The document proposes a scheme to achieve secure, scalable, and fine-grained data access control in cloud computing. It combines key-policy attribute-based encryption (KP-ABE) and proxy re-encryption (PRE). When a new user joins, the data owner assigns them an access structure and secret key using KP-ABE. To revoke a user, the data is re-encrypted using PRE without needing to re-encrypt the entire data store or interact with the data owner. The proposed scheme provides fine-grained access control, confidentiality of user privileges, accountability of secret keys, and data confidentiality.

1. Achieving Secure, Scalable, and Fine-grained
Data Access Control in Cloud Computing
Instructor: Dr. TRUONG TUAN ANH
Presenter: NGUYEN THE CUONG
1

2. REFERENCES
1. S.C. Yu, C. Wang, K.I. Ren, and W.J. Lou, “Achieving Secure, Scalable, and
Fine-grained Data Access Control in Cloud Computing.” INFOCOM, 2010
Proceedings IEEE, pp.321-334, 2010.
2. Jeong-Min Do, You-Jin Song, and Namje Park, “Attribute based Proxy Re-
Encryption for Data Confidentiality in Cloud Computing Environments.”
2011 First ACIS/JNU International Conference on Computers, Networks,
Systems, and Industrial Engineering.
3. Key-Policy Attribute-Based Encryption and Public Key Encryption with
Keyword Search (Lesson 8 ). Teacher : Benoit Libert. November 3, 2014.
4. http://mohamednabeel.blogspot.com/2011/03/proxy-re-encryption.html.
5. Internet. 2

3. CONTENTS
1. INTRODUCTION.
2. RELATED WORK.
3. PROPOSED SCHEME.
4. ANALYSIS OF PROPOSED SCHEME.
5. Q & A.
3

4. 1. INTRODUCTION.
• Business environment will move to cloud computing
environment.
• The problem of data confidentiality in computing
environment begins from the untrustworthy cloud service
provider.
• The data owner (business ) re-encrypt all the data files
accessible to the leaving user, or even needs the data owner
to stay online to update secret keys for users.
• In order to achieve secure, scalable and fine-grained access
control on outsourced data in the cloud.
4

5. 1. INTRODUCTION.
5

6. 2. RELATED WORK.
a. Key Policy Attribute-Based Encryption (KP-
ABE).
b. Proxy Re-Encryption (PRE).
6

7. 2. RELATED WORK.
a. Key Policy Attribute-Based Encryption (KP-ABE): is a
public key cryptography primitive for one-to-many
communications. The idea of a KP-ABE is to have the
sender encrypt the message only once. It is the policy
assigned to users' keys that will determine if these users
will be allowed to decrypt:
• Ciphertexts are labeled with a set w of descriptive
attributes.
• Private key corresponds to an access policy P.
• Decryption works if and only if P(w) = 1.
7

8. 2. RELATED WORK.
a. Key Policy
Attribute-Based
Encryption
(KP-ABE):
8

9. 2. RELATED WORK.
9
a. KP-ABE Examples:
• Attributes can be {Researcher, Teacher, Student, ENS Lyon, CNRS}.
• M. Dupont is researcher at the CNRS. So, his policy will be : (Researcher AND
CNRS).
• Mme Dupre is researcher at the ENS Lyon and also teacher at the ENS Lyon. So
her policy will be : ((Researcher OR Teacher) AND ENS Lyon).
• M. Dupuis is researcher at the CNRS and also gives courses at the ENS Lyon. His
policy is : ((Researcher AND CNRS) OR (Teacher AND ENS Lyon)).
• Chloe is student at the ENS Lyon, her policy is : (Student AND ENS Lyon).
If w = {Researcher, CNRS}, which means that only researchers at the CNRS should be
able to decrypt the message, then only M. Dupont and M. Dupuis have the good
policy to read the message.
If w = Researcher, ENS Lyon, CNRSg, meaning that recipients must be all the research
staff in both ENS Lyon and CNRS, then M. Dupont, Mme Dupre and M.Dupuis can all
read the message.

10. 2. RELATED WORK.
b. Proxy Re-Encryption (PRE).
An example would be Alice wants to temporarily forward her emails encrypted under
her public key to Bob. So, she forwards her encrypted emails to a proxy and gets it to
covert her encrypted emails to the ones encrypted under Bob's public key so that Bob
can decrypt and read the emails.
1. The proxy cannot see the plaintext unless it colludes with Bob.
2. The proxy cannot derive the secret key of Alice (even when the proxy colludes with
Bob).
10

11. 3. PROPOSED SCHEME.
11

12. 3. PROPOSED SCHEME.
 New User Grant: When
a new user wants to
join the system, the
data owner assigns an
access structure and
the corresponding
secret key to this user
as follows:
(KP-ABE)
12

13. • KP-ABE: This algorithm takes a message M, the public key PK (Public Key), and a set
of attributes i as input. It outputs the ciphertext E. (SK – Secret Key).
3. PROPOSED SCHEME.
13

14. 3. PROPOSED SCHEME.
 Revoke user:
Proxy Re-Encryption (PRE).
14

15. 4. ANALYSIS OF PROPOSED SCHEME.
a)Fine – grained Access Control.
b)User Access Privilege Confidentiality.
c) User Secret Key Accountability.
d)Data Confidentiality.
15

16. 5. Question and Answer:
Thanks for watching.
16