IRJET- A Review Paper on an Efficient File Hierarchy Attribute Based Encryption Scheme in Cloud Computing

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 05 Issue: 04 | Apr-2018 www.irjet.net p-ISSN: 2395-0072
© 2018, IRJET | Impact Factor value: 6.171 | ISO 9001:2008 Certified Journal | Page 1139
A Review Paper on an Efficient File Hierarchy Attribute Based
Encryption Scheme in Cloud Computing
Shital Panchal1, Kamthane A.N.2, Shital Gaikwad3
1P.G. Student, Dept. of Computer Science & Engineering, MPGI School of Engineering, Nanded, Maharashtra, India
2HOD, Dept. of Computer Science & Engineering, MPGI School of Engineering, Nanded, Maharashtra, India
3Assistant Prof., Dept. of Computer Science & Engineering, MPGI School of Engineering, Nanded,
Maharashtra, India
---------------------------------------------------------------------***---------------------------------------------------------------------
Abstract - Cloud computing enables the users to remotely
store their data in a server and provide services on-demand.
Cloud storage is the best way to handle our information
securely. Data security and privacy are the critical issues.
There are many encryption technologies used to share data
securely. One of the best ways is CP-ABE is to solve challenging
problem of secure data sharing scheme in cloud computing.
Only authorized users are able to encrypt and decrypt data.
Each user has the set of attributes. The layered access
structure are integrated into single access structure .The
hierarchical files are encrypted with integrated access
structure. Ciphertext time cost of encryption is saved. Final
Implementation gives that linearly increasing the encryption
and decryption time as number of attributes are increased. In
this paper an efficient file hierarchy attribute based
encryption scheme is proposed.
Key Words: Cloud Computing,datasharing,filehierarchy
ciphertext-policy, attribute based encryption
1. INTRODUCTION
Cloud Computing can be described as web service oriented
computing that provides an environment which acts as a
service in delivering software and informationmanagement
in a way that would have typically only been available in
product format. This is donethroughpersonal devices – such
as a laptop – that would access the services available
through the network of servers that is called the “cloud”.
1.1 Overview
Cloud Computing is the use of hardware and software to
deliver aservice over a network (typically the Internet)....An
example of a Cloud Computing provider is Google’s Gmail.
Gmail users can access ﬁles and applications hosted by
Google via the internet from any device. Cloud Computing is
to protect data fromleaking, users need to encrypt their data
before shared.
Cloud computing posesprivacyconcerns becausetheservice
provider can access the data that is in the cloud at any time.
It could accidentally or deliberately alter or even delete
information. Many cloud providers can share information
with third parties if necessary for purposes of law and order
even without a warrant. That is permitted in their privacy
policies, which users must agree to before they start using
cloud services. Solutions to privacy include policy and
legislation as well as end users’ choices for how data is
stored. Users can encrypt data that is processed or stored
within the cloud to prevent unauthorized access[1].
Role based authentication is a combinationofsymmetrickey
cryptography and public key cryptography where by every
encryption process needs data, public key, groupkey,policy.
a policy is a set of rule that can be specified as chain also for
e.g., in the context of hospital a policy can be given as
{doctor, patient} which means anybody from the doctors
group or patient group can simultaneously decrypt the
document on the other hand a policy can be specified as
chain policy for instance{doctor},{patient} this is known as
nested policy .In such cases a patient can decrypt the
document only when that is decrypted by doctors first,
Policy based encryption is becoming popular in an
enterprise context where different authorities require
different permission and privacy settings for the access of
the records. In this work we want to develop a novel CP-
ABE[2] based search technique in an enterprise hospital
context deployed in a local cloud with fog computing
architecture ,our proposedsystemwill offerdifferentlevel of
encryption, decryption, authentication, authorization and
privacy setting for doctors, administrators and patients .we
also propose to use a machine learning base system to
diagnose abnormality in the medical image. In this work we
demonstrate the use of CP-ABE with human entities as well
as i n the context of machine learning the overall work
demonstrate the entire process of medical scanning in an
enterprise hospital application both plain record encryption
and image encryption with the help of CP-ABE.
Problem definition:
CP-ABE is derived from AES and it is extremely complicated
mathematically, CP-ABE encryption not only encrypts the
data with a key but at the same time embeds the access
policy, because access policy can be changed, the overall
decryption process is also extremely complicated, therefore
one of the major issue.
Issues:
1. Access Policy Management:
Implementing CP-ABE based system is, the design issue of
appropriate forming the group, generating the group keys
and managing the access policies.

2. Attack Prevention:
As CP-ABE scheme to decrypt the key, one of major issues
with the system is that anybody acquiring a group key, a
drawback can overcome by incorporating the private key
also in the decryption process not only decryption authority
require the group key but at the same time it on private key.
3. As our proposed work implement CP-ABE based
encryption both record as well as with the images, the
decryption and encryption of such a system using on hybrid
records become a huge issue.
4. Bandwidth and latency Management:
As medical data is sensitive and requires a faster processing
and because CP-ABE based encryptionaddshugeprocessing
overhead ,a huge issue in such system is to develop systems
with optimal processing and communication latency.
Challenges:
1. The major challenge with CP-ABE based encryption is
creating mathematical model of encryptiononthetopofAES
encryption schema that supports changed privacy. Simple
form of CP-ABE encryption allows the user to specify the
access policies as the simple set{doctor ,patient},however
more complicated CP-ABE architecture allows the user to
embed a complex set of policies where by policy itself can be
nested designing and implementation of such a system and
maintaining the integrity of the policy chain is extremely
difficult.
2. Handling Media Data:
As most of the hospital or enterprise application not only
deals with text data ,but also other forms of data like images,
developing an algorithm that holds goodforbothtextaswell
as image(binary record) is of extremely challenging serve.
3.Data Size:
Because CP-ABE is developed on the top of AES which is
block encryption technique, it accepts the data to multiplier
of block size. However in most cases the record will not be
multiplier of the block size, padding of the data at thetime of
encryption and removal of padding is the challenging task.
2. LITERATURE SURVEY
The literature survey that containing study of different
schemes available in Attribute Based encryption(ABE). An
efficient file hierarchy attribute-based encryption scheme
(FH-CP-ABE) is proposed by Shulan Wang, JunweiZhou,
Joseph K. Liu, Jianping Yu, Jianyong Chen and WeixinXie.The
layered access structures are integrated into a single access
structure, and then the hierarchical files are encrypted with
the integrated access structure. The cipher text components
related to attributes could be shared by the files. Therefore,
both cipher text storage and time costs of encryption are
saved. Moreover, the proposed scheme is proved to be
secure under the standard assumption. In this study, an
efficient encryption scheme based on layered model of the
access structure is proposed in cloud computing, which is
named file hierarchy CP-ABE scheme (or FH-CP-ABE, for
short). FH-CP-ABE extendstypical CPABEwitha hierarchical
structure of access policy, so as to achieve simple, flexible
and fine-grained access control.
2.1 Attribute Based Encryption
An attribute based encryption scheme introduced by Sahai
and Waters in 2005 and the goal is to provide security and
access control. Attribute-based encryption(ABE)isa public-
key based one to many encryption that allows users to
encrypt and decrypt data based on user attributes. In which
the secret key of a user and the cipher text are dependent
upon attributes (e.g. the country she lives, or the kind of
subscription she has). In such a system, the decryption of a
cipher text is possible only if the set of attributes of the user
key matches the attributes of the cipher text. Decryption is
only possible when the number of matching is at least a
threshold value d. Collusion-resistance is crucial security
feature of Attribute-Based Encryption [3]-[5]. An adversary
that holds multiple keys should only be able to access data if
at least one individual key grants access. The problem with
attribute based encryption (ABE) scheme is that data owner
needs to use every authorized user's public key to encrypt
data. The application of this scheme is restricted in the real
environment because it uses the access of monotonic
attributes to control user's access in the system.
2.2 Key Policy Attribute Based Encryption
It is the modified form of classical model of ABE. Users are
assigned with an access tree structure over the data
attributes. Threshold gates are the nodes of the access tree.
The attributes are associated by leaf nodes. To reflect the
access tree Structure the secret key of the user is defined.
Cipher texts are labeled with sets of attributes and private
keys are associated with monotonic access structures that
control which cipher texts a user is able to decrypt. Key
Policy Attribute Based Encryption (KP-ABE) scheme[6] is
designed for one-to-many communications.
KP-ABE scheme consists of the following four algorithms:
Setup : Algorithm takes input K as a securityparameter and
returns PK as public key and a system master secret key
MK.PK is used by message senders for encryption. MK is
used to generate user secret keys and is known only to the
authority.
Encryption :Algorithmtakesa messageM,thepublickey PK,
and a set of attributes as input. It outputs the ciphertext E.
Key Generation: Algorithm takes as input an access
structure T and the master secret key MK. It outputs a secret
key SK that enables the user to decrypt a message encrypted
under a set of attributes if and only if matches T.

Decryption : It takes as input the user’s secret key SK for
access structure T and theciphertextE,whichwasencrypted
under the attribute set . This algorithm outputs the message
M if and only if the attribute set satisfies the user’s access
structure T.
Limitations of KP-ABE:-
1. Encryptor cannot decide who candecrypttheencrypted
data. It can only choose descriptive attributes for the
data, and has no choice but to trust the key issuer.
KPABE is not naturally suitable to certain applications.
For example, sophisticated broadcast encryptionwhere
users are described by various attributes andinthis,the
one whose attributes match a policy associated with a
ciphertext, it can decrypttheciphertext.KP-ABEscheme
supports user secret key accountability. It is providing
fine grained access but has no longer with flexibilityand
scalability.
2. Expressive Key Policy Attribute Based Encryption:- In
KP-ABE, enables senders to encrypt messageswitha set
of attributes and private keys are associatedwithaccess
tree structure. Access tree structure specifies which all
the ciphertexts the key holder is allowed to decrypt.
Expressive key-policy attribute-based encryption
(KPABE) schemes allow for non-monotonic access
structures. Non monotonic access tree structures are
those may contain negated attributes and with constant
cipher-text size. This is more efficient than KP-ABE.
2.3 Ciphertext policy attribute based encryption
It introduced the concept of another modified form of ABE
called CP-ABE that is Ciphertext Policy Attribute Based
Encryption. In CP-ABE scheme, attribute policies are
associated with data and attributes are associated withkeys
and only those keys that the associated attributes satisfythe
policy associated with the data are able to decrypt the data.
CP-ABE works in the reverse way of KP-ABE. In CP-ABE the
ciphertext is associated with an access tree structure and
each user secret key is embedded with a set of attributes. In
ABE, including KP-ABE and CP-ABE, the authority runs the
algorithm Setup and Key Generation to generate systemMK,
PK, and user secret keys. Only authorized users (i.e., users
with intended access structures) are able to decrypt by
calling the algorithm Decryption. In CP-ABE, each user is
associated with a set of attributes. His secret key is
generated based on his attributes. While encrypting a
message, the encryptor specifies the threshold access
structure for his interested attributes. This message is then
encrypted based on this access structure such that only
those whose attributes satisfy the access structure can
decrypt it. With CP ABE technique, encrypted data can be
kept confidential and secure against collusion attacks.
CP-ABE scheme consists of following four algorithms:
1. Setup : This algorithm takes as input a securityparameter
κ and returns the public key PK as well as a system master
secret key MK. PK is used by message senders for
encryption. MK is used to generate user secret keys and is
known only to the authority.
2.Encrypt : This algorithm takes as input the public
parameter PK, a message M, and an access structure T. It
outputs the ciphertext CT.
3.Key-Gen : This algorithm takes as input a set of attributes
associated with the user and the master secret key MK. It
outputs a secret key SK that enables the user to decrypt a
message encrypted under an access tree structure T if and
only if matches T.
4.Decrypt : This algorithm takes as input the ciphertext CT
and a secret key SK for an attributes set . It returns the
message M if and only if satisfies the access structure
associated with the ciphertext CT. In CP-ABE depends how
attributes and policy are associated with cipher texts and
users‟ decryption keys. In a CP-ABE scheme, a ciphertext is
associated with a monotonic tree access structure and a
user’s decryption key is associated with set of attributes. In
this scheme, the roles of ciphertexts and decryptionkeysare
switched as that in KP-ABE.
Limitations of CP-ABE:-
However, basic CP-ABE schemes are still not fulfilling the
enterprise requirements of access control which require
considerable flexibility and efficiency. CP-ABE has
limitations in specifying policies and managing user
attributes. In a CP-ABE scheme, decryption keys only
support user attributes that are organized logically as a
single set, so users can only use all possible combinations of
attributes in a single set issued in their keys to satisfy
policies. For realizing complex access control on encrypted
data and maintaining confidential-ability, CP-ABE can be
used. Encrypted data can be kept confidential even if the
storage server is un-trusted; moreover, our methods are
secure againstcollusionattacks[7].KP-ABEusesattributesto
describe the encrypted data and built policies into user’s
keys. In other hand CP-ABE, attributes are used todescribea
user’s credentials. Data encryptor determines a policy for
who can decrypt.
3. DESIGN GOALS

Authority-accepts the user enrollment and creates some
parameters.
Cloud service provider (CSP) -is the manager of cloud
servers and provides multiple services for client.
Data owner -encrypts anduploadsthegeneratedciphertext
to CSP. It has large data needed to be stored and shared in
cloud system.
User -downloads and decrypts the interested cipher text
from CSP.
The shared files usuallyhavehierarchical structure.Thatis,a
group of files are divided into a number of hierarchy
subgroups located at different access levels. If the filesin the
same hierarchical structure could be encrypted by an
integrated access structure, the storage cost of cipher text
and time cost of encryption could be saved.
3.1 Existing Scheme
CP-ABE system in the past has been used in the context of
text records where text records are given various label of
privacy and keys to different groups .CP-ABE byte design
does not support media and binary records .Due to this
disadvantage it cannot be used in many of the practical
enterprise applicationandgenerallyislimitedtovarioustext
based searching and indexing technique.
3.2 Proposed Scheme
In order to overcome this basic drawback of CP-ABE based
systems we propose a novel updated CP-ABE system which
can be used for both text as well as binary(image records)
we develop medical application where patient can register
once the patient is registered their text record will be
encrypted with privacy setting of admins and doctors
patient personal record such as phone number and email-id
will be encrypted with an access to only patient and admin
as such a doctor would be able to view the patient and his
case history but not the personal information,theadmincan
upload the medical image(braintumor) withprivacysettings
of only doctors and patients. A doctor upon viewing the
medical image through a machine learning system. The
result of machine learning system is a set of feature vector
which will again be encrypted with the policy of only
machine learning. The doctor will be able to see whether a
particular record is abnormal or normal that information is
again encrypted with the policy of doctor and thatparticular
patient therefore a patient can view his own record, medical
diagnosis observation a doctor will be able to see the patient
general information, case history and the medical images
and diagnosis but a doctor will not able to visualize the
images of the doctors of the other patients a doctor will not
able to visualize the personal information of the patient, the
admin on the other hand would be able to see all the
information of the patient along with their personal
information but will not able to view medical diagnosis
reports.
3.3 Computation Cost on Data Owner
The layered model of access structure is provided so as to
achieve multiple hierarchical files sharing. The files are
encrypted with one integrated access structure. So, data
owner can encrypt the different levels of the files and
generate an integrated ciphertext only executing the
encryption algorithm one time. Especially, some common
attributes should be computed only once instead of many
times since each common attribute is appeared in the
integrated access structure one time, where the common
attribute denotes that it is appeared in multiple access sub-
trees associated with k hierarchical files. Assume that there
are n common attributes appeared in the m(m ≤ k) access
sub-trees associated with the k hierarchical files, the
computation workload of the common attributes about
ciphertext C(x,y) and C'(x,y) is reduced by 2n(m −1/m), thus
the encryption efficiency of data owner is also improved.
3.4 Computation Cost on User
In decryption process, users can decrypt all of his
authorization files with computationofsecretkeyoncesince
transport nodes are added in the access structure with k
level nodes. And the bilinear pairing operation of each
common nodes used in multiple access sub-trees of the files
is computed only once since each common node is also
appeared in the integrated access structure one time.
Assume that there are n common nodes appeared in the
m(m ≤ k) access sub-trees associated with the k hierarchical
files, the bilinear pairing computation cost of the common
nodes about decryption Decrypt Node(CT, SK,(x, y)) is also
reduced by 2n(m−1/m) if the user needs to decrypt the k
files.
4. CONCLUSION AND FUTURE WORK
In this paper, the proposed scheme gives the encryptionand
decryption time which is linearly increasing as the number
of attributes are increasing. Therefore, both cipher text
storage and time cost of encryption are saved. The proposed
scheme has an advantage that users can decrypt all
authorization files by computing secret key once. Thus, the
time cost of decryption is also saved if the user needs to
decrypt multiple files. CP-ABE an adjustment of Attribute
Based Encryption (ABE) for the reasons for giving
certifications towards the provenance the delicate
information Our scheme also enables dynamic modification
of access policies o supports efficient on-demand
user/attribute revocation and break-glass access under
emergency scenarios. From the survey we understand that
some amount of work has been done in the field of cloud
computing for several security issues. It can be applied to
achieve scalable, flexible, security, privacy, data
confidentiality and fine-grainedaccesscontrol ofoutsourced
data in cloud computing. There is more scope for future
research in the field of secure data sharing in the cloud. We
proposed a scheme for efficient identity-based user

revocation in multi-authority CP-ABE. In the future, our
work can be continued in several directions. Securely
forwarding the revocation related computations to the CSP
(or even to the user). The security of our construction is
proved in the generic bilinear group model, although we
believe it would be possible to achieve full security by
adapting the dual system encryptionmethodology.Thistype
of work would be interesting even if it resulted in a
moderate loss of efficiency from our existing system.
REFERENCES
[1] C.-K. Chu, W.-T. Zhu, J. Han, J.-K. Liu, J. Xu, and J. Zhou,
“Security concerns in popular cloud storage services,”
IEEE Pervasive Comput., vol. 12, no. 4, pp. 50–57,
Oct./Dec. 2013.
[2] Y. Yang, J. K. Liu, K. Liang, K.-K. R. Choo, and J. Zhou,
“Extended proxy-assisted approach: Achieving
revocable ﬁne-grained encryption of cloud data,” in
Proc. 20th Eur. Symp. Res. Comput. Secur. (ESORICS),
vol. 9327. Sep. 2015, pp. 146–166.
[3] Sphurti Atram, N. R. Borkar A Review Paper on
Attribute-Based Encryption SchemeinCloudComputing
2017
[4] A. Sahai and B. Waters, “Fuzzy identity-based
encryption,” in Advances in Cryptology. Berlin,
Germany: Springer, May 2005, pp. 457–473.
[5] W. Zhu, J. Yu, T. Wang, P. Zhang, and W. Xie, “Efﬁcient
attribute-based encryption from R-LWE,” Chin. J.
Electron., vol. 23, no. 4, pp. 778–782, Oct. 2014.
[6] V. Goyal, O. Pandey, A. Sahai, and B.Waters”Attribute-
based encryption for fine-grained access control of
encrypted data," in Proceedings of the 13th ACM
conference on Computer and communications security,
pp. 89{98, 2006}
[7] Minu George1, Dr. C.Suresh Gnanadhas2, Saranya.K3 , A
Survey on Attribute Based Encryption Scheme in Cloud
Computing.2013

IRJET- A Review Paper on an Efficient File Hierarchy Attribute Based Encryption Scheme in Cloud Computing

Recommended

More Related Content

What's hot (20)

Similar to IRJET- A Review Paper on an Efficient File Hierarchy Attribute Based Encryption Scheme in Cloud Computing (20)

More from IRJET Journal (20)

Recently uploaded (20)

IRJET- A Review Paper on an Efficient File Hierarchy Attribute Based Encryption Scheme in Cloud Computing