IET Information Security
Research Article
Attribute-based broadcast encryption scheme
for lightweight devices
ISSN 1751-8709
Received on 4th April 2017
Revised 29th July 2017
Accepted on 18th August 2017
doi: 10.1049/iet-ifs.2017.0157
www.ietdl.org
Sébastien Canard
1
, Duong-Hieu Phan
2
, Viet Cuong Trinh
3
1
Applied Crypto Group, Orange Labs, Caen, France
2
XLIM (Université de Limoges, CNRS), Limoges, France
3
Faculty of Information and Communication Technologies, Hong Duc University, Thanh Hoa, Viet Nam
E-mail: trinhvietcuong@hdu.edu.vn
Abstract: Lightweight devices, such as a smartcard associated with a top-box decoder in pay-TV or a SIM card coupled with a
powerful (but not totally trusted) smartphone, play an important role in modern applications. The essential requirements for a
cryptographic scheme to be truly implemented in lightweight devices are that it should have compact secret key size and
support fast decryption. Attribute-based broadcast encryption (ABBE) combines the functionalities of both broadcast encryption
and attribute-based encryption in an efficient way, ABBE is therefore a promising cryptographic scheme to be used in practical
applications such as mobile pay-TV, satellite transmission, or Internet of Things. Designing an ABBE scheme which can be truly
implemented in lightweight devices is still an open question. In this study, the authors solve it by proposing an efficient constant-
size private key ciphertext-policy ABBE scheme for disjunctive normal form supporting fast decryption and achieving standard
security levels of an ABBE scheme. They concretely show that the authors’ scheme can be truly implemented in a prototype for
a smartphone-based cloud storage use case. In particular, they show how to alleviate some parts of their scheme so as to
obtain a very practical system, and they give some concrete benchmarks.
1 Introduction
We are currently in a very active period of development of
cryptography. Modern technologies, namely cloud computing and
big data, require the design of advanced cryptographic schemes
supporting new functionalities. In many applications that involve a
large set of users, one needs to have stronger and more flexible
capabilities to encrypt data than the traditional public-key
encryption: the encryption should take into account specific
policies in such a way that only receivers with suitable rights can
decrypt the encrypted messages.
Attribute-based encryption: To this end, Sahai and Waters [1]
introduced the concept of attribute-based encryption (ABE) in
which the encryption and decryption can be based on some
attributes. Since then, a lot of development has been performed in
this area, with many interesting results [1–11], to name a few.
There are now two categories of ABE: ciphertext-policy ABE (CP-
ABE) and key-policyABE (KP-ABE), where CP-ABE attracts
researcher's attention more than KP-ABE since it is used for many
practical applications as shown in [7]. In a CP-ABE scheme, the
secret key is associated with a set of attributes and the ciphertext is
associated with an access policy (structure) over the universe of
attributes: a user can then decrypt a given ciphertext if the set of
attributes related to his/her secret key satisfies the access policy
underlying the ciphertext. In contrast, in a KP-ABE scheme, each
secret key corresponds to an access policy and a set of attributes is
associated with the ciphertext. Concerning the access structure, to
date several types of access policy have been investigated. Two
limited ones are AND-gates and threshold. In [4, 12], the access
structure is constructed by AND-gates on multi-valued attributes. In
[3, 6, 13], the access policy is threshold, meaning that there is no
distinction among attributes in the access policy: anyone who
possesses enough attributes (equal or bigger than a threshold
chosen by the sender) will be able to decrypt. Fine-grained access
control is the most desired and also well formalised as Boolean
formula in disjunctive normal form (DNF) or in conjunctive
normal form (CNF).
Attribute-based broadcast encryption: In some practical cases,
one may want to remove the right to decrypt to some specific users.
The notion of attribute-based broadcast encryption (ABBE) has then
been introduced in [14] to address the problem of user revocation.
More precisely, in such a system, the broadcaster is capable of
revoking any receiver and the collusion of revoked users cannot
decrypt any ciphertext even if they possess sufficient attributes to
satisfy the access policy. In traditional ABE schemes, the revocation
can be performed based on attributes (resp., negative attributes as
some non-monotonic schemes [2, 9, 11]), by adding the AND of a
clause containing the attributes corresponding to non-revoked users
(resp., negative attributes corresponding to revoked users).
However, this will give an inefficient solution as the ciphertext
grows linearly to the number of non-revoked users (resp., revoked
users), which is large. An ABBE scheme should allow individual
receivers to be directly revoked in an efficient way. We also
emphasise that anonymity is a prominent property of an ABBE
scheme, for which the sender does not know the identities of the
receivers as well as exactly what kind of attributes those users own.
ABBE for lightweight devices: In the context of lightweight
devices, which are being used in practical applications such as
mobile pay-TV, satellite transmission, or Internet of Things, it is of
great importance to construct a scheme with compact secret key
and supporting fast decryption. The reason is that lightweight
devices are relatively small and the secure memory is often
implemented in a smartcard. Moreover, the power of lightweight
devices is quite restricted. Regarding compact secret key, while
broadcast encryption with constant-size secret key has been solved
by Boneh et al. in [15], the extension of Boneh-Gentry-Waters
(BGW) technique to ABBE setting makes the secret key longer, due
to the obligation of combining different attributes in the decryption,
as shown in [7]. The problem of designing constant-size private
key ABBE schemes supporting fine-grained access control was
partially solved in ESORICS ‘15 [16]. However, the problem is
still open since the proposed non-monotonic scheme only manages
restrictive access policies supporting AND-gates and wildcards:
they do not treat the case of CNF or DNF forms. More precisely, if
the access policy is
A
1
∧ ∗ ∧ A
2
, where * is a wildcard, then any
user whose attribute set contains exactly three attributes (no more
no less) and two of them are
A
1
, A
2
can decrypt the ciphertext. This
obliviously can reduce the ciphertext size, however in exchange,
the secret key size now is 3 + 2(N
1
+ 1) elements, where N
1
is the
IET Inf. Secur.
© The Institution of Engineering and Technology 2017
1