ABSTRACT: Access control in searchable encryption with the use of atribute-based encryption and SGX

Abstract

We designed a hybrid encryption scheme that deals with the problem of storing data on untrusted clouds. Our work is an extension of [2, 7] and combines Symmetric Searchable Encryption (SSE) [3] and Attribute-Based Encryption (ABE) [4], along with the functionality offered by Intel SGX [6]. Our scheme compromises four SGX enclaves: Master Authority (MS) that generates public parameters and issues secret ABE keys to the users according to their attributes, a CSP enclave that verifies, stores and processes search requests by users, a KeyTray (KT) that acts as a storage server for SSE keys and a Revocation Enclave (REV) that controls access rights. How it Works: A data owner ui generates an SSE key Ki, encrypts her data locally and then sends them to the CSP. Additionally, ui encrypts Ki using ABE - this results to a ciphertext cpKi of Ki - and sends it to KT. Finally, ui sends a list of access rights to REV for the users that she wishes to share her data with. Access rights are represented as a one dimensional array s of length four, where each bit corresponds to one of the following scopes: view, add, delete and revoke. For example if sj = [1, 0,0,0], uj can only read files. If another user uj wishes to access uis encrypted data, she first needs to contact KT and request cpKi. Since cpKi is encrypted with ABE, uj will only be able to decrypt it if her attributes satisfy the underlying policy. Assuming that uj successfully recovers Ki she then needs to prove that she is allowed to access uis data. To this end, she requests a proof from REV indicating her access rights. With this proof, along with Ki, uj can create the SSE tokens needed to access the database. Finally, we have designed a revocation mechanism that is based on SGX and is agnostic to the underlying encryption schemes. If uj wishes to revoke a scope from another user she needs to have certain access right enabled (i.e. sj [3] = 1). Revocation is then as simple as sending a request to REV containing the id of the user to be revoked, uℓ, as well as an integer n < 4, indicating which bit of sℓ will be flipped from 1 to 0. The security of our scheme is proved through a simulation-based security analysis as well as an analysis showing its resistance against a set of new attacks. The security proof is coupled with extensive experiments that show the eficiency and practicality of our approach. Our experiments mainly aimed at analyzing the processing time. For the implementation of the CP-ABE scheme, we used the library provided by Bethencourt et al. [5] while for the SSE scheme we used the Dynamic Forward Private SSE scheme described in [3]. Finally, for the implementation of the parts that run in secure enclaves we used the SGX-OpenSSL library [1]. Due to space constraints a detailed description of the scheme and its evaluation will be presented in the full version of the paper.