Towards a cryptography encyclopedia: a survey on attribute-based encryption

2.1. Complexity assumptions

Bilinear maps are believed to be the mainstream solution for key generation in ABE schemes. A bilinear map is an efficient, precise, and secure method for key generation in polynomial time, while other popular cryptographic systems, such as RSA or Diffie-Hellman, are hard to transform into an ABE system ^[11]. A bilinear map is defined as follows:

Definition 1  Bilinear Map: Let $$ G_1 $$, $$ G_2 $$, and $$ G_T $$ be cyclic groups with the same large prime order $$ q $$. According to ^[11], bilinear maps used specifically in identity-based encryption (IBE) and ABE systems fulfill the following three properties.

● Bilinearity: $$ (g_1^a, g_2^b) = e(g_1, g_2)^{ab} $$ with $$ g_1 $$ and $$ g_2 $$ being the generators of $$ G_1 $$ and $$ G_2 $$, respectively, and $$ a, b \in \mathbb{Z} $$. In the case of $$ G_1 = G_2 $$, the bilinear map is called symmetric.

● Computability: For any pair given by $$ G_1 \times G_2 $$, a bilinear map $$ e $$ has to be efficiently computable.

● Non-degeneracy: The bilinear map does not map all pairs in $$ G_1 \times G_2 $$ to the identity in $$ G_T $$: $$ e(g_1, g_2) \neq 1 $$.

The security of bilinear maps, and thus of ABE schemes in general, is based on the bilinear Diffie-Hellman complexity assumption, abbreviated as BDH, that describes the problem of computing the bilinear pair $$ e(g, g)^{abc} $$ for any given tuple $$ \{(g, g^a, g^b, g^c)\} $$ with $$ a $$, $$ b $$, $$ c $$$$ \in \mathbb{Z} $$^[11]. More specifically, the security of many ABE schemes is based on the decisional BDH (DBDH) and the decisional modified BDH assumption (MBDH) ^[12]. These are defined in the following:

Definition 2  Decisional Bilinear Diffie-Hellman assumption (DBDH): Assume that a challenger chooses $$ a, b, c, z \in \mathbb{Z} $$ at random. The DBDH assumption is that no adversary can distinguish the tuple (1) $$ (A=g^a, B=g^b, C=g^c, Z= e(g, g)^{abc}) $$ from the tuple (2) $$ (A=g^a, B=g^b, C=g^c, Z= e(g, g)^{z}) $$ in polynomial time with a non-negligible advantage.

Definition 3  Decisional Modified Bilinear Diffie-Hellman assumption (MBDH): Suppose an adversary chooses $$ a, b, c, z \in \mathbb{Z} $$ at random. The MBDH assumption specifies that no adversary is able to distinguish the tuple (1) $$ (A=g^a, B=g^b, C=g^c, Z= e(g, g)^{ab/c}) $$ from the tuple (2) $$ (A=g^a, B=g^b, C=g^c, Z= e(g, g)^{z}) $$ in polynomial time with a non-negligible advantage.

2.2. Access policy

Generally, access control is a procedure that restricts, denies, or allows access to resources. In the context of ABE, the term access policy can be described as a control structure defining if an entity has the permission to decrypt certain data ^[13]. In the case of ABE schemes that are often used in secure cloud environments, the access policy controls which users can decrypt certain data stored in the cloud by data owners (DOs) ^[13]. As an illustrative example, imagine the following academic situation: The performance record of students in a course CS must be only accessible by the respective professor or teaching assistants of the course. This can be expressed by the following access policy in the form of a boolean formula: ((Role: Professor AND Course: CS) OR (Role: Teaching-Assistant AND Course: CS)). The variables in this predicate, such as 'Professor' or 'CS', are called attributes; the predicate or policy itself is also called an access structure ^[13].

In addition to this representation as a Boolean formula, access policies are often represented as trees. The leaves of such a tree represent the used attributes. The remaining leaves represent gates, such as AND or OR. If the gate of the root node is fulfilled, the access is allowed, or the decryption of the ciphertext is possible ^[13]. As an illustration of the concept of the access policy by a tree, Figure 1 illustrates such an access policy tree for the university example described above.

Figure 1. Example representation of an access policy as a tree, according to Priya et al. ^[13].

The access policy in ABE schemes can either be encoded into the secret key of data users (DUs) or it can be specified by the ciphertext. In existing ABE schemes, different kinds of access policies are used, such as threshold policies, AND policies, tree policies, and the linear secret sharing scheme (LSSS) matrix. Waters ^[14] proposed this last methodology of access control for Ciphertext-Policy ABE (CP-ABE) only in 2011. It uses a so-called LSSS matrix over the attributes in the system, allowing for the concise expression of the previously used structures in the form of an LSSS ^[12]. According to Zhang et al. ^[15], schemes using LSSS access structures generally tend to be more efficient while maintaining expressiveness compared to ABE schemes based on other kinds of policies ^[15]. The access policy can also support either only positive attributes or both positive and negative attributes. In the first case, the access structure is then called monotonic; in the second case, it is called non-monotonic ^[16].

Threshold access policies are used in various ABE schemes, such as the first Key-Policy ABE (KP-ABE) scheme by Goyal et al. ^[17]. A tree can act as a representation of this access policy. In such a tree, the leaves represent attributes while the other nodes (root and intermediate) consist of threshold gates of the form [$$ m, n $$]. Here, $$ m $$ is the threshold value of the number of attributes to be fulfilled for satisfying the gate. The total number of attributes following the gate is represented with $$ n $$. The threshold gate [$$ 1, n $$] represents the OR gate, and [$$ n, n $$] represents the AND-gate ^[18]. The access policy is fulfilled when the root of the tree is satisfied, allowing a user to decrypt the data.

Figure 2a shows an example of such a threshold gate tree structure with the attributes X1, X2, and X3 for the access policy (X1 AND (X2 OR X3)). Here, the gate [1,2] is an OR gate that is satisfied if one or more of the attributes X2 and X3 following are fulfilled. The gate [2,2] represents an AND-gate, accordingly.

Figure 2. Illustration of threshold and non-monotonic access structure.

The access structure in the KP-ABE scheme by Goyal et al. ^[17] is a so-called monotonic access structure. In such an access policy, a negative attribute cannot be represented. It can be used, for example, to exclude users to whom the owner does not want to disclose data. Ostrovsky et al. ^[19] proposed the first ABE scheme with non-monotonic access structures. This scheme supports both positive and negative attributes. Consequently, such non-monotonic access structures are able to express more complicated access policies. However, non-monotonic access structures introduce additional overhead for encryption and decryption and increase the size of ciphertext and keys when compared to schemes with monotonic policies ^[12]. This scheme is only reasonably applicable for a fixed number of attributes and for a limited number of users. Figure 2b shows an example of such a non-monotonic access structure (X1 AND X2 AND NOT X3) with the attributes X1, X2, and X3.

2.3. ABE schemes

In this section, we introduce the fundamental concept of ABE and its two sub-categories, namely KP-ABE and CP-ABE ^[16]. We also describe the different kinds of access structures used in ABE schemes.

In 2005, Sahai and Waters ^[20] proposed the first ABE scheme, called FIBE, a simplification of IBE ^[13]. ABE is a one-to-many algorithm using public key cryptography for protecting data in the cloud. The special property of ABE is that the ciphertext and the secret keys of the users are based on a set of attributes used for controlling whether a specific user is allowed to decrypt the data ^[15]. This basic ABE scheme involves three different entities, namely an authority, a DO, and a DU ^[18]. Generating the keys according to attribute sets that are necessary for the DOs and users is the responsibility of the authority ^[16]. The DO receives a public key for encrypting the data along with the attributes before storing it in the cloud. DUs obtain a secret key, also called a private key, from the authority, and they can use this secret keyto decrypt data from the cloud ^[18]. In the ABE scheme by Sahai and Waters, the decryption is only possible in case a threshold number of $$ d $$ components of the attributes in the ciphertext are equal to the attributes in the user secret key ^[16]. The architecture of this basic ABE scheme is presented on an abstract, high level in Figure 3, similar to the graphics in ^[18].

Figure 3. Architecture of the basic Attribute-Based Encryption (in the style of Kumar et al. ^[18]).

As a promising cryptographic primitive for a more secure cloud, research efforts on attribute-based encryption have significantly increased over the last few years. In FIBE, the first and basic ABE scheme, the threshold is the only access structure supported. During the setup phase, it gets fixed by the authority. Nevertheless, many practical applications have increasing needs for flexible access control policies that support operations such as 'and', 'or', 'threshold', and 'non' ^[12]. Therefore, more complex types of ABE schemes were proposed. Since their emergence in the year 2005, numerous ABE schemes have been proposed, including new variations of basic ABE focusing on different properties ^[15]. These schemes can generally be classified into the two categories: CP-ABE and KP-ABE ^{[11–13, 15, 16, 18]}.

2.4. KP-ABE

In 2006, Goyal et al. ^[17] proposed the first KP-ABE scheme extending basic ABE. The scheme was intended for fine-grained sharing of encrypted data and has been proven secure under the DBDH assumption. Generally, in KP-ABE schemes, the access policy is encoded into the secret keys of the user while the ciphertexts are created using a set of attributes. A ciphertext can only successfully be decrypted by a user if the attributes of the encrypted data fulfill the access policy embedded into the user's secret key ^[13].

For instance, let us assume an academic situation with a user possessing a secret key with the following access policy encoded into it: ((Identity: Student AND Department: CS) OR Identity: Teacher). In this case, the user is not permitted to decrypt a ciphertext generated based on the attribute set {Identity: Student, Department: CE, Year: 3}. However, the user would be able to decrypt a ciphertext with the attribute set {Identity: Teacher} ^[15]. Figure 4 illustrates this concept of KP-ABE. A trusted authority publishes the public key (1) and generates the secret keys with respect to the user's access policy (2). The DO chooses an attribute list L and integrates L into the ciphertext (3). The user is able to decrypt and access the data stored in the cloud based on the access policy that is embedded into his secret key (4). The fact that the access policy is integrated into the secret keys of the users is a major drawback of KP-ABE schemes. As a consequence, the DO cannot specify who can decrypt the ciphertext. Instead, they can only influence this by selecting a set of attributes for it ^[12].

Figure 4. The general concept of KP-ABE (in the style of Zhang et al. ^[18]).

2.5. CP-ABE

In 2007, Bethencourt et al. ^[21] proposed the first CP-ABE scheme using a monotonic threshold gate access structure. In contrast to KP-ABE schemes, in CP-ABE, the secret keys of users are associated with a set of attributes instead of an access policy. This association is integrated into the ciphertext rather than into the user's secret key in KP-ABE ^[11].

Figure 5 illustrates the general concept of CP-ABE using a typical application example. It includes four entities, namely a trusted authority, the DU, the DO, and a cloud where the data is stored. The trusted authority publishes the public key (1), which the DO uses to encrypt their data, and distributes the corresponding secret keys to each user (2). Hereby, the attribute list of a DU is integrated into his secret key. After selecting an access policy for his data, the DO embeds it into the ciphertext of the corresponding data encrypted with the public key (3). DUs can retrieve the encrypted data from the cloud. In order to access the original data, they need to decrypt the ciphertext using their secret keys. However, successful decryption is only possible if the attributes integrated into the secret key match the one inside the ciphertext (4).

Figure 5. Concept of CP-ABE (in the style of Zhang et al. ^[15]).

For example, assume three DUs, with the respective attribute lists $$ L_A = \{Teacher, Alice\} $$, $$ L_B = \{CS, Student, Bob\} $$, and $$ L_C = \{CE, Student, Carl\} $$. For a ciphertext encrypted with the policy (Teacher OR (CS AND Student)), Alice and Bob can successfully access the original data while Carl is not able to decrypt the ciphertext.

2.6. General Comparison of KP- and CP-ABE

KP-ABE and CP-ABE schemes work in an opposite manner in terms of the integration of access policy and attributes. As a result, these schemes are generally suitable for different kinds of applications due to differences in the flexibility and complexity assumptions ^[12].

Both KP- and CP-ABE can support complex strategies for access structures. Therefore, they are suitable for applications that require fine-grained control of data sharing. However, in KP-ABE schemes, the access policy is integrated into the secret keys of the users. Consequently, DOs have no control over which DUs can actually access and decrypt their data. In comparison, CP-ABE is generally more applicable for most real-world cloud data sharing applications, in which the DOs have full control of their data ^[13]. KP-ABE schemes are rather suitable for query applications, such as pay-TV subscriptions, access to databases, or targeted broadcasts. On the other hand, CP-ABE schemes are often used in applications that require access control, for example, access to social networking user profiles or electronic medical systems ^[12].

KP-ABE schemes are usually proven secure under the standard DBDH complexity assumption described in Section 2.1 2.1. Since CP-ABE schemes generally tend to be more complex than KP-ABE schemes, it is also more difficult to prove their security. In order to achieve chosen-plaintext attack (CPA) security under the standard complexity assumption in CP-ABE, the focus of research is on the design of suitable access policies. We can differentiate between three types of access structures that are often used in CP-ABE schemes, namely AND-gate, access tree, and LSSS matrix, as described in Section 2.2.

3.1. Methodology

The methodology used for our survey is illustrated in Figure 6. In order to gain an overview of existing publications on ABE schemes, we initially chose the existing ABE surveys from sources such as ^[12], ^[18], ^[16], ^[13], and ^[11]. We gradually increased this initial dataset by iteratively applying Forward Snowballing as long as we could find new publications on ABE schemes. From the total number of publications identified in this way, we then selected the schemes we included in our survey. More specifically, our inclusion criteria involved considering a scheme that (1) proposed a new ABE scheme or an extension of an existing one not previously examined by us and (2) that was proposed after 2014. The exclusion criterion was based on the obsolescence of a scheme since newer schemes often offer the same or more features. This resulted in 42 ABE schemes meeting our criteria. We then created a taxonomy for these 42 schemes and determined comparison metrics and features. We go into more detail on the taxonomy and comparison metrics in Sections 3.2 and 3.3 below, and we distinguish them from related work in Section 3.4.

Figure 6. Survey methodology.

3.2. Taxonomy of ABE

In order to review ABE schemes and conduct a systematic comparison, we first propose a taxonomy of ABE schemes. Figure 7 illustrates our proposed taxonomy for ABE. ABE schemes realize different properties in terms of cryptographic functionality. These properties have an impact on the computational efficiency, security, and the formulation of access policies or attribute secret keys within a scheme. Our proposed taxonomy includes the following categories of ABE schemes according to these features. The taxonomy also allows us to identify combinations of features that are not yet fulfilled by existing systems. Thus, among the ABE schemes we have considered, there is still no KP-ABE scheme that offers the features such as Hidden Policy or Accountability. In the following, we describe the categories, omitting Access Structure since we have already presented it in Section Ⅱ:

Figure 7. Proposed ABE taxonomy.

● Multi-Authority ABE: Contrary to traditional ABE, in which a single authority is able to decrypt all ciphertexts, in multi-authority (MA) ABE, there are multiple authorities operating simultaneously. The MA-ABE category can be further divided into centralized and decentralized MA ABE, depending on whether a central authority (CA) is used or not. This property of multi-authorities can be applied to both KP- and CP-ABE ^[18].

● Accountable ABE: In order to improve the security of ABE and prevent the abuse of keys, schemes belonging to this category provide means to ensure accountability. Accountable ABE schemes specifically focus on two problems: the illegal sharing of keys among users and the misconduct of attribute authorities (AAs). Accountable ABEs implement both user accountability/tractability and the accountability of AAs. Accountability can be applied to both KP- and CP-ABE ^{[12, 15]}.

● Hidden Policy ABE: Hidden policy ABE schemes, also called policy-hiding ABE, aim to protect the privacy of access policies. This feature is only relevant to CP-ABE, where DOs include the access policy into the ciphertext sent to the cloud, as described in Section 2.5. As a consequence, in such non-hidden-policy CP-ABE, anyone who is able to access this ciphertext can learn the access policy. The hidden policy category overcomes this problem by hiding the access structure ^[18]. This property of policy hiding can only be applied to CP-ABE [18].

● Proxy Re-encryption ABE: The concept of proxy re-encyption (PRE) aims to make data sharing more efficient. Proxy Re-encryption ABE schemes apply this PRE primitive to the attribute-based context. In this category, data encrypted with an access policy is re-encrypted by a proxy into a new ciphertext according to a new access policy. As a result, users fulfilling the new access policy are now able to decrypt the ciphertext without the proxy learning any useful information about the data. This feature is only relevant to CP-ABE ^[12].

● Policy Updating ABE: Traditional CP-ABE does not allow to dynamically change the access policy of a ciphertext. For access control applications that require such changes, for example, in case of emergencies, Policy Updating ABE provides mechanisms to update the access policy in a ciphertext ^[15]. KP-ABE schemes cannot update their policies, while some CP-ABE schemes are able to do this.

● Revocable ABE: Revocation mechanisms in ABE can be divided into user revocation and attribute revocation. The attribute revocation deals with dynamically editing the attributes of the users due to expiration, revocation, or addition of attributes. User revocation is used to remove or add users, for example, to deal with malicious behavior. Revocable ABE can be realized in two different ways, resulting in two subcategories, direct and indirect revocation ^[18]. User revocation is only possible with CP-ABE.

● Hierarchical ABE: In hierarchical ABE, the assignment of access rights is organized in a hierarchical manner. Only CP-ABE can provide this fine-grained access control; however, it is not optimal for large hierarchical structures, such as enterprises, due to the lack of a full delegation mechanism. Hierarchical ABE schemes provide scalability for such large enterprises by using a hierarchical structure for attributes ^[16].

3.3. Evaluation Criteria for ABE

In this section, we introduce and describe the metrics and features used in our systematic comparison of ABE schemes. We divide this comparison into the evaluation of the security features and the performance of schemes.

Security: ABE has two fundamental security features: Data confidentiality and collusion resistance. However, these features are usually achieved under different premises regarding the types of adversaries and the security models and the underlying complexity assumption involved in the security analysis. In consequence, there may be different ABE schemes fulfilling the same security goals, but they cannot be considered equally secure since the underlying conditions (e.g., security models) are different ^[15]. Therefore, we compare the security of ABE schemes according to their underlying complexity assumption and security model resulting from the types of adversaries.

● Security Model: The security model of an ABE scheme captures the specific types of adversaries against which the scheme is proven to be secure. Security proofs of ABE typically consider two types of adversaries, namely the selective adversary and the adaptive adversary. The selective adversary has to select its target access policy or attribute list in advance, which the adaptive adversary does not have to do. As a result, the adaptive adversary is more powerful. An ABE scheme can achieve selective or full security, depending on the type of the adversary it is proven secure against. This is referred to as the security model of the scheme. A full security proof is technically more challenging than a selective security proof. In the first case, the target access policy or attribute list is not pre-determined. Thus, an adversary in the simulation process is not able to set parameters in a targeted manner. A scheme that offers a fully secure model generally has a higher security than a scheme with selective security ^[13].

● Complexity Assumption: ABE schemes use and rely on complexity assumptions, so they are another important aspect of their security. The DBDH assumption is also called the standard complexity assumption, as it is used in many ABE schemes ^[11]. We describe the complexity assumptions in Section 2.1.

Performance: In order to evaluate the efficiency of ABE schemes, we mainly refer to their storage, communication, and computation costs. We present the features reflecting these costs in the following:

● Public Key Size: The size of the public keys in ABE schemes is the first feature that influences its storage costs. In many cases, the size of the public keys increases linearly with the number of attributes in the system. However, public keys that are constant in size are preferable in an ideal scenario ^[12].

● Secret Key Size: The size of the corresponding secret keys in ABE schemes is the next feature relevant to the storage costs. Similar to the size of the public keys, the size of secret keys in many ABE schemes is often linearly proportional to the number of attributes in the system. Ideally, an ABE scheme should have secret keys of constant size ^[16].

● Ciphertext Size: The encrypted data stored in the cloud by DOs and retrieved by DUs, together with the communication costs, influence the size of a ciphertext in an ABE scheme. It is also linearly proportional to the complexity of the corresponding access policy ^[15].

● Encryption and Decryption Costs: The costs for encryption and decryption in ABE schemes are two major components of their computation costs. In IoT cloud scenarios, there may be small devices involved with limited resources, thus requiring low communication costs. The most expensive cryptographic operation regarding encryption and decryption in ABE is the bilinear pairing. In addition to this operation, we consider the two operations, point multiplication and exponentiation, in the evaluation of the computation costs. In comparison to these three operations, basic arithmetic operations, such as addition or multiplication, generally have less impact on the computation costs and are, therefore, typically ignored when evaluating computation costs in ABE ^[15].

● Access Policy: The access policy of an ABE scheme represents the expressiveness and granularity of the corresponding access control system. As described in Section 2.2, existing ABE schemes can have different types of access policies. Popular policies are the tree policy, the threshold policy, or the LSSS policy. When comparing LSSS-based schemes with those employing other access policies, the former typically achieves better efficiency. Additionally, while the ABE schemes based on the LSSS policy can generally achieve enhanced efficiency compared to other access policies, they also maintain an equivalent level of expressiveness as these alternative schemes ^[18].

● Scalability: The scalabilty of ABE schemes is an important aspect related to their basic structure and functionality. In order to achieve scalability, schemes should allow dynamic expansion of the system. Generally, scalable ABE schemes need to include some form of hierarchy in the structure of authorities in order to efficiently deal with large and hierarchical structures ^[11].

3.4. Differentiation from Related Work

Several surveys ^{[11–13, 16, 18, 22]} have been published on ABE. They cover both KP-ABE and CP-ABE. We propose a refined taxonomy breaking down CP-ABE and KP-ABE into further categories, namely MA, accountable, hidden policy, proxy re-encryption, policy updating, revocable, hierarchical, and (non-)monotonic ABE. Pang et al. ^[12] only mentioned the categories MA, accountable, proxy re-encrypion, and revocable. Kumar et al. ^[18] investigated only MA, hidden-policy, revocable, and hierarchical ABE. The survey by Lee et al. ^[16] just contained the categories, hierarchical and non-monotonic. Priya et al. ^[13] mentioned neither of these categories, besides basic KP- and CP-ABE. Qiao et al. ^[11] only investigated the non-monotonic category. We further apply our taxonomy for a detailed feature comparison of ABE schemes. We are not aware of any existing survey providing such a detailed comparison of ABE schemes.

In addition to the feature comparison, we investigated current ABE schemes from all these categories and systematically compared them according to the discussed evaluation criteria. The criteria consider both the efficiency and security of the ABE schemes. For efficiency, we examine the storage costs represented by the size of the public and the secret keys, the communication costs in terms of the size of the ciphertext, and the computation costs represented by the costs for encryption and decryption. Moreover, we included the access policy of an ABE scheme as an additional criterion. Regarding security, we focused on the two fundamental properties of ABE schemes, namely the security model and the adopted complexity assumption. Most other surveys mentioned storage, communication, and computation costs. However, ^{[11, 13, 16]} did not examine the size of public keys in ABE schemes. Additionally, ^[13] lacked the features of secret key size and ciphertext size and only generally investigated computation costs. Besides ^{[12, 16]}, no other survey mentioned the access policy of ABE schemes. Only ^{[13, 18]} mentioned the security model as a property of ABE schemes. The adopted complexity assumption of an ABE scheme is mentioned in all surveys except for Lee et al ^[16]. However, again, we have a detailed comparison of the efficiency and security of a great number of ABE schemes that other existing surveys do not include.

Most surveys examined only a handful of schemes up to a maximum of ten. Kumar et al. ^[18] compared a larger number of schemes; however, they focused on older schemes and did not consider many important recent schemes. Additionally, they did not investigate every scheme they mentioned. In fact, in their comparison, they left out schemes for which they did not specify their achievement of features or performance regarding the costs or security. Altogether, we surveyed and compared a total of 42 different ABE schemes, resulting in a much broader coverage compared to the existing surveys. Moreover, similar to Kumar et al. ^[18], all existing surveys focus on older schemes proposed in 2014 or earlier. In contrast, our survey includes many recent schemes published in 2015 or later.

The survey by Rasori et al. ^[22] aimed to identify a selection of ABE schemes that are suitable for use in the IoT domain. For this purpose, schemes are first analyzed theoretically, and then, the performance of nine methods on typical IoT hardware is determined. However, no complete overview of the theoretical performance of the considered schemes is provided. Regarding features, however, the expressiveness of their access policies was given for all schemes.

In summary, we provide a systematization of existing knowledge on ABE in addition to a detailed comparison of existing ABE schemes. Table 1 provides an overview of the features and evaluation criteria used in our survey compared to the related work.

4.1. Centralized

Chase et al. ^[23] proposed the first MA ABE scheme. This KP-ABE scheme used one CA and multiple AAs. Identity-related keys are issued to users by the CA, which was also responsible for issuing seeds for each AA. The AAs managed attributes and issued attribute-related keys. A user's keys from different AAs werelinked by a global identifier (GID) of the corresponding user. In this scheme, the CA still needed to be fully trusted since it was able to decrypt all ciphertexts, becoming a vulnerability in the system.

Li et al. ^[24] designed a MA CP-ABE scheme that also employed one CA and multiple AAs. In this scheme, the CA was also in charge of issuing the identity-related keys. However, contrary to ^[23], it was not able to decrypt any ciphertext. The security proofs of the scheme were based on the technique of dual system encryption and were given in the standard models. This scheme supported outsourcing of decryption and indirect user and attribute revocation.

Xue et al. ^[26] proposed an auditable and robust MA CP-ABE scheme addressing the issue of failures in AAs. Here, every AA was able to independently generate secret keys for any possible attribute set for users. In the case of a maliciously behaving AA, the CA was able to detect such behavior.

Yu et al. ^[25] presented a MA CP-ABE with the ability to revoke malicious users directly. Corresponding public parameters and ciphertext components were both updated via the revocation process. Keys of the remaining users remained untouched. To detect if a specific ciphertext was correctly updated by the cloud server, the revocation mechanism also offered verification.

4.2. Decentralized

Chase et al. ^[27] aimed to remove the need for a trusted CA, as in ^[23], and proposed a decentralized MA CP-ABE scheme without one. They used a secret pseudorandom function (PRF) and each pair of AAs shared the seeds during the initialization phase. If at most $$ (n-2) $$ AAs were corrupted, where $$ n $$ denotes the number of total AAs, the scheme was considered secure. Moreover, the scheme protected users from colluding with AAs that pool their information on a particular user.

Lewko and Waters ^[28] proposed a decentralized MA scheme offering full security, contrary to ^{[23, 27]}, which only provided selective security. However, with a large attribute universe, this could become inefficient. Nevertheless, in the random oracle model (ROM), it was the first adaptively (fully) secure MA CP-ABE scheme that was proven secure. Since no collaboration among AAs during the setup and key generation phase was required, it improved previous MA CP-ABE schemes. Any LSSS matrix could be used to describe the used access policy.

Han et al. ^[29] designed a decentralized KP-ABE scheme with privacy protection. The secret key distribution was carried out by AAs, among which cooperation was not required. The privacy preserving key extraction protocol was used under the standard complexity assumption. However, user collusion, meaning two users pooling their decryption keys to generate decryption keys, was not prevented by this scheme.

In ^[30], Zhang et al. presented a decentralized MA CP-ABE scheme supporting a large attribute universe. It was based on prime order groups and enabled tractability. This means that malicious users that leak their keys (even partially or modified) could be identified by the system.

4.3. Further Comparison

The schemes ^{[23, 25–27]} were based on prime order groups and were proven secure under the standard model. Reference ^[30] was the only scheme that supports a large attribute universe. Scheme ^[24] was the only one that achieved full (adaptive) security; its security proof was based on the standard model. Moreover, it employed an efficient outsourced approach for decryption; thus, only one exponent operation was required. The schemes in ^[27–30] were decentralized, among which ^[27] required cooperation between AAs for initialization. In contrast, the schemes ^{[23, 24, 26]} were centralized and requireda CA. The CAs in ^{[23, 26]} were able to decrypt any ciphertext, thus possibly becoming a security vulnerability of the system. Each AA in ^[26] was responsible for managing all attributes in the system, whereas the AAs in the other schemes were only responsible for a subset of the total attribute universe. These subsets were disjunct among the AAs. The schemes ^{[24, 25, 28, 30]} remained secure as long as one AA was not corrupted by an adversary. If both decentralized architecture and full security are required, we recommend the scheme ^[28].

5.1. Accountable ABE Schemes

The first accountable CP-ABE scheme was proposed by Li et al. ^[31] in 2009. It embedded additional user-specific information into the user's secret key, thereby enabling private user accountability. Thus, the system could detect and prevent illegal keys from sharing among users. The scheme was selectively secure in the ROM. However, it lacked expressiveness by only supporting AND-gate access policies.

Wang et al. ^[32] presented a KP-ABE scheme with an accountable authority. The main idea of this scheme was a key-splitting trick. In this trick, the secret value of the keys was divided into two parts. These parts were then utilized to generate two partial keys. One of them corresponded to the access policy, and the other to the identity. However, the traceability algorithm required the entire well-formed decryption key.

Aiming to realize accountability both for users and AAs, Ning et al. ^[33] described an accountable CP-ABE scheme. This scheme used the efficient LSSS matrix as an access policy. In the white-box model, this enabled weak public accountability both for users and the AA. The authors presented the security proofs of the scheme under the q-string Diffie-Hellman (Q-SDH) assumption and some further assumptions.

In ^[34], Zhang et al. presented a security weakness in the scheme of Ning et al. ^[33], which resulted from re-randomization of the attribute secret key. Subsequently, they proposed a CP-ABE scheme with both user and AA accountability. The scheme also used LSSS for an access policy and was proven fully secure in the ROM.

Furthermore, Ning et al. ^[35] proposed an accountable LSSS-based CP-ABE scheme. It was a combination of conventional CP-ABE, anonymous IBE, and identity hierarchies. Moreover, full security and public user accountability were provided in this scheme.

Liu et al. ^[36] designed another accountable CP-ABE scheme. The scheme provides public user accountability and user revocation. For this, a publicly available revocation list exists that is used to update the ciphertexts accordingly.

5.2. Further Comparison

The schemes ^{[31, 34]} provided the advantage of small and constant-size public keys. In ^{[33, 35]}, an efficient LSSS policy was used. They had a small attribute universe and were based on composite-order groups. Reference ^[32] was based on prime order groups with a small attribute universe and tree access policies. The two schemes ^{[31, 34]} provided alarge attribute universe and were resistant against selective adversaries. Besides ^[32], only the schemes ^{[31, 36]} were constructed in prime order groups. Only the AA was able to perform the accountability of these schemes. Only two of the accountable ABE schemes simultaneously achieved the accountability of both users and AAs. We recommend the scheme proposed by Zhang et al. ^[34] for applications that require authority accountability, user accountability, and a large universe.

6.1. Hidden-Policy Schemes

Nishide et al. ^[37] proposed the first hidden policy schemes for CP-ABE. The security of their scheme was based on the DBDH and DLIN assumptions in the ROM. However, it was only proven secure for selective adversaries. The authors used the AND-gate on multi-valued attributes with wildcard access structures. These wildcards introduced "don't care" values for attributes in access structures. Hidden policy in this scheme was achieved by the inner product predicate encryption technique. Lai et al. ^[38] presented a new hidden-policy CP-ABE scheme in order to achieve full security against adaptive adversaries. This approach provided full security under new complexity assumptions and is based on composite-order groups as well. Both schemes ^{[37, 38]} lacked expressiveness concerning their access structure since they only used policies with AND-gates. Moreover, the length of the ciphertext depended linearly on the number of attribute values, and they only supported a small attribute universe.

Next, Phuong et al. ^[39] proposed a hidden-policy CP-ABE scheme aiming to reduce the size of ciphertexts, which was constant in their scheme. For access policy, AND-gates were used with positive, negative, and wildcard attributes. This scheme had two vectors and transformed the attributes and access policies into them in order to hide the AND-gate policies. Furthermore, it used inner product encryption to hide the access policies. The scheme was only proven secure against selective adversaries.

With the goal of improving the computational efficiency and expressiveness, Zhang et al. ^[40] proposed a new policy-hiding CP-ABE scheme. In this approach, the authors used the efficient and expressive LSSS policies to design a policy-hiding ABE scheme with a large attribute universe. The attribute matching process required only two bilinear pairings and, thus, was efficient. Moreover, the scheme provided full security in the standard model.

In ^[41], Zhang et al. further improved their approach from ^[40] and proposed an extension of their scheme that, among other things, improved the efficiency by reducing decryption costs.

6.2. Further Comparison

The schemes ^{[38, 40, 41]} providedfull security as they were proven secure against adaptive adversaries, while the schemes ^{[37, 39]} provided only selective security. The schemes ^{[37, 39]} only supported a small attribute universe, while the two schemes ^{[40, 41]} supported a large attribute universe. Furthermore, both schemes had low decryption costs. They achieve efficient attribute matching since their computation costs were unaffected by the complexity of the access policy. Only the scheme ^[41] provided constant computation costs in the decryption process. In terms of expressiveness of access policies, the schemes ^[37–39] only used AND-gate access structures. The references ^{[37, 39]} also used wildcard attributes, while ^[39] additionally supported non-monotonic access structures with negative attributes. Only the schemes of ^{[40, 41]} supported the expressive LSSS policies. For applications requiring privacy-aware access control, for example, in mobile clouds, the scheme ^[41] can be recommended, considering its efficiency and full security features.

7.1. PRE and PU Schemes

Liang et al. ^[42] proposed the first proxy re-encryption CP-ABE scheme. If the DO is offline in this scheme, he delegated his capacities to a proxy in the data access control. In this CP-ABPRE scheme, a proxy was allowed to transform the access policies of ciphertexts. Similar to the technique explained above, he transformed one with one specified access policy into one with another access policy. The policy is only represented as AND-gates on positive and negative attributes. The scheme used proxy re-encryption to enable policy updating. CP-ABPRE was proven secure only against selective adversaries and had high computational costs as it demanded a high number of pairings.

Luo et al. ^[43] extended the previous scheme and introduced the re-encryption control. Here, the DO had the power to decide if the ciphertext could be re-encrypted or not. The scheme used AND-gates with multi-value and wildcard attributes in its access policy. Moreover, it also supported non-monotonic access structures. The scheme was proven selectively secure under the standard complexity assumption.

Liang et al. ^[44] used the technique of dual system encryption and proposed a more efficient and expressive CP-ABPRE scheme. The scheme was proven secure against adaptive adversaries in the standard model under composite-order groups. Therefore, it achieved full security.

In 2016, Yang et al. ^[45] suggested another CP-ABPRE scheme. This approach used tree-based access control and also implemented policy updating through proxy re-encryption. The scheme had attribute secret keys of constant size. Its security analysis used generic group models. The scheme also supported direct user revocation in addition to policy updating and PRE.

Zhang et al. ^[46] designed a so-called anonymous CP-ABPRE scheme. In this approach, the technique called "match-then-re-encrypt" was proposed. This technique helped the proxy to decide whether a ciphertext should be transformed without requiring the access policy. The scheme was proven selectively secure under the assumptions of DBDH, DLIN, and CBDH.

7.2. Further Comparison

The scheme ^[44] used LSSS for access policies. Therefore, even if composite-order groups were implemented in the concrete design, it was more expressive than the other schemes. The schemes ^{[42–44, 46]} were secure under the standard assumption. Only the scheme ^[45] had constant-size public keys. Therefore, it supported alarge attribute universe. Moreover, the scheme ^[45] was the only approach with constant decryption costs that were independent of the complexity of the access structures. For security-sensitive applications, we recommend the scheme ^[46]. In the case of applications that have constrained resources, we recommend an efficient scheme ^[45].

8.1. Indirect Revocation

Hur and Noh ^[47] proposed a tree-based CP-ABE solution with fine-grained indirect user and attribute revocation mechanisms. The key technique of this scheme for efficient revocation is a stateless group key distribution method based on binary trees. This made the revocation efficient. Both backward secrecy and forward secrecy were achieved under the BDH assumption. However, the authors provided only an informal security analysis, and the scheme was susceptible to collusion attacks.

Yang et al. ^[48] also used the LSSS access policy to present a similar CP-ABE scheme. It was proven secure under the q-type assumption in the ROM model. Updates were performed by a third-party server, and both indirect attribute and user revocation were enabled by this scheme based on this update mechanism.

Cui et al. ^[49] proposed a CP-ABE scheme that did not support AA revocation; thus, only users could be revoked in an indirect manner. Non-revoked users were able to exploit an untrusted server to transform ciphertexts.

Xu et al. ^[50] proposed an LSSS-based KP-ABE scheme supporting indirect user revocation. The revocation mechanism was realized with the help of a subset-cover framework. This scheme achieved forward secrecy only. Moreover, the scheme also provided attribute update mechanisms. Nevertheless, this scheme only achieved selective security, and the decryption costs are still high.

8.2. Direct Revocation

Yang et al. ^[51] proposed a CP-ABE approach that used trees for direct user revocation. To achieve that, the server kept a proxy decryption key list that was used for that. Every DO had to generate master and secret keys, together with the suitable corresponding system public parameters.

Fan et al. ^[52] presented another tree-based CP-ABE scheme with revocation. The scheme allowed dynamic membership management with arbitrary states. Moreover, this approach provided both direct attribute and direct user revocation. The system's public key was adaptively updated to achieve that.

In ^[53], Zhang et al. described a CP-ABE scheme for direct attribute and direct user revocation. The scheme was based on an auxiliary function presented by the authors. It was used to specify and update the ciphertexts for revocation. The length of ciphertexts in this scheme was both constant and small. However, it also had some downsides because it only supported the AND-gate policy and only provided selective security.

A revocable KP-ABE scheme was proposed by Lewko et al ^[54]. This scheme had short parameters and secret keys. In order to achieve better decryption efficiency, the costs depending on "parameter and secret key size" were transferred to the side of the ciphertext. In the scheme, direct user revocation was realized based on a new technique called "two equation". However, the proposed solution only provided selective security, and q-type assumptions were involved in the proofs. Additionally, the scheme did not support attribute revocation.

Shi et al. ^[55] presented another KP-ABE scheme with direct user revocation. The scheme provided verifiable ciphertext delegation. This enabled an untrusted third party to update ciphertexts without any delegated keys. Both backward secrecy and forward secrecy were achieved in the scheme. However, the scheme was based on multilinear pairings. This is impractical since the candidates of multilinear pairings are limited and the security is questionable. In addition to revocation, the scheme also provided attribute update mechanisms.

8.3. Further Comparison

In terms of access policies, the schemes ^{[48, 49]} supported expressive LSSS-based access structures. The schemes ^{[47, 51, 52]} usedtree-based access structures, while ^[53] only provided access structures with AND-gates. Both user and attribute revocation were realized in ^{[47, 48, 52, 53]}, while the remaining schemes ^{[49–51, 54, 55]} only provided user revocation. However, the schemes ^{[49, 51]} were very efficient in terms of user-side decryption costs since they outsourced extensive calculations to a server. The schemes ^{[47, 48]} realized indirect attribute revocation in addition to indirect user revocation, while ^{[52, 53]} realized both revocations directly. Only selective security was achieved in ^[53]. However, ^[52] was proven fully secure against adaptive adversaries in the standard models. Thus, the scheme ^[52] can be recommended in case full security and direct and fine-grained revocation are required. All schemes realize forward secrecy. However, only ^{[49, 51]} additionally provide backward secrecy (without re-keying).

9.1. Hierarchical Schemes

Wang et al. ^[56] suggested a hierarchical CP-ABE scheme aimed at enhancing the flexibility of delegation for any user to join the access control system. The scheme combined hierarchical identity-based encryption and CP-ABE. Additionally, it supported indirect user and attribute revocation. In the ROM model, it had selective security under the BDH assumption. However, this approach suffered from performance drawbacks since the decryption overhead, due to pairings, was linearly proportional to the complexity of the access policy.

Wan et al. ^[57] described a tree-based hierarchical CP-ABE scheme that supported direct user revocation. Furthermore, since the security analysis relied on that of the basic CP-ABE scheme by Bethencourt et al. ^[21], the scheme had formal security in the ROM with generic groups.

In ^[58], Deng et al. presented a hierarchical CP-ABE scheme in which the attributes were organized as a matrix. The scheme supports LSSS-based access policies and, hence, was more expressive than the other approaches mentioned before. Even though it was already fully secure in standard models, composite-order groups were used in the scheme design.

Wang et al. ^[59] proposed a hierarchical CP-ABE scheme that supported a large attribute universe and tree policies. However, it was only secure against selective adversaries.

Teng et al. ^[60] invented a hierarchical CP-ABE scheme with the goal of improving communication efficiency. It had ciphertexts of constant size and used a threshold-based access policy. The security analysis in standard models showedresistance to selective adversaries under q-type assumptions.

Li et al. ^[61] also designed a hierarchical CP-ABE scheme that provided resistance against side channel attacks. The scheme proved resilient to both master key leakage and secret key leakage under composite-order groups. The complexity of LSSS policies resulted in a larger computation overhead.

9.2. Further Comparison

Only the scheme ^[60] had ciphertexts of constant size. Additionally, the costs for encryption in this scheme were also constant and small. The schemes ^{[56, 57, 59]} all had public keys of constant size. Thus, they supported a large attribute universe. The two schemes ^{[58, 61]} used an LSSS-based access policy. Therefore, they were the most expressive schemes. Moreover, both of these schemes were secure against adaptive adversaries under standard models. In addition to the hierarchical feature, only the scheme ^[57] provided direct user revocation, and only the scheme ^[56] realized indirect user and attribute revocation. As a result, the scheme ^[60] is especially appropriate for applications with limited resources due to its efficiency in the decryption process and the low communication costs. In case additional revocation of both user and attributes is required, the scheme ^[56] can be recommended.

Authors' contributions

The primary contributions were made by Thomas Prantl and Timo Zeck, while the other authors supported the paper in different roles, facilitating its publication.

Availability of data and materials

Not applicable.

Financial support and sponsorship

This research has been funded by the Federal Ministry of Education and Research of Germany in the framework KMU-innovativ - Verbundprojekt: Secure Internet of Things Management Platform - SIMPL (project number 16KIS0852) ^[63].

Conflicts of interest

All authors declared that there are no conflicts of interest.

Ethical approval and consent to participate

Not applicable.

Consent for publication

Not applicable.

Copyright

© The Author(s) 2023.