International Association
for Cryptologic Research

Ciphertext-policy attribute-based encryption (CP-ABE) is regarded as a promising cryptographic tool for encrypted access control in public cloud storage systems. However, a problem for CP-ABE schemes is that there is no way to change access policy on ciphertext once it is generated. This shortcoming makes us cannot conveniently use CP-ABE as traditional 1-to-1 public key encryption when the access policy needs to be changed. In this paper, we propose a dynamic policy update algorithm for CP-ABE. The policy update algorithm not only has the ability to remove attributes from an access policy but also is able to add newly issued attributes to an access policy. When the access policy of a ciphertext changes, user private key will always be fixed and thus private channels to update user keys are eliminated. Moreover, our policy update algorithm does not rely on predefined attributes, such as timestamp and user ID, and does not produce new public parameters as well. The update algorithm can be independently executed by the creator of a ciphertext and the update times for the ciphertext are unlimited. We construct such a scheme and show its usage in a practical scenario. The performance analysis shows an excellent result: The communication, computation, and storage costs of our policy update are only relevant to the number of attributes in access policy.