Key management is an essential component of a cryptographic access control system with a large number of resources. It manages the secret keys assigned to the system entities in such a way that only authorized users can access a resource. Read access control allows read access of a resource by the authorized users and disallows others. An important objective of a key management is to reduce the secret key storage with each authorized user. To this end, there exist two prominent types of key management hierarchy with single key storage per user used for read access control in data outsourcing scenario: user-based and resource-based. In this work, we analyze the two types of hierarchy with respect to static hierarchy characteristics and dynamic operations such as adding or revoking user authorization. Our analysis shows that the resource-based hierarchies can be a better candidate which is not given equal emphasis in the literature. A new heuristic for minimizing the key management hierarchy is introduced that makes it practical in use even for a large number of users and resources. The performance evaluation of dynamic operations such as adding or revoking a user’s read subscription is shown experimentally to support our analytical results.

Summary A time‐limited data access control scheme allows a user's access to the data files only for a specified time period. A cryptographic solution to the time‐limited access control problem is by encrypting each data group associated with a time period with a distinct key. The data is encrypted by the data owner. The respective decryption keys are then distributed to authorized users by the data owner. A user requires one secret decryption key storage for each authorized time period. To reduce the secret key storage with each user, time‐limited hierarchical key management schemes are generally used. Many such schemes are proposed in the recent years. The objective of these schemes is system efficiency and data security. Construction of such schemes become more challenging when data is outsourced to an untrusted third party service provider. In current work, an efficient and secure time‐limited hierarchical key assignment scheme is proposed for key management suitable for data outsourcing scenario. We compare it with the other recent similar schemes. The scheme is formally proved against the modern stronger security notion called key indistinguishability.