Ciphertext-policy attribute-based encryption (CP-ABE) is suitable for providing secure data-sharing services in the cloud storage scenario. However, attribute revocation in CP-ABE is a sticky issue. The research achievement on quantum computing makes the traditional CP-ABE no longer secure. Fortunately, lattice-based CP-ABE can resist quantum attacks. This paper proposes a lattice-based CP-ABE scheme with a tree access structure that supports the immediate revocation of attributes. This scheme is resistant to quantum and collusion attacks. When attribute revocation occurs, the semi-trusted third party implements the immediate attribute revocation to handle dynamic user permission changes immediately. The proposed re-encryption algorithm can effectively reduce the computational complexity of ciphertext re-encryption during attribute revocation, and the lazy ciphertext update method reduces the scope and size of the ciphertext update. Finally, it is shown that, under the standard model, the scheme is proven secure against chosen-plaintext attacks (CPA), and its security can be attributed to the learning with errors (LWE) difficulty problem.

Ciphertext‐policy attribute‐based encryption (CP‐ABE) is a cryptographic scheme suitable for secure data sharing on cloud storage. The CP‐ABE based on lattice theory has the property of resisting quantum attack. Some data objects uploaded to the cloud by the same data owner may cause conflicts of interest, or their combination may expose sensitive information. This paper proposes a revocable CP‐ABE scheme on the lattice, based on ring learning with error (R‐LWE) problem, to enforce access control constraints on user access to such data objects. In this scheme, first, the access policies of such data objects are amended by adding dummy attributes. Second, we control the secret key components associated with the dummy attributes or revoke the dummy attributes to prevent users from continuously accessing specific parts or all data objects from this kind of data set. Finally, we carry on the efficiency and security analysis of the scheme. The analysis results show that the scheme is efficient and safe.

CP-ABE (Ciphertext-Policy Attribute-Based Encryption) with hidden access control policy enables data owners to share their encrypted data using cloud storage with authorized users while keeping the access control policies blinded. However, a mechanism to prevent users from achieving successive access to a data owner’s certain number of data objects, which present a conflict of interest or whose combination thereof is sensitive, has yet to be studied. In this paper, we analyze the underlying relations among these particular data objects, introduce the concept of the sensitive data set constraint, and propose a CP-ABE access control scheme with hidden attributes for the sensitive data set constraint. This scheme incorporates extensible, partially hidden constraint policy. In our scheme, due to the separation of duty principle, the duties of enforcing the access control policy and the constraint policy are divided into two independent entities to enhance security. The hidden constraint policy provides flexibility in that the data owner can partially change the sensitive data set constraint structure after the system has been set up.