Fine Grained Access Control Of Encrypted Data In Outsourcing Storage

To make use of the storage service supplied by cloud computing, users usually choose to outsource their encrypted data in order to achieve confidentiality. Whereas this limits the others to access the data. Proxy re-encryption allows a data owner (delegator) to authorize a cloud server (proxy) to transform some of his cipher-texts into the cipher-texts that can be decrypted by another specified user (delegatee). In such a way, the sharing of users’cipher-texts can be realized. However, the access control using proxy re-encryption in outsourcing storage is coarse grained. Once a delegatee has been granted to decrypt a certain cipher-text of a delegator, it can collude with the dishonest proxy to decrypt the delegator’s some other cipher-texts which are never granted to decrypt or even all the cipher-texts encrypted using the same key as the authorized one. Hence, how to realize a fine grained access control of users’confidential data is a significant problem in outsourcing storage that needs to be addressed urgently.To overcome the above weakness of proxy re-encryption when applied in outsourcing s-torage, this paper introduces a new concept called mediated decryption. The role of proxy in proxy re-encryption is called mediator in mediated decryption. In a mediated decryption system, the encryption algorithm employs the hybrid encryption mechanism which incorporates the key encapsulation mechanism and one time symmetric key encryption. And the access control of a user’s cipher-texts is realized by sharing the encapsulated key between the mediator and the delegatee. The authorized delegatee would request a mediated result from the mediator before it accesses the encrypted file. When the request is granted, the delegatee who has another en-capsulated key share as well as the mediated decryption result is able to decrypt the cipher-texts without the decryption key. As the authorization to access a cipher-text of a user is bind with that cipher-text, when applied in outsourcing storage the delegatee and the mediator can get no information of the plain text contained in any unauthorized cipher-text even if they collude together. This paper presents the formal definition and security model of mediated decryption based on traditional public key encryption. Besides that, the definition and security model of identity based mediated decryption is proposed. Some concrete constructions are proposed in this paper. And their security gets proved in corresponding security model.The schemes in this paper will be analysed from the prospective of theory and experiment. The advantages of mediated decryption systems are discussed as well as the computation cost of the proposed schemes. Besides that, this paper investigates how to implement the constructions. Experimental results demonstrate these schemes’practical aspects. In the end, how to apply mediated decryption in outsourcing storage to realize a fine grained control over users’cipher-text is described.