(from   : 1  )

Background

• two key encryption similar to Time-based solutions
• data encrypted using data key
• data key is secured by (encrypted or distributed according to) control key
• control key may be time-based

Idea

• each file associated with file access policy
• each policy may be Boolean combination of atomic policies
• each atomic policy is associated with control key (may be time-based), controlled by key manager
• when policy is revoked the corresponding key is removed from key manager
• when the policy combination associated with a file is revoked, the data key (hence the encrypted content) cannot be recovered with the control keys of the policies -- we say the file is deleted

Conjunctive Policies:

If file \(F\) is associated with policies \(P_1\wedge \dots \wedge P_m\), data owner has to generate data key \(K\) and keys \(S_1, \dots, S_m\) Key \(K\) is encrypted using all \(S_i\) keys, namely: \(\lbrace \lbrace K\rbrace_{S_1}\rbrace_{S_2}\cdots _{S_m}\) and together with \(\lbrace F \rbrace_K\) and \(S_1^{e_1},\dots,S_m^{e_m}\) is stored in the cloud. In similar manner, during download the owner sends to the key manager \((S_1 R)^{e_1},\dots,(S_m R)^{e_m}\) and after response recovers \(S_1,\dots,S_m\), hence \(K\) and \(F\).

Disjunctive Policies:

If file \(F\) is associated with policies \(P_1\vee \dots \vee P_m\), data owner has to generate data key \(K\) and keys \(S_1, \dots, S_m\) Key \(K\) is encrypted separately by each \(S_i\) key, namely: \(\lbrace K\rbrace_{S_1}, \dots \lbrace K\rbrace_{S_m}\) and together with \(\lbrace F \rbrace_K\) and \(S_1^{e_1},\dots,S_m^{e_m}\) is stored in the cloud. In order to recover \(F\) owner may use any of the policies.

Policy Reneval

Important is that the old policy will always be revoked first before the new policy is revoked. If the new policy is revoked first, then the file version that is protected with the old policy may still be accessible when the control keys of the old policy are compromised, meaning that the file is not assuredly deleted. A straightforward approach of implementing policy renewal is to combine the file upload and download operations, but without retrieving the encrypted file from the cloud.

• File metadata: contains two pieces of information -- file size and HMAC. FADE uses HMAC-SHA1 for integrity checking. The file metadata is of fixed size (with 8 bytes of file size and 20 bytes of HMAC) and is attached at the beginning of the encrypted file.
• Policy metadata: includes the specification of the Boolean combination of policies and the corresponding encrypted cryptographic keys. Each single policy is specified by a unique 4-byte integer identifier. To represent a Boolean combination of policies '*' and '+' are used to denote the AND and OR operators. Policy metadata is uploaded as a separate file in order to allow easy policy changes.

Results presented by the authors in   : 1  show that overhead caused by using FADE is not significant.
The results of the experiments are presented below.

Experiment 1. Performance of upload/download operations

Experiment 2. Performance of policy updates

We do not show the AES+HMAC time as it is not involved in policy renewal.