![](bg6.png)
architecture for heterogeneous environments and does
not rely on require an attribute history list for revocation.
Li et al. (2013) proposed a design which leverages ABE
to provide secure data sharing of personal health records.
The scope of their work does not, however, include
resource-constrained devices or existing infrastructure.
Li et al. (2018) present a lightweight approach for secure
fine-grained data sharing. Similar to our construction,
the majority of computations can be offloaded to more
powerful devices. Their scheme does not support direct
attribute revocation, as our architecture does. Sepehri
and Trombetta (2017) present an inner product-based,
attribute-based proxy re-encryption scheme. Like our
design, their scheme is suitable for computationally con-
strained scenarios. The authors do not discuss attribute
revocation or authentication across multiple security do-
mains. Michalas (2019) proposed a new protocol which
combines ABE and Symmetric Searchable Encryption
(SSE) to overcome current weaknesses of cloud stor-
age: Missing user revocation and overall efficiency. The
authors separate revocation from ABE by using Intel’s
Software Guard Extensions (SGX) to deploy a revocation
authority in a Trusted Execution Environment (TEE).
Notwithstanding, their protocol does not concentrate on
the performance of ABE itself. Hence, decryption and
thus, multiple bilinear pairing operations are still costly
from a users perspective. Summarising, in this paper, we
bridge the gap between heterogeneous environments and
fine-grained access control. We improve the state-of-the-
art by proposing a new design to incorporate ABE while
keeping security guarantees for data owners.
5 CONCLUSION
By presenting an architectural design based on Attribute-
Based Encryption (ABE) with outsourced decryption,
we demonstrated how secure resource sharing can be
achieved across different security domain boundaries.
Our approach differs from existing solutions by provid-
ing an industry-first approach, focusing on resource-
constrained devices and support for arbitrary Identity
Providers (IdPs). Existing workflows, as well as user
revocation, remain unchanged. The conducted evalua-
tion proves that the proposed design is practical. The
most apparent finding is that the proposed system only
introduces a nominal overhead for organisations.
The current system does not account for user privacy
or accountability of actions. Indeed, the issue of privacy
and accountability in these professional environments is
an intriguing one. We consider the privacy of users as one
of the most significant improvements to the system, in the
future. Furthermore, we will concentrate on improving
the overall performance of the system.
REFERENCES
Alexandra Institute (2019). FRESCO - A FRamework for
Efficient Secure COmputation.
Barker, E. (2016). Recommendation for Key Management
Part 1: General. Technical report, National Institute of
Standards and Technology, Gaithersburg, MD.
Bethencourt, J., Sahai, A., and Waters, B. (2007). Ciphertext-
Policy Attribute-Based Encryption. In 2007 IEEE Sym-
posium on Security and Privacy (SP ’07), pages 321–334.
ECRYPT – CSA (2018). D5.4 Algorithms, Key Size and
Protocols Report (2018). Technical report, H2020-ICT-
2014 – Project 645421.
Goyal, V., Pandey, O., Sahai, A., and Waters, B. (2006).
Attribute-Based Encryption for Fine-grained Access Con-
trol of Encrypted Data. In Proceedings of the 13th ACM
Conference on Computer and Communications Security,
CCS ’06, pages 89–98, New York, NY, USA. ACM.
Green, M., Hohenberger, S., and Waters, B. (2011). Outsourc-
ing the Decryption of ABE Ciphertexts. In Proceedings
of the 20th USENIX Conference on Security, SEC’11,
page 34, Berkeley, CA, USA. USENIX Association.
Hardt, D. (2012). The OAuth 2.0 Authorization Framework.
Technical report, RFC Editor.
Hur, J. and Noh, D. K. (2011). Attribute-Based Access Control
with Efficient Revocation in Data Outsourcing Systems.
IEEE Transactions on Parallel and Distributed Systems,
22(7):1214–1221.
Jones, M., Bradley, J., and Sakimura, N. (2015). JSON Web
Token (JWT). RFC 7519, RFC Editor.
Li, J., Zhang, Y., Chen, X., and Xiang, Y. (2018). Secure
attribute-based data sharing for resource-limited users in
cloud computing. Computers & Security, 72:1–12.
Li, M., Yu, S., Zheng, Y., Ren, K., and Lou, W. (2013).
Scalable and Secure Sharing of Personal Health Records
in Cloud Computing Using Attribute-Based Encryption.
IEEE Transactions on Parallel and Distributed Systems,
24(1):131–143.
Lin, G., Hong, H., and Sun, Z. (2017). A Collaborative Key
Management Protocol in Ciphertext Policy Attribute-
Based Encryption for Cloud Data Sharing. IEEE Access,
5:9464–9475.
Michalas, A. (2019). The Lord of the Shares: Combining
Attribute-based Encryption and Searchable Encryption
for Flexible Data Sharing. In Proceedings of the 34th
ACM/SIGAPP Symposium on Applied Computing, SAC
’19, pages 146–155, New York, NY, USA. ACM.
Sepehri, M. and Trombetta, A. (2017). Secure and Efficient
Data Sharing with Atribute-based Proxy Re-encryption
Scheme. In Proceedings of the 12th International Con-
ference on Availability, Reliability and Security, ARES
’17, pages 63:1—-63:6, New York, NY, USA. ACM.
Wang, G., Liu, Q., and Wu, J. (2010). Hierarchical Attribute-
based Encryption for Fine-grained Access Control in
Cloud Storage Services. In Proceedings of the 17th ACM
Conference on Computer and Communications Security,
CCS ’10, pages 735–737, New York, NY, USA. ACM.
SECRYPT 2020 - 17th International Conference on Security and Cryptography
552