In KP-
ABE, access policy is encoded in subscriber’s private
key and a set of attributes are encoded in ciphertext.
In CP-ABE, access policy is encoded in ciphertext
and a set of attributes are encoded in subscriber’s pri-
vate key. In CP-ABE, only if the set of required at-
tributes encoded in receiver’s private key satisfies the
access policy encoded in received ciphertext, will the
receiver be able to decrypt the ciphertext. Since the
introduction of CP-ABE, researchers have proposed
innovative mechanisms to use it to improve data pri-
vacy (Zhou and Huang, 2012), (Ji et al., 2014).
3 DIGITAL LOCKERS IN INDIA
DigiLocker is an Aadhaar based online service which
facilitates subscribers to store e-documents, issuer
agencies to provide e-documents and requester appli-
cations to get access to e-documents. An e-document
is a digitally signed electronic document. Reposi-
tores are provided by issuers to host collection of e-
documents. Digital Locker is a storage space pro-
vided to each subscriber to store e-documents. Re-
quester is an application which seeks access to some
Bakshi, P. and Nandi, S.
Privacy Enhanced DigiLocker using Ciphertext-Policy Attribute-Based Encryption.
DOI: 10.5220/0009777205410546
In Proceedings of the 17th International Joint Conference on e-Business and Telecommunications (ICETE 2020) - SECRYPT, pages 541-546
ISBN: 978-989-758-446-6
Copyright
c
 2020 by SCITEPRESS – Science and Technology Publications, Lda. All rights reserved
541

e-document. All participating entities must adhere to
Digital Locker Technology Specification (DLTS) (Me-
itY, 2019).
An e-document is uniquely identified by a Unique
Resource Identifier (URI) which is a triplet of the form
hIssuerID :: DocType :: DocIDi, where IssuerID is a
unique identifier ot the issuer, e.g., CBSE, for Central
Board of Secondary Education. DocType is a classi-
fication of e-documents as defined by the issuer. For
example, CBSE may classify certificates into MSTN
for 10th mark sheet and KVYP for certificates issued
to KVPY scholarship fellow. DocType also helps is-
suers to use different repositories for different types
of e-documents. DocID is an issuer defined unique
identifier (an alphanumeric string) of the e-document
within a document type. Some hypothetical examples
of e-document URI are hCBSE :: MSTN :: 22636726i,
hDLSSB :: HSMS :: GJSGEJXSi. DigiLocker ensures
data integrity of e-documents by mandating that all
e-documents are digitally signed by issuers.
When an issuer is registered, it provides two APIs,
namely, PullDoc to pull an e-document based on a
given URI and PullUri to pull all URIs meeting a
given search criteria. When a requester application is
registered, it is given a unique requester identifier, a
secret key which is shared between DigiLocker and
requester application and a FetchDoc API is given
to access e-documents based on URI. Based on the
URI, FetchDoc forwards the request to approprirate
issuers to retrieve the e-document. DigiLocker en-
sures secure data access of e-documents by API li-
cense keys, secure transport, an explicit authentica-
tion (if required by DocType) and all requests and re-
sponses to be digitally signed.
4 PRELIMINARIES
This section briefly describes some of the necessary
background.
4.1 Bilinear Pairings (Zhang et al.,
2004)
Let G
1
and G
2
are elliptic groups of order p, G
T
is
a multiplicative group of order p, g
1
is a generator of
G
1
, g
2
is a generator of G
2
, P ∈ G
1
, Q ∈ G
2
and a, b
∈ Z
p
, then a bilinear pairing is a map e : G
1
× G
2
→
G
T
that satisfies the following three properties.
1 Bilinearity: e(P
a
,Q
b
) = e(P,Q)
ab
2 Non-Degeneracy: e(g
1
,g
2
) 6= 1
3 Computability: e(P,Q) can be computed effi-
ciently.
4.2 Decision Bilinear Diffie-Hellman
(DBDH) Assumption (Yacobi, 2002)
Let G, G
T
are cyclic groups of prime order p >
2
λ
where λ ∈ N, g is the generator of G, e :
G × G → G
T
is an efficiently computable sym-
metric bilinear pairing map and a,b,c,z ∈ Z
p
are
random numbers. The DBDH assumption states
that no probabilistic polynomial time algorithm
can distinguish between hg, g
a
,g
b
,g
c
,e(g,g)
abc
i and
hg,g
a
,g
b
,g
c
,e(g,g)
z
i with more than a negligible ad-
vantage.
4.3 Security Model
The security model of proposed scheme is based on
the following IND-sAtt-CPA game (Ibraimi et al.,
2009) between a challenger and an adversary A.
Init Phase. Adversary A chooses a challenge access
tree T
∗
and gives it to challenger.
Setup Phase. Challenger runs a setup procedure to
generate hASK,APKi and gives the public key APK
to adversary A.
Phase I. Adversary A makes an attribute- based pri-
vate key request to the key generation oracle for any
attribute set with the restriction that the attribute set
should not include any attribute which is part of T
∗
.
Challenger generates the key as described in section
5.4 and returns the same to adversary A.
Challenge Phase. Adversary A sends two equal
length messages m
0
and m
1
to challenger. Challenger
chooses a random number b ∈
R
{0,1}, encrypts m
b
using T
∗
and APK as is described in section 5.3.
Phase II. Adversary A can send multiple requests to
generate attribute-based private key with the same re-
striction as in Phase I.
Guess Phase. Adversary A outputs a guess b0 ∈
{0,1}.
The advantage of adversary A in this game is de-
fined to be ε = |Pr[b0 = b] −
1
2
|. Only if any polyno-
mial time adversary A has a negligible advantage, the
scheme is considered secure against an adaptive cho-
sen plaintext attack (CPA).
4.4 Access Tree
Access tree structure is a means to specify an ac-
cess policy during encryption that must be satisfied by
attribute-based private keys in order to decrypt. Let T
be a tree representing an access structure. Each non-
leaf node of the tree represents a threshold gate, de-
scribed by its children and a threshold value. If num
x
SECRYPT 2020 - 17th International Conference on Security and Cryptography
542

is the number of children and k
x
is the threshold value
of a node x, then, k
x
= 1 represents an OR gate and
k
x
= num
x
represents an AND gate. Each leaf node x
of the tree is described by an attribute and a threshold
value k
x
= 1.
Let T
x
denotes the subtree rooted at node x. If a
set of attributes λ satisfies the subtree T
x
, it is repre-
sented as T
x
(λ) = 1. T
x
(λ) is computed recursively
as follows. If x is a non-leaf node, evaulate T (y) for
all children nodes y of node x. T
x
(λ) returns 1 if and
only if at least k
x
children return 1. If x is a leaf node,
then T
x
(λ) returns 1 if and only if attr(x) ∈ λ.
5 OUR CONSTRUCTION
The proposed scheme introduces two new roles,
namely, Attribute Authority Manager (AAM) and At-
tribute Authority (AA). AAM is an entity which man-
ages the universe of attributes and AA is an entity
which manages a set of attributes (as assigned by
AAM). DigiLocker is proposed to assume the role of
AAM and individual issuers are proposed to assume
the role of AA. A subscriber is assigned a set of at-
tributes from each issuer which holds at least one e-
document of the subscriber. Each requester applica-
tion is assigned a set of attributes from DigiLocker
based on certain criteria such as purpose of access,
for how long the data is going to be used, etc. To cre-
ate a privacy enhanced e-document for a subscriber,
issuer and susbcriber mutually creates an attribute-
based token (which will be used later in encryption)
for an access policy, generates a symmetric key, en-
crypts the document with symmetric key, encrypts the
symmetric key with attribute-based token, creates an
e-document enclosing both the encrypted symmetric
key and the encrypted document, creates a URI for
this e-document and pushes it to subscriber’s digital
locker using PushURI API. When this e-document is
shared with a requester application, the requester will
be able to decrypt the encrypted symmetric key only
if the requester is associated with a set of attributes
which satisfies the access policy used to encryt the
symmetric key. Only when the requester obtais the
symmetric key, will he be able to decrypt and retrieve
the document.
In Setup(κ) procedure, AAM chose a cyclic group
G
0
of large prime order p (κ defines the size of group)
on which discrete logarithm problem is assumed to be
hard, generator g, a bilinear map e : G
0
×G
0
→ G
1
for
which bilinear diffie hellman problem is assumed to
be hard, a hash function H : {0,1}
∗
→ G
0
which maps
a binary string encoded attribute to a group element,
chose random numbers α,β ∈
R
Z
p
and set its private
key ASK and public key APK as below.
ASK = {β,g
α
}
APK = {g
β
,e(g,g)
α
,G
0
,g}
5.1 Attribute Assignment
An attribute can be any characteristic of a subscriber
or requester and is represented by a binary string
{0,1}
∗
. Attribute assignement to both subscribers and
requesters is proposed to be done lazily in the back-
ground with the aim to keep the list of associated at-
tributes in DigiLocker up to date.
For subscriber’s attribute assignment and modifi-
cation, two APIs are proposed to be introduced. First
is PullAttrs(ID
i
) which is provided by issuers and
is consumed by DigiLocker to pull updated list of at-
tributes of subscriber with Aadhaar number ID
i
. Sec-
ond is PushAttrs(ID
i
,NewAttrs) which is provided
by DigiLocker and is consumed by issuer to push any
change in attributes of subscriber with Aadhaar num-
ber ID
i
. For requester applications, attributes are as-
signed and updated by DigiLocker.
It is important to take appropriate measures to
handle load of a voluminous country like India. One
such measure could be to prepone part of the encryp-
tion process. This preponed encryption process gen-
erates a token with mutual cooperation between sub-
scriber and issuer. This token can be reused every
time for a given subscriber and for a given access pol-
icy.
A helper procedure encPartial(T ,r) is as-
sumed to be present which works as follows. It
choses a polynomial q
x
for each node x (including
the leaves) in the tree T . These polynomials are cho-
sen in the following way in a top-down manner, start-
ing from the root node R. For each node x in the
tree, set the degree d
x
of the polynomial q
x
to be one
less than the threshold value k
x
of that node, that is,
d
x
= k
x
− 1. Starting with the root node R the pro-
cedure chooses a random r ∈
R
Z
p
and sets q
r
(0) = r.
Then, it chooses d
R
other points of the polynomial q
R
randomly to define it completely. For any other node
x, it sets q
x
(0) = q
parent(x)
(index(x)) and chooses d
x
other points randomly to completely define q
x
.
5.2 Token Generation
An access tree T
iv
is comprised of access subtree T
S
iv
from subscriber S
i
and access subtree T
I
iv
from is-
suer I
v
(refer figure 1). If issuer I
v
needs to gen-
erate its part of token for subscriber S
i
, for access
tree T
iv
, it generates a random number r
i
∈
R
Z
p
,
and generates following partial-token using APK and
Privacy Enhanced DigiLocker using Ciphertext-Policy Attribute-Based Encryption
543

∨
R
∧
R
I
iv
A
R
n
A
R
1
∧
R
S
iv
A
R
n
A
R
1
T
S
iv
T
I
iv
T
iv
Figure 1: Example of an access policy tree.
encPartial(T
I
iv
,r
i
). Let Y
I
is the set of leaf nodes
in T
I
iv
.
CTtok
I
iv
=















T
I
iv
C1
I
= e(g,g)
αr
i
C2
I
= g
βr
i
C3
I
y
= g
q
y
(0)
C4
I
y
= H(attr(y))
q
y
(0)
)
∀ y∈Y
I
Issuer notifies subscriber to provide its part of the
token. Subscriber S
i
generates a random number
r
s
∈
R
Z
p
and generates following partial-token using
APK and encPartial(T
S
iv
). Let Y
S
is the set of leaf
nodes in T
S
iv
.
CTtok
S
iv
=















T
S
iv
C1
S
= e(g,g)
αr
s
C2
S
= g
βr
s
C3
S
y
= g
q
y
(0)
C4
S
y
= H(attr(y))
q
y
(0)
)
∀ y∈Y
S
Subscriber provides its part of partial-token to issuer.
Issuer creates the final token by combining the two
partial-tokens and keeps it securely with it.
CTtok
iv
=





























T
iv
= T
S
iv
∪ T
I
iv
C1 = C1
S
.C1
I
= e(g,g)
αr
s
e(g,g)
αr
i
C2 = C2
S
.C2
I
= g
βr
s
g
βr
i
C3 = C3
S
y
∪ C3
I
y
= g
q
y
(0)
C4 = C4
S
y
∪ C4
I
y
= H(attr(y))
q
y
(0)









∀ y∈Y
S
∪Y
I
5.3 Encryption
A new DocType PRIV is proposed to be introduced
for privacy enhanced e-documents. To create a pri-
vacy enahanced e-document, issuer creates a URI
hI
v
:: PRIV :: D
w
i where I
v
is the issuer identifier and
D
w
is the document identifier within the document
type PRIV. Now, issuer generates a random num-
ber r
ie
∈
R
Z
p
, generates a symmetric key SK
ivw
, en-
crypts e-document m with SK
ivw
, encrypts SK
ivw
with
CTtok
I
iv
and produces the following ciphertext.
CT
ivw
=



















T
iv
= T
S
iv
∪ T
I
iv
C1 = e(g,g)
αr
s
r
ie
e(g,g)
αr
i
r
ie
SK
ivw
C2 = g
βr
s
r
ie
g
βr
i
r
ie
C3
y
= g
r
ie
(q
y
(0))
C4
y
= H(attr(y))
q
y
(0)
)
∀ y∈Y
iv
C5 = {m}
SK
ivw
5.4 Key Generation
A new API GenABPvtKey(ID
i
,IS
j
) is proposed to
be provided by DigiLocker to generate an attribute-
based private key for a subscriber with Aadhaar iden-
tifier ID
i
and with attributes from issuers in the set
IS
j
. Let S
ij
is the set of all attributes assigned to S
i
by all issuers in set IS
j
. DigiLocker generates random
numbers r ∈
R
Z
p
, r
j
∈
R
Z
p
for each attribute j ∈
R
S
ij
,
computes attribute-based private key ASK
ID
i
IS
j
as be-
low and keeps this key securely with it.
ASK
ID
i
IS
j
=



D = g
(α+r)/β
D
j
= g
r
.H(j)
r
j
D
j
0 = g
r
j

∀ j∈S
ij
Note that multiple attribute based private keys can ex-
ist for a subscriber for different set of attributes. If any
one issuer set IS
i
is a proper subset of an other issuer
set IS
j
, the key corresponding to IS
i
is redundant and
can be removed.
5.5 Decryption
A new API FetchPrivDocURI is proposed to be
provided by DigiLocker for decryption purpose.
This API facilitates a requester with identifier ID
R
to retrieve ciphertext CT
ivw
of e-document from
URI hI
v
:: PRIV :: D
W
i of subscriber S
i
. Dig-
iLocker extracts the set of attribute issuers IS
k
from CT
ivw
→ T
iv
, retrieves ASK
ID
R
IS
k
and calls
Decrypt(CT
ivw
,ASK
ID
R
IS
k
). A helper procedure
DecryptNode(CT
ivw
,ASK
ID
R
IS
K
) is defined as below.
Let S
k
is the set of all attributes from issuers in
set IS
k
. If x is a leaf node and if attr(x) /∈ S
k
,
then DecryptNode(CT
ivw
,ASK
ID
R
IS
k
,x) =⊥ else if
attr(x) ∈ S
k
, then the procedure is defined as below.
DecryptNode(CT
ivw
,ASK
ID
R
IS
k
,x)
=
e(D
x
,C4
y
)
e(D
x
0,C5
y
)
=
e(g
r
.H(attr(x))
r
j
,g
r
ie
q
y
(0)
)
e(g
r
j
,H(attr(x))
q
x
(0)
)
= e(g,g)
rr
ie
q
x
(0)
If x is a non-leaf node, the recursive procedure is
SECRYPT 2020 - 17th International Conference on Security and Cryptography
544

defined as follows. For all children nodes z of x,
DecryptNode(CT
ivw
,ASK
i
,x) is called and their out-
put is stored in F
z
. Let S
x
be an arbitrary k
x
sized set
of child nodes z such that F
z
6=⊥. If no such set ex-
ists then the node was not satisfied and the function
returns ⊥. Otherwise, F
x
is computed as below.
F
x
=
∏
z∈S
x
F
∆
i,S
x
0
(0)
z
where{i = index(z)
S
x
0 = {index(z) : z ∈ S
x
}
=
∏
z∈S
x
F
∆
i,S
x
0
(0)
z
=
∏
z∈S
x
(e(g,g)
r.r
ie
.q
z
(0)
)
∆
i,S
x
0
(0)
=
∏
z∈S
x
(e(g,g)
r.r
ie
.q
parent(z)
(index(z))
)
∆
i,S
x
0
(0)
=
∏
z∈S
x
e(g,g)
r.r
ie
.q
x
(i)∆
i,S
x
0
(0)
= e(g,g)
rr
ie
q
x
(0)(using polynomial interpolation)
Decrypt(CT
ivw
,ASK
ID
R
IS
k
) calls DecryptNode(
CT
ivw
,ASK
ID
R
IS
k
,R) where R is root node of T
iv
.
If the access tree is satisfied by attributes in S
k
,
set A = DecryptNode(CT
ivw
,ASK
ID
R
IS
k
,R) =
e(g,g)
r.r
ie
.(r
s
+r
i
)
. Now the procedure ob-
tains symmetric key SK
ivw
by computing
C1
e(C2,D)
A
=
e(g,g)
αr
s
r
ie
e(g,g)
αr
i
r
ie
SK
ivw
e(g
βr
s
r
ie
g
βr
i
r
ie
,g
(α+r)/β
)
e(g,g)
rr
ie
(r
s
+r
i
))
=
e(g,g)
αr
s
r
ie
e(g,g)
αr
i
r
ie
SK
ivw
e(g
βr
ie
(r
s
+r
i
)
,g
(α+r)/β
)
e(g,g)
rr
ie
(r
s
+r
i
))
=
e(g,g)
αr
ie
(r
s
+r
i
)
SK
ivw
e(g,g)
r
ie
(r
s
+r
i
)(α+r)
e(g,g)
rr
ie
(r
s
+r
i
))
= SK
ivw
Symmetric key SK
ivw
is now used to decrypt the en-
crypted e-document.
m = {CT
ivw
→ C5}
SK
ivw
DigiLocker returns the decrypted document m to re-
quester.
6 SECURITY ANALYSIS
If the proposed scheme is not secure than an adver-
sary A can win IND-sAtt-CPA game and solve the
DBDH assumption with advantage ε/2. If the DBDG
assumption is solved by adversary A, a simulator β
can be built which can solve DBDH assumption with
advantage ε/2. Challenger chose a group G
0
, a gen-
erator g, a bilinear map e and chose random num-
bers a,b,c,θ ∈
R
Z
∗
p
. The challenger selects at random
µ ∈
R
0,1 and sets Z
µ
as below.
Z
µ
=
(
(g,g)
abc
, if µ = 0
e(g,g)
θ
, if µ = 1
Challenger provides DBDB challenge to the simula-
tor: hg,A,B,C,Z
µ
i hg,g
a
,g
b
,g
c
,Z
µ
i. In IND-sAtt-
CPA game, simulator β plays the role of challenger
for adversary A.
Init Phase. The adversary chose the challenge ac-
cess tree T
∗
and gives it to simulator.
Setup Phase. The challenger chose a random num-
ber x0 ∈ Z
p
, sets α = ab + x0 and computes y as be-
low.
y = e(g,g)
α
= e(g,g)
ab
e(g,g)
x0
Now, challenger chose a random numbers r ∈
R
Z
p
and r
i
∈
R
Z
p
for (1 ≤ i ≤ |U|) and for all a
j
∈ U,
computes d
j
and d
j
0 as below.
d
j
=
(
g
r/b
H(j)
r
j
...if a
j
/∈ T
∗
g
r
H(j)
r
j
...if a
j
∈ T
∗
d
j
0 = g
r
j





(1 ≤ j ≤ |U|)
Now, challenger sends public parameters APK =
{g
β
,e(g,g)
α
,G,g} to adversary A .
Phase 1. In this phase, adversary A sends requests
for private key for any set of attributes w
j
which
does not contain any attribute in T
∗
.
w
j
= {a
j
| (a
j
∈ U ∧ a
j
/∈ T
∗
)}
For each query from adversary A, challenger chose
a random number r0 ∈
R
Z
p
, sets r = −b(r0 + a) and
computes D as below.
D = g
(α+r)/β
= (g
(α+r)
)
1/β
= (g
((ab+x0)−b(r0+a))
)
1/β
= (g
x0−br0
)
1/β
= (g
x0
.(g
b
)
−r0
)
1/β
Because of restriction a
j
/∈ T
∗
in this phase, D
j
can
be computed as below.
D
j
= g
r/b
H(j)
r
j
= g
r/b
H(j)
r
j
= g
−(r
0
+a)
H(j)
r
j
= (g
a
)
−1
g
−r0
H(j)
r
j
Now, challenger sends private key ASK
w
j
=
D,(D
j
,D
j
0) | ∀a
j
∈ w
j
to adversary A
Challenge Phase. In this phase, adversary A
submits two plaintext messages m
0
and m
1
to the
challenger. Challenger selects a random plain-
text message m
b
from the two messages where
b ∈
R
{0,1}, sets r
ie
= 1, chose random variables
r
i
and r
s
such that c = r
i
+ r
c
. Now, set value of
root node T
∗
to c and assign values to leaf nodes
of T
∗
as described in section 4.4 to arrive at C3
y
and C4
y
. The final ciphertext CT
T
∗
is computed
Privacy Enhanced DigiLocker using Ciphertext-Policy Attribute-Based Encryption
545

as below. The ciphertext is returned to adversary A.
CT
T
∗
=





























T
iv
= T
∗
C1 = e(g,g)
αr
s
e(g,g)
αr
i
m
b
= e(g,g)
α(r
s
+r
i
)
m
b
= e(g,g)
c
m
b
C2 = g
βr
s
g
βr
i
= g
β(r
s
+r
i
)
= g
β
g
c
C3
y
= g
(q
y
(0))
C4
y
= H(attr(y))
q
y
(0)
)
∀ y ∈ Y
iv
Phase 2. In this phase, adversary A can continue to
send secret key generation requests with the same
restriction as in Phase1, i.e., a
j
/∈ T
∗
.
Guess Phase. In this phase, adversary A outputs
a guess b0 ∈ {0, 1}. If b0 = b, the simulator β
will guess that µ = 0 and Z
µ
= e(g,g)
abc
, other-
wise will guess that µ = 1 and Z
µ
= e(g, g)
θ
. When
Z
u
= e(g,g)
abc
the simulator β gives the perfect
simulation and c
T
∗
is a valid ciphertext. Therefore
the advantage of the adversary is
Pr[b0 = b | Z
µ
= e(g,g)
abc
] =
1
2
+ ε
If µ = 1 then Z
µ
= e(g,g)
θ
and c
T
∗
is random ci-
phertext for the adversary, and the adversary does
not gain information about m
b
. Hence we have
Pr[b0 6= b | Z
µ
= e(g,g)
θ
] =
1
2
Since the simulator β guesses µ0 = 0 when b0 = b
and µ0 = 1 when b0 6= b, the overall advantage of β
to solve DBDH assumption is
1
2
Pr[µ0 = µ | µ = 0] +
1
2
Pr[µ0 = µ | µ = 1] −
1
2
=
ε
2
If the adversary A has the above advantage ε to
win the IND-sAtt-CPA game, the challenger can
solve the DBDH assumption problem with ε/2 ad-
vantage with the help of adversary A. However,
there are no effective polynomial algorithms which
can solve the DBDH assumption problem with non-
negligible advantage according to the DBDH as-
sumption. Hence, the adversary cannot win the
IND-sAtt-CPA game with the above advantage ε,
namely the adversary having no advantage to break
through the proposed scheme.
7 CONCLUSION
This paper presented a scheme to improve data pri-
vacy in DigiLocker by using CP-ABE. The scheme
also proposed to prepone part of the encryption pro-
cess to increase performance. This preponed process
creates a token which can be reused later. The pro-
posed scheme is proved to be secure against IND-
sAtt-CPA game. The proposed scheme can further be
enhanced by using homomorphic encryption which
allows processing on encrypted data and using post-
quantum ABE schemes, for both of which, though
schemes exist but are still non-trivial and not prac-
tical.
REFERENCES
Bethencourt, J., Sahai, A., and Waters, B. (2007).
Ciphertext-policy attribute-based encryption. In 2007
IEEE symposium on security and privacy (SP’07),
pages 321–334. IEEE.
GoI (2015). Digilocker. https://digilocker.gov.in.
Goyal, V., Pandey, O., Sahai, A., and Waters, B. (2006).
Attribute-based encryption for fine-grained access
control of encrypted data. In Proceedings of the 13th
ACM conference on Computer and communications
security, pages 89–98.
Ibraimi, L., Tang, Q., Hartel, P., and Jonker, W. (2009). Ef-
ficient and provable secure ciphertext-policy attribute-
based encryption schemes. In International Confer-
ence on Information Security Practice and Experi-
ence, pages 1–12. Springer.
IETF (2012). The oauth 2.0 authorization framework. https:
//tools.ietf.org/rfc/rfc6749.txt.
Ji, Y.-m., Tan, J., Liu, H., Sun, Y.-p., Kang, J.-b., Kuang, Z.,
and Zhao, C. (2014). A privacy protection method
based on cp-abe and kp-abe for cloud computing.
JSW, 9(6):1367–1375.
MeitY (2019). Digital locker technical specification
(dlts). https://img1.digitallocker.gov.in/assets/img/
technicalspecifications-dlts-ver-2.3.pdf.
UIDAI (2009). What is aadhaar. https://uidai.gov.in/
myaadhaar/about-your-aadhaar.html.
Yacobi, Y. (2002). A note on the bilinear diffie-hellman
assumption. IACR Cryptology ePrint Archive,
2002:113.
Zhang, F., Safavi-Naini, R., and Susilo, W. (2004). An ef-
ficient signature scheme from bilinear pairings and its
applications. In International Workshop on Public Key
Cryptography, pages 277–290. Springer.
Zhou, Z. and Huang, D. (2012). Efficient and secure data
storage operations for mobile cloud computing. In
2012 8th international conference on network and ser-
vice management (cnsm) and 2012 workshop on sys-
tems virtualiztion management (svm), pages 37–45.
IEEE.
SECRYPT 2020 - 17th International Conference on Security and Cryptography
546