在屬性加密機制中，有別於植基於身份之加密機制，發送方並非選擇特定加密對象，而是選擇特定的屬性集合作為密文的條件，只要該接收方的屬性和密文上的屬性條件吻合，便能解密成功以獲得正確的資訊。在任何加密系統中，對於使用者權限控管是必要的，然而由於屬性集合並不能辨別出特定的使用者，如此在屬性加密系統中，要達到對使用者權限的廢止是不容易的，在屬性加密上達到動態的成員管理仍是重要的議題。另一方面, 線性秘密分享機制（LSSS）是一個實現存取控制的結構以及更為通用並且不失效率的方法。而我們發現在大多已發表的研究當中，在整體結構建置上，屬性存取結構上並沒有將門檻值的情況納入考量，如此所能運用之存取結構相當有限。
有鑑於此，我們提出了一個具備動態成員管理之密文政策屬性加密機制。我們同時考慮了屬性存取結構上的門檻值情況並且較傳統植基於樹狀結構之屬性加密機制更為優秀。同時，我們也使用正規的安全模型，證明了該機制之安全性。

Attribute-based encryption (ABE) is an access control mechanism where a sender can encrypt a secret message according to an attribute set for multiple receivers. In such a system, it is a challenge to achieve the revocation efficiently on a specific user since different users may share common attributes. Thus dynamic membership is a necessary issue to discuss. On the other hand, linear secret sharing scheme (LSSS) acts a more general method used to realize monotone access structures in ABE. Compared to the traditional tree-based access structures, LSSS represents more general access policies while keeping high efficiency. However, most literatures about LSSS-based ABE do not state the situation about threshold on the access structure, and it lowers the variety of access policies. In this thesis, we present an efficient attribute-based encryption scheme with dynamic membership by using LSSS. Our scheme can implement threshold gates in the access structure. Our scheme is more efficient as compared with other revocable ABE schemes. Moreover, the proposed scheme achieves CCA security under the DBDH assumption in the standard model.

論文審定書i
Acknowledgments iv
摘要v
Abstract vi
List of Figures x
List of Tables xi
Chapter 1 Introduction 1
1.1 Contributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.2 Organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Chapter 2 Preliminaries 4
2.1 Bilinear Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
2.2 The Decisional Bilinear Diffie-Hellman (DBDH) Assumption . . . . . . . . . . 4
2.3 Access Structures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2.4 Linear Secret Sharing Schemes . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2.5 Lagrange Interpolation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.6 Ciphertext-Policy Attribute-based Encryption with Dynamic Membership . . . 6
2.7 The Insertion of Access Structure . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.8 LSSS with Threshold-gate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Chapter 3 Related Works 13
3.1 Bethencourt et al.’s CP-ABE [6] . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
3.2 Fan et al.’s scheme [12] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.2.1 Review of Fan et al.’s Scheme . . . . . . . . . . . . . . . . . . . . . . . . 16
3.2.2 Cryptanalysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
3.2.3 Improvement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
3.3 Attrapadung et al.’s scheme [3] . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
3.4 Hur’s scheme [16] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
3.5 Yang et al.’s scheme [32] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Chapter 4 Our Construction 35
4.1 The proposed scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
4.1.1 Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
4.1.2 Enrollment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
4.1.3 Leaving . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
4.1.4 Updating . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
4.1.5 Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
4.1.6 Decryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
4.2 Dynamic Membership . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Chapter 5 Security Proof 41
5.1 Security Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
5.2 Security Proof . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Chapter 6 Comparison 47
6.1 Properties Comparison . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
6.2 Analysis on Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
6.2.1 Attrapadung et al.’s Scheme [3] . . . . . . . . . . . . . . . . . . . . . . . 51
6.2.2 Fan et al.’s Scheme [12] . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
6.2.3 Hur’s Scheme [16] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
6.2.4 Yang et al.’s Scheme [32] . . . . . . . . . . . . . . . . . . . . . . . . . . 53
6.2.5 Our Scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Chapter 7 Conclusion 54
Bibliography 55
Appendix A Example 59

[1] B. Archer and E. W. Weisstein. Lagrange interpolating polynomial. MathWorld–A Wolfram
Web Resource, http://mathworld.wolfram.com.
[2] N. Attrapadung and H. Imai. Attribute-based encryption supporting direct/indirect revocation
modes. In Proceedings of the 12th IMA International Conference on Cryptography
and Coding, Cryptography and Coding ’09, pages 278–300, 2009.
[3] N. Attrapadung and H. Imai. Conjunctive broadcast and attribute-based encryption. In
Pairing, Lecture Notes in Computer Science, pages 248–265, 2009.
[4] A. Beimel. Secure schemes for secret sharing and key distribution. PhD thesis, Israel
Institute of Technology, Technion, Haifa, Israel, 1996.
[5] M. Belenkiy, J. Camenisch, M. Chase, M. Kohlweiss, A. Lysyanskaya, and H. Shacham.
Randomizable proofs and delegatable anonymous credentials. In Advances in Cryptology-
CRYPTO 2009, pages 108–125. Springer, 2009.
[6] J. Bethencournt, A. Sahai, and B. Waters. Ciphertext-policy attribute-based encryption.
In Proceedings of the 2007 IEEE Symposium on Security and Privacy, SP ’07, pages
321–334, 2007.
[7] A. Boldyreva, V. Goyal, and V. Kumar. Identity-based encryption with efficient revocation.
In Proceedings of the 15th ACM conference on Computer and communications
security, pages 417–426, 2008.
[8] D. Boneh and M. Franklin. Identity-based encryption from the Weil pairing. In Proceedgins
of Advances in Cryptology CRYPTO 2001, pages 213–229, 2001.
[9] M. Chase and S.S.M Chow. Improving privacy and security in multi-authority attributebased
encryption. In Proceedings of the 16th ACM conference on Computer and communications
security, pages 121–130, 2009.
[10] L. Cheung and C. Newport. Provably secure ciphertext policy abe. In Proceedings of the
14th ACM conference on Computer and communications security, pages 456–465. ACM,
2007.
[11] S.S.M Chow. Removing escrow from identity-based encryption. In Public Key
Cryptography–PKC 2009, pages 256–276. Springer, 2009.
[12] C.-I. Fan, V. S.-M. Huang, and H.-M. Rung. Arbitrary-state attribute-based encryption
with dynamic membership. IEEE Transactions on Computers, pages 553–561, 2014.
[13] C.-I. Fan, C.-N. Wu, C.-H. Chen, Y.-F. Tseng, and C.-C. Feng. Attribute-based proxy reencryption
with dynamic membership. In Proceedings of the 10th Asia Joint Conference
on Information Security (AsiaJCIS 2015), pages 26–32, Kaohsiung, Taiwan, 2015.
[14] V. Goyal, A. Jain, O. Pandey, and A. Sahai. Bounded ciphertext policy attribute based
encryption. In Automata, languages and programming, pages 579–591. Springer, 2008.
[15] V. Goyal, O.Pandey, A. Sahai, and B. Waters. Attribute-based encryption for fine-grained
access control of encrypted data. In Proceedings of the 13th ACM Conference on Computer
and Communications Security, CCS ’06, pages 89–98, 2006.
[16] J. Hur. Improving security and efficiency in attribute-based data sharing. Knowledge and
Data Engineering, IEEE Transactions on, 25:2271–2282, 2013.
[17] L. Ibraimi, M. Petkovic, S. Nikova, P. Hartel, and W. Jonker. Mediated ciphertext-policy
attribute-based encryption and its application. In Information security applications, pages
309–323. Springer, 2009.
[18] N. Koblitz, A. Menezes, and S. Vanstone. The state of elliptic curve cryptography. Designs,
Codes and Cryptography, 19:173–193, 2000.
[19] A. Lewko and B. Waters. Decentralizing attribute-based encryption. In Proceedings of
the 30th Annual International Conference on Theory and Applications of Cryptographic
Techniques: Advances in Cryptology, EUROCRYPT’11, pages 568–588, 2011.
[20] X. Liang, Z. Cao, H. Lin, and D. Xing. Provably secure and efficient bounded ciphertext
policy attribute based encryption. In Proceedings of the 4th International Symposium on
Information, Computer, and Communications Security, pages 343–352. ACM, 2009.
[21] Z. Liu, Z. Cao, and D. S. Wong. Efficient generation of linear secret sharing scheme
matrices from threshold access trees. Cryptology ePrint Archive, Report 2010/374, 2010.
http://eprint.iacr.org/.
[22] A. J. Menezes, S. A. Vanstone, and P. C. V. Oorschot. Handbook of Applied Cryptography.
CRC Press, Inc. Boca Raton, 2001.
[23] S. Müller, S. Katzenbeisser, and C. Eckert. On multi-authority ciphertext-policy attributebased
encryption. Bulletion of the Korean Mathematical Society, 46, 2009.
[24] V. Nikov and S. Nikova. New monotone span programs from old. IACR Cryptology ePrint
Archive, 2004:282, 2004.
[25] R. Ostrovsky, A. Sahai, and B. Waters. Attribute-based encryption with non-monotonic
access structures. In Proceedings of the 14th ACM conference on Computer and communications
security, pages 195–203. ACM, 2007.
[26] Y. Rouselakis and B. Waters. New constructions and proof methods for large universe
attribute-based encryption. IACR Cryptology ePrint Archive, 2012:583, 2012.
[27] A. Sahai and B. Waters. Fuzzy identity-based encryption. In Proceedings of the 24th Annual
International Conference on Theory and Applications of Cryptographic Techniques,
EUROCRYPT’05, pages 457–473, 2005.
[28] M. Scott. Implementing cryptographic pairings. In Proceedings of the Pairing-Based
Cryptography, pages 177–196, 2007.
[29] A. Shamir. How to share a secret. Commun. ACM, 22:612–613, 1979.
[30] Y. Shi, Q. Zheng, J. Liu, and Z. Han. Directly revocable key-policy attribute-based encryption
with verifiable ciphertext delegation. Inf. Sci., 295:221–231, 2015.
[31] B. Waters. Ciphertext-policy attribute-based encryption: An expressive, efficient, and
provably secure realization. In Public Key Cryptography, Lecture Notes in Computer
Science, pages 53–70, 2011.
[32] K. Yang, X. Jia, and K. Ren. Attribute-based fine-grained access control with efficient
revocation in cloud storage systems. In Proceedings of the 8th ACM SIGSAC symposium
on Information, computer and communications security, pages 523–528, 2013.
[33] S. Yu, K. Ren, and W. Lou. Fdac: Toward fine-grained distributed data access control
in wireless sensor networks. Parallel and Distributed Systems, IEEE Transactions on,
22:673–686, 2011.
[34] S. Yu, C. Wang, K. Ren, and W. Lou. Attribute based data sharing with attribute revocation.
In Proceedings of the 5th ACM Symposium on Information, Computer and
Communications Security, pages 261–270, 2010.
[35] F. Zhang, Q. Li, and H. Xiong. Efficient revocable key-policy attribute based encryption
with full security. In CIS, pages 477–481, 2012.
[36] Y. Zhang, W. Liu, W. Lou, and Y. Fang. Securing mobile ad hoc networks with certificateless
public keys. IEEE Transactions on Dependable and Secure Computing, 3:386 –
399, 2006.