Insider Threat Mitigation in Attribute-based Encryption

Huntsville (Ala.)

Recent advances in computing have enabled cloud storage service, among others, that collect and provide efficient long term storage of huge amounts data that may include users’ privacy sensitive information. Concerns about the security and privacy of the sensitive data stored in the cloud is one key obstacle to the success of these cloud based applications and services. To tackle these issues, Attribute based Encryption (ABE) approaches, especially the Ciphertext-Policy Attribute based Encryption (CP-ABE), have been shown to be very promising. ABE helps provide access control solutions to protect the privacy-sensitive information stored in the cloud storage centers. However, use of an ABE approach in such cases suffers from two key insider threats: insider threat due to colluding users; and that due to a potentially malicious or compromised authority center. Even though the users’ collusion has been addressed in the literature, to our best knowledge, the authority center as an insider has not been addressed, and existing schemes assume that the authority is fully trusted or honest-but-curious. In this paper, we propose a new technical solution to mitigate the threat from the authority as an insider in an ABE system. We present analysis to show that the proposed work is efficient from the perspective of algorithms and can mitigate the insider threat in the authority party effectively