An Ad Hoc Group Signature Scheme for Accountable and Anonymous Access to Outsourced Data Chuang Wang...
-
Upload
roland-johnston -
Category
Documents
-
view
216 -
download
2
Transcript of An Ad Hoc Group Signature Scheme for Accountable and Anonymous Access to Outsourced Data Chuang Wang...
An Ad Hoc Group Signature Scheme for Accountable and Anonymous Access to
Outsourced Data
Chuang Wanga,b and Wensheng Zhanga
aDepartment of Computer ScienceIowa State UniversitybSymantec Corporation
2
Background: Data Outsourcing
remote un-trusted data storage server
encrypt
decrypt
author
authorized users
3
ABE (Attribute-based Encryption)
OR
AND
“Computer
Science”
“ISU”
“PrivacyGrp@Symant
ec”
Access Structure
Graduate student
@cs.iastate
retrieve
decrypt
retrieve
decrypt
X
derive key based on secrets
associated with his attributes
4
Accountability?
What if the secret doc is found exposed?A trusted third-party authority should be able to find out who have accessed the data (accountability/ traceability)
Meanwhile, anonymity of users should be kept from entities other than the authority (including the un-trusted storage server)
OR
AND
“Computer
Science”
“ISU”
“Privacy@Symant
ec”
Access Structure
5
Group Signature Scheme
OR
AND
“Computer
Science”
“ISU”
“Privacy@Symant
ec”
Access Structure
group public key (gpk)
A user i’s personalized private key
(gski)
m
σm = sign(gpk, gski, m)
Verify(gpk, σm)=1?Record σm
(Authority is able to trace the signature to user i.)
Authorized Users
6
Group Signature Scheme: Problem
OR
AND
“Computer
Science”
“ISU”
“Privacy@Symant
ec”
Access Structure
group public key (gpk)
A user i’s personalized private key
(gski)
Access structures may be defined on the fly (when a document is outsourced)
Significant communication
overheads may need to set up private
keys for the members of dynamic
groups
The groups of users satisfying the access structures are formed
dynamically
Authorized Users
7
Our Proposal: Ad Hoc Group Signature (AdHocSign) – Design
Goals
Objective: ad hoc group signature scheme.
Design RequirementsUser anonymity: A successfully verified user could be any one of the authorized users.
– Ex: Access Structure = “a AND b”; a successfully-verified user could be any one owning attributes a and b.
– Ex: Access Structure = “(a AND b) OR c”; a successfully-verified user could be any one owning attributes a and b, or any one owning c, and the server and other users cannot know which of the above two cases occurs.
Traceability: The authority is able to trace a signature to a user.
8
Our Proposal: Ad Hoc Group Signature (AdHocSign) – Design
Goals
Objective: ad hoc group signature scheme.
Design RequirementsUser anonymity: A successfully verified user could be any one of the authorized users.
Accountability (traceability): The authority is able to trace a signature to a user.
Efficiency in communication (for group management):
when a new access structure is created, no extra communication for group management (e.g., distributing keys) is required.
9
Our Proposal: Ad Hoc Group Signature (AdHocSign) – Key Ideas
When a user joins: he/she is preloaded key materials for each attribute assigned.
Storage Cost
Communication Cost
When a document (and associated access structure) posted to server:
server is given key materials for the access structure (AS).
A user’s attributes satisfy the AS
Y
Obtain: the user-specific and access structure-specific privacy key for group signature
10
Basis: Group Signature [BonehShacham’04]
Complexity Assumptions:q-SDH problemDecision Linear problem
xi, Ai=g 1/(ζ+xi) g, g’=g
ζ
user i’s private key (gski)
public key (gpk)
e(Ai, g’×g ) = e(g, g) xibilinear mapping
System-wide secret
• Signing: sign(gpk, gski, m) σm
• Verifying: verify(gpk, m, σm) 1/0
11
AdHocSign: Roadmap of the Design
What to do?Construct and give appropriate key materials to users and storage server, s.t., an authorized user is able to derive his/her private key as in the BS group signature scheme
How?Consider a conjunction-only access structure
– Ex: “a AND b”Consider a disjunction-only access structure
– Ex: “a OR b”Consider a general (i.e., conjunction of disjunctive) access structure
– Ex: “(a OR b) AND (c OR d)”
12
AdHocSign for Conjunction-only Access Structures: Intuition
AND
a b
Access structure: T
Secrets:
αa , αb Authority
Server
Key materials: ra, rbPublic key:
• gT = g
• gT’ = gT
ζ
αa×ra+αb×rb
User i
Private key:
• xi
Key materials:
• for attribute a: gi,a=g
• for attribute b: gi,b=g
• … …
αa/(ζ+x i)
αb/(ζ+x i)
<T=“a AND b”; ra, rb>
• AiT = gi,a ×gi,b = grbra (αa×ra+αb×rb)/(ζ+x i)
e(AiT, gT’×gT
xi) = e(gT, gT)
13
AdHocSign for Disjunction-only Access Structures: Intuition (1)
OR
a b
Access structure: T
Secrets:
αa, αb,Authority
Server
Key materials:
ra= rT/αa ; rb= rT/αb
Public key:
• gT = g
• gT’ = gT
ζ
rT
User i
Private key:
• xi
Key materials:
• for attribute a: gi,a=g
• for attribute c: …
• … …
αa/(ζ+x i)
<T=“a OR b”; ra, rb>
• AiT = gi,a =
g
ra rT/(ζ+x i)
e(AiT, gT’×gT
xi) = e(gT, gT)
rT
14
AdHocSign for Disjunction-only Access Structures: Intuition (2)
OR
a b
Access structure: T
Secrets:
αa, αb,Authority
Server
Key materials:
ra= rT/αa ; rb= rT/αb
User i
Key materials:
• for attribute a: gi,a=g
• … …
• … …
αa/(ζ+x i)
<T=“a OR b”; ra, rb>
rT, ζ
Problem: User i can derive gi,b = gi,a,
<T=“a OR b”; ra, rb>
ra/rb
though user i does not own attribute b.
Later on, user i can satisfy access structures such as “a AND b”, “b OR x”.
15
AdHocSign for Disjunction-only Access Structure: Intuition (3)
The authorityFor each attribute a, multiple (instead of a single) secret
numbers are picked: αa,1, αa,2, …, αa,N Each user i who owns attribute a is preloaded with N secrets (key materials):gi,a,1, gi,a,2, …, gi,a,N, where gi,a,k = g
Every time when a new disjunction-only access structure, e.g., T=“a OR b”, is defined:
rT is selected randomly
rT,a = rT/αa,k1 and rT,b = rT/αb,k2, where αa,k1 and αb,k2 have not been used before
A user i with attribute a or b should use gi,a,k1 or gi,b,k2 to derive its private key
αa, k/(ζ+ xi)
16
AdHocSign for General Access Structures: Intuition
OR
c d
Access structure
αa,k1
Authority
OR
a b
AND
αb,k2 αc,k3 αd,k4
rT1 rT2
Server
Key materials given to server:(a, k1, rT,a = rT1/αa,k1)
(b, k2, rT,b = rT1/αb,k2)
(c, k3, rT,c = rT2/αc,k3)
(d, k4, rT,d = rT2/αd,k4)
Public key:
• gT = grT1+rT2
• gT’ = gTζ
17
AdHocSign for General Access Structures: Intuition
User i
Assume the user owns attributes a and d
Key materials assigned to user i:
• For attribute a
• …
• gi,a,k1 = g
• …
• For attribute d
• …
• gi,d,k4 = g
• …
αa,k1/(ζ+xi)
αd,k4/(ζ+xi)
Key materials provided by server:(a, k1, rT,a = rT1/αa,k1)
… ….
(d, k4, rT,d = rT2/αd,k4)
AiT = gi,a,k1 × gi,d,k4
= g
rT, a rT, d
(rT1+rT2)/(ζ+xi)
Private key: (xi, AiT)
18
Security Features
TraceabilityIntuitively: Storage server and/or collusive users are hard to forge valid signatures that cannot trace back to any of them, as long as the SDH problem is hard.
Formally: Our proposed AdHocSign scheme is (t, qH, qS, n, m,ε) traceable if (q, t’, ε’)-SDH assumption holds, where n = q-1, ε= 8n*sqrt(ε’qH) + 2n/q, t’=O(tmN).
19
Security Features
Selfless-anonymityIntuitively: Storage server and/or others are hard to determine if two signatures are pertinent to the same user or not, as long as the Decision Linear problem is hard.
Formally: Our proposed AdHocSign scheme is (t, qH, qS, n, m,ε) selflessly anonymous if (t’, ε’) Decision Linear assumption holds, where ε’ = ε(1/n2 – qSqH/p)/2.
20
Cost Analysis
Computational costUser’s cost
– Private key preparation– x exponential ops, where x is the number of disjunctive
components in the access structure – typically lower than signing cost as long as x is not too
large– Signing (using BS Group Signature Signing)
Server’s cost– Verification (using BS Group Signature Signing)
Overall: Typically less than twice of that of BS Group Signature scheme
21
Cost Analysis
Communication costO(L): L is the length of an access structure
Storage costO(Nx)
– x - total number of attributes owned by a user – N - total number of secrets preloaded for each attribute
N: the minimum number of different access structures that can be defined dynamically; in practice, more different access structures can be defined dynamically
22
Conclusion
We design a new group signature scheme for dynamically-formed groups
Selfless-anonymity
Traceability
No user key distribution at dynamic group forming time – at the cost of storing extra key materials when a user
joins the system
Applicable when: storage is cheaper than communication (cost for dynamic management of groups)
Thank you!
Contacts of the authors{wzhang, chuangw}@iastate.edu
Full paper:www.cs.iastate.edu/~wzhang/papers/adhocsign.pdf
24
Implementation
Prototype developmentBased on jPBC (java pairing-based library)Adopting the type A curve
Evaluation setupUser: desktop with 1.83 GHz Genuine Intel processor and 3GB RAMServer: workstation with two 2.13 GHz Intel Xeon processors and 24 GB RAM
Evaluation resultsBS Group Signature
– Signing cost – 1.65 seconds by average– Verification cost – 0.28 seconds by average
Private key computation in AdHocSign– ~0.1 second for each disjunctive component in the access structure