FACOR：Flexible Access Control with Outsourceable Revocation in Mobile Clouds

Access control is a key mechanism to secure outsourced data in mobile clouds. Some existing solutions are proposed to enforce flexible access control on outsourced data or reduce the computations performed by mobile devices. However, less attention has been paid to the efficiency of revocation when there are mobile devices needed to be revoked. In this paper, we put forward a new solution, referred to as flexible access control with outsourceable revocation(FACOR) for mobile clouds. The FACOR applies the attribute-based encryption to enable flexible access control on outsourced data, and allows mobile users to outsource the time-consuming encryption and decryption computations to proxies, with only requiring attributes authorization to be fully trusted. As an advantageous feature, FACOR provides an outsourceable revocation for mobile users to reduce the complicated attribute-based revocation operations. The security analysis shows that our FACOR scheme achieves data security against collusion attacks and unauthorized accesses from revoked users. Both theoretical and experimental results confirm that our proposed scheme greatly reliefs the mobile devices from heavy encryption and decryption computations, as well as the complicated revocation of access rights in mobile clouds.

Public Auditing for Shared Data Utilizing Backups with User Revocation in the Cloud

With the advent of cloud storage, users can share their own data in the remote cloud as a group. To ensure the security of stored data and the normal operation of public auditing, once a user is revoked from the user group, the data files he signed should be resigned by other legal users in the group. In this paper, we propose a new re-signature scheme utilizing backup files to rebuild data which can resist the collusion between the cloud and revoked users, and we use Shamir Secret Sharing Scheme to encrypt data in the multi-managers system which can separate the authority of the group managers. Moreover, our scheme is more practical because we do not need managers to be online all the time. Performance evaluation shows that our mechanism can improve the efficiency of the process of data re-signature.

Rainbow:reliable personally identifiable information retrieval across multi-cloud

Personally identifiable information(PII)refers to any information that links to an individual.Sharing PII is extremely useful in public affairs yet hard to implement due to the worries about privacy violations.Building a PII retrieval service over multi-cloud,which is a modern strategy to make services stable where multiple servers are deployed,seems to be a promising solution.However,three major technical challenges remain to be solved.The first is the privacy and access control of PII.In fact,each entry in PII can be shared to different users with different access rights.Hence,flexible and fine-grained access control is needed.Second,a reliable user revocation mechanism is required to ensure that users can be revoked efficiently,even if few cloud servers are compromised or collapse,to avoid data leakage.Third,verifying the correctness of received PII and locating a misbehaved server when wrong data are returned is crucial to guarantee user’s privacy,but challenging to realize.In this paper,we propose Rainbow,a secure and practical PII retrieval scheme to solve the above issues.In particular,we design an important cryptographic tool,called Reliable Outsourced Attribute Based Encryption(ROABE)which provides data privacy,flexible and fine-grained access control,reliable immediate user revocation and verification for multiple servers simultaneously,to support Rainbow.Moreover,we present how to build Rainbow with ROABE and several necessary cloud techniques in real world.To evaluate the performance,we deploy Rainbow on multiple mainstream clouds,namely,AWS,GCP and Microsoft Azure,and experiment in browsers on mobile phones and computers.Both theoretical analysis and experimental results indicate that Rainbow is secure and practical.

Secure personal data sharing in cloud computing using attribute-based broadcast encryption

The ciphertext-policy（CP） attribute-based encryption（ABE）（CP-ABE） emergings as a promising technology for allowing users to conveniently access data in cloud computing. Unfortunately, it suffers from several drawbacks such as decryption overhead, user revocation and privacy preserving. The authors proposed a new efficient and privacy-preserving attribute-based broadcast encryption（BE）（ABBE） named EP-ABBE, that can reduce the decryption computation overhead by partial decryption, and protect user privacy by obfuscating access policy of ciphertext and user＇s attributes. Based on EP-ABBE, a secure and flexible personal data sharing scheme in cloud computing was presented, in which the data owner can enjoy the flexibly of encrypting personal data using a specified access policy together with an implicit user index set. With the proposed scheme, efficient user revocation is achieved by dropping revoked user＇s index from the user index set, which is with very low computation cost. Moreover, the privacy of user can well be protected in the scheme. The security and performance analysis show that the scheme is secure, efficient and privacy-preserving.