PaperlayerView exact revision on arXiv

Source-linked AI summary

An End-To-End Encrypted Cache System with Time-Dependent Access Control

Keita Emura, Masato Yoshimi

arXiv:2302.11292v1cs.CRcs.NI

TL;DR

Encrypted cache systems can improve communication efficiency and privacy, but the original Cache-22 system did not implement concrete access control. This paper adds NNL-based time-dependent access control with O(log Tmax) communication, demonstrating effective access-right control while exposing a cache-capacity and network-traffic trade-off.

  • Problem

    The original Cache-22 system lacked a concrete access-control method despite using decryption-key delivery to control content access.

  • Method

    The paper adds NNL-based time-dependent access control, assigning time periods to binary-tree leaves and encrypting content according to availability periods.

  • Results

    O(log Tmax) communication is achieved, and experiments show the modified system is effective for access-right control while cache capacity affects network traffic.

  • Takeaways & Limitations

    Time-dependent access control can scale in Cache-22, but duplicated contents alter the relationship between cache capacity and network traffic.

  • Takeaways & Limitations

    The protocol is stateful because users must manage O(log Tmax)-size decryption keys.

Abstract

from arXiv · show

Due to the increasing use of encrypted communication, such as Transport Layer Security (TLS), encrypted cache systems are a promising approach for providing communication efficiency and privacy. Cache-22 is an encrypted cache system (Emura et al. ISITA 2020) that makes it possible to significantly reduce communication between a cache server and a service provider. In the final procedure of Cache-22, the service provider sends the corresponding decryption key to the user via TLS and this procedure allows the service provider to control which users can access the contents. For example, if a user has downloaded ciphertexts of several episodes of a show, the service provider can decide to provide some of the contents (e.g., the first episode) available for free while requiring a fee for the remaining contents. However, no concrete access control method has been implemented in the original Cache-22 system. In this paper, we add a scalable access control protocol to Cache-22. Specifically, we propose a time-dependent access control that requires a communication cost of $O(\log T_{\sf max})$ where $T_{\sf max}$ is the maximum time period. Although the protocol is stateful, we can provide time-dependent access control with scalability at the expense of this key management. We present experimental results and demonstrate that the modified system is effective for controlling access rights. We also observe a relationship between cache capacity and network traffic because the number of duplicated contents is higher than that in the original Cache-22 system, due to time-dependent access control.

I. INTRODUCTION

Encrypted cache systems aim to reduce communication overhead while preserving privacy, but Cache-22 lacked a concrete access-control method. A naive authentication-based approach would require communication proportional to the number of users.

  • Encrypted cache systems address communication overhead and privacy challenges created by encrypted communications such as TLS.
  • Cache-22 provides unlinkability without public-key encryption and gives a formal cryptographic security definition.
  • Cache-22 reduces communication between the cache server and service provider by using small, content-independent tags and cached ciphertexts.The service provider ultimately sends the corresponding decryption key to the user.
  • Adding Access Control to Cache-22: The original system claimed that sending decryption keys could support user-specific access control, but provided no concrete access-control method.This could distinguish free content from content requiring payment.
  • Adding Access Control to Cache-22: O(N) communication is required when an authentication-based solution sends the decryption key individually to N users.

A. Our Contribution

The paper adds time-dependent access control to Cache-22 using an NNL-based binary-tree construction. It provides logarithmic communication and key-management costs while making access depend on the content's availability period.

  • O(log Tmax) communication is achieved by applying the Naor–Naor–Lotspiech framework to Cache-22.Here, Tmax is the maximum time period.
  • Each time period is assigned to a binary-tree leaf, and content is encrypted according to the period during which it is available.A time period may represent a day, week, month, or another interval.
  • Toy Example: The time tree assigns users to leaves according to access rights, with users sharing a leaf when their rights are identical.Each user holds the keys on the path from the assigned leaf to the root.
  • O(log Tmax) ciphertexts are generated, and each user manages O(log Tmax)-size decryption keys.
  • The construction is stateful because users must manage decryption keys, trading key management for scalable time-dependent access control.

A. Cache-22 System

The original Cache-22 system stores tagged ciphertexts at a cache server and uses secure protocols to retrieve content. The service provider sends the decryption key to the requesting user after the ciphertext is delivered.

  • Cache-22 assumes TLS-protected communication and stores each content's tag-ciphertext pair in a cache table.Tags reveal no information about the content under the stated assumption.
  • The system consists of table generation, content request, content sending, cache request, key sending, and content obtaining algorithms.
  • Table Generation: The service provider generates a pseudorandom tag and encrypts each content with a randomly chosen symmetric key.
  • Content Request: A user requests content by name and identity, after which the service provider determines the content and sends its tag through a secure channel.
  • Content Sending: On a cache hit, the cache server returns the ciphertext and informs the service provider; on a miss, it obtains and stores the ciphertext before sending it.
  • Key and Content Obtaining: The service provider sends the decryption key to the identified user, who retrieves the IV from the tag and decrypts the ciphertext.

B. NNL Framework

The NNL complete subtree method represents access-control structure with a binary tree and identifies nodes covering non-revoked leaves. In this protocol, time periods replace user assignments and are revoked sequentially, yielding logarithmic representation size.

  • Complete subtree method: The complete subtree method uses a binary tree whose leaves represent entities and whose paths connect leaves to the root.For each revoked leaf, its path is collected before sibling children outside those paths are selected.
  • Algorithm: The algorithm initializes X and Y, collects paths of revoked leaves in X, and adds uncovered children of nodes in X to Y.If no leaves are revoked, the root node is added to Y.
  • Time-dependent adaptation: In the proposed access control, time periods are assigned to leaves and leaves are revoked sequentially from the leftmost node.This adapts the original user-based complete subtree construction to time-dependent access rights.
  • Scalability: |Y| = O(log N) with N := Tmax, making the representation scalable regardless of the number of revoked users.The bound follows from sequential revocation of time-period leaves.

III. CACHE SYSTEM WITH TIME-DEPENDENT ACCESS CONTROL

The proposed Cache-22 extension encrypts each content for its availability period and uses NNL-derived keys, tags, and cached ciphertexts to enforce time-dependent access rights. Users obtain keys according to their assigned period, while the cache serves encrypted content without requiring user identities.

  • Access policy: A user assigned to period t′ may obtain content encrypted for period t when t ≤ t′, with access rights determined in advance.The service provider adds new contents after receiving a user request under the stated simplified operating assumption.
  • Time and key structure: Tmax = 2^m time periods are mapped to binary-tree leaves, and each content is multiply encrypted using keys associated with its availability period.Tags combine content and NNL index j so the appropriate ciphertext can be selected.
  • Key management: The protocol adds KeyGen and SendKey so the service provider generates keys in advance and sends path keys matching each user’s access rights.For a user assigned to t, the provider sends kc,j for every j on Path(t) over a secure channel.
  • Table generation: GenTable computes tags and encrypts each content under every key on the path of its assigned time period, producing the provider’s content table.Each entry stores the content, its indexed tags, ciphertexts, and corresponding keys.
  • Request and caching flow: ContentRequest selects a valid NNL node index, while CacheRequest and SendContent retrieve, cache, and return the corresponding indexed ciphertext.Cache misses cause the cache server to obtain and store the ciphertext from the service provider.
  • Content delivery and privacy: Users decrypt returned ciphertexts locally, and the proposed system can hide user identities from the cache server.Unlike the original system, identity forwarding is unnecessary because the indexed ciphertext and keys support retrieval and decryption.

A. Cipher Suite

The implementation selects a post-quantum-capable TLS cipher suite with Kyber key agreement and AES-GCM encryption, while using SHA-256 and omitting post-quantum authentication.

  • Cipher suite: The implementation uses TLS_Kyber_ECDSA_WITH_AES_256_GCM_SHA256 as its underlying cipher suite.The suite combines Kyber, ECDSA, AES-256-GCM, and SHA-256 components.
  • Post-quantum key agreement: Kyber512 provides 128-bit security through the X25519Kyber512Draft00 key agreement in the experiment.Kyber is described as a lattice-based scheme secure under the MLWE assumption.
  • Symmetric encryption and hashing: AES-GCM-256 and SHA-256 were selected with doubled key length considerations against the Grover algorithm.The implementation does not consider post-quantum authentication.

B. Implementing Components

The authors implemented and experimentally evaluated the time-dependent Cache-22 extension using separate service-provider, cache-server, and user components. The setup models multiple users, request popularity, LRU caching, and changing time periods to examine access control and cache behavior.

  • Implementation: The experimental system was implemented specifically to evaluate Cache-22 with time-dependent access control.The implementation extends Cache-22 to encrypt and decrypt content with multiple keys.
  • Components: The implementation contains SP, CS, and User code sets corresponding to the service provider, cache server, and user components.The modules were written in Go using CIRCL with conventional TLS and post-quantum primitives.
  • Request simulation: User requests were simulated through a web-server service provider and cache server that either forwarded requests or returned cached encrypted contents.Users decrypted content when they possessed the corresponding key.
  • Experimental environment: The experiment parameterized component behavior for varied situations and specified concrete conditions in the experimental setup.The setup used virtual machines on Amazon EC2 with uniform configurations.
  • Cache policy: The cache used Least Recently Used replacement, erasing ciphertexts generated in the past when they became unavailable at the current time.This models time-sensitive cache contents under the proposed access-control setting.
  • Access-control evaluation: With Tmax = 16, the experiments checked that revoked users could not obtain content directly from the service provider.A revoked user was defined as one whose access-rights time period had passed.
  • Cache effect: Introducing the cache server reduces communications between the cache server and service provider without removing time-dependent access control.The implementation also examines cache capacity and time-series cache-hit behavior.

C. Change in Network Traffic by Introducing Time-Dependent Access Control

Time-dependent access control preserves substantial cache benefits, but its duplicated ciphertexts make cache capacity more important because multiple keys can increase cache misses and traffic.

  • Cache hit ratios exceeded 70% in all cases at t1, reducing network traffic through cached ciphertexts.At t1, all users held the root-node key k1, matching the hit ratio of a cache without time-dependent access control.
  • Approximately 50% of network traffic was reduced with a 4,096 MB cache containing 6.25% of all contents.
  • Multiple encryption keys generate duplicated ciphertexts, so relatively large key counts can lower hit ratios when cache capacity is low.A user may be unable to decrypt a ciphertext stored after another user's request, increasing cache misses and traffic.
  • Differences among cache capacities are relatively small with one key but relatively large when four keys are used.The paper gives t1, t9, t13, t15, and t16 as one-key periods and t2 as a four-key period.

V. CONCLUSION

The paper adds time-dependent access control to Cache-22 and evaluates its effects on access rights and cache behavior. The protocol is effective for controlling access rights, while duplicated contents alter the relationship between cache capacity and network traffic.

  • The proposed time-dependent access control protocol is effective for controlling access rights but increases duplicated contents compared with original Cache-22.
  • Duplicated contents affect the relationship between cache capacity and network traffic in the modified Cache-22 system.
  • Confirming the effectiveness of introducing multiple cache servers is left for future work.The proposed system assigns higher-node keys to more users, suggesting that multiple cache servers could store ciphertexts encrypted under those keys.
Loading 2302.11292v1…