在許多情況下，我們可能會希望把一些敏感的資料進行加密，並使得只有某些符合我們所設下之限制的人能夠解開。在這種情況之下，加密者無法確切知道誰能夠對此密文進行解密，加密者所唯一知道的資訊是怎麼樣的人能夠解開這份密文。
當然我們可以藉由將資料儲存在一台或是多台分散式伺服器並由其管理者來為我們處理這樣的問,但是我們如何能信任此伺服器的管理者？所以將資料以上述方式進行加密後，再進行後續的儲存或是發送等動作,以保證資料內容不被未授權之人士所取得，是比較合理的作法。
這樣的機制我們稱之為屬性加密。屬性加密必須要能確保使用者屬性的正確性，所以服務提供者必須要能夠讓使用者進行屬性變更的動作。除此之外，這樣的服務也可能成為一種付費服務，當它成為付費服務之後，對成員資格的控管就將變得相當重要，當某成員因為某些原因被取消資格之後，則此成員必須無法繼續享受服務提供者所提供的屬性加密服務,也就是,任何過期或是被吊銷的使用者私密金鑰將無法繼作用在經用屬性加密所產生之密文上以進行解密的工作。

Abstract
Attribute-Based Encryption (ABE) is a relatively new encryption technology which is
similar to multi-receiver encryption but the privacy of ciphertext receivers is protected
by a set of attributes such that no one, even the encryptor, knows the identities of the
receivers. Although the identities of those receivers remain unknown, the encryptor can
ensure that all of the receivers cannot decrypt the ciphertext except for those who
match the restrictions on predefined attribute values associated with the ciphertext.
However, maintaining the correctness of users’ attributes will take huge cost because
the interactions between all users and the key generation center (KGC) are required to
renew all of their private keys whenever a user joins, leaves the group, or updates the
value of any of his attributes. Since user joining, leaving, and attribute updating may
occur frequently in real situations, membership management will become a quite
important issue in an ABE system but no existing scheme can perfectly cope with this
problem. In this manuscript, we will present an ABE scheme which aims at the issue on
dynamic membership management. Our work keeps high flexibility of the constrains on
attributes and makes it possible for the procedures of user joining, leaving, and attribute
updating to be dynamic, that is, it is not necessary for those users who do not update
their attribute statuses to renew their private keys when some user changes his status.
Finally, we also formally prove the security of the proposed scheme.

1 Introduction 3
2 Preliminaries 6
2.1 Backgrounds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.1.1 Lagrange Interpolation . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.1.2 Bilinear Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.1.3 Access Structures . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.1.4 Key-Policy v.s. Ciphertext Policy . . . . . . . . . . . . . . . . . . . 7
2.1.5 Hard Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.2 Security Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
3 Related Works 13
3.1 Boneh-Franklin IBE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
3.1.1 BasicIdent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
3.1.2 FullIdent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
3.2 Sahai-Waters Fuzzy IBE . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.3 Baek-Susilo-Zhou Fuzzy IBE . . . . . . . . . . . . . . . . . . . . . . . . . . 17
3.4 Goyal-Pandey-Sahai-Waters ABE . . . . . . . . . . . . . . . . . . . . . . . 18
3.5 Bethencourt-Sahai-Waters CP-ABE . . . . . . . . . . . . . . . . . . . . . . 21
4 Our Construction 24
4.1 The Proposed Scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
5 Security Proof 30
5.1 CPA Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
5.2 CCA Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
5.3 Dynamic Membership . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
6 Comparisons 64
6.1 Performance and Functionality . . . . . . . . . . . . . . . . . . . . . . . . . 64
6.2 Size of Ciphertext . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
7 Conclusions 68
Bibliography 69

[1] J. Baek, W. Susilo, and J. Zhou, “New Constructions of Fuzzy Identity-Based
Encryption,” Proceedings of the 2nd ACM symposium on Information, computer
and communications security, pp. 368-370, 2007.
[2] F. Bao, R.H. Deng, and F.H. Zhu, “Variations of Diffie-Hellman Problem,”
Information and Communications Security, LNCS 2836, pp. 301-312, 2003.
[3] A. Beimel and M. Franklin, “Weakly-Private Secret Sharing Schemes,” Theory
of Cryptography, LNCS 4392, pp. 253-272, 2007.
[4] J. Bethencourt, A. Sahai, and B. Waters, “Ciphertext-Policy Attribute-Based
Encryption,” Proceedings of the 2007 IEEE Symposium on Security and Privacy,
pp. 321-334, 2007.
[5] D. Boneh and M. Franklin, “Identity-Based Encryption from the Weil Pairing,”
Crypto 2001, LNCS 2139, pp. 213-229, 2001.
[6] A. Branden and E. W. Weisstein, “Lagrange Interpolating Polynomial,”
MathWorld–A Wolfram Web Resource, http://mathworld.wolfram.com
[7] Y. Dodis and R. Yampolskiy, “A verifiable random function with short proofs
and keys,” Public Key Cryptography - PKC 2005, LNCS 3386, pp. 416-431,
2005.
[8] E. Fujisaki and T. Okamoto, “Secure integration of asymmetric and symmetric
encryption schemes,” Proceedings of the 19th Annual International Cryptology
Conference on Advances in Cryptology, LNCS1666, pp. 537-554, 1999.
[9] V. Goyal, O. Pandey, A. Sahai, and B. Waters, “Attribute-based encryption
for fine-grained access control of encrypted data,” Proceedings of the 13th
ACM conference on Computer and communications security, pp. 89-98, 2006.
[10] A. Sahai and B. Waters, “Fuzzy Identity-Based Encryption,” Advances in
Cryptology - EUROCRYPT, LNCS 3494, pp. 457-473, 2005.
[11] A. Shamir, “How to share a secret,” Communications of the ACM, Volume
22, Issue 11, pp. 612-613, 1979.