A secure anti collusion data sharing scheme for dynamic groups in the cloud

1045-9219 (c) 2013 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See
http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/TPDS.2015.2388446, IEEE Transactions on Parallel and Distributed Systems
1
A Secure Anti-Collusion Data Sharing Scheme for
Dynamic Groups in the Cloud
Zhongma Zhu
School of Information Science and
Engineering
Southeast University
Nanjing, China
zhuzhongma@163.com
Rui Jiang (Corresponding author)
School of Information Science and
Engineering
Southeast University
Nanjing, China
R.Jiang@seu.edu.cn
Abstract: Benefited from cloud computing, users can achieve an effective and
economical approach for data sharing among group members in the cloud with the
characters of low maintenance and little management cost. Meanwhile, we must
provide security guarantees for the sharing data files since they are outsourced.
Unfortunately, because of the frequent change of the membership, sharing data while
providing privacy-preserving is still a challenging issue, especially for an untrusted
cloud due to the collusion attack. Moreover, for existing schemes, the security of key
distribution is based on the secure communication channel, however, to have such
channel is a strong assumption and is difficult for practice. In this paper, we propose a
secure data sharing scheme for dynamic members. Firstly, we propose a secure way
for key distribution without any secure communication channels, and the users can
securely obtain their private keys from group manager. Secondly, our scheme can
achieve fine-grained access control, any user in the group can use the source in the
cloud and revoked users cannot access the cloud again after they are revoked. Thirdly,
we can protect the scheme from collusion attack, which means that revoked users
cannot get the original data file even if they conspire with the untrusted cloud. In our
approach, by leveraging polynomial function, we can achieve a secure user revocation
scheme. Finally, our scheme can achieve fine efficiency, which means previous users
need not to update their private keys for the situation either a new user joins in the
group or a user is revoked from the group.

2
Key words: Access control, Privacy-preserving, Key distribution, Cloud computing
1 INTRODUCTION
Cloud computing, with the characteristics of intrinsic data sharing and low
maintenance, provides a better utilization of resources. In cloud computing, cloud
service providers offer an abstraction of infinite storage space for clients to host data
[1]. It can help clients reduce their financial overhead of data managements by
migrating the local managements system into cloud servers.
However, security concerns become the main constraint as we now outsource the
storage of data, which is possibly sensitive, to cloud providers. To preserve data
privacy, a common approach is to encrypt data files before the clients upload the
encrypted data into the cloud [2]. Unfortunately, it is difficult to design a secure and
efficient data sharing scheme, especially for dynamic groups in the cloud.
Kallahalla et al [3] presented a cryptographic storage system that enables secure
data sharing on untrustworthy servers based on the techniques that dividing files into
filegroups and encrypting each file_group with a file-block key. However, the
file-block keys need to be updated and distributed for a user revocation, therefore, the
system had a heavy key distribution overhead. Other schemes for data sharing on
untrusted servers have been proposed in [4],[5]. However, the complexities of user
participation and revocation in these schemes are linearly increasing with the number
of data owners and the revoked users.
Yu et al [6] exploited and combined techniques of key policy attribute-based
encryption [7], proxy re-encryption and lazy re-encryption to achieve fine-grained
data access control without disclosing data contents. However, the single-owner
manner may hinder the implementation of applications, where any member in the
group can use the cloud service to store and share data files with others.
Lu et al [8] proposed a secure provenance scheme by leveraging group signatures
and ciphertext-policy attribute-based encryption techniques [9]. Each user obtains two
keys after the registration while the attribute key is used to decrypt the data which is

3
encrypted by the attribute-based encryption and the group signature key is used for
privacy-preserving and traceability. However, the revocation is not supported in this
scheme.
Liu et al [10] presented a secure multi-owner data sharing scheme, named Mona.
It is claimed that the scheme can achieve fine-grained access control and revoked
users will not be able to access the sharing data again once they are revoked. However,
the scheme will easily suffer from the collusion attack by the revoked user and the
cloud [13]. The revoked user can use his private key to decrypt the encrypted data file
and get the secret data after his revocation by conspiring with the cloud. In the phase
of file access, first of all, the revoked user sends his request to the cloud, then the
cloud responds the corresponding encrypted data file and revocation list to the
revoked user without verifications. Next, the revoked user can compute the decryption
key with the help of the attack algorithm. Finally, this attack can lead to the revoked
users getting the sharing data and disclosing other secrets of legitimate members.
Zhou et al [14] presented a secure access control scheme on encrypted data in
cloud storage by invoking role-based encryption technique. It is claimed that the
scheme can achieve efficient user revocation that combines role-based access control
policies with encryption to secure large data storage in the cloud. Unfortunately, the
verifications between entities are not concerned, the scheme easily suffer from attacks,
for example, collusion attack. Finally, this attack can lead to disclosing sensitive data
files.
Zou et al. [15] presented a practical and flexible key management mechanism for
trusted collaborative computing. By leveraging access control polynomial, it is
designed to achieve efficient access control for dynamic groups. Unfortunately, the
secure way for sharing the personal permanent portable secret between the user and
the server is not supported and the private key will be disclosed once the personal
permanent portable secret is obtained by the attackers.
Nabeel et al. [16] proposed a privacy preserving policy-based content sharing
scheme in public clouds. However, this scheme is not secure because of the weak

4
protection of commitment in the phase of identity token issuance.
In this paper, we propose a secure data sharing scheme, which can achieve secure
key distribution and data sharing for dynamic group. The main contributions of our
scheme include:
1. We provide a secure way for key distribution without any secure
communication channels. The users can securely obtain their private keys
from group manager without any Certificate Authorities due to the
verification for the public key of the user.
2. Our scheme can achieve fine-grained access control, with the help of the
group user list, any user in the group can use the source in the cloud and
revoked users cannot access the cloud again after they are revoked.
3. We propose a secure data sharing scheme which can be protected from
collusion attack. The revoked users can not be able to get the original
data files once they are revoked even if they conspire with the untrusted
cloud. Our scheme can achieve secure user revocation with the help of
polynomial function.
4. Our scheme is able to support dynamic groups efficiently, when a new
user joins in the group or a user is revoked from the group, the private
keys of the other users do not need to be recomputed and updated.
5. We provide security analysis to prove the security of our scheme. In
addition, we also perform simulations to demonstrate the efficiency of
our scheme.
The remainder of the paper proceeds as follows. In section 2, we describe the
system model and our design goals. Our proposed scheme is presented in detail in
section 3, followed by the security analysis and performance evaluation in section 4
and 5, respectively. Finally, the conclusion is made in section 6.

5
2 THREAT MODEL, SYSTEM MODEL AND DESIGN GOALS
2.1 Threat Model
As the threat model, in this paper, we propose our scheme based on the
Dolev-Yao model [17], in which the adversary can overhear, intercept, and synthesis
any message at the communication channels. With the Dolev-Yao model, the only
way to protect the information from attacking by the passive eavesdroppers and active
saboteurs is to design the effective security protocols. This means there is not any
secure communication channels between the communication entities. Therefore, this
kind of threaten model can be more effective and practical to demonstrate the
communication in the real world.
2.2 System Model
Cloud
Group Manager Group Members
Registration
Key distribution
Data file Data file
Figure 1 System model
As illustrated in figure 1, the system model consists of three different entities: the
cloud, a group manager and a large number of group members.
The cloud, maintained by the cloud service providers, provides storage space for
hosting data files in a pay-as-you-go manner. However, the cloud is untrusted since
the cloud service providers are easily to become untrusted. Therefore, the cloud will
try to learn the content of the stored data.
Group manager takes charge of system parameters generation, user registration,

6
and user revocation. In the practical applications, the group manager usually is the
leader of the group. Therefore, we assume that the group manager is fully trusted by
the other parties.
Group members (users) are a set of registered users that will store their own data
into the cloud and share them with others. In the scheme, the group membership is
dynamically changed, due to the new user registration and user revocation.
2.3 Design Goals
We describe the main design goals of the proposed scheme including key
distribution, data confidentiality, access control and efficiency as follows:
Key Distribution: The requirement of key distribution is that users can securely
obtain their private keys from the group manager without any Certificate Authorities.
In other existing schemes, this goal is achieved by assuming that the communication
channel is secure, however, in our scheme, we can achieve it without this strong
assumption.
Access control: First, group members are able to use the cloud resource for data
storage and data sharing. Second, unauthorized users cannot access the cloud resource
at any time, and revoked users will be incapable of using the cloud resource again
once they are revoked.
Data confidentiality: Data confidentiality requires that unauthorized users
including the cloud are incapable of learning the content of the stored data. To
maintain the availability of data confidentiality for dynamic groups is still an
important and challenging issue. Specifically, revoked users are unable to decrypt the
stored data file after the revocation.
Efficiency: Any group member can store and share data files with others in the
group by the cloud. User revocation can be achieved without involving the others,
which means that the remaining users do not need to update their private keys.

7
3 THE PROPOSED SCHEME
3.1 Preliminaries
3.1.1 Bilinear Maps
Let 1G and 2G be additive cyclic groups of the same prime order q [18]. Let
1 1 2:e G G G  denote a bilinear map constructed with the following properties:
1. Bilinear: For all *
, qa b Z and    1, , , , .
ab
P Q G e aP bQ e P Q 
2. Nondegenerate: There exists a point Q such that  , 1.e Q Q 
3. Computable: There is an efficient algorithm to compute  ,e P Q for any
1, .P Q G
3.1.2 Complexity Assumptions
Definition 1 (Basic Diffie-Hellman Problem (BDHP) Assumption [19]). Given base
point P and a value *
,qZ  it is easy to compute .P  However, given , ,P P  it
is infeasible to compute  because of the discrete logarithm problem.
Definition 2 (Decisional Diffie-Hellman Problem (DDHP) Assumption[20]). Similar
to definition 1, given base point P and  , ,aP a b P it is infeasible to compute P.b
Definition 3 (Weak Bilinear Diffie-Hellman Exponent (WBDHE) Assumption[21]).
For unknown *
,qa Z given 2
1, , ,..., , ,l
Y aY a Y a Y P G it is infeasible to compute
 
1
, .ae Y P
3.1.3 Notations
Each user has a pair of keys  , ,pk sk which is used in the asymmetric
encryption algorithm, and pk needs to be negotiated with the group manager on the
condition that no Certificate Authorities and security channels are involved in. KEY
is the private key of the user and is used for data sharing in the scheme. UL is the
group user list which records part of the private keys of the legal group users. DL is
the data list which records the identity of the sharing data and the time that they are
updated. The description of notation used in our scheme is illustrated in figure 2.

8
iID the identity of user i
Notation Description
pk
the public key of the user that needs to
be negociated with the group manager
sk the corresponding private key to pk
 , ,i i ix A BKEY  the private key which is distributed to the user from
the group manager and used for data sharing
 kEnc gsymmetric encryption al orithm
used the encryption key k
 kAENC gasymmetric encryption al orithm
used the encryption key k
UL group user list
DL data list
idataID ithe identity of data
Figure 2 Notation used in our scheme description
3.2 Scheme Description
The scheme of our scheme includes system initialization, user registration for
existing user, file upload, user revocation, registration for new user and file download.
3.2.1 System Initialization
The group manager takes charge of this operation. He generates a bilinear map
group system   1 2, , , , ,S q G G e   then selects two random elements 1,P G G and a
number *
,qZ  then computes ,W P  Y G  and  , .Z e G P At last, the
group manager publishes the parameters   1, , , , , , , ,S P W Y Z f f Enc where f is hash
function:  
* *
0,1 ,qZ 1f is hash function:  
*
10,1 ,G and  Enc is a symmetric
encryption algorithm. Besides, the group manager will keep the parameters  ,G as
the secret master key.
3.2.2 Registration for Existing User
As illustrated in Figure 3, this operation is performed by user, the group manager

9
and the cloud.
Group managerUser
1, ,ac,iID pk v
,U R
 2 1, , , ,i sk iID v AENC ID v ac
 2,pkAENC KEY v
Cloud
    
?
|| || , , .iR e v f pk ac ID P W e U P   
 Group User List UL
     
?
1, ,e W f UL e P sig UL
Figure 3 Registration for existing user
First of all, the user sends 1, ,iID pk v as a request to the group manager, where
iID is the identity of the user, pk is the public key used in the asymmetric
encryption algorithm, such as ECC, ac is the account user used to pay for the
registration, which is related to the identity of the user, and *
1 qv Z is a random
number selected by the user.
On receiving the request, the group manager then chooses a random number
*
qr Z and computes  , ,
r
R e P P   1 || || .i
U r v f pk ac ID P     At last, the
group manager sends ,U R to the user for verification.
Then the verification is performed by user through checking the equation
    
?
1 || || , , .i
R e v f pk ac ID P W e U P    The user sends the message
 2 1, , , ,i sk iID v AENC ID v ac to the group manager after successful verification, where
*
2 qv Z is a random number,  AENC is a asymmetric encryption algorithm, such
as ECC, and sk is the corresponding private key to the public key pk used in the
asymmetric encryption algorithm.
The group manager compares the received iID message with the identity iID
computed by decrypting  1, , .sk iAENC ID v ac In addition, the group manager verifies if
the decrypted number 1v is equal to the random number 1v in the first step. After
successful verifications, the group manager generates the message KEY as follows
when the iID message matches the identity in the first step:
The group manager selects a random number *
i qx Z and computes the following

10
equations：
 
1
1
1
i
i
i
i
i
i i
A P G
x
x
B G G
x
V f B



   


  

 


(1)
 , ,i i ix A B constructs the message .KEY
The group manager then sends the encrypted message  2,pkAENC KEY v to user
and stores  , , ,i i i ix A V ID in the local storage space. In addition, the group manager
adds  ,i iA x to the group user list UL, which is illustrated in Table 1. To guarantee
the freshness of the group user list, the group manager adds a time stamp ult to it.
Then the group manager signs his signature    1sig UL f UL and sends the group
user list to the cloud. The cloud verifies the signature by checking the equation
     
?
1, ,e W f UL e P sig UL and stores the group user list, which is only available for
the cloud, in the cloud after successful verification.
Finally, the user decrypts the message  2,pkAENC KEY v by his private key in ECC
and then he can obtain his private key  , , .i i ix A B After successful registration, the
user becomes a group member.
Table 1 Group user list
groupID 1A 1x
2A 2x
rA rx ult  sig UL
 
3.2.3 File Upload
The operation of file upload is performed as illustrated in Figure 4.
First of all, the group member chooses a unique data file identity dataID and a
random number *
,qk Z then computes these parameters as the following equation:

11
 
1 1
2 1
2
k
K
C k Y G
C k P G
K Z G
C Enc M
  
   

 
 
(2)
Then the group member encrypts  1 2, , , ,data dataID C C C t with his private key ,iB
where datat is the real time stamp. At last, the group member sends
 1 2
, , , ,i
B data dataEnc ID C C C t to the group manager.
Group manager
Cloud
 0,...,r mEK K W W 
 1 2, ,
rK
CE C C C
Group member
 
1 1
2 1
2
k
K
C k Y G
C k P G
K Z G
C Enc M
  
  
 

 1 2, , , ,iB data dataEnc ID C C C t
 data list DL
  , , , , ,group data data DFDF ID ID CE EK t 
Figure 4 File upload
After getting this message  1 2
, , , , ,i
B data dataEnc ID C C C t the group manager decrypts
it and gets  1 2, , , ,dataID C C C then the group manager checks the legal group members
in his local storage space and if iB is the private key of a legal user, then the group
manager constructs the polynomial function      1 0 modm m i
p j j i if x x V a x q    
and the exponential function    0
0 ,..., ,..., .ma a
mW W G G After that, the group manager
selects a random re-encryption key rK and constructs  0 ,..., .r mEK K W W  Finally,
the group manager encrypts cipher-text  1 2, ,
rK
CE C C C with the re-encryption key
and sends   , , , , ,group data data DFDF ID ID CE EK t  to the cloud, where datat is the time
that the data file is uploaded and  1DF f DF  is the signature of the group
manager for the data file.
In addition, the group manager also sends the data list to the cloud in order to let
the users verify the freshness of the data file. As illustrated in Table 2, the group
manager adds  ,data dataID t and the current time DLt to the data list DL. To guarantee
that both users can obtain the latest version of data file and the cloud can update the
data file, the group manager updates the data list everyday. At last, the group manager

12
adds his signature    1sig DL f DL to the data list and sends the data list to the
cloud for storage.
Table 2 Data list
groupID 1dataID 1datat
2dataID 2datat
rdataID rdatat DLt  sig DL
 
Finally, on receiving the message, the cloud verifies the identity of the group
manager by checking the equation     
?
1, , DFe W f DF e P  and stores the message
after successful verification.
3.2.4 User Revocation
User revocation is performed by the group manager and the cloud, which is
illustrated in figure 5.
Group manager Cloud
  '
, , , , ,group data data DFDF ID ID CE EK t 
 '
0 1,..., .r mEK K W W  
  '1 2, ,
rK
CE C C C
Figure 5 User revocation
When a user i with identity iID is revoked, the group manager performs the
following operations:
1. Removing user i from the group user list in the local storage space and
updating the group user list which is stored in the cloud.
2. Checking the new group user list, suppose that there are m legal group
members in the list. According to the list, group manager then constructs
the new polynomial function      ' 1
1 0 modm m j
p j j j j
j i
f x x V a x q
 

    and
the new exponential function    0 1
0 1,..., ,..., ,ma a
mW W G G 
  where 1.G G
3. Selecting a new random re-encryption key '
rK and constructing

13
 '
0 1,..., .r mEK K W W  
4. Computing cipher-text   '1 2, ,
rK
CE C C C with the new re-encryption key
'
.rK
5. Signing his signature ( )DF to the modified message
 '
, , , , ,group data data
DF ID ID CE EK t where '
data
t is the time stamp.
6. Sending the message   '
, , , , ,group data data DFDF ID ID CE EK t  to the cloud.
Having received the modified message, first of all, the cloud verifies the signature
by checking the equation     
?
1, , .DFe W f DF e P  After successful verification, the
cloud The cloud replaces the old data file with the new data file.
In addition, the group manager updates all the time stamp '
datat of the data files in
the group for the data list. Then the group manager sends the new data list to the cloud
for storage. Finally, the cloud updates the data list.
3.2.5 Registration for New User
For the registration of a new user with its identity 1m
ID 
, the group manager
performs the same operations as registration for existing user, which is illustrated in
section 3.2.2.
In addition, the group manager updates the data files stored in the cloud. First of all,
the group manager checks the rest of the legal users, then he constructs the new
polynomial function      1 1
1 0 modm m j
p j j j jf x x V a x q 
     and the new
exponential function    0 1
0 1,..., ,..., .ma a
mW W G G 
  After that, the group manager
selects a new random re-encryption key ''
rK and constructs  ''
0 1,..., .r mEK K W W  
Finally, the group manager encrypts cipher-text   ''1 2, ,
rK
CE C C C with the new
re-encryption key and sends   ''
, , , , ,group data data DFDF ID ID CE EK t  to the cloud.
At last, the group manager updates all the time stamp ''
datat of the data files in the
group for the data list. Then the group manager sends the new data list to the cloud for
storage.
3.2.6 File Download
This operation is performed by the group member and the cloud, as illustrated in
figure 6, the group member encrypts dataID with his key iA and sends

14
, , ( )igroup i A dataID ID Enc ID as a request to the cloud. On receiving the message, the
cloud decrypts it and compares the encryption key iA with keys in the group user list,
if the encryption key iA is in the list, the cloud then sends the corresponding data file
  , , , , ,group data data DFDF ID ID CE EK t  and the data list to the group member.
Having received the message sent by the cloud, the group member verifies the
validity of the data file and the list by checking the equation     
?
1, , DFe W f DF e P 
and     
?
1, , ( ) .e W f DL e P sig DL Then the group member checks if the time stamp
stored in the DF and the data list is the same. Finally, the group member starts to
decrypt the data file after successful verification.
Cloud
 , , , , , ,group data dataID ID CE EK t DL
Group member
, , ( )igroup i A dataID ID Enc ID
Check UL
    
?
1, , DFe W f DF e P 
    
?
1, , ( ) .e W f DL e P sig DL
Figure 6 file download
In order to decrypt the original data, the group member needs to perform two
decryptions. For the decryption of the re-encryption, the group member computes
 i iV f B with his private key, then he computes the re-encryption key
   
0 1 .
j
i p i
V f Vm
r j j r rK W W K G K     Finally, the group member decrypts CE and gets
 1 2, , .C C C For the decryption of the first encryption, the group member computes
   
^
1 2, , ,K e C A e C B and the member can decrypt the correct ciphertext due to the
following equation:
   
   
^
1 2, ,
1
, ,
, ,
.
k kx
x x
k
K e C A e C B
x
e k Y P e k P G
x x
e G P e P G
Z K

 
 
 

   
       
    

 
(3)
Finally, the group member can decrypt the encrypted data C and get the original

15
data file M by leveraging the encryption key
^
.K
4 SECURITY ANALYSIS
In this section, we prove the security of our scheme in terms of key distribution,
access control and data confidentiality.
4.1 Key Distribution
Theorem 1. In our scheme, the communication entities can securely negotiate the
public key pk and distribute the private key  , ,i i iKEY x A B to users without any
Certificate Authorities and secure communication channels.
Proof. As illustrated in Figure 3, in the phase of user registration, the user sends his
public key pk and a random number *
1 qv Z to the group manager with his
identity iID . Then the group manager computes corresponding value , .U R
Moreover, the user can verify the identity of the group manager by the equation
    
?
1
|| || , , .i
R e v f pk ac ID P W e U P    The pk becomes the negotiated public key
after successful verification equation. Then the group manager can securely distribute
the private key ,KEY which is used for data sharing, to users with the help of
negotiated public key and without any Certificate Authorities and secure
communication channels. The correctness of the above verification equation is
elaborated in equation (4).
       
    
    
     
   
   
 
1
1
1 1
1
1
|| ||
|| ||
1
|| || , , || || ,
, || || ,
, || || ,
, ,
,
|| || ,
,
i
i
r
i i
r
i
r
i
r v f pk ac ID
r v f pk ac ID
i
R e v f pk ac ID P W e P P e v f pk ac ID P W
e P P e v f pk ac ID P P
e P P e v f pk ac ID P P
e P P e P P
e P P
e r v f pk ac ID P P
e U P





 
  
      
   
    
 

   

(4)
If an attacker wants to pass the verification, he needs to compute
  1 || || ,iU r v f pk ac ID P     which means that given , ,P R he needs to

16
compute   1 || || iU r v f pk ac ID P     for unknown *
.qZ  However, this
contradicts with the DDHP assumption. Therefore, the user can verify the identity of
the group manager by the verification equation above and they can securely negotiate
the public key without any Certificate Authorities and secure communication
channels.
In addition, our scheme can guarantee the user and the group manager to obtain
the correct message which is sent by the legal communication entity. As illustrated in
figure 3, in the third step of user registration, the group manager performs
verifications after receiving the message from the user. First of all, he decrypts
 1, ,sk iAENC ID v ac and obtains 1, .iID v Then he compares them with the received iID
message and the random number 1v in the first step. If either of them is not equal,
the manager stops the registration and informs the user to send new request in the
third step. Moreover, the user sends a random number 2v to the manager and the
manager encrypts it with the public key .pk Therefore, the attacker cannot cheat the
legal users and our scheme can be protected from replay attack. ■
4.2 Access Control
Theorem 2. Benefited from the group user list, which is generated by the group
manager, our scheme can achieve efficient access control.
Proof. The access control is based on the security of the group user list, which is
signed by the group manager with his signature    1sig UL f UL and this operation
is generally performed by the cloud. The cloud verifies the identity of the group
manager by checking the equation      
?
1, , .e W f UL e P sig UL The correctness of
above verification equation is based on the following relation:
     
  
  
  
1 1
1
1
, ,
,
,
,
e W f UL e P f UL
e P f UL
e P f UL
e P sig UL







(5)
Suppose that an attacker can forge the signature, which means that given , ,P P  he
needs to compute , where *
.qZ  However, this contradicts with BDHP

17
assumption. Therefore, there is no one except the group manager that can modify and
update the group user list to make sure that the resources in the cloud is available for
the legal users and unavailable for the revoked users and attackers. ■
4.3 Data Confidentiality
Theorem 3. Our scheme can protect data confidentiality, the cloud is unable to
learn the content of the stored files  , , , ,group data dataDF ID ID CE EK t even under
the collusion with the revoked users.
Proof. Theorem 3 can be deduced from the following two lemmas.
Lemma 3.1. The cloud is unable to learn the content of the stored files
 , , , , .group data dataDF ID ID CE EK t
Proof. First of all, the cloud cannot obtain the re-encryption key, even the cloud
can get the re-encryption key, then he can get  1 2, , ,C C C where
 1 2, , , .k
KC k Y C k P K Z C Enc M      Suppose that the cloud can compute the
encryption key, which means that given 1 , ,C k Y P  for unknown , the cloud can
compute    
1
1, , .
k
e C P e G P K   However, this contradicts with WBDHE
assumption which is mentioned in [11].
Lemma 3.2. Even under the collusion with the revoked users, the cloud is
incapable of learning the content of the stored files  , , , , .group data dataDF ID ID CE EK t
Proof. When a user is revoked, the group manager updates the data files stored in
the cloud with a new re-encryption key '
rK and constructs the new polynomial
function      ' 1
1 0 modm m j
p j j j j
j i
f x x V a x q
 

    and the new exponential function
   0 1
0 1,..., ,..., .ma a
mW W G G 
  From the original polynomial function in the phase of file
upload, we can obtain that when , [1, ],ix V i m   then
 
 
 
2
0 1 2 0
1
1
...
[1, ]
0
m m i
m i i
p
m
j j
m
j i j
a a x a x a x a x
f x
x V
V V i m



    

 
   




(6)
And for other values of ,x the value of the polynomial function is not zero.
At last, the group manager constructs  '
0 1,...,r mEK K W W   and sends it to the

18
cloud with a signature so that others cannot fake it. Only the legal users can recover
the re-encryption key due to the following equation:
   
 
0
2 1
0 1 2
'
1 1
0 1 1
...
j j
i j i
m
i i m i
p i
V a Vam m
r j j r j
a a V a V a V
r
f V
r
r
K W W K G G
K G
K G
K

 
 
   
    
 
 

 
(7)
When a user is revoked, the group manager constructs new polynomial function
 '
.pf x From the equation above, we can know that the revoked user cannot recover
the re-encryption key due to the equation  '
' '
.p if V
r rK G K  Suppose that the revoked
user can compute the re-encryption key, which means that given '
0 ,rK W he can
compute '
.rK Obviously, this contradicts with the BDHP assumption.
In addition, to make sure that the cloud updates the data files, the group manager
adds a time stamp datat to the data files and signs his signature  1DF f DF  for
verification. Moreover, the group manager updates the data file list by using his
signature    1sig DL f DL for the verifications of group members. Therefore, the
keys that the revoked users hold cannot be used to decrypt the re-encryption data files
anymore since the users are revoked. Thus the cloud is unable to learn the content of
the stored files even under the collusion with the revoked users. ■
4.4 Security Comparison
Table 3 Security performance comparison
Secure key
distribution
Access
control
Secure user
revocation
Anti-collusion
attack
Data
confidentiality
Mona √
RBAC
scheme
√
ODBE √ √ √
Our
scheme
√ √ √ √ √
In general, our scheme can achieve secure key distribution, fine access control
and secure user revocation. For clearly seeing the advantages of security of our
proposed scheme, as illustrated in table 3, we list a table compared with Mona, which
is Liu et al.’s scheme, the RBAC scheme, which is Zhou et al.’s scheme and ODBE

19
scheme, which is Delerablee et al.’s scheme. The √ in the blank means the scheme
can achieve the corresponding goal.
5 PERFORMANCE EVALUATION
We make the performance simulation with NS2 and compare with Mona in [10]
and the original dynamic broadcast encryption (ODBE) scheme in [12]. Without loss
of generality, we set 160p  and the elements in 1G and 2G to be 161 and 1,024
bits, respectively. In addition, we assume the size of the data identity is 16 bits, which
yield a group capacity of 16
2 data files. Similarly, the size of user and group identity
are also set 16 bits. Both group members and group managers processes are conducted
on a laptop with Core 2 T5800 2.0 GHz, DDR2 800 2G, Ubuntu 12.04 X86. The
cloud process is implemented on a laptop with Core i7-3630 2.4 GHz, DDR3 1600 8G,
Ubuntu 12.04 X64. We select an elliptic curve with 160 bits group order.
5.1 Member Computation Cost
10 20 30 40 50 60 70 80 90 100
0.2
0.4
0.6
0.8
1
1.2
1.4
1.6
The number of revokrd users
computationofmember-side
ODBE
RBAC
Mona
our scheme
10 20 30 40 50 60 70 80 90 100
1.4
1.6
1.8
2
2.2
2.4
2.6
2.8
ODBE
RBAC
Mona
our scheme
(a) Generating a 10 MB file (b) Generating a 100 MB file
Figure 7 Comparison on computation cost of members for file upload among
ODBE, RBAC, Mona and our scheme
As illustrated in figure 7, we list the comparison on computation cost of members
for file upload among ODBE, RBAC, Mona and our scheme. It is obviously observed
that the computation cost for members in our scheme is irrelevant to the number of
revoked users. The reason is that in our scheme, we move the operation of user

20
revocation to the group manager so that the legal clients can encrypt the data files
alone without involving information of other clients, including both legal and revoked
clients. On the contrary, the computation cost increases with the number of revoked
users in ODBE. The reason is that several operations including point multiplications
and exponentiations have to be performed by clients to compute the parameters in
ODBE.
The computation cost of members for file download operations with the size of 10
and 100Mbytes are illustrated in figure 8. The computation cost is irrelevant to the
number of revoked users in RBAC scheme. The reason is that no matter how many
users are revoked, the operations for members to decrypt the data files almost remain
the same. The computation cost in Mona increases with the number of revoked users,
because the users need to perform computing for revocation verification and check
whether the data owner is a revoked user. Besides the above operations, more
parameters need to be computed by members in ODBE. On the contrary, the
computation cost decreases with the number of revoked users in our scheme because
of the computation for the recovery of the secret parameter decreases with the number
of revoked users.
10 20 30 40 50 60 70 80 90 100
0.2
0.4
0.6
0.8
1
1.2
1.4
1.6
1.8
2
ODBE
RBAC
Mona
our scheme
10 20 30 40 50 60 70 80 90 100
1.6
1.8
2
2.2
2.4
2.6
2.8
3
3.2
3.4
3.6
ODBE
RBAC
Mona
our scheme
(a) Downloading a 10 MB file (b) Downloading a 100 MB file
Figure 8 Comparison on computation cost of members for file download among
ODBE, RBAC, Mona and our scheme

21
5.2 Cloud Computation Cost
As illustrated in figure 9, we list the comparison on computation cost of the cloud
for file upload between Mona and our scheme. In general, it can be obviously seen
that both the computation costs of the cloud in two schemes are acceptable. In detail,
the cost in Mona increases with the number of revoked users, as the revocation
verification cost increases. However, in our scheme, the cost is irrelevant to the
number of the revoked users. The reason is that the computation cost of the cloud for
file upload in our scheme consists of two verifications for signature, which is
irrelevant to the number of the revoked users. The reason for the small computation
cost of the cloud in the phase of file upload in RBAC scheme is that the verifications
between communication entities are not concerned in this scheme.
10 20 30 40 50 60 70 80 90 100
0
0.05
0.1
0.15
0.2
0.25
computationofcloud-side
RBAC
Mona
our scheme
10 20 30 40 50 60 70 80 90 100
0
0.05
0.1
0.15
0.2
0.25
0.3
0.35
RBAC
Mona
our scheme
(a) Uploading a 10 MB file (b) Uploading a 100 MB file
Figure 9 Comparison on computation cost of members for file upload among
RBAC, Mona and our scheme
The computation cost of the cloud for file download operations with the size of 10
and 100Mbytes are illustrated in figure 10. Similar to the operation of file upload, the
computation cost of the cloud is mainly determined by the revocation verification
operation. Therefore, the cost increases with the number of revoked users. However,
in our scheme, the cloud just simply verifies the signature. Therefore, the computation
cost of the cloud for file download is irrelevant to the number of the revoked users.
The reason for the high computation cost of the cloud in RBAC scheme is that the

22
cloud performs some algorithm operations to help the user to decrypt data files. In
addition, it can be seen that in these schemes, the computation cost is independent
with the size of the file, since both the signature in Mona and the encrypted message
in our scheme are irrelevant to the size of the requested file and the operations of
cloud for decryption in RBAC scheme is also irrelevant to the size of the encrypted
data files.
10 20 30 40 50 60 70 80 90 100
0
0.2
0.4
0.6
0.8
1
1.2
1.4
RBAC
Mona
our scheme
10 20 30 40 50 60 70 80 90 100
0
0.2
0.4
0.6
0.8
1
1.2
1.4
RBAC
Mona
our scheme
(a) Downloading a 10 MB file (b) Downloading a 100 MB file
Figure 10 Comparison on computation cost of the cloud for file download among
RBAC, Mona and our scheme
6 CONCLUSION
In this paper, we design a secure anti-collusion data sharing scheme for dynamic
groups in the cloud. In our scheme, the users can securely obtain their private keys
from group manager Certificate Authorities and secure communication channels. Also,
our scheme is able to support dynamic groups efficiently, when a new user joins in the
group or a user is revoked from the group, the private keys of the other users do not
need to be recomputed and updated. Moreover, our scheme can achieve secure user
revocation, the revoked users can not be able to get the original data files once they
are revoked even if they conspire with the untrusted cloud.
Acknowledgements
This work is supported by the National Natural Science Foundation of China

23
(NO.61202448), and the Key Laboratory Program of Information Network Security of
Ministry of Public Security (No.C14610).
References
[1] M. Armbrust, A. Fox, R. Griffith, A. D. Joseph, R. Katz, A. Konwinski, G. Lee, D.
Patterson, A. Rabkin, I. Stoica, and M. Zaharia. “A View of Cloud Computing,”
Comm. ACM, vol. 53, no. 4, pp. 50-58, Apr.2010.
[2] S. Kamara and K. Lauter, “Cryptographic Cloud Storage,” Proc. Int’l Conf.
Financial Cryptography and Data Security (FC), pp.136- 149, Jan. 2010.
[3] M. Kallahalla, E. Riedel, R. Swaminathan, Q. Wang, and K. Fu, “Plutus: Scalable
Secure File Sharing on Untrusted Storage,” Proc. USENIX Conf. File and Storage
Technologies, pp. 29-42, 2003.
[4] E. Goh, H. Shacham, N. Modadugu, and D. Boneh, “Sirius: Securing Remote
Untrusted Storage,” Proc. Network and Distributed Systems Security Symp. (NDSS),
pp. 131-145, 2003.
[5] G. Ateniese, K. Fu, M. Green, and S. Hohenberger, “Improved Proxy
Re-Encryption Schemes with Applications to Secure Distributed Storage,” Proc.
Network and Distributed Systems Security Symp. (NDSS), pp. 29-43, 2005.
[6] Shucheng Yu, Cong Wang, Kui Ren, and Weijing Lou, “Achieving Secure,
Scalable, and Fine-grained Data Access Control in Cloud Computing,” Proc. ACM
Symp. Information, Computer and Comm. Security, pp. 282-292, 2010.
[7] V. Goyal, O. Pandey, A. Sahai, and B. Waters, “Attribute-Based Encryption for
Fine-Grained Access Control of Encrypted Data,” Proc. ACM Conf. Computer and
Comm. Security (CCS), pp. 89-98, 2006
[8] R. Lu, X. Lin, X. Liang, and X. Shen, “Secure Provenance: The Essential of Bread
and Butter of Data Forensics in Cloud Computing,” Proc. ACM Symp. Information,
Computer and Comm. Security, pp. 282-292, 2010.
[9] B. Waters, “Ciphertext-Policy Attribute-Based Encryption: An Expressive,
Efficient, and Provably Secure Realization,” Proc. Int’l Conf. Practice and Theory in

24
Public Key Cryptography Conf. Public Key Cryptography,
http://eprint.iacr.org/2008/290.pdf, 2008
[10] Xuefeng Liu, Yuqing Zhang, Boyang Wang, and Jingbo Yang, “Mona: Secure
Multi-Owner Data Sharing for Dynamic Groups in the Cloud,” IEEE Transactions on
Parallel and Distributed Systems, vol. 24, no. 6, pp. 1182-1191, June 2013.
[11] D. Boneh, X. Boyen, and E. Goh, “Hierarchical Identity Based Encryption with
Constant Size Ciphertext,” Proc. Ann. Int’l Conf. Theory and Applications of
Cryptographic Techniques (EUROCRYPT), pp. 440-456, 2005.
[12] C. Delerablee, P. Paillier, and D. Pointcheval, “Fully Collusion Secure Dynamic
Broadcast Encryption with Constant-Size Ci-phertexts or Decryption Keys,” Proc.
First Int’l Conf. Pairing-Based Cryptography, pp. 39-59, 2007.
[13] Zhongma Zhu, Zemin Jiang, Rui Jiang, “The Attack on Mona: Secure
Multi-Owner Data Sharing for Dynamic Groups in the Cloud,” Proceedings of 2013
International Conference on Information Science and Cloud Computing (ISCC 2013 ),
Guangzhou, Dec.7, 2013, pp. 185-189.
[14] Lan Zhou, Vijay Varadharajan, and Michael Hitchens, “Achieving Secure
Role-Based Access Control on Encrypted Data in Cloud Storage,” IEEE Transactions
on Information Forensics and Security, vol. 8, no. 12, pp. 1947-1960, December
2013.
[15] Xukai Zou, Yuan-shun Dai, and Elisa Bertino, “A practical and flexible key
management mechanism for trusted collaborative computing,” INFOCOM 2008, pp.
1211-1219.
[16] M. Nabeel, N. Shang, and E. Bertino, “Privacy preserving policy based content
sharing in public clouds,” IEEE Trans. on Know. and Data Eng., vol. 25, no. 11, pp.
2602-2614, 2013.
[17] Dolev, D., Yao A. C., "On the security of public key protocols", IEEE trans. on
Information Theory, vol. IT-29, no. 2, pp. 198–208, 1983
[18] Boneh Dan, Franklin Matt, “Identity-based encryption from the weil pairing,”
Lecture Notes in Computer Science, vol. 2139 LNCS, pp. 213-229, 2001

25
[19] B. den Boer, Diffie–Hellman is as strong as discrete log for certain primes in
Advances in Cryptology – CRYPTO 88, Lecture Notes in Computer Science 403,
Springer, p. 530, 1988.
[20] D. Boneh, X. Boyen, H. shacham, “Short group signature,” Proc. Int’l
Cryptology Conf. Advances in Cryptology, pp.41-55, 2004.
[21] D. Boneh, X. Boyen, and E. Goh, “Hierarchical Identity Based Encryption with
Constant Size Ciphertext,” Proc. Ann. Int’l Conf. Theory and Applications of
Cryptographic Techniques (EUROCRYPT), pp. 440-456, 2005.
Zhongma Zhu is a student in the Information Science and
Engineering Department at Southeast University, China. He
majored in information security, mainly engaged in cloud storage
security protocols research.
Rui Jiang is now an associate professor at Southeast University,
China. He received his Ph D degree at Shanghai Jiaotong University,
Shanghai, China in 2005. His current research interests include
secure analysis and design of communication protocols, secure
mobile cloud computing, secure network and systems
communications, mobile voice end-to-end secure
communications, and applied cryptography.

A secure anti collusion data sharing scheme for dynamic groups in the cloud

More Related Content

What's hot (19)

Viewers also liked (11)

Similar to A secure anti collusion data sharing scheme for dynamic groups in the cloud (20)

Recently uploaded (20)

A secure anti collusion data sharing scheme for dynamic groups in the cloud