IEEE TRANSACTIONS ON SERVICES COMPUTING, VOL. 8, NO.

4, JULY/AUGUST 2015 601

From RBAC to ABAC: Constructing Flexible Data

Access Control for Cloud Storage Services
Yan Zhu, Member, IEEE, Dijiang Huang, Senior Member, IEEE, Chang-Jyun Hu, and Xin Wang

Abstract—This paper addresses how to construct an RBAC-compatible secure cloud storage service with a user-friendly and
easy-to-manage attribute-based access control (ABAC) mechanism. Similar to role hierarchies in RBAC, attribute hierarchies
(considered as partial ordering relations) are introduced into attribute-based encryption (ABE) in order to define a seniority relation
among all values of an attribute, whereby a user holding senior attribute values acquires permissions of his/her juniors. Based on these
notations, we present a new ABE scheme called attribute-based encryption with attribute hierarchies (ABE-AH) to provide an efficient
approach to implement comparison operations between attribute values on a poset derived from an attribute lattice. By using bilinear
groups of a composite order, we present a practical construction of ABE-AH based on forward and backward derivation functions.
Compared with prior solutions, our scheme offers a compact policy representation approach that can significantly reduce the size of
private-keys and ciphertexts. To demonstrate how to use the presented solution, we illustrate how to provide richer expressive access
policies to facilitate flexible access control for data access services in clouds.

Index Terms—Security, secure cloud storage, role-based access control, attribute-based encryption, data migration

1 INTRODUCTION

I NCREASINGLY, more and more enterprises and individuals

have moved their data, such as personal data and large
archive system, into cloud-based storage services because
data access policy:

ðððFaculty ¼ Prof:Þ or ðFaculty ¼ Associate Prof:Þ

they provide various attractive services such as infinite or ðFaculty ¼ Assistant Prof:ÞÞ and ðDep: ¼ CSÞÞ:
capacity on on-demand, no upfront cost, long-term archiv-
Using ABE solution, this data access policy is used as a pub-
ing, etc. Furthermore, consumers can access applications
lic constraint to encrypt a data encrypting key (DEK), and
and data without location constraints. However, several
then the data is encrypted by the DEK. If a user owns
recent surveys [1], [2] showed that 88 percent potential
the private key with the corresponding attributes: i.e.,
cloud consumers worry about the privacy of their data, and
fFaculty Prof:; Dep: CSg, he can obtain the DEK and
security is often cited as the top concern for adopting cloud-
then decrypt this encrypted data.
based storage solutions.
ABE has been proved to be a powerful data access con-
Using cloud-based storage services, it is common to cen-
trol solution that meets a variety of application require-
trally store customers’ data. Security issues arose due to the
ments for cloud-based storage services. However, ABE also
fact that cloud-based storage is outsourcing-service and there
has some implementation issues when using attributes to
may incur untrusted or honest-but-curious attacks. In order
construct the data access policies. First, data migration from
to protect the privacy of consumers’ data, attribute-based
existing IT systems to a cloud storage environment is not
encryption (ABE) [3], [4], [5] has been proposed to provide
easy to be transferred because these systems are usually not
data access control for cloud storage services. ABE is a pow-
designed for ABAC. Second, ABE as a fine-grained data
erful and flexible approach, which implements attribute-
access control requires that “objects receive their attributes
based access control (ABAC) by encrypting data with a
either directly from the data creator or as a result of automated
specified access policy over attributes [6]. By matching
scanning tools” according to NIST’s ABAC definition [7]. In
attributes of access policy on the stored data, only autho-
the former case, the data creator needs to know the data
rized users who own these attributes and corresponding
access policies in advance, which may require substantial
private keys can access and decrypt the data. For example,
background knowledge on how to construct the data access
we use ABE to encrypt a file by enforcing the following
policies. In the latter case, the deployment of effective scan-
ning tools is usually difficult when the data access policies
 Y. Zhu, C.-J. Hu, and X. Wang are with the School of Computer and are required to keep consistent with diverse interpretations
Communication Engineering, University of Science and Technology of access policies from various data creators and users.
Beijing, Beijing 100083, China.
E-mail: {zhuyan, Wangxin}@ustb.edu.cn, chjyhu@163.com.
These restrictions hinder the applicability of using ABE for
 D. Huang is with the School of Computing, Informatics, and Decision cloud storage services.
Systems Engineering, Arizona State University, Tempe, AZ 85287. To address the above-described issues and provide a
E-mail: dijiang@asu.edu. smooth transition for using ABAC in cloud storage service,
Manuscript received 3 Feb. 2014; revised 9 Aug. 2014; accepted 25 Sept. 2014. we first investigate into the role-based access control
Date of publication 15 Oct. 2014; date of current version 7 Aug. 2015. (RBAC) that has been widely adopted by various informa-
For information on obtaining reprints of this article, please send e-mail to:
reprints@ieee.org, and reference the Digital Object Identifier below. tion systems (such as Windows/Active Directory RBAC,
Digital Object Identifier no. 10.1109/TSC.2014.2363474 HP-UX, AIX, Oracle). Compared to ABAC, advantages of
1939-1374 ß 2014 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission.
nsed use limited to: MINISTERE DE L'ENSEIGNEMENT SUPERIEUR ET DE LA RECHERCHE SCIENTIFIQUE. Downloaded
See http://www.ieee.org/publications_standards/publications/rights/index.html on May 12,2022 at 09:15:28 UTC from IEEE Xplore. Res
for more information.
 602
Fig. 1. The architecture for user-friendly security cloud storage in exist-
ing RBAC system.
using RBAC include simplicity, easy-to-use, and automatic
running without user’s intervention. To see an example of
this in an RBAC-based system, a role’s responsibilities and
relationships to other roles are usually specified by an
administrator or using a system default setup, and the role
assignment is usually transparent to end users. Typically,
users do not need to develop access policies for their own
resources; but if necessary, they can customize their own
policies. Based on this fact, our goal is to establish a user-
friendly, secure, flexible, and easy-to-manage access control
service by transferring the easy-use features of RBAC model
into the ABAC model by applying ABE schemes. As a
result, cloud storage services can be naturally implemented
based on this kind of ABAC model.
To illustrate the presented solution, an example of cloud
storage service is shown in Fig. 1, where conversion mecha-
nism from RBAC to ABAC (realized by Migration Proxy) is
introduced as a bridge that migrates automatically data from
existing RBAC systems to cloud-based ABAC system. In this
system, public cloud could be used to store actual data in the
ABE-encrypted form. Users who wish to share or access the
data only need to interact with the existing RBAC systems
(such as Windows NT and Linux); and the migration proxy
should make automatically and routinely data transmission
between two systems. At the meantime, the cloud storage
service can also provide ABAC-based security policy
enforcement directly to more advanced users.
To achieve the described system, there are many techni-
cal challenges to overcome. One of the most challenging
issues is to implement the hierarchy structure used by
RBAC as well as cryptographic partial ordering relation in
ABE. This means that we must provide an efficient
approach to support attribute hierarchy with arbitrary par-
tial ordering relations, including the comparative opera-
tions (ai  aj ) for a poset H ¼ ðA; Þ on a set of attributes
A ¼ fa1 ; . . . ; an g. Such a partial ordering relation is very
helpful to reduce the computation overhead of using ABE,
as well as to keep the compatibility with the RBAC model.
For instance, in the previously presented example, we can
define a set of attribute values as
Faculty ¼ fLecture; Assistant Prof:; Associate Prof:; Prof:g
and a partial ordering relation (called attribute hierarchy)
Lecture  Assistant Prof:  Associate Prof:  Prof: Then,
we can define a policy as
ððFaculty  Associate Prof:Þ and ðDep: ¼ CSÞÞ:
nsed use limited to: MINISTERE DE L'ENSEIGNEMENT SUPERIEUR ET DE LA RECHERCHE SCIENTIFIQUE. Downloaded on May 12,2022 at 09:15:28 UTC from IEEE Xplore. Res
IEEE TRANSACTIONS ON SERVICES COMPUTING, VOL. 8, NO. 4, JULY/AUGUST 2015
It is easy to find that this approach simplifies the complexity
of deploying access policies from this instance, however
none of ABE schemes support the partial ordering relation.
Fortunately, there have been some cryptographic work [8],
[9] has been proposed to realize the hierarchical key in terms
of RBAC. The main drawback of these solutions is that they
cannot be directly utilized by ABE schemes. On the other
side, some ABE solutions support the tree-hierarchy (i.e.,
called hierarchical ABE) [10], [11], [12]. However they can-
not support full RBAC-type hierarchy [13] (i.e., a lattice with
tree, inverted tree, or general hierarchies) on all attribute val-
ues. We address the described challenges by constructing an
effective RBAC-compatible ABE for secure cloud storage
services. Our solution takes advantages of both RBAC and
ABAC, and it is compatible with existing RBAC systems. In
summary, our contributions are presented as follows:
 We present a practical solution to convert RBAC-
based rules into ABAC-based policies. This conver-
sion can help migrate the data from existing RBAC
systems into ABE-based secure cloud storage. This
solution fully utilizes the highly automated feature
of existing RBAC system, so it provides the follow-
ing advantages:
- including good properties of both RBAC and
ABAC;
- making it compatible to existing RBAC;
- realizing more flexible policy enforcement for
cloud data storage due to policy expended from
RBAC to ABAC.
 We present an effective cryptographic method to
realize partial ordering relation (derived from hierar-
chy structure in RBAC) used by existing ABE solu-
tions. In our approach, a hierarchical hash function
(HHF) is introduced for realizing the cryptographic
order-preserving mapping from a partial-order hier-
archy. Based on this function, we present a new ABE
scheme, called ABE with Attribute Hierarchy (ABE-
AH), for our RBAC-compatible data access control
for secure cloud storage services.
 We prove that our ABE-AH scheme is semantic
secure and unforgeable under the Computational
Diffie-Hellman (CDH) and extended Decisional Dif-
fie-Hellman (eDDH) assumptions.
 Compared with prior ABE solutions, ABE-AH
scheme provides more succinct and richer policy
representations with more flexible access control
capabilities.
Organization. Section 2 overviews some basic notations and
frameworks. In Section 3, we present our solution from
RBAC to ABAC. Sections 4 and 5 provide the definitions of
ABE-AH, security models, and cryptographic partial ordering
relations. We present the construction of ABE-AH and its
security analysis in Sections 6 and 7, respectively. We evaluate
the performance of the ABE-AH scheme in Section 8. Finally,
We conclude the solution in Section 10.
2 NOTATIONS AND DEFINITIONS
In this section, we provide the definitions of RBAC and
ABAC models, as well as some notations used in this paper.
 ZHU ET AL.: FROM RBAC TO ABAC: CONSTRUCTING FLEXIBLE DATA ACCESS CONTROL FOR CLOUD STORAGE SERVICES
Furthermore, the relationships between them are discussed
and analysed, and ABE over ABAC is introduced in the
end. These discussions lay a foundation for our solution.
2.1 RBAC Model
In an information system, a hierarchy or lattice is used to
denote the relationships and arrangements of the objects,
users, elements, values, and so on. Especially, in many access
control systems the users are organized in a hierarchy con-
structed with a number of classes, called security classes or
roles, according to their competencies and responsibilities.
This hierarchy arises from the fact that some users have
more access rights than others. In order to manage large-
scale systems, the hierarchy in RBAC becomes more complex
than other systems. Especially, role hierarchy (RH) is a natu-
ral means for structuring roles to reflect an organization’s
lines of authority and responsibility. We adopt the defini-
tions from RBAC models proposed by Sandu et al. [14]:
Definition 1 [Hierarchical RBAC model]. The RBAC model
has the following components:
 U, R, P , and S denote users, roles, permissions and
sessions respectively;
 PA  P  R is a many-to-many permission to role
assignment relation;
 UA  U  R is a many-to-many user to role assign-
ment relation;
 RH  R  R is a partial order on R called the role
hierarchy or role dominance relation, written as ;
 user : S ! U is a function mapping each session si to
the single user userðsi Þ; and
 roles : S ! 2R is a function mapping each session si
to a set of roles: rolesðsi Þ  fr 2 R j 9r0 2 R; r  r0 :
0 
ðuserðs
S i Þ; r Þ 2 UAg and si has the permissions:
00 00 00
r2rolesðsi Þ fp 2 P j 9r 2 R; r  r : ðp; r Þ 2 PAg.
The last component states that the system can automati-
cally run the RBAC without user’s intervention. When a
user performs an operation, first of all, the system uses the
function userðsi Þ, taking as input the session si , to get the
single user. Next, the set of the user’s roles rolesðsi Þ is
known by using the user to role assignment relation UA.
Then, the user’s permissions are found by using the role
hierarchy RH and permission to role assignment relation
PA. Finally, the system determines whether the user’s oper-
ation is legitimate according to the permissions. We present
some terminologies in partial order. Let C ¼ hP; i be a
(finite) partially ordered set with partial order relation  on
a (finite) set P . Two distinct elements x and y in C are said
to be comparable if x  y or y  x. Otherwise, they are
incomparable, denoted by xky and ?x denotes the indepen-
dent set fy 2 P j xjjyg.
2.2 ABAC Model
Similar to role hierarchy in RBAC, the hierarchy is also
extremely useful for ABE to introduce attribute hierarchy or
attribute lattice (AH or AL), which defines a seniority rela-
tion among all values of an attribute, whereby a user hold-
ing the senior attribute values acquires the permissions of
nsed use limited to: MINISTERE DE L'ENSEIGNEMENT SUPERIEUR ET DE LA RECHERCHE SCIENTIFIQUE. Downloaded on May 12,2022 at 09:15:28 UTC from IEEE Xplore. Res
603
TABLE 1
Grammar for ABAC Addresses and Policies
Name Symbol Description
Attribute Ai 2 a set of attributes A
Attribute value ai;j 2 Numerals j Strings
Delivery Policy p ::¼¼ %
Condition % ::¼¼ xjð% or %Þjð% and %Þ
Literal x ::¼¼ ðAi  ai;j Þ
Relation  ::¼¼ j j¼jj
their juniors. In fact, this kind of attribute lattice has been
introduced in ABAC model [6].
Table 1 describes the language according to [15]. We
call an access control system as an ABAC system if this
system satisfies the above specifications. Here, access
policy can be expressed as a logical function on some
attribute values. For the sake of clarity, we propose a defi-
nition of policy matching (or relation matching) of attribute-
based access control as follows:
Definition 2 (ABAC Model). The ABAC model has the follow-
ing components:
 Let A ¼ fA1 ; . . . ; An g be a (finite) set of attributes. Let
Ai ¼ fai;1 ; . . . ; ai;m g be a set of values correspond to
an attribute Ai 2 A. Ai is called as a hierarchy, if all
elements in ai have a partial ordering relation . That
is, Hi ¼ ðAi ; Þ.
 Let x :¼ Ai  ai;j denote a literal in terms of the rela-
tion between Ai and ai;j in a poset Hi . For an assign-
ment of attribute value Ai ai;l , the relation
Ai  ai;j returns “true” if ai;l  ai;j ; otherwise, it
returns “false”.
Let p :¼ ]xk denote an access policy function based on
the Boolean function, where ] denotes either and or or
logical operation. For the assignment of attribute val-
ues r :¼ ðA1 ; . . . ; An Þ ða1;j1 ; . . . ; an;jn Þ, the policy
matching between hp; ri (which is denoted as
Matchðp; rÞ) returns “true” if the Boolean function is
satisfied according to the results of literals, otherwise,
it returns “false”.
 User has the access permission specified by p iff
W
r2S Matchðp; rÞ ¼ true for a set of attribute assign-
ments S ¼ frg.
In Fig. 2, we show some simple examples of university
information system to describe the above definition. These
examples includes three attribute lattices: Departments,
faculty, and Clearance. For example, there exists the senior-
ity relation among four basic levels of clearance: ðunclassified
 confidential  secret  topsecretÞ. Similarly, there also exists
the relation among three levels of faculty: ðlecture 
assistant prof:  associate prof:  prof:Þ. If the above defi-
nition is implemented in ABE, we can define a policy of
“Read” permission as
p :¼ ðfaculty  assistant prof: or clear: 
secretÞ and Depart:  School of Engineering:
Next, given a set of attribute assignments
 604 IEEE TRANSACTIONS ON SERVICES COMPUTING, VOL. 8, NO. 4, JULY/AUGUST 2015

Fig. 2. Some examples for attribute lattice in a management information system.

r :¼ ðDepartments; Faculty; ClearanceÞ space A1  A2   An is used to express the char-

ðElectrical Depart:; associate prof:; topsecretÞ;
it is easy to compute the result of matchðp; rÞ. Hence, the
attribute lattice can simplify the access policy, reduce the
computational overheads, and decrease the size of cipher-
texts and private-keys in ABE. Note that, the ABE with AH
must have the ability to support full RBAC model with tree,
inverted tree, and general hierarchies on them, as shown
Fig. 2.
In short, ABAC provides a more scalable and flexible
access management based on powerful policy specification.
Moreover, ABAC supports some new features, for example,
dynamically changing attributes, such as time of day and
location, can be accommodated in access control decisions.
2.3 RBAC versus ABAC
In this section we discuss the relationships between
RBAC and ABAC, which will be used to implement the
conversion from RBAC to ABAC below. First of all, it is
easy to find that there exist some similarities between
them. For example, both RBAC and ABAC are able to
map each user to a set of identities (roles or attributes).
When the number of users is far greater than the number
of identities, such a mapping can help simplify authority
management for a large organization. Similarly, both
adopted hierarchical structure (which be used to realize
comparison operators) to further simplify authority man-
agement. Although there are these similarities between, it
is obvious to find many differences (see Table 2), which
be summarized as follows:
acteristics of a user in ABAC;
 Hierarchical structure. in RBAC all roles are usually
included in a role hierarchy, but in ABAC each attri-
bute has a hierarchical structure. This does not mean
that the expression ability of RH is weaker than that
of AH because we are able to integrate multiple hier-
archies into a hierarchy, but these attribute hierar-
chies are simpler and easier to use and understand
than role hierarchy.
 Resource’s constrain specification. in both models they
are stored together with the resources. Given a cer-
tain resource, in RBAC they are represented as a
binary relation between roles and permissions, but
in ABAC they are as an access policy on Boolean
function. Obviously, the expression ability of the lat-
ter is stronger than that of the former;
 Permission criterion. RBAC relies on the following
search of permissions:
[
fp 2 P j9r00 2 R; r00  r : ðp; r00 Þ 2 PAg;
r2rolesðsi Þ
the result of which is a set of permissions authorized
to access the particular resource for the current ses-
sion. In ABAC it relies on policy matching between
policy function p and attribute assignments S ¼ frg
as follows:
_ 
true accept
Matchðp; rÞ ¼
false reject:
r2S

 User’s authority. in RBAC we use a simple binary Observing the above comparison, it is not difficult to find
relation between users and roles, and in most cases that ABAC model has stronger ability to express complex
only one role is assigned in current session; but a set access policies than RBAC model, moreover RBAC-based
of attribute assignments included in the attribute rule can be converted and integrated into ABAC-based policy.

TABLE 2
Comparison between RBAC and ABAC

RBAC ABAC
User’s authority UA: a binary relation between U  R r: multiple attribute assignments
Hierarchical structure RH: one role hierarchy Hi : multiple attribute hierarchies
Resource’s constrain specification PA: a binary relation between P  R p: an access policy function
Permission criterion Relation search between user and permission Match: policy matching between p and r

nsed use limited to: MINISTERE DE L'ENSEIGNEMENT SUPERIEUR ET DE LA RECHERCHE SCIENTIFIQUE. Downloaded on May 12,2022 at 09:15:28 UTC from IEEE Xplore. Res
 ZHU ET AL.: FROM RBAC TO ABAC: CONSTRUCTING FLEXIBLE DATA ACCESS CONTROL FOR CLOUD STORAGE SERVICES
Fig. 3. The framework of RBAC-Compatible ABE for secure cloud storage.
Benefited from this kind of conversion, ABAC-based cloud
storage service will provide a more secure, flexible, scalable
way to share data than existing RBAC-based IT systems.
2.4 ABE over ABAC
Attribute-based encryption is a cryptosystem built on
ABAC model [3], [4], [16], [17]. In ABE, attributes are used
to encrypt data, such as key-policy ABE (KP-ABE) [3] or
used as credentials to decrypt data, such as ciphertext-pol-
icy ABE (CP-ABE) [17], [18]. We adopt the construction,
proposed by the BSW’s CP-ABE scheme [17], to realize the
logical operations and string matching. In CP-ABE, access
policy function is used to constraint the decryption permis-
sion, that is, the decryption is authorized iff Matchðp;
rÞ ¼ true, where the policy function p is hidden into cipher-
text and r is assigned to the user’s private key.
In order to realize the policy matching Matchð Þ, one of
main techniques, cryptographic logical operations, have
been developed in recent years. In CP-ABE, cryptographic
logical operations is implemented by using an extension of
general threshold secret sharing (SS):
Definition 3 (Threshold Secret Sharing). Let t; n be positive
integers, t n, A ðt; nÞ—threshold scheme is a method of
sharing a secret s among a set of n participants, in such a way
that any t participants can compute the value of s, but no
group of t 1 participants can do so.
It is easy to note that AND and OR logics can be realized
by the threshold secret sharing scheme, as follows:
 AND gates. considered as ðn; nÞ-threshold schemes;
 OR gates. considered as ð1; nÞ-threshold schemes.
Therefore, t-of-n AND gates can be constructed as
ðt; nÞ-threshold schemes. The common scheme introduced
by Shamir is based upon Lagrange interpolation, namely, it
takes t points to define a polynomial of degree t 1 and the
secret s is represented as the free coefficient of polynomial.
Further, hierarchical secret sharing is also suitable for Bool-
ean formulas: given a logical hierarchy over AND/OR oper-
ations, a logical tree can be constructed to express this
hierarchy and the secret is set as the value of root of this
tree, such that the values of lower nodes can be calculated
recursively by sharing the value of upper nodes in terms of
ðt; nÞ-threshold schemes.
However, there has been little work on studying crypto-
graphic comparison mechanisms to support partial ordering
relations. Even though Bethencourt et al. [17] presented a bit-
wise comparison method to implement integer comparison
nsed use limited to: MINISTERE DE L'ENSEIGNEMENT SUPERIEUR ET DE LA RECHERCHE SCIENTIFIQUE. Downloaded on May 12,2022 at 09:15:28 UTC from IEEE Xplore. Res
605
(as an example of line ordering relation) based on CP-ABE
scheme, it is not efficient enough for general partial ordering
relations.
3 SOLUTION FROM RBAC TO ABAC
In this section we propose a practical solution for moving
the data from RBAC system into ABE-based secure cloud
storage. We first introduce the framework of this solution.
Then we propose an effective method that converts RBAC
rules into ABAC policies. Finally, a RBAC-compatible ABE
is defined to meet the needs of construction of this solution.
3.1 System Framework
In this paper we focus on the solution of migrating and
sharing the data in existing RBAC systems into cloud. We
try to resolve two problems: 1) how to remain access con-
straints of data on RBAC to implement data sharing in
cloud; and 2) how to ensure the security of data in public
cloud, especially for “honest and curious” cloud [19].
ABAC model is considered as a suitable solution for
secure information sharing in large-scale organizations,
especially for cloud computing environments. However,
facing with a variety of existing enterprise RBAC systems,
re-establishment of such a ABAC system is not realistic.
Therefore, we desire to develop a new “transparent” migra-
tion solution that existing RBAC systems are integrated into
the cloud to implement better data sharing. In our solution,
a ABAC-based system is deployed in the cloud, existing
RBAC systems are unified into this cloud ABAC system.
The openness of cloud computing means that more autho-
rized users have quick and easy access to the cloud data
they need. Furthermore, the ABE cryptosystem must be
used for data security in cloud ABAC system. Hence, our
goal is to improve ABE for implementing cloud data
encryption in the existing RBAC systems.
In order to achieve this goal, we expect to provide an
effective method that transforms the RBAC mechanism into
an ABE-based instance. Based on this instance, data can be
encrypted by using ABE and then stored into cloud. In
Fig. 3 we describe the framework of our solution, where
a user can use the existing system with RBAC (such as
Windows, Linux) to access cloud resources. The accessing
process is completely transparent to the user, at the same
time, data can be stored and shared by using ABE encryp-
tion. In this figure, an existing RBAC system is connected to
cloud storage service on ABAC model. To migrate RBAC
data to cloud, a new module, called migration proxy, need
 606
to append into RBAC system. The proxy can perform the
following functions: rule conversion between RBAC and
ABAC, encryption/decryption processes, and key manage-
ment. The process of proxy is described as follows:

When a “create” requestor asks to store a new data to
cloud, the proxy converts the role of roles corre-
sponding to permission p1 ¼ “write”, p2 ¼ “create”,
and p3 ¼ “read” into policy functions fp1 ; p2 ; p3 g
according to Section 3.2; and then, the proxy obtains
the ABE keys escrowed by key management unit,
and uses the keys and fp1 ; p2 ; p3 g to encrypt the data
as ABE-ciphertext; finally, the ciphertext and its pol-
icy fp1 ; p2 ; p3 g is sent to the cloud.
 When a “write” requestor asks to write the existing
data to cloud, the proxy does not need to rewrite the
policy function fp1 ; p2 ; p3 g, but re-encrypts the mod-
ificated parts into the cloud.
 When a “read” requestor asks to read data stored in
the cloud, the proxy first downloads the policy func-
tion p3 corresponding to permission “read” and per-
forms the access authorization decision (see Section
3.2); if it permits, the proxy obtains the ABE keys
escrowed by key management unit, and then down-
loads and decrypts the data.
We will highlight the rule conversion from RBAC to
ABAC, as well as RBAC-compatible ABE system below.
3.2 Rule Conversion from RBAC to ABAC
Recall the analysis in Section 2.3, it is easy to find that
ABAC’s expression ability is stronger than that of RBAC.
This means that we might convert access constraints from
RBAC model into ABAC model. Given a RBAC system that
is constructed on standard RBAC model in Definition 1. We
present a simple conversion method based on “one-to-one”
mapping from role to attribute as follows:
 Map the set of roles R and its hierarchy RH to a
poset ðA; Þ ¼ ðR; RHÞ, where each roles ri 2 R
becomes the attribute values ai 2 A and A ¼ R. This
mapping is direct and obvious.
 Map each permission p 2 P to a policy function p
with Boolean function
_ is,
p :¼ ðr  AÞ:
9r;ðp;rÞ2PA
 Map user’s assignments (for a certain u 2 U) to an
attribute assignment r as
r :¼ A fr 2 R j ðu; rÞ 2 UAg:
However, this conversion does not show the advantage
of ABAC model. In the respect of granularity, the role in
RBAC (coarse grain) can be considered as “multi-attribute”
composite. For example, “School Leader of Business (SLB)”
in RBAC is able to denote the composite of two attributes:
“School of Business” and “Leader”. Therefore, the above-
mentioned conversion can be performed in a more flexible
way. So, we present a more effective multi-attribute
nsed use limited to: MINISTERE DE L'ENSEIGNEMENT SUPERIEUR ET DE LA RECHERCHE SCIENTIFIQUE. Downloaded on May 12,2022 at 09:15:28 UTC from IEEE Xplore. Res
IEEE TRANSACTIONS ON SERVICES COMPUTING, VOL. 8, NO. 4, JULY/AUGUST 2015
conversion method based on “one-to-many” mapping from
role to attribute as follows:
 The role set R is divided into n groups of set of
attributes, that is, R ¼ A1  A2   An . For each
Ai , we build a hierarchy ðAi ; Þ.
 Map each permission p 2 P to a policy function p,
but Equation (1) also need to become
!
_ ^
p :¼ ðai  Ai Þ :
8r¼ða1 ;...;an Þ;ðp;rÞ2PA ai 2r
 Similarly, Equation (2) becomes
r :¼ ðA1 ; . . . ; An Þ fða1 ; . . . ; an Þj
¼ ða1 ; . . . ; an Þ 2 R : ðu; rÞ 2 UAg:
We define the partial ordering relation on the Cartesian
product of ordered sets as follows: ða1 ; . . . ; an Þ  ða01 ; . . . ; a0n Þ
if and only if a1  a01 ^ ^ an  a0n . This is a partial order.
Next, we describe the process of accessing cloud resour-
ces. If the user wishes to access the data in the cloud, the
system first obtains the access policy of the resource, then
calculates rolesðsÞ to get the set of authorized roles, where
rolesðsÞ  fr 2 R j 9r0 2 R; r  r0 : ðuserðsÞ; r0 Þ 2 UAg. Using
the set of authorized roles, the system can check whether
there is an effective subset of roles in rolesðsÞ which meets
the above access policy, that is, Matchðp; rÞ ¼ true. If the
subset exists, the system downloads the data and decrypts
it locally.
We give a simple approach to implement “Access Autho-
rization Decision”, which adopts the roles in RBAC to verify
the ABAC policy function p. In the case of simple “one-to-
one” conversion, the verification can be checked by using
_ 
true accept
Matchðp; ðA aÞÞ ¼
a¼r;r2rolesðsÞ
false reject;
W
where p :¼ 9r00 ;ðp;r00 Þ2PA ðr00  RÞ. This means that there
exists at least one r 2 rolesðsÞ and r00 2 R for r00  r to make
ðp; r00 Þ 2 PA if the above verificaiton is accepted. This is con-
sistent
S with the statement of permissions in RBAC, that
00
r2rolesðsÞ fp 2 P j 9r 2 R; r00  r : ðp; r00 Þ 2 PAg. Further-
(1) more, in the case of “multi-attribute” composite, the above
equation turns into
_
Matchðp; ðA1 ; . . . ; An Þ ða1 ; . . . ; an ÞÞ
8r¼ða1 ;...;an Þ;
rrolesðsÞ

true accept
¼
(2) false reject:
Similarly, it is obvious that this conversion is also consistent
with the statement of permissions RBAC. In short, the
above-mentioned conversions will be used to construct our
RBAC-compatible ABE system.
In practical applications, we highlight two extra atten-
tions: 1) we must clearly understand the relationship among
roles and role hierarchy in RBAC system because we found
that the definition of role hierarchy is not clear in some
existing RBAC systems; and 2) In the multi-attribute
 ZHU ET AL.: FROM RBAC TO ABAC: CONSTRUCTING FLEXIBLE DATA ACCESS CONTROL FOR CLOUD STORAGE SERVICES
Fig. 4. Attribute lattice used in our example.
conversion, we emphasize that the mapping from roles
to attributes must be strictly satisfy the partial ordering
relation on the Cartesian product of ordered sets. It is also
a good alternative for “one-to-one” mapping from role to
attribute if the above-mentioned attentions are not met.
3.3 An Example of Our Solution
We assume we have a simple RBAC-based University sys-
tem, in which the set of roles R and role hierarchy RH are
showed in Fig. 4 (it is the same as the Department in Fig. 2).
We assume that there exist two users Vincent and Crown
in this system, that is, U :¼ ðVincent; CrownÞ. Moreover, we
assume that Vincent works at EconomicsDepartment (EcD)
and Crown is a SchoolLeaderofBusiness, namely,
UA :¼ ððVincent; EcDÞ; ðCrown; SLBÞÞ;
where EcD and SLB are two acronyms for name of depart-
ment. According to Equation (1) in our convention method,
the system manager designates the attribute assignments
rVincent :¼ A fr 2 R j ðVincent; rÞ 2 UAg ¼ A EcD;
rCrown :¼ A fr 2 R j ðCrown; rÞ 2 UAg ¼ A SLB
into the ABE’s private key of Vincent and Crown,
respectively.
Next, we assume that a document (called Doc1 ) in this
system has the Read and Write permissions, P :¼ ðRead;
WriteÞ, and the permission-to-role assignment is
PA :¼ ððRead; SBÞ; ðWrite; SLBÞÞ;
where SB and SLB denotes SchoolofBusiness and
SchoolLeaderofBusiness. According to Equation (2) in our
convention method, the migration proxy can generate two
policy functions
_
pwrite :¼ ðr  AÞ
9r;ðWrite;rÞ2PA
_ document Doc1 , and the proxy re-encrypts the modification
¼ ðSLB  AÞ ¼ ðSLB  AÞ
9SLB;ðWrite;SLBÞ2PA
_ ABE encryption key.
pread :¼ ðr  AÞ
9r;ðRead;rÞ2PA
_
¼ ðSB  AÞ ¼ ðSB  AÞ:
9SB;ðRead;SBÞ2PA
nsed use limited to: MINISTERE DE L'ENSEIGNEMENT SUPERIEUR ET DE LA RECHERCHE SCIENTIFIQUE. Downloaded on May 12,2022 at 09:15:28 UTC from IEEE Xplore. Res
607
The proxy writes these two policies ðpwrite ; pread Þ into
the header of Doc1 and uses pread :¼ ðSB  AÞ encrypts the
file by using the Encrypt algorithm in ABE. Finally, the
encrypted file Doc1 is migrated into the cloud.
When the user Vincent expects to access this file by using
the Migration proxy, the proxy first obtains the session s (by
using command in the operation system) from RBAC sys-
tem, and then invokes the function usersðsÞ ! ðVincentÞ to
get the user’s name (see Equation (3)). Based on it, the proxy
computes all possible roles by using the following function:
rolesðsÞ  fr 2 R j 9r0 2 R; r  r0 : ðuserðsi Þ; r0 Þ 2 UAg
¼ fr 2 R j 9r0 2 R; r  r0 : ðVincent; r0 Þ 2 UAg
¼ fr 2 R j r  EcD : ðVincent; EcDÞ 2 UAg
¼ fEcD; SB; Ung:
Next, the proxy downloads the permission assignment PA
of Doc1 from the cloud and checks the permission:
[r2rolesðsÞ fp 2 P j 9r00 2 R; r00  r : ðp; r00 Þ 2 PAg
¼ [r2fEcD;SB;Ung fp 2 P j 9r00 2 R; r00  r : ðp; r00 Þ 2 PAg
¼ fp 2 P j 9r00 2 R; r00  EcD : ðp; r00 Þ 2 PAg
[ fp 2 P j 9r00 2 R; r00  SB : ðp; r00 Þ 2 PAg
[ fp 2 P j 9r00 2 R; r00  Un : ðp; r00 Þ 2 PAg
¼ fRead 2 P j 9SB 2 R; SB  EcD : ðRead; SBÞ 2 PAg
[ fRead 2 P j 9SB 2 R; SB  SB : ðRead; SBÞ 2 PAg
¼ fReadg:
(3) Hence, the proxy allows to download the encrypted file
Doc1 with an encryption policy pread :¼ ðSB  AÞ for
Vincent. Vincent is able to decrypt this file by using his pri-
vate key with attribute assignment rVincent ¼ A EcD
because the policy matching between the ciphertext’s policy
function and the user’s attribute assignment,
Matchðpread ; rVincent Þ
¼ MatchðSB  A; A EcDÞ ¼ true
is satisfied in terms of the relation SB  EcD in RH.
The “write” (or “create”) operation also executes the sim-
ilar process as above besides the process of file encrypting
and migrating to cloud is accomplished by the migration
proxy. In this process, the proxy only needs to verify the
(4) matching between the file’s policy and the user’s attribute
assignment. For example, the user Crown tries to write the
file Doc1 , the proxy invokes userðsÞ ! ðCrownÞ and rolesðsÞ
 fr 2 R j r  SLB : ðCrown; SLBÞ 2 UAg ¼ fSLB; EcD;
AcD; SB; Ung. S Based on these values, the permission
00 00
is com-
puted as r2fSLB;EcD;AcD;SB;Ung fp 2 P j 9r 2 R; r  r : ðp;
r00 Þ 2 PAg ¼ fRead; Writeg in terms of the policy PA in
Equation (4). Hence, Crown have the authority to write the
parts submitted by Crown into cloud by using the escrowed
We have the ability to achieve multi-attribute conversion
at the same process as above if the roles are “one-to-many”
mapped to several different set of attributes. This kind
conversion is very intuitive and can help to simplify the
role hierarchy.
 608 IEEE TRANSACTIONS ON SERVICES COMPUTING,
It is obvious that our conversion methods are complete
and sound from the above examples, only if ABE can sup-
port partial ordering relation over one or more attribute
sets, as well as the matching operation Matchðp; rÞ in
decryption. However, the existing schemes do not support
this relation. For this purpose, we will put forward such an
effective ABE construction in next section.
4 RBAC-COMPATIBLE ABE
In the previous section, the attribute hierarchy (partial
ordering relation on ðA; Þ) have been introduced to RBAC-
Compatible ABE. This means that comparison operation 
on attribute hierarchies would be executed in the ABE.
However, existing ABE schemes do not support comparison
operation on attribute hierarchies at present.1 In light of
the fact that the comparison operation can enhance the
capacity of constraint expressions, decrease the computa-
tional overheads of encryption and decryption, and reduce
the size of ciphertexts and private-keys, in this section we
design an efficient cryptographic comparison operations for
arbitrary partial orders to support the expressions of attri-
bute lattices in ABE.
4.1 ABE with Attribute Hierarchies
An attribute-based encryption with attribute lattice (ABE-
AH) consists of the following five algorithms:
Setup(A; S). Takes in the parameters of cryptosystem S and
the attribute universe description A. It outputs a master
key msk, the public parameter pp and a encryption-key
ek;
GenKey(msk; r). Takes in the manager key msk and a user’s
attribute assignments r for a certain user. It outputs a
user’s private-key usk.
Encrypt (ek; p; M). Takes in the encryption key ek, the access
policy p over A, and the plaintext M 2 f0; 1g . It out-
puts a ciphertext C such that only users whose private
keys satisfy the access policy p are able to exact M.
Decrypt (pp; usk; C). Takes in the public parameters pp, a
ciphertext C and a private key usk. If the set of attrib-
utes of usk satisfies the access policy of the ciphertext, it
outputs the plaintext M.
In this framework, the scheme must obey this rule as
follows: Given the above-mentioned ðr; pÞ, we can compute
ðmsk; pp; ekÞ SetupðA; SÞ and gsk GenKeyðmsk; rÞ.
Such that, we hold
2 3
Decryptðpp; usk; CÞ ¼ Mj
Pr4 C Encryptðek; p; MÞ; 5 ¼ 1;
Matchðp; rÞ ¼ true
if and only if the access is granted over hp; ri according to
the policy matching criterion.
4.2 Security Definition of ABE-AH
To analyze the security of ABE-AH scheme, we first con-
sider a new kind of security, called indistinguishability
1. Note that this kind of hierarchy on posets is different from that on
the hierarchy IBE (HIBE) schemes because the latter only supports a
tree structure.
nsed use limited to: MINISTERE DE L'ENSEIGNEMENT SUPERIEUR ET DE LA RECHERCHE SCIENTIFIQUE. Downloaded on May 12,2022 at 09:15:28 UTC from IEEE Xplore. Res
VOL. 8, NO. 4, JULY/AUGUST 2015
against chosen plaintext attacks with adaptive attribute lat-
tice (IND-AH-CPA), which can be transformed into the
security against chosen ciphertext attacks (IND-CCA) by
applying a random oracle technique based on Fujisaki-Oka-
moto transformation. In this kind of security, we consider
that the adversary can query arbitrary partial ordering rela-
tions (attribute hierarchies) to construct a key hierarchy.
Given an ABE-AH scheme ES, the IND-AH-CPA security is
evaluated by the following game:
Setup. The challenger B runs Setup algorithm, gives the
adversary A the public parameters pp, and keeps the
master key msk and the encryption key ek secret;
Query. The adversary A gives the challenger B an attribute
identity-poset pair ðAi ; Hi Þ, where Hi ¼ hVi ; i is an
arbitrary partial ordering relation. The challenger B
assist A to construct the cooperatively attribute lattice.
After all queries are realized, the adversary can require
the challenger B to generate a valid ciphertext for an
arbitrary policy p and message M.
Challenge. The adversary A submits two equal length mes-
sages M0 and M1 . In addition, the adversary gives a
challenge policy p in terms of A. The challenger B flips
a random coin b 2 f0; 1g, and encrypts Mb under a pol-
icy p. The correspondent ciphertext Cb is given to the
adversary A.
Guess. The adversary outputs a guess b0 2 f0; 1g of b.
In this game, the advantage of the adversary A attacking
the ABE-AH scheme is defined as AdvES IND AL CPA
ðAÞ ¼
 
1
jPr½b 0
¼ b Pr½b 0
¼
6 bj ¼ Pr½b0 ¼ b 1; where the proba-
2 2
bility is taken over the random coins of A and all probabilis-
tic algorithms in the scheme.
Definition 4. A ciphertext-policy attribute-based encryption with
attribute lattice scheme is ðt; "Þ-adaptive attribute lattice
against chosen plaintext attacks (IND-AH-CPA), if for any
polynomial time adversary with time-complexity t, there is at
most a negligible advantage " in the above game.
5 CRYPTOGRAPHIC PARTIAL ORDERING
RELATIONS
In this section, we propose a novel construction for integer
comparison to overcome the limitations of BSW’s CP-ABE
scheme. We first give the background on compositing order
bilinear groups. Then, we present two key constructions:
forward and backward derivation functions. Finally,
we present the construction of our ABE scheme based on
those techniques.
5.1 Our Approach
From the discussions above, an efficient secure comparison
mechanism is needed to express complex access policy and
realize attribute hierarchy. This motivates us to investigate
a new approach for partial ordering relation, which can be
used to construct encryption schemes based on various
comparison relations. In the following, we present our idea
of a new approach for cryptographic comparison built on
the mathematical principles of comparison relation.
In mathematics, the comparison relation on a partially
ordered set (or poset) is a binary relation denoted by infix ,
 ZHU ET AL.: FROM RBAC TO ABAC: CONSTRUCTING FLEXIBLE DATA ACCESS CONTROL FOR CLOUD STORAGE SERVICES
Fig. 5. The order preserving mapping for general poset.
e.g.,  ða; bÞ or a  b, where a binary relation on a set H is a
collection of ordered pairs of elements in H. Strictly speak-
ing, the comparison on integer is a total order or a linear
order which is a binary relation with the following proper-
ties: for any a; b 2 U, we have
 Reflexivity. a  a;
 Antisymmetric. If a  b and b  a then a ¼ b;
 Transitivity. If a  b and b  c then a  c.
For a and b are two elements of a partially ordered set H,
if a  b or b  a, then a and b are comparable. Otherwise
they are incomparable, denoted by ajjb.
Our objective is to develop an effective method for cryp-
tographic comparison relation. That is, let H ¼ fa1 ;
a2 ; . . . ; am g be a countable set with partial ordering, we
expect to define a set of cryptographic random numbers
V ¼ fv1 ; v2 ; . . . ; vm g in a large space F, which can preserve
the order of elements in H. To do so, we can make use of a
cryptographic map c : H ! V to convert H to V: 2 It is obvi-
ous that c must be an order-preserving mapping such that if
ai  aj in H, it implies there exists a partial-order relation 
to ensure vi  vj in V , where vi ¼ cðai Þ and vj ¼ cðaj Þ. In
Fig. 5, we describe this kind of order preserving mapping c
from U to V , where  is used to represent the order relation
between vi and vj . Here, vi  vj does not means the value of
vj is greater than that of vi .
In order to ensure the security of cryptosystem, V ¼
fv1 ; v2 ; . . . ; vm g is required to be a set of random values.
Here it comes the question: how to define the partial ordering
relation  over a set of random values in a secure manner? By
“secure”, we mean if ai  aj , then it is easy to verify the
relation vi  vj ; otherwise, vi  vj is not provable.
To answer this question, we turn our attention to use
cryptographic “one-way” property to represent the partial
ordering relation in set V . The one-way property means
that given the integer relation ai  aj and two corre-
sponding value vi ; vj , there exists an efficient algorithm
fð Þ to obtain vj from vi , but it is hard to compute vi from
vj . So we have
ai  aj , Pr½fðvi Þ ¼ vj  ¼ 1;
where, , denotes the equivalence relation. In fact, this
means that the decision problem of ai  aj converted into
computing function problem of vj ¼ fðvi Þ.
In summary, our idea for cryptographic comparison rela-
tion on hH; i is to create a mapping from a partial ordering
set to a new set of random numbers, and then define a new
ordering relation on the new set based on “one-way”
2. In fact, V is a small subset of set of cryptographic values.
nsed use limited to: MINISTERE DE L'ENSEIGNEMENT SUPERIEUR ET DE LA RECHERCHE SCIENTIFIQUE. Downloaded on May 12,2022 at 09:15:28 UTC from IEEE Xplore. Res
609
property. This process can be expressed to build two func-
tions: Mapping function cð Þ converts a partial ordering set
to a new set of random numbers; and Ordering function fð Þ
sets up a new ordering relation in the new set of random
numbers. Typically, the mapping function is confidential,
but the ordering function is publicly verifiable. So, we re-
define these two functions with private/public key, as
follows:
 Mapping function c : SK  H 7! V , which converts a
poset H into V , where SK is a set of private keys.
 Ordering function f : PK  V 7! V , which can pub-
licly compute the value of other element in V from a
element, only if these two elements satisfies ordering
relation, where PK is a set of public parameters.
We illustrate this process and the two functions in Fig. 6.
Note that, the randomness property of elements in V is nec-
essary to ensure the security of comparison relation, in par-
ticular, to prevent forgery.
A related technique called order-preserving encryption
(OPE) was introduced in database community by Agrawal
et al. [20]. We say that the encryption scheme ðK; E; DÞ is an
OPE scheme if E K ð Þ is an order-preserving function in inte-
ger. That is, E K ðiÞ > E K ðjÞ iff i > j. Note that, the comparison
operation > between two ciphertexts is straightforward
numerical comparison, which is a tough hypothesis for
designing an OPE scheme. Such that, as far as we know, “the
first formal cryptographic treatment of OPE did not appear
until recently” [21]. Moreover, the OPE scheme is not suit-
able for general partially ordered relation because the
numerical comparison just meet the totally ordered relation.
Hence, our proposed approach cannot be replaced by OPE.
5.2 Hierarchial Hash Functions
As the above-mentioned approach, we give the crypto-
graphic definitions of order-preserving mapping, called
hierarchical hash function (HHF, represented as fpk; ð Þ) in
this section. Such a function implement the comparison
operation  on a poset ðH; Þ.
At first, we setup the  relation over V by using a ran-
dom mapping function. Given a cryptographic map c :
SK  H ! V , where V ¼ fv1 ; v2 ; . . . ; vm g is a set of crypto-
graphic values and vi ¼ csk ðai Þ for all i 2 ½1; m and ai is
any attribute string in f0; 1g . We require that vi is random
and hard-to-guess if sk is unknown.
Next, it is obvious that csk ð Þ must be an order-preserv-
ing mapping, that is a map such that if ai  aj in H implies
there exists a partial-order relation  to ensure vi  vj in V .
Therefore, in order to setup this kind of relation over V , we
consider the partial-order relation in V as the “one-way”
property in cryptography. Therefore, we provide a defini-
tion of hierarchy hash function that is used to construct pub-
lic ordering function, as follows:
Definition 5 (Hierarchial Hash Function). Given a function
f : PK  V ! V based on a set ðH; Þ, it is called a forward
derivation function if it satisfies the conditions:
 Easy to compute. The function fð Þ can be computed in
a polynomial-time, if ai  aj , i.e., vj fpk;ai aj ðvi Þ;
 610 IEEE TRANSACTIONS ON SERVICES COMPUTING, VOL. 8, NO. 4, JULY/AUGUST 2015

Fig. 6. Our solution for cryptographic comparison relation.

 Pre-image resistance. It is infeasible for any probabilis- HðAi jjaij Þr for all aij 2 Ai . And then, we define the random
tic polynomial time (PPT) algorithm to compute vj mapping function csk ð Þ as follows:
from vi if aj  ai . Y
 Second pre-image resistance. Given an input vi 2 V , it vij csk ðai;j Þ ¼ vrij ¼ wi0 wik
is infeasible for any PPT algorithm to find vj 2 V , aij 6aik
Y
ai jjaj and fpk;ai ak ðvi Þ ¼ fpk;aj ak ðvj Þ. ¼ HðAi Þ r
HðAi jjaij Þr 2 G;
aij 6ak
The above definition follows the definition of general
hash function, but from a viewpoint of practical use, we Q
where vij ¼ wi0 aij 6aik wik . Note that, everyone can com-
did not require collision resistance, that is, it is infeasible pute HðAi Þ and HðAi jjaij Þ, but vi;j cannot be computed if
for any PPT algorithm to find two elements vi and vj 2 V the secret r is unknown. So we build the public parameter
and fpk;ai ak ðvi Þ ¼ fpk;ai ak ðvj Þ. In addition, the transitivity (or the part of ciphertext) as
property can be satisfied because fpk;ai ak ðvi Þ ¼ fpk;aj ak
ðfpk;ai aj ðvi ÞÞ. pk ¼ ðG; Hð Þ; fwik g8aik ;aij aik Þ:
We show a simple example to explain HHF in Fig. 7.
This example assume that we have a poset H ¼ ðA; Þ,
where A ¼ fa1 ; a2 ; . . . ; a7 g. Given v7 , the HHF ensures Finally, we define the HHF fpk ð Þ as
that the value of v3 ; v4 ; v1 can be obtained by using Y
fpk; ðv7 Þ. Inversely, given v3 , it is hard to guess v6 and v7 vik fpk;aij aik ðvij Þ ¼ vij wil
ail 2Gðaik ;aij Þ
according to pre-image resistance property. As the same 0 1
reason, v4 cannot be guessed because v4 jjv3 . More impor- Y Y
tantly, in the hierarchy it is easy to find the collision of ¼ @wi0 wil A wil
HHF. For example, v1 ¼ fpk;v3 v1 ðv3 Þ ¼ fpk;v4 v1 ðv4 Þ, how- aij 6ail [aik 6ail fail gn[aij 6ail fail g

ever, it is still hard to guess v4 from v3 according to Y

second pre-image resistance property. These security
properties should be used to guarantee the security of
our ABE scheme.
5.3 Cryptographic Construction of HHF
In this section, we will present a cryptography construction
of HHF, which will be used in our ABE scheme. This con-
struction is built on a general multiplicative group G. In
addition, we make use of a hash function H : f0; 1g 7! G,
which can map any string into a random element in G.
First, given a attribute hierarchy with a poset ðAi ; Þ and
Ai ¼ ðai1 ; . . . ; aimi Þ, we assume that Ai and all aij can be rep-
resented as f0; 1g . Let wi0 ¼ HðAi Þ and wij ¼ HðAi jjaij Þ.
Next, we pick a random integer r 2 G as the private key
sk ¼ r. We define that wi0 ¼ wri0 ¼ HðAi Þr and wij ¼ wrij ¼
¼ wi0 wil ¼ vik 2 G;
aik 6ail
where Gðaik ; aij Þ denotes [aik 6ail fail g n [aij 6ail fail g and
ail 2 Gðaik ; aij Þ  f8ail ; aij  ail g. For example, let see the
example of Fig. 7. In this example we list all elements of vi
according to partial ordering relation in Table 3. It is easy to
find that [aik 6ail fail g  [aij 6ail fail g if aik  aij . Hence, vij
can be computed according to such a containment relation-
ship. For example, given v5 and w1 ; w2 ; w4 ; w5 , we can com-
pute its seniors v1 ; v2 ; v4 , that is, v4 ¼ v5 w5 , v1 ¼ v4 w2 w4 ,
and v2 ¼ v4 w1 w4 .
In this construction it is intractable to obtain vik from vij for
aik  aij because [aik 6ail fail g  [aij 6ail fail g, aik 2 [aij 6ail
TABLE 3
Examples for HHF Construction

vi [ai 6aj wj [ai aj wj

v1 w2 ; w3 ; w4 ; w5 ; w6 ; w7 w1
v2 w1 ; w3 ; w4 ; w5 ; w6 ; w7 w2
v3 w2 ; w4 ; w5 ; w6 ; w7 w1 ; w3
v4 w3 ; w5 ; w6 ; w7 w1 ; w2 ; w4
v5 w3 ; w6 ; w7 w1 ; w2 ; w4 ; w5
v6 w2 ; w4 ; w5 ; w7 w1 ; w3 ; w6
v7 w5 ; w6 w1 ; w2 ; w3 ; w4 ; w7
Fig. 7. An example of hierarchy hash function.

nsed use limited to: MINISTERE DE L'ENSEIGNEMENT SUPERIEUR ET DE LA RECHERCHE SCIENTIFIQUE. Downloaded on May 12,2022 at 09:15:28 UTC from IEEE Xplore. Res
 ZHU ET AL.: FROM RBAC TO ABAC: CONSTRUCTING FLEXIBLE DATA ACCESS CONTROL FOR CLOUD STORAGE SERVICES
Fig. 8. Our construction of ABE-AH scheme.
fail g, and aik 62 [aik 6ail fail g. This means that vik can be
obtained unless vij =wik is computed. So, vik cannot not be
computed because wik is not in pk. For example, it is
hard to compute v6 ¼ v3 =w6 from v3 and w1 ; w3 because
w6 is unknown for a6  a3 . Also, v4 ¼ v3 =w4 cannot be
computed from v3 and w1 ; w3 because w4 is unknown
for a4 jja3 . This ensures pre-image resistance and second
pre-image resistance.
6 CONSTRUCTION OF ABE-AH
In this section we propose a novel construction with attri-
bute hierarchies based on BSW’s CP-ABE scheme. This
construction enjoys the lower computation and communica-
tion/storage costs. Moreover, we can generate a private key
with range controls, and then can implement comparisons
between two range controls from ciphertext and private
key, respectively.
We set up our systems using bilinear pairings proposed
by Boneh and Franklin [22]. Let G1 , G2 and GT be three
cyclic groups of large prime order p using pairing-friendly
curves, and e be a computable bilinear map e : G1 
G2 ! GT 3 with the following properties. For any G 2 G1 ,
H 2 G2 and all a; b 2 Zp , we have
1) Bilinearity. eðGa ; H b Þ ¼ eðG; HÞab .
2) Non-degeneracy. eðG; HÞ 6¼ 1 unless G or H ¼ 1.
3) Computability. eðG; HÞ is efficiently computable.
Where, ½aP denotes the multiplication of a point P in
elliptic curve by a scalar a 2 Zp . A bilinear map group
3. We require that no efficient isomorphism G2 ! G1 or G1 ! G2 is
known, or G2 ! G1 is unknown but its inverted G1 ! G2 is known.
nsed use limited to: MINISTERE DE L'ENSEIGNEMENT SUPERIEUR ET DE LA RECHERCHE SCIENTIFIQUE. Downloaded on May 12,2022 at 09:15:28 UTC from IEEE Xplore. Res
611
system S is a tuple S ¼ hp; G1 ; G2 ; GT ; ei composed of the
objects as described above. S may also include group gener-
ators in its description. In addition, there is a hash function
H : f0; 1g ! G.
Our ABE-AH scheme is described in Fig. 8. Our scheme
is constructed on BSW’s CP-ABE scheme, which makes use
of the hierarchy secret sharing scheme (HSSS) to realize
AND and OR operations for a access policy which be repre-
sented by Boolean function. In the description of our
scheme, we omit these details. Our ABE-AH scheme has an
optimum performance of storage and computation. For
example, the length of the user’s private key usk is directly
proportional to the number of attributes in AðiÞ , that is,
Oð#AðiÞ Þ, where # denotes the number of elements in a set.
Similarly, the length of ciphertexts is directly proportional
to the number of literals in an access tree T corresponding
to p, that is, Oð#T Þ. More importantly, the length of cipher-
texts is unrelated to the size of candidate attribute values
for a certain policy, by which we usually measure the length
of a ciphertext in the trivial equal matching way. Therefore,
the shorter ciphertext commonly means the lower over-
heads of computation, so that the ABE-AH scheme also
involves low computational overhead in the process of
encryption and decryption.
Next, we prove that if the decryptor’s attribute values
satisfy the policy p, and the decryptor can obtain the correct
message M from a ciphertext C using our ABE-AH scheme.
The analysis process is listed as follows:
First, if a decryptor’s attribute value aij satisfies the literal
aik  Aj in the ciphertext (that is aik  aij ), the decryptor
s
computes fE00 ;aik aij ðviki Þ since the value vsiji ¼ fE00 ;aik aij ðvsiki Þ ¼
i i
 612 IEEE TRANSACTIONS ON SERVICES COMPUTING, VOL. 8, NO. 4, JULY/AUGUST 2015

Q Q
vsiki ail 2Gðaij ;aik Þ wsili ¼ wsi0i aij 6ail wsili 2 G can be efficiently a; b 2 Zp , it is computationally intractable to compute the
computed from ¼ Ei00
s
fwili gaik ail
and ail 2 Gðaij ; aik Þ  value gab 2 G. More exactly, we define a game to measure
f8ail ; aik  ail g if the condition aik  aij holds. the difficulty of computing csk ðaj Þ from csk ðai Þ for aj  ai .
s s That is, for any t-time PPT algorithm A and a negligible ", if
Second, given the correct value viji ¼ fE00 ;aik aij ðviki Þ, we
i
can computes the value Sj in terms of Equation (5) as follows: 2 3
8H; H 2 pk; vi csk ðai Þ;
eðDi ; Ei Þ eðgt viji ; hsi Þ
r
Pr4 ðaj ; vj Þ Ahð Þ ðpk; vi Þ; : aj  ai 5 ":
Si ¼  0  ¼   s  9aj 2R V; aj ¼ aj ^ cpk ðaj Þ ¼ vj
e Di ; fE00 ;aik aij ðEi0 Þ e hri ; fE00 ;aik aij viki
i i

eðgt viji ; hsi Þ

r
¼  r si  ¼ eðg; hÞt si : We call that this problem is hard to resist the pre-image
e h i ; vij attack of HHF. Hence, we have the following theorem.
Theorem 2. Assuming that the CDH assumption holds, any
Finally, according to the aggregate algorithm in [17], the probabilistic polynomial-time PPT algorithm is hard to break
decryptor can obtain S ¼ eðg; hÞts only if the decryptor’s the pre-image resistance property.
attribute set is matching the policy tree T ; otherwise, the Proof. Assume that there exists a PPT adversary A to com-
decryptor cannot get S. When the decryptor gets S, she can pute vj from ðpk; vi Þ for ai 6 aj with a non-negligible
compute the correct message M in terms of the equation probability. By using A, we construct an algorithm B to
solve the computational DH problem as follows:
M eðg; hÞas eðg; hÞts
M 0 ¼ C1 S=eðD; C2 Þ ¼  aþt  ¼ M: 1) given ai , let sk ¼ a and set B sets vi ¼ ðga Þr and
e g b ; hbs
fwk ¼ ðga Þrk g8ak ;ai ak , where r and rk are some
random integers.
Combining these two conditions, we know that if the 2) for a hash query HðAjjal Þ in al 2 Gðai ; aj Þ, the ran-
b kl
P l Þ ¼ ðg Þ for al 6¼ aj ,
decryptor can get the message M if and only if the dom Oracle returns HðAjja
decryptor’s attribute set is matching the policy tree T and kl
the decryptor’s attribute values follow the comparison con- and HðAjjaj Þ ¼ gr =ðgb Þ al 2Gðai ;aj Þ , where kl is a
straints in the access policy p. Hence, if the decryptor can random integer in Zp .
get the message M if and only if the decryptor’s attribute 3) we revoke Aðpk; vi ; fwk g8akP;ai ak Þ. If A returns vj ,
1= kl
sets satisfy the access policy of the attribute lattices. B outputs gab ¼ ððga Þr =vj Þ al 2Gðai ;aj Þ
.
According
Q to the definition of v i , we have
Q vi ¼ vj
7 SECURITY ANALYSIS ð al 2Gðai ;aj Þ wl Þ ¼ vj w0ij ¼ gar , where w0ij ¼ al 2Gðai ;aj Þ wl .
7.1 Security Analysis of HHF Also, in terms of the definition of P random Oracle, we
First, before proving the security of our HHF construction, Q kl
have w00ij ¼ al 2Gðai ;aj Þ HðAjjal Þ ¼ ðgb Þ al 2Gðai ;aj Þ . Further,
we consider the security of the random values obtained P
from HðAjjai Þ in HHF for all ai 2 A. Usually, we call colli- since sk ¼ a, this means that w0ij ¼ w00ij a ¼ ðgab Þ
k
al 2Gðai ;aj Þ l
.
sion if two group of random values are equal, i.e., for any P
Q kl
P we have vi ¼ vj ðg ÞP ¼ gar and gab ¼
al 2Gðai ;aj Þ
two different subsets W1 and W2 of A, al 2W1 HðAjjal Þ ¼ Therefore, ab

Q 1= k 1= k
al 2W2 HðAjjal Þ. Due to the reason that all vi must be chosen ðw0ij Þ al 2Gðai ;aj Þ l
¼ ððga Þr =vj Þ al 2Gðai ;aj Þ l
. This contra-
at random, this scheme do not permit the collision among dicts to the CDH assumption, thus the theorem holds. u
t
the vi (or vi 6¼ vj ) for i 6¼ j. The following theorem tells us
Finally, we prove that our HHF is secure with second
that this collision probability is negligible only if the secu-
pre-image resistance under the CDH assumption. we also
rity parameter k is large enough. Moreover, the fast sort
define a game to measure the difficulty of computing
algorithm can help us to find the collision.
csk ðaj Þ from csk ðai Þ for aj jjai and fpk;ai ak ðvi Þ ¼ fpk;aj ak ðvj Þ.
Theorem 1. The collision probability of getting any sum among That is, for any t-time PPT algorithm A and a negligible ", if
m random integers, which are chosen in Zp from a uniform dis-
2 2 3
tribution, is less than ðmþ1Þ
4p , where p is a large prime number.
8H; H 2 pk; vi csk ðai Þ;
6 Þ 7
ðaj ; vj Þ A ðpk; vi Þ;
hð
Since the total number of roles is far less than the size of Pr6 7
4 9aj ; ak 2R V; aj ¼ aj ^ cpk ðaj Þ ¼ vj ; : aj jjai 5 ":
space of keys, this theorem means that the collision proba-
fpk;ai ak ðvi Þ ¼ fpk;aj ak ðvj Þ
bility is neglectable for a large number of attributes m, e.g.,
given m ¼ 1; 000 and m  p  2160 , the collision probability
20 We call that this problem is hard to resist the second pre-
is less than 22162 ¼ 2 142 . This means that the security of HHF
image attack of HHF. Hence, we have the following
is not related to the combination of the attributes.
theorem.
Next, we prove that our HHF is secure with pre-image
resistance under the Computational Diffie-Hellman (CDH) Theorem 3. Assuming that the CDH assumption holds, any
assumption: consider a cyclic group G of order p and a ran- probabilistic polynomial-time PPT algorithm is hard to break
domly chosen generator g, given ðga ; gb Þ for two random the second pre-image resistance property.

nsed use limited to: MINISTERE DE L'ENSEIGNEMENT SUPERIEUR ET DE LA RECHERCHE SCIENTIFIQUE. Downloaded on May 12,2022 at 09:15:28 UTC from IEEE Xplore. Res
 ZHU ET AL.: FROM RBAC TO ABAC: CONSTRUCTING FLEXIBLE DATA ACCESS CONTROL FOR CLOUD STORAGE SERVICES 613

Proof. Assume that there exists a PPT adversary A to com- T ¼ eðG; HÞ&t . This means that if DDH problem is hard in
pute vj from ðpk; vi Þ for ai jjaj and fpk;ai ak ðvi Þ ¼ fpk;aj ak ðvj Þ GT then eDDH problem is also hard in G and GT even if the
with a non-negligible probability. By using A, we build bilinear pairing exists here.
an algorithm B0 to solve the CDH problem as follows: More precisely, we have the following theorem accord-
ing to the intractability of distinguishing the two distribu-
1) given ai ; ak 2 H, let sk ¼ a, B0 sets vi ¼ ðga Þr and tions involved in the General Decision Diffie-Hellman
fwl ¼ ðga Þrk g8ak ;ai al , where r and rk are some ran- Exponent (GDDHE) problem [23]:
dom integers, and vk ¼ fpk;ai ak ðvi Þ.
Theorem 4 (Lower Bound of eDDH, [23]). Given an eDDH
2) for a hash query HðAÞ and HðAjjal Þ in al 6¼ aj , the
problem on S ¼ ðp; G; GT ; eð ; ÞÞ, for any PPT algorithm A
random Oracle returns HðAÞ ¼ ðgbP Þk0 and HðAjj that makes a total of at most q queries to the oracle computing
P kl
al Þ ¼ ðgb Þkl , but HðAjjaj Þ ¼ gr =ðgb Þ ai 6al ;al 6¼aj
,
k0 þ the group operations in G; GT and the bilinear pairing
2
where kl is a random integer in Zp . e : G  G ! GT , we have AdveDDH ðAÞ 2ðqþ10Þ
p .
3) we revoke Aðpk; vi ; fwk g8ak ;ai ak Þ. If A returns We prove the semantic security of our scheme under the
vj for ai jjaj and aj  ak , B outputs gab ¼ assumption of extended DDH problem. Since this kind of
P
1=ðk0 þ kÞ security is concerned with the plaintext, which be confi-
ðvj Þ aj 6al Þ l
. dentiality-protected rather than the validity of constraints
According to the definition of vi and ai jjaj , we have as described above, we need only to consider the adaptive
0 0 11a attribute lattice against chosen plaintext attacks. Hence, we
Y prove the Theorem 5, in which the advantage of adversary
vi ¼ @HðAÞ @ HðAjjal ÞAA is at most 4ðqþ10Þ
2
according to Theorem 4 and "0 > 2".
p
ai 6al
0 1a Theorem 5 (Semantic Security). Assume that extended Deci-
P
b k0 þ gr sion Diffie-Hellman problem on S ¼ ðp; G; GT ; eð ; ÞÞ with
¼ @ðg Þ A
k
ai 6al ;al 6¼aj l P
k0 þ k order p is ðt0 ; "0 Þ-hard, the ABE-AH construction is
ðgb Þ ai 6al ;al 6¼aj l
ðt; "Þ-adaptive attribute lattice against chosen plaintext attacks
¼ gar ; P (IND-AL-CPA), such that for any PPT algorithm A ¼ ðA1 ;
P
k0 þ
kl
A2 Þ, the success probability of A satisfies
where HðAjjaj Þ ¼ g =ðg Þ r b ai 6al ;al 6¼aj
. Also, in terms
of the definition of vj and sk ¼ a, we have vj ¼ ðH 2 3
P 8ðpk; mskÞ SetupðkÞ;
Q b k0 þ ai 6al kl a 6 A1 i ðpkÞ; 7
a OðH Þ
ðAÞ ð aj 6al HðAjjal ÞÞÞ ¼ ððg Þ Þ . This means ðM0 ; M1 Þ
P Pr6 0
4b ¼ b :
7
5 ";
k þ k b R f0; 1g;
that vj ¼ ðgab Þ 0 ai 6al l . Therefore, if A returns v , we 0
A2 ðEncryptðpk; p; Mb ÞÞ
P j b
1=ðk0 þ kÞ
have g ¼ ðvj Þ
ab aj 6al Þ l
. This contradicts to compu-
where "0 > 2", t0  t þ qA tA þ qh th , and tA ; th denotes the time
tational CDH assumption, thus the theorem holds. u
t of attribute query and hash query.
In summary, two above-mentioned cases means that it is
hard to compute the values of all elements fvj g8aj ;ai 6aj for a
given vi because we have the partial ordering ai 6
8 PERFORMANCE EVALUATION
aj ¼ ðaj  ri Þ _ ðai jjaj Þ. Therefore, our construction of HHF 8.1 Performance Analysis of ABE Cryptosystem
is a secure hierarchial hash functions. Our ABE scheme is constructed on bilinear map system
from from elliptic curve pairings. For simplification, we
7.2 Security Analysis of ABE-AH Scheme give several notations to denote the time for various opera-
The analysis of HHF has showed the security of partial tions in our ABE scheme. EðGÞ and EðGT Þ are used to
ordering relation in our ABE scheme. Now, we focus on the denote the exponentiation in G and GT , respectively. B is
security of ciphertexts in this scheme. Since semantic secu- used to denote the paring e : G  G ! GT . We neglect the
rity is a widely used definition for security in an asymmetric operations in Zp , the hash function H : f0; 1g ! G and the
key encryption algorithm, we will also prove the semantic multiplication in G and GT , since they are much more effi-
security of our scheme. The semantic security of our ABE cient than exponentiation and paring operation. We analyse
scheme enjoys the same security as the extension of BSW’s the computation and communication complexity for each
CP-ABE scheme [17] because our scheme is built on their phase, where jT j denotes the number of the leaf nodes in
scheme in addition to our partial ordering relation on HHF. the tree, jAj denotes the set of attributes of encryptor and
Our scheme is secure under extended Decision Diffie- decryptor, and lZp ; lG ; lGT denote the length of elements in
Hellman problem assumption, which is defined as follows: Zp ; G; GT , respectively. The security of comparison opera-
Suppose S ¼ ðp; G; GT ; eð ; ÞÞ be a cryptosystem on bilinear tions is based on two mathematical assumptions: the hard-
pairing. Given ðG; Gt Þ; ðH; H t Þ; ðeðG; HÞ& ; T Þ for two ran- ness of CDH and eDDH problem, so we define k ¼ 80 bit
dom t; & 2 Zn , it is hard to decide whether or not and p ¼ 160 bit to build a sufficiently secure system.
T ¼ eðG; HÞ&t , where g; h are two generators in G and G; GT In Tables 4 and 5, we analyse the performance of our
with order p. It is easy to see that an eDDH problem can be ABE scheme from two aspects: computation and communi-
transferred into a DDH problem in GT , that is, given cation/storage costs. In Setup, the computation and storage
ðeðG; HÞ; eðG; HÞt ; eðG; HÞ& ; T Þ in GT to decide whether costs are constant. In KeyGen, it is easy find that the

nsed use limited to: MINISTERE DE L'ENSEIGNEMENT SUPERIEUR ET DE LA RECHERCHE SCIENTIFIQUE. Downloaded on May 12,2022 at 09:15:28 UTC from IEEE Xplore. Res
 614 IEEE TRANSACTIONS ON SERVICES COMPUTING,
TABLE 4
Complexity Analysis of Our ABE Scheme
Computation Complexity
Setup 2 EðGÞ þ 1 EðGT Þ þ 1 B
KeyGen ð1 þ 3jAjÞ EðGÞ
Encrypt ð2 þ 3jAjÞ EðGÞ þ 1 EðGT Þ
Decrypt ð1 þ 2jAjÞ B þ jAj EðGÞ þ jT j EðGT Þ
computation and storage of generating user’s private key is
bound up with the size of A, but for each attribute Ai the
user only needs two elements in G stored by himself. In
Encrypt, the computation and storage costs of ciphertexts is
related to the size of A and T . Finally, in Decrypt, the com-
putation of decryption is also related to the size of A and T ,
but the bilinear map operations will consume a large
amount of time and memory. From the above analysis, the
computation and storage of our scheme is bound up with
the size of A and T , but the storage size of user’s private
key is shorter than general scheme.
8.2 Performance Analysis of Rule Conversion
Our solution for migrating from RBAC to ABAC enjoys an
optimum performance. When the “one-to-one” conversion
method is used in our solution, the generation of access pol-
icy only requires one-time search for PA, and the mapping
process of user’s attribute assignment also requires one-
time scanning for UA. The access authorization decision
based on Match requires one-time function invoking of
rokesðsi Þ, one-time searching for RH, as well as at most
jRHj time searching for PA, where jRHj denotes the num-
ber of roles in RH. When the multi-attribute conversion
method is introduced, that is, R ¼ A1  A2   An , the
complexities of three above-mentioned processes are
increased to n ¼ jAj times, but the searching processes for
RA, RH, and PA are the same as before.
In Table 6 we show some comparison results of conver-
sion between our scheme and BSW’s ABE scheme [17] from
a RBAC-based university management system with around
40 roles, which is used for maintenance of large volumes of
information, including student, faculty, inventory, trans-
port, library, facility management. Our scheme divided 40
roles into six groups where each group has seven attribute
values, but the BEW’s ABE without attribute hierarchy only
achieved the same number of attributes by one-to-one map-
ping. We found that these conversions entail a substantial
attribute engineering effort: our scheme reduced the length
of private keys and ciphertexts to less than 60 percent at
average case, where lG ¼ lGT ¼ 320 bits and lZp ¼ 160 bits.
This means that the computational costs were reduced
TABLE 5
Communication/Storage Analysis of Our ABE Scheme
Communication/Storage Complexity
Public parameter (pp) 1 lZp
Encryption key (ek) 3 lG þ 1 lGT
Master key (msk) 1 lG þ 1 lZp
Private key (usk) ð1 þ 2jAjÞ lG
Ciphertext (C) ð1 þ 3jT jÞ lG þ 1 lGT
Plaintext (M) 1 lGT
nsed use limited to: MINISTERE DE L'ENSEIGNEMENT SUPERIEUR ET DE LA RECHERCHE SCIENTIFIQUE. Downloaded on May 12,2022 at 09:15:28 UTC from IEEE Xplore. Res
VOL. 8, NO. 4, JULY/AUGUST 2015
TABLE 6
The Results of Conversion from RBAC to ABAC
Our Scheme BSW’s Scheme [17]
Number of roles 40 40
Number of set of attributes n 6 40
Average size of attribute sets v 7 1
Length of private key 13lG  0:5 KB 41lG  1:6 KB
Length of ciphertext 20lG  0:8 KB 62lG  2:5 KB
enormously. Benefited from these possible rule conversions,
our scheme provides a secure and efficient solution to cloud
storage in a more flexible manner.
8.3 Performance Evaluation of System
We have implemented our scheme in Qt/C++ and experi-
ments were run on a small cloud based on Openstack plat-
form with six servers. All disk operations were performed
on a 1.82TB RAID five disk array. Using GMP and PBC
libraries, we have implemented a cryptosystem based on
our solution in this paper. This C library contains approxi-
mately 8,000 lines of code and has been tested on a virtual
network platform based on VMware workstation, in which
consists of a simple medical RBAC system, a cloud storage
service, and a virtual network.
Our experiments employed 6 sets of attributes, that is,
A ¼ fA1 ; . . . ; A6 g. In every experiment we randomly built an
attribute hierarchy for each Ai 2 A, where the size of hierar-
chies (the number of nodes) can be specified in accordance
with our requirements. In Fig. 9 we show the practical compu-
tational costs of different algorithms in our ABE scheme
under the different sizes of attribute hierarchy (from 5 to 55).
From the trends of these curves, the change of computational
costs is not significant for different hierarchies.
In Table 7 the detail data are listed for the above experi-
ments. In these experiments, the performance of Setup algo-
rithm does not changed for all cases, but the performance of
other three algorithms are increased along with the size
ascending. However, the increasing is not significant. In
addition, the decryption is the most expensive algorithm
because a great amount of bilinear map operations are exe-
cuted. In our experiments we ignores the execution time of
the other modules because their changes were not evident
for the different hierarchies.
Fig. 9. Computational costs of our scheme under the different sizes of
attribute hierarchy (from 5 to 55).
 ZHU ET AL.: FROM RBAC TO ABAC: CONSTRUCTING FLEXIBLE DATA ACCESS CONTROL FOR CLOUD STORAGE SERVICES 615

TABLE 7 REFERENCES
Computational Consts of Our Scheme for Different Hierarchies
[1] F. R. Institute. (2010). Personal data in the cloud: A global survey
of consumer attitudes [Online]. Available: http://www.fujitsu.
Heirarchy size Setup GenKey Encrypt Decrypt com/downloads/SOL/fai/reports/fujitsu/personal-data-in-the-
5 3.38521 5.97481 7.56601 12.99482 cloud.pdf
10 3.38521 5.97481 7.56601 12.99482 [2] K. Ren, C. Wang, and Q. Wang, “Security challenges for the public
15 3.38521 5.97481 7.56601 12.99482 cloud,” IEEE Internet Comput., vol. 16, no. 1, pp. 69–73, Jan./Feb.
20 3.44761 5.97481 7.56601 12.99482 2012.
[3] V. Goyal, O. Pandey, A. Sahai, and B. Waters, “Attribute-
25 3.43201 5.89681 7.59721 13.02602 based encryption for fine-grained access control of encrypted
30 3.38521 5.91241 7.62841 13.05722 data,” in Proc. 13th ACM Conf. Comput. Commun. Security,
35 3.40081 5.89681 7.64401 13.07282 2006, pp. 89–98.
40 3.40081 6.00601 7.76881 13.16642 [4] R. Ostrovsky, A. Sahai, and B. Waters, “Attribute-based encryp-
45 3.43201 6.06841 7.90921 13.21322 tion with non-monotonic access structures,” in Proc. 14th ACM
50 3.44761 6.08401 7.92481 13.33802 Conf. Comput. Commun. Security, 2007, pp. 195–203.
55 3.47881 6.38041 8.42402 13.55642 [5] S. Yu, C. Wang, K. Ren, and W. Lou, “Achieving secure, scalable,
and fine-grained data access control in cloud computing,” in Proc.
IEEE Conf. Comput. Commun., 2010, pp. 534–542.
[6] R. Bobba, O. Fatemieh, F. Khan, A. Khan, C. A. Gunter, H. Khur-
9 RELATED WORK ana, and M. Prabhakaran, “Attribute-based messaging: Access
While the concept of ABAC has been around (introduced as control and confidentiality,” ACM Trans. Inf. Syst. Secur., vol. 13,
no. 4, p. 31, 2010.
early as 1996 in ISO 10181-3 and X.509 ACs), it has gained [7] V. C. Hu, D. Ferraiolo, R. Kuhn, A. Schnitzer, K. Sandlin, R. Miller,
prominence in research literature with its use in trust nego- and K. Scarfone, “Guide to attribute based access control (ABAC)
tiation and credential-based access control in a distributed definition and considerations,” NIST Special Publ., vol. 800, p. 162,
system with multiple administrative domains [6], [15]. 2014.
[8] M. J. Atallah, K. B. Frikken, and M. Blanton, “Dynamic and effi-
Goyal et al. [3] first defined the two complimentary forms of cient key management for access hierarchies,” in Proc. 12th ACM
ABE, namely, key-policy ABE and Ciphertext-Policy ABE Conf. Comput. Commun. Security, Alexandria, VA, USA, 2005,
(CP-ABE), and provided a construction for KP-ABE. Then, pp. 190–202.
[9] S. D. C. di Vimercati, S. Foresti, S. Jajodia, S. Paraboschi, and
Bethencourt et al. [17] gave the first construction for a CP- P. Samarati, “Over-encryption: Management of access control evo-
ABE scheme (short for BSW) in the generic group model. lution on outsourced data,” in Proc. 33rd Int. Conf. Very Large Data
These schemes supported monotonic Boolean encryption Bases, 2007, pp. 123–134.
policies. Many ABE schemes with varying properties have [10] R. Bobba, H. Khurana, and M. Prabhakaran, “Attribute-sets: A
practically motivated enhancement to attribute-based
been proposed since then, for example, schemes that sup- encryption,” in Proc. 15th Eur. Symp. Res. Comput. Security, 2009,
ported non-monotonic boolean encryption policies (e.g., pp. 587–604.
[4]), schemes that supported multiple attribute authorities [11] G. Wang, Q. Liu, and J. Wu, “Hierarchical attribute-based encryp-
(e.g., [24]), and so on. Recently, Lewko and Waters [25] pro- tion for fine-grained access control in cloud storage services,”
in Proc. ACM Conf. Comput. Commun. Secur., 2010, pp. 735–737.
posed a multi-authority ABE system, in which any party [12] J. Li, Q. Wang, C. Wang, and K. Ren, “Enhancing attribute-based
can become an authority and there is no requirement for encryption with attribute hierarchy,” in Proc. ACM Mobile Netw.
any global manager. Also, Waters [26] presented a new Appl., vol. 16, no. 5, pp. 553–561, 2011.
[13] Y. Zhu, G.-J. Ahn, H. Hu, D. Ma, and S. Wang, “Role-based cryp-
methodology for realizing CP-ABE under concrete and non- tosystem: A new cryptographic RBAC system based on role-key
interactive cryptographic assumptions in the standard hierarchy,” IEEE Trans. Inf. Forensics Secur., vol. 8, no. 12,
model. Lewko et al. [27] presented a fully secure ABE pp. 2138–2153, Dec. 2013.
scheme and attribute-hiding predicate encryption (PE) [14] R. Sandhu, E. Coyne, H. Fenstein, and C. Youman, “Role-based
access control models,” IEEE Comput., vol. 29, no. 2, pp. 38–47,
scheme for inner-product predicates by using dual system Feb. 1996.
encryption methodology. [15] R. Bobba, O. Fatemieh, F. Khan, C. A. Gunter, and H. Khurana,
“Using attribute-based access control to enable attribute-based
messaging,” in Proc. 22nd Annu. Comput. Security Appl. Conf., 2006,
10 CONCLUSION pp. 403–413.
[16] A. Sahai and B. Waters, “Fuzzy identity-based encryption,”
In this paper, we addressed the effective method to simplify in Proc. EUROCRYPT, 2005, pp. 457–473.
the policy-specified burden of cloud users in the process of [17] J. Bethencourt, A. Sahai, and B. Waters, “Ciphertext-policy attri-
bute-based encryption,” in Proc. IEEE Symp. Secur. Privacy, 2007,
using ABE. Our method is to improve ABE to support RBAC pp. 321–334.
model, the existing RBAC users, without alterations, can [18] V. Goyal, A. Jain, O. Pandey, and A. Sahai, “Bounded ciphertext
access their ABE-encrypted data in the cloud. Compared with policy attribute based encryption,” in Proc. Int. Colloq. Automata,
Lang. Program., 2008, pp. 579–591.
trivial equal and bit matching in prior solutions, our scheme [19] Y. Zhu, G.-J. Ahn, H. Hu, S. Yau, H. An, and C.-J. Hu, “Dynamic
enhances the expressive capacity of access policies, decreases audit services for outsourced storages in clouds,” IEEE Trans.
the computational overheads, and reduces the size of cipher- Serv. Comput., vol. 6, no. 2, pp. 227–238, Apr.-Jun. 2013.
texts and private-keys for attribute-based encryption. [20] R. Agrawal, J. Kiernan, R. Srikant, and Y. Xu, “Order preserving
encryption for numeric data,” in Proc. ACM SIGMOD Int. Conf.
Manage. Data, 2004, pp. 563–574.
ACKNOWLEDGMENTS [21] A. Boldyreva, N. Chenette, and A. O’Neill, “Order-preserving
encryption revisited: Improved security analysis and alternative
The authors are indebted to anonymous reviewers for their solutions,” in Proc. Annu. Int. Cryptol. Conf. Adv. Cryptol., 2011,
valuable suggestions. This work was supported by the pp. 578–595.
National 973 Program (Grant No. 2013CB329605) and the [22] D. Boneh and M. Franklin, “Identity-based encryption from the
weil pairing,” in Proc. 21st Annu. Int. Cryptol. Conf. Adv. Cryptol.,
National Natural Science Foundation of China (Grant Nos. 2001, pp. 213–229.
61170264 and 61472032).

nsed use limited to: MINISTERE DE L'ENSEIGNEMENT SUPERIEUR ET DE LA RECHERCHE SCIENTIFIQUE. Downloaded on May 12,2022 at 09:15:28 UTC from IEEE Xplore. Res
 616 IEEE TRANSACTIONS ON SERVICES COMPUTING, VOL. 8, NO. 4, JULY/AUGUST 2015

[23] D. Boneh, X. Boyen, and E.-J. Goh, “Hierarchical identity based ChangJyun Hu received the PhD degree from
encryption with constant size ciphertext,” in Proc. 24th Annu. Int. Peking University, Beijing, China, in 2001. He is
Conf. Theory Appl. Cryptographic Tech., 2005, pp. 440–456. currently a professor at the School of Computer
[24] M. Chase and S. S. M. Chow, “Improving privacy and security in and Communication Engineering, University of
multi-authority attribute-based encryption,” in Proc. ACM Conf. Science and Technology, Beijing, China. His
Comput. Commun. Secur., 2009, pp. 121–130. main research interests include parallel comput-
[25] A. B. Lewko and B. Waters, “Decentralizing attribute-based ing, parallel compilation technology, parallel soft-
encryption,” in Proc. Annu. Int. Conf. Theory Appl. Cryptographic ware engineering, network storage system, data
Tech., 2011, pp. 568–588. engineering, and software engineering.
[26] B. Waters, “Ciphertext-policy attribute-based encryption: An
expressive, efficient, and provably secure realization,” in Public
Key Cryptography, New York, NY, USA: Springer, 2011, pp. 53–70.
[27] A. B. Lewko, T. Okamoto, A. Sahai, K. Takashima, and B. Waters, Xin Wang received the BS degree from the
“Fully secure functional encryption: Attribute-based encryption Hubei University of Technology, China, in 2012.
and (hierarchical) inner product encryption,” in Proc. Annu. Int. She is working toward master’s degree at the
Conf. Theory Appl. Cryptographic Tech., 2010, pp. 62–91. School of Computer and Communication Engi-
neering, University of Science and Technology
Yan Zhu received the PhD degree in computer Beijing, China from 2013. Her research interests
science from Harbin Engineering University, include cryptography, cloud computing, and net-
China, in 2005. He is currently a professor at the work security.
University of Science and Technology, Beijing,
China. He was an associate professor at Peking
University, China, from 2007 to 2012. He was a
visiting associate professor at the Arizona State
University, from 2008 to 2009, and a visiting
research investigator of the University of Michi-
gan-Dearborn in 2012. His research interests
include cryptography, secure computation, and
network security. He is a member of the IEEE.

Dijiang Huang received the BS degree from the

Beijing University of Posts and Telecommunica-
tions, China, in 1995, and the MS and PhD
degrees from the University of Missouri-Kansas
City, in 2001 and 2004, respectively. He is an
associate professor at the School of Computing
Informatics and Decision System Engineering,
Arizona State University. His current research
interests include computer networking, security,
and privacy. He is an associate editor of the Jour-
nal of Network and System Management and an
editor of the IEEE Communications Surveys and Tutorials. He was an
organizer for many international conferences and workshops. His
research is supported by the United States National Science Foundation
(NSF), the US Office of Naval Research (ONR), the US Army Research
Office, NATO, and the Consortium of Embedded Systems. He received
the ONR Young Investigator Program Award. He is a senior member of
the IEEE.

nsed use limited to: MINISTERE DE L'ENSEIGNEMENT SUPERIEUR ET DE LA RECHERCHE SCIENTIFIQUE. Downloaded on May 12,2022 at 09:15:28 UTC from IEEE Xplore. Res