2
Server Mediated Access Control
Access list: John, Beth, Sue, Bob
Attributes: “Computer Science” , “Admissions”
File 1•Server stores data in clear
•Expressive access controls
4
Traditional Encrypted Filesystem
File 1Owner: John
File 2Owner: Tim
Encrypted Files stored on Untrusted Server
Every user can decrypt its own files
Files to be shared across different users? Credentials?
Lost expressivity of trusted server approach!
5
A New Approach to Encrypting Data
File 1•“Creator: John”
•“Computer Science”
•“Admissions”
•“Date: 04-11-06”
File 2•“Creator: Tim”
•“History”
•“Admissions”
•“Date: 03-20-05”
Label files with attributes
Goal: Encryption with Expressive Access Control
6
File 1•“Creator: John”
•“Computer Science”
•“Admissions”
•“Date: 04-11-06”
File 2•“Creator: Tim”
•“History”
•“Admissions”
•“Date: 03-20-05”
Univ. Key Authority
OR
AND
“Computer
Science”
“Admissions”
“Bob”
A New Approach to Encrypting Files
7
Attribute-Based Encryption[Sahai-Waters 05]
Start with monotonic access formulas [GPSW06]
Techniques from IBE [S84,BF01]
Challenge: Collusion Resistance
Further developments of ABE
Bringing into Practice
8
Attribute-Based Encryption
Ciphertext has set of attributes
Keys reflect a tree access structure
Decrypt iff attributes from CT
satisfy key’s policyOR
AND
“Computer
Science”
“Admissions”
“Bob”•“Creator: John”
•“Computer Science”
•“Admissions”
•“Date: 04-11-06”
9
Central goal: Prevent Collusions
If neither user can decrypt a CT,
then they can’t together
AND
“Computer
Science”
“Admissions”
AND
“History”
“Hiring”
Ciphertext = M, {“Computer Science”, “Hiring”}
10
A Misguided Approach
KHistory, KCS, KHiring , KAdmissions, …Public Parameters
SKCS, SKAdmissions SKHistory, SKHiring
CT= EKCS( R) , EKHiring(M-R)
Neither can decrypt alone, but …
11
Our Approach
Two key ideas
Prevent collusion attacksBilinear maps “tie” key components together
Support access formulas General Secret Sharing Schemes
12
Bilinear Maps
G , GT : multiplicative of prime order p.
Def: An admissible bilinear map e: GG
GT is:
– Non-degenerate: g generates G e(g,g) generates GT .
– Bilinear: e(ga, gb) = e(g,g)ab a,bZ, gG
– Efficiently computable.
– Exist based on Elliptic-Curve Cryptography
13
Secret Sharing [Ben86]
Secret Sharing for tree-structure of AND + OR
OR
AND
“Computer
Science”
“Admissions”
“Bob”
y
y
y
r(y-r)
Replicate secret for OR’s.
Split secrets for AND’s.
14
The Fixed Attributes System: System Setup
Public Parameters
gt1, gt2,.... gtn, e(g,g)y
“Bob”, “John”, …, “Admissions”List of all possible attributes:
15
Encryption
Public Parameters
gt1, gt2, gt3,.... gtn, e(g,g)y
Ciphertext gst2 , gst3 , gstn, e(g,g)sy
Select set of attributes, raise them to random s
M
File 1•“Creator: John” (attribute 2)
•“Computer Science” (attribute 3)
•“Admissions” (attribute n)
16
Key Generation
Public Parameters
Private Key gy1/t1 , gy3/t3 , gyn/tn
gt1, gt2,.... gtn, e(g,g)y
Fresh randomness used for each key generated!
Ciphertext gst2 , gst3 , gstn, e(g,g)sy M
OR
AND
“Computer
Science”
“Admissions”
“Bob”
y
y
y
r(y-r)y3= yn=
y1=
17
Decryption
e(g,g)sy3e(g,g)syn = e(g,g)s(y-r+r) = e(g,g)sy
(Linear operation in exponent to reconstruct e(g,g)sy)
Ciphertext gst2, gst3, gstn, Me(g,g)sy
Private Key gy1/t1 , gy3/t3 , gyn/tn
e(g,g)sy
3
18
Security
Reduction: Bilinear Decisional Diffie-Hellman
Given ga,gb,gc distinguish e(g,g)abc from random
Collusion resistance
Can’t combine private key components
19
The Large Universe Construction: Key Idea
Public Function T(.), e(g,g)y
Private Key
Any string can be a valid attribute
Ciphertext gs, e(g,g)syMFor each attribute i: T(i)s
For each attribute i gyiT(i)ri , gri
e(g,g)syi
Public Parameters
20
Delegation
AND
“Computer
Science”
“admissions”
OR
“Bob”
Derive a key for a more restrictive policy
Year=2006
Bob’s Assistant
21
Making ABE more expressive
Any access formulas•Challenge: Decryptor ignores an attribute
Attributes describe CT, policy in key•Flip things around
22
Supporting “NOTs” [OSW07]
Example Peer Review of Other Depts.
AND
“Year:2007”“Dept. Review”
“Computer
Science”
NOT
Bob is in C.S. dept => Avoid Conflict of Interest
Challenge: Can’t attacker just ignore CT components?
23
A Simple Solution
Use explicit “not” attributes
Attribute “Not:Admissions”, “Not:Biology”
Problems:•Encryptor does not know all attributes to
negate•Huge number of attributes per CT
•“Creator: John”
•“History”
•“Admissions”
•“Date: 04-11-06”
•“Not:Anthropology”
•“Not:Aeronautics”
• …
•“Not:Zoology”
24
Technique 1: Simplify Formulas
Use DeMorgan’s law to propagate NOTs
to just the attributes
AND
“Dept. Review”
“Public Policy”“Comput
er Science”
NOT
OR
NOT NOT
25
Applying Revocation Techniques
Broadcast a ciphertext to all but a certain set of users
Used in digital content protection•E.g. Revoke compromised players
P1 P2 P3
26
Applying Revocation Techniques
Focus on a particular Not Attribute
AND
“Year:2007”“Dept. Review”
“Computer
Science”
NOT
27
Applying Revocation Techniques
Focus on a particular ‘Not’ Attribute
“Computer
Science”
NOT
•“Creator: John”
•“Computer Science”
•“Admissions”
•“Date: 04-11-06”
Attribute in ‘Not’ as node’s “identity”
Attributes in CT as Revoked Users
Node ID not in “revoked” list =>satisfied
N.B. – Just one node in larger policy
28
The Naor-Pinkas Scheme
Pick a degree n polynomial q( ), q(0)=a•n+1 points to interpolate
User t gets q(t)
Encryption: gs , ,Mgsa
•Revoked x1, …, xn
gsq(t)
gsq(x1) , ..., gsq(xn)
Can interpolate to gsq(0)=gsa iff t not in {x1,…xn}
29
Applying Revocation to ABE
Use same S.S. techniques for key generation•Same techniques for pos. attributes
“Local” N-P Revocation at each Not-Attribute
Upshot: N-P Revocation requires to use each CT attribute
30
Ciphertext Policy ABE [BSW07]
Encrypt Data reflect Decryption Policies
Users’ Private Keys are descriptive attributes
OR
AND
“Discipline
Committee”“Professor”
“Counselor”
“Professor”,
“Discipline Committee”,
“Age=33”, “History”
Univ. Key Authority
“Thinking” Encryptor
31
Challenges in Practice [PTMW06]
Applications•Health Care•Netflow Logs (currently building)
How are CTs annotated?•Can we automate?
Convention for using Attributes?•“Prof.” or “Professor”•Does “T.A.” + “CS236” mean TAing CS236?
32
Challenges in Practice
What group do Public Parameters represent?
Univ. Key Authority
Individual’s Key
33
Advanced Crypto Software Collection
Goal: Make advanced Crypto available to systems researchers
http://acsc.csl.sri.com (8 projects)
$ cpabe-setup
$ cpabe-keygen -o sara_priv_key pub_key master_key \
sysadmin it_department 'office = 1431' 'hire_date = '`date +%s`
$ cpabe-enc pub_key security_report.pdf (sysadmin and (hire_date < 946702800 or security_team)) or (business_staff and 2 of (executive_level >= 5, audit_group, strategy_team))
Projects at UIUC and MIT using ABE
34
Conclusions and Open Directions
Attribute-Based Encryption for Expressive Access Control on Encrypted Data
Extending Capabilities•Delegation•Non-Monotonic Formulas•Ciphertext-Policy
Currently implemented
35
Conclusions and Open Directions
Open: Can we express access control for any circuit over attributes?
What are limits of capability-based crypto?•Capability that evaluates any function
s
Univ. Key Authority
F( )
F(s)
37
Related Work
Identity-Based Encryption [Shamir84,BF01,C01]
Access Control [Smart03], Hidden Credentials[Holt et al. 03-04]
•Not Collusion Resistant
Secret Sharing Schemes [Shamir79, Benaloh86…]•Allow Collusion
38
System Sketch
Public Parameters
Choose degree n polynomial q(), q(0)=b Can compute
gq(x)gq(0), gq(1),.... gq(n),
Ciphertext gs, gsq(x1) , … , gsq(xn) Attributes: x1, x2…
=t
Private Key grq(t), gr
“Computer
Science”
NOTe(g,g)srq(t) e(g,g)srq(x1) e(g,g)srq(xn)
If points different can compute e(g,g)srb
39
Applications: Targeted Broadcast Encryption
Encrypted stream
AND
“Soccer” “Germany”
AND
“Sport” “11-01-2006”
Ciphertext = S, {“Sport”, “Soccer”, “Germany”, “France”, “11-01-2006”}
40
Extensions
Building from any linear secret sharing scheme
In particular, tree of threshold gates…
Delegation of Private Keys
41
Threshold Attribute-Based Enc. [SW05]
Sahai-Waters introduced ABE, but only for“threshold policies”:•Ciphertext has set of attributes •User has set of attributes• If more than k attributes match, then User
can decrypt.
Main Application- Biometrics