关键词: 属性加密, 访问控制, 属性撤销

Abstract:

When using the data sharing function in the cloud environment, due to the complexity of the cloud environment, the data needs to be secured and access controlled, which requires the use of encryption mechanism. Encryption based on Ciphertext Policy Attributes（CP-ABE） is a widely used encryption mechanism, which can set access rights according to the user’s attributes. Any user with qualified access rights can access the data. However, the cloud is a dynamic environment, and sometimes only a part of users with access rights may be allowed to access data, which requires the revocation mechanism of user rights. However, in CP-ABE, access revocation or user revocation is a lengthy and costly event. According to the improvement of CP-ABE process, the proposed scheme embedded the user’s personal secret that can be flexibly controlled in the original ciphertext, so that when the user’s permission revocation is carried out, neither the user revocation data using the new access policy nor the data re-encryption is required, which greatly reduces the computing cost of permission revocation. Compared with the well-known CP-ABE revocation scheme, the proposed scheme has lower computational cost and better security.

Key words: Ciphertext Policy Attributes（CP-ABE）, access control, attribute revocation