TRO-CP-ABE: a secure and flexible layer with traceability and easy revocation in ciphertext-policy attribute-based encryption

Attribute-based encryption (ABE) is a very efficient way of authorising users to access confidential data in organisations without public-key validation from external trusted authorities or complex login processes. Ciphertext-policy attribute-based encryption (CP-ABE) is an improvement over ABE in which access is granted to users based on their attributes if they satisfy the access policy of the ciphertext defined by the data owner. CP-ABE poses many challenges like tracing the malicious user, revoking the access of users, collusion attacks: where users may combine keys to gain access to unauthorised data, and key escrow: when authorities have complete access to protected data due to saved private keys. Our proposed solution is an added security layer on top of the underlying CP-ABE which solves the four security concerns mentioned above. The TRO-CP-ABE system also gives great flexibility to the system designer on the use of key generation algorithms and access structures as required.