Source-linked AI summary
AnonyControl: Control Cloud Data Anonymously with Multi-Authority Attribute-Based Encryption
Taeho Jung, Xiang-Yang Li, Zhiguo Wan, Meng Wan
TL;DR
Cloud computing threatens data confidentiality and user privacy because outsourced data and attribute-based identities fall outside users’ control. AnonyControl uses multiple authorities for anonymous, fine-grained privilege control and reports tolerance of up to N −2 authority compromises, alongside security and performance analysis.
Problem
Cloud computing requires protection against data exposure, identity disclosure, and security breaches, while existing ABE-based schemes provide less coverage for user privacy.
Method
AnonyControl decomposes a central authority into multiple authorities to provide anonymous attribute-based privilege control.
Results
The scheme achieves fine-grained privilege control, protects user identity information against individual authorities, and tolerates compromise of up to N −2 authorities.
Takeaways & Limitations
AnonyControl supports anonymous cloud data access while restricting file operations to users whose private keys satisfy the relevant privilege tree.
Abstract
from arXiv · showhide
Cloud computing is a revolutionary computing paradigm which enables flexible, on-demand and low-cost usage of computing resources. However, those advantages, ironically, are the causes of security and privacy problems, which emerge because the data owned by different users are stored in some cloud servers instead of under their own control. To deal with security problems, various schemes based on the Attribute- Based Encryption (ABE) have been proposed recently. However, the privacy problem of cloud computing is yet to be solved. This paper presents an anonymous privilege control scheme AnonyControl to address the user and data privacy problem in a cloud. By using multiple authorities in cloud computing system, our proposed scheme achieves anonymous cloud data access, finegrained privilege control, and more importantly, tolerance to up to (N -2) authority compromise. Our security and performance analysis show that AnonyControl is both secure and efficient for cloud computing environment.
I. INTRODUCTION
Cloud computing creates confidentiality, privacy, and compromise-resilience challenges because users’ data and attribute-based identities are handled outside their control. AnonyControl addresses these challenges with multi-authority, anonymous privilege control built on ABE-related techniques.
- Cloud systems expose stored data to server inspection, interception, and unauthorized access because resources are outside users’ control.
- Users’ attribute-based identities may be revealed to key generators, motivating private-key issuance that preserves identity secrecy.
- The scheme uses multiple authorities to decentralize attribute management while retaining fine-grained privilege control and compromise tolerance.
- AnonyControl protects user privacy against each authority and tolerates compromise of up to (N −2) authorities.
- Its security argument relies on the assumption that probabilistic polynomial-time algorithms cannot solve DDH or DBDH with non-negligible advantage.
B. CP-ABE
CP-ABE associates ciphertexts with access policies so users decrypt when their attribute-based private keys satisfy those policies. AnonyControl extends this policy structure into privilege trees that govern multiple file operations.
- CP-ABE: In CP-ABE, ciphertexts carry access trees and private keys carry attributes; decryption occurs when the attributes satisfy the ciphertext policy.
- Privilege trees: Privilege trees associate separate operations such as read, modify, and delete with policies satisfied by authorized users.
- Privilege trees: A data file can contain r privilege structures, with privilege 0 reserved for reading and other privileges defined independently.
- Privilege trees: Each privilege tree records node relationships, child ordering, and attribute values used to evaluate authorization.
D. Satisfying the Privilege Tree
Privilege satisfaction is evaluated recursively over attribute trees, and successful verification determines which cloud operations a consumer may execute. The system separates attribute authorities, cloud storage, owners, and consumers under stated trust assumptions.
- Tree satisfaction: A leaf matches when its attribute belongs to the user’s set, while a non-leaf matches when at least k_x child nodes satisfy the threshold.
- Tree satisfaction: An example attribute set satisfies a deletion tree, granting the corresponding delete privilege.
- System model: The system includes N attribute authorities, a cloud server, data owners, and data consumers, with users able to hold owner and consumer roles.
- System model: Authorities divide attributes into disjoint sets, while owners encrypt files and consumers request jointly created private keys.
- Operation control: Consumers may download files, but the cloud server processes an operation only after the relevant privilege tree is satisfied and verified.
- Trust assumptions: Cloud servers are untrusted and may collude with users, whereas authorities are semi-honest and seek information individually without colluding.
C. Design Goal
The design goal is to let data owners share data with fine-grained privileges while keeping consumers’ identities confidential through multiple authorities and preserving compromise tolerance.
- C. Design Goal: The scheme targets secure data sharing with fine-grained privilege control and confidentiality of Data Consumers’ identity information.
- C. Design Goal: A center authority is decomposed into multiple authorities to preserve tolerance against compromise attacks.
- C. Design Goal: Setup jointly computes public parameters and authority-specific keys, while key generation produces a private key for a user’s attributes and pseudonym.
- C. Design Goal: Encryption maps a message and privilege trees to a ciphertext and verification set, granting operations only when attributes satisfy the corresponding tree.
- C. Design Goal: Decryption supports file operations, and re-encryption applies new privilege trees after an authorized user satisfies the required privileges.
A. Setup
During setup, authorities collaboratively generate system parameters and secret values, using shared randomness to establish a compromise-tolerant multi-authority system.
- A. Setup: One authority selects a bilinear group, while all authorities independently choose random values and exchange corresponding public elements.
- A. Setup: Authorities exchange pairwise secret shares to compute authority parameters whose product satisfies ∏k∈A x_k = 1 mod p.
- A. Setup: The resulting master key for authority A_k is MK_k = {v_k, x_k}, and the system publishes a public key containing the global parameters.
- A. Setup: Setup normally has O(N^2) time complexity, reducible to O(N) with clustering at the cost of weaker compromise tolerance.
- A. Setup: New users request private keys from all authorities, which independently generate and merge partial key components before sending the aggregated components to the user.
2) Key Aggregation:
Key aggregation combines authority-generated components into a user key, while encryption protects a symmetric file key under privilege trees and gives the cloud a verification set.
- 2) Key Aggregation:: The user aggregates received D, D_i, and D′_i components into a private key SK_u.
- 2) Key Aggregation:: The data owner encrypts the file with a symmetric key, then encrypts that key under a set of privilege trees.
- 2) Key Aggregation:: Shamir’s secret sharing implements threshold gates, requiring at least k_x child values to reconstruct a node value.
- 2) Key Aggregation:: The ciphertext contains the symmetric key and attribute values representing the specified privilege trees.
- 2) Key Aggregation:: A verification set is disclosed only to the cloud server, and the owner uploads it with the ciphertext and encrypted file.
D. Decrypt(PK, SKu, CT)
Decryption recursively evaluates privilege trees to recover the symmetric key or authorize an operation; re-encryption replaces the privilege set to exclude revoked users.
- D. Decrypt(PK, SK_u, CT): DecryptNode recursively evaluates child nodes and succeeds at an internal node only when enough child results satisfy its threshold.
- D. Decrypt(PK, SK_u, CT): When a privilege tree is satisfied, the user can recover the symmetric key and decrypt the data file.
- D. Decrypt(PK, SK_u, CT): For other operations, the user sends a derived verification value to the cloud, which proceeds when it matches the expected value.
- D. Decrypt(PK, SK_u, CT): An authorized re-encrypting user decrypts the file, selects a new symmetric key, and adds subtrees that block revoked users while preserving access for unrelated users.
- D. Decrypt(PK, SK_u, CT): In the example, revocation adds the condition (Chinese ∨ Ph.D Student) to the updated privilege tree.
V. SECURITY ANALYSIS
AnonyControl separates identity-bearing attributes across authorities and remains tolerant of compromise of up to (N −2) authorities. Its security analysis also identifies a trade-off between setup efficiency and compromise tolerance, while compromised authorities may still threaten ciphertexts governed only by their attributes.
- Attributes containing user identity information are separately controlled by different authorities, protecting that information.
- Even after compromising up to (N −2) authorities, an adversary cannot construct a valid secret key because two parameters remain unknown.
- Clustering authorities reduces setup complexity from O(N^2) to O(N), but weakens compromise tolerance.
- Compromised authorities can issue valid attribute keys, so ciphertexts whose privilege trees contain only those attributes might be illegally decrypted.
C. Data Confidentiality against Collusion Attack
The scheme’s confidentiality analysis models chosen-plaintext security and argues that colluding keys cannot bypass access trees. Its proof reduces any successful attack to solving the DBDH problem with non-negligible advantage.
- An attacker can recover the protected value only when available attributes satisfy the privilege tree.
- Randomization prevents components from different keys from combining successfully, so at least one valid key must satisfy the privilege tree.
- The security model gives the adversary adaptive key queries for attribute sets that do not satisfy the challenge tree, followed by encryption of one of two equal-size messages.
- The proof states that breaking AnonyControl implies a probabilistic polynomial-time algorithm can solve DBDH with non-negligible advantage.
- When the challenge tuple is random, the ciphertext contains no information about the selected message; when valid, it is a ciphertext of that message.
VI. PERFORMANCE ANALYSIS
The performance analysis defines N as the number of attribute authorities, I as the size of the entire attribute set, and X as the number of nodes in a privilege tree.
- N denotes the number of attribute authorities, I the size of the entire attribute set, and X the number of nodes in a privilege tree Tp.
A. Setup
The setup analysis reports linear total complexity under clustered computation, while attribute-key generation remains quadratic in the number of authorities plus an attribute-dependent term.
- Setup computation has total complexity O(N), with O(1) complexity per authority when clustered computation is used.
- Attribute Key Generation has total complexity O(N^2 + I · N), while aggregation of two keys costs O(I).
- The per-authority complexity of Attribute Key Generation is O(N + I).
C. Encryption
The scheme’s implementation provides command-line tools for setup, key generation, encryption, decryption, and re-encryption, with experiments evaluating core algorithm overhead under varying authority, attribute, and privilege conditions.
- Implementation: The prototype implements setup, key generation, encryption, decryption, and re-encryption through five command-line tools.The toolkit jointly generates public and master keys, creates attribute-specific private-key parts, encrypts and decrypts files, and re-encrypts files under other privilege trees.
- Experimental setup: Experiments measure Setup, Key Generation, Encryption, and Decryption overhead under varying authority and attribute conditions.The implementation uses the CP-ABE toolkit and PBC library on Linux hardware, while Figure 5 varies authorities, attributes, and privilege-tree settings.
- Results: Encryption and decryption runtime is independent of tree structure and depends only on the number of nodes in the tree.The experiments report this behavior across different tree structures, matching the preceding performance analysis.
- Results: Re-encryption is omitted from the experiments because it is treated as a composition of decryption and encryption.The paper describes re-encryption as barely a composition of the two operations.
- Conclusion: The paper reports that AnonyControl combines fine-grained privilege control, anonymity, tolerance of up to N −2 authority compromise, and secure, efficient cloud storage operation.The conclusion also states that outsourced contents remain unreadable unless private keys satisfy privilege tree T0.