Revocation-Ready CP-ABE Key Management for Blockchain-Based IoT Data Sharing

• URL: http://arxiv.org/abs/2605.04280v1
• Date: Tue, 05 May 2026 20:31:12 GMT
• Title: Revocation-Ready CP-ABE Key Management for Blockchain-Based IoT Data Sharing
• Abstract summary: This paper presents a revocation-ready key management layer that replaces online key release with ciphertext key publication.<n>We implement a minimal end-to-end prototype using a local content-addressed store, a hash-chained ledger, and a CP-ABE backend.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Blockchain-based IoT data sharing systems increasingly adopt a hybrid architecture in which a permissioned ledger stores tamper-evident metadata while encrypted payloads are placed in content-addressed storage. In such systems, a central security bottleneck is key access control: enforcing dynamic, multi-user authorization for releasing or using bulk-data decryption keys. Existing designs often rely on always-online RBAC or smart-contract gates that return keys to authorized users, reintroducing a trusted online policy enforcement point and weakening auditability. This paper presents a revocation-ready key management layer that replaces online key release with ciphertext key publication: the ledger records metadata of the form (CID, CK, PolicyID, epoch), where CK is a CP-ABE ciphertext encapsulating an AES-GCM key. Users retrieve CK from the ledger and decrypt locally if their attributes satisfy the policy. To support forward revocation and policy evolution without re-encrypting large files, the design introduces an epoch/time-bound attribute and a lightweight CK-rotation protocol that updates only small ciphertext keys and ledger entries. We implement a minimal end-to-end prototype using a local content-addressed store, a hash-chained ledger, and a CP-ABE backend, with the goal of isolating key-management costs rather than benchmarking production blockchain throughput. Experiments on a commodity MacBook show that CP-ABE encryption dominates store latency, with approximately 186 ms for a k=6 mixed-Boolean policy, while ledger and storage operations remain around 1-2 ms. Epoch-based revocation amortizes key update cost under churn, gateway-assisted mode reduces median client-side decryption time by more than 4x under a simulated 4x client slow-down, and ledger growth scales with the number of shared assets rather than the number of readers.

Related papers

• Pushing Forward Multi-Secret-Key Homomorphic Encryption for Private Average Aggregation [45.381652768314375]
  Homomorphic Encryption naturally fits the client--aggregator communication pattern of Federated Learning.<n>We propose lightweight multi-secret-key protocols for private average aggregation based on RLWE-based Homomorphic Encryption.<n>Our results show that the proposed approach substantially reduces ciphertext expansion and online cost, while preserving practical homomorphic aggregation performance.
  arXiv  Detail & Related papers  (2026-09-01T23:21:48Z)
• KeyPooling: Measuring Where LLM API Relay Paths Collapse Prompt Cache Isolation [53.952294884822955]
  Large language model (LLM) API relays authenticate customers separately but often forward requests through shared provider credentials.<n>We present KeyPooling, a measurement method that traces customer identity through cache lookup and write.<n>We derive a defense contract: every customer must enter a provider-enforced domain.
  arXiv  Detail & Related papers  (2026-08-18T08:12:34Z)
• The Trust-Free Aggregation Layer of the Unicity Infrastructure [1.1766230941766413]
  Unicity is a novel blockchain infrastructure for enabling users to execute off-chain peer-to-peer token transactions.<n>A key component of the infrastructure is the Aggregation Layer responsible for storing information about the spent states of tokens.<n>Our implementation uses no trusted setup, achieves throughput of 10,000 insertions per second and millisecond range verification time on a single consumer-class CPU.
  arXiv  Detail & Related papers  (2026-08-05T18:18:16Z)
• Back from the Future: Key-Value Cache Management by Counter-Causal Surprise [67.1056509495879]
  Key-value (KV) cache management through compression and eviction strategies has emerged as an important research direction in recent years.<n>We propose a simple yet effective KV eviction scheme motivated by the insight that past tokens which can be well-predicted from more recent tokens are redundant.<n>We evaluate our strategy on various open-source LLMs and benchmark datasets showing competitive or improved performance over other state-of-the-art methods.
  arXiv  Detail & Related papers  (2026-07-30T02:42:51Z)
• Privacy-Enhanced Zero-Order Federated Learning via xMK-CKKS over Wireless Channels [8.23636165923649]
  Homomorphic encryption (HE) enables privacy-preserving aggregation in federated learning (FL)<n>We propose a four-phase protocol that enables xMK-CKKS, a famous multi-key HE scheme, aggregation over a shared wireless channel without channel estimation.
  arXiv  Detail & Related papers  (2026-05-28T15:56:43Z)
• Send the Key in Cleartext: Halving Key Consumption while Preserving Unconditional Security in QKD Authentication [59.664950447941386]
  Quantum Key Distribution (QKD) protocols require Information-Theoretically Secure (ITS) authentication of the classical channel to preserve the unconditional security of the distilled key.<n>Since QKD requires mutual authentication, two independent one-time keys are typically consumed per round, imposing a non-trivial overhead on the net secure key rate.<n>We present a novel ITS authentication scheme based on $varepsilon$-Almost Strongly Universal$ ($varepsilon$-ASU$)
  arXiv  Detail & Related papers  (2026-03-26T14:36:05Z)
• Efficient ML-DSA Public Key Management Method with Identity for PKI and Its Application [34.906142924769675]
  We propose a novel identity-based public key management framework for PKI based on post-quantum cryptography, termed textitIPK-pq.<n>Building on the concept of the Composite Public Key (CPK), textitIPK-pq addresses the linear collusion problem inherent in CPK through an enhanced identity mapping mechanism.<n>We provide a formal security proof for textitIPK-pq, covering both individual private key components and the composite private key.
  arXiv  Detail & Related papers  (2026-03-26T05:26:31Z)
• From See to Shield: ML-Assisted Fine-Grained Access Control for Visual Data [40.12543056558646]
  This work presents a system architecture for trusted data sharing with policy-driven access control.<n>The proposed architecture integrates automated detection of sensitive regions, post-correction, key management, and access control.<n>We show that our system provides effective PSO detection, increases macro-averaged F1 score (5%) and mean Average Precision (10%), and maintains an average policy-enforced decryption time of less than 1 second per image.
  arXiv  Detail & Related papers  (2025-10-22T09:41:31Z)
• A Relay-Chain-Powered Ciphertext-Policy Attribute-Based Encryption in Intelligent Transportation Systems [0.8849672280563691]
  This work suggests a new architecture that combines a relay chain-driven encryption system with a modified Ciphertext-Policy Attribute-Based Encryption scheme.<n>The model proposes a context-aware smart contract on a worldwide relay chain that checks against data properties, including event type, time, and geographical region.<n>High-sensitivity events are secured with firm, multi-attribute access rules, whereas common updates use light policies to help reduce processing burdens.
  arXiv  Detail & Related papers  (2025-08-22T08:11:23Z)
• PKE and ABE with Collusion-Resistant Secure Key Leasing [5.5097304991439975]
  We introduce collusion-resistant security for PKE-SKL (denoted as PKE-CR-SKL)<n>In this model, the adversary can adaptively obtain multiple quantum decryption keys and access a verification oracle.<n>The size of the public key and ciphertexts must remain independent of the total number of generated quantum decryption keys.
  arXiv  Detail & Related papers  (2025-02-18T03:19:54Z)
• Thetacrypt: A Distributed Service for Threshold Cryptography [0.0]
  Thetacrypt is a versatile library for integrating many threshold schemes into one language.<n>It offers a way to easily build distributed systems using threshold cryptography and is agnostic to their implementation.<n>The library currently includes six cryptographic schemes that span ciphers, signatures, and randomness generation.
  arXiv  Detail & Related papers  (2025-02-05T15:03:59Z)
• CCA-Secure Key-Aggregate Proxy Re-Encryption for Secure Cloud Storage [1.4610685586329806]
  Data protection in cloud storage is the key to the survival of the cloud industry. Proxy Re-Encryption schemes enable users to convert their ciphertext into others ciphertext by using a re-encryption key. Recently, we lowered the key storage cost of C-PREs to constant size and proposed the first Key-Aggregate Proxy Re-Encryption scheme.
  arXiv  Detail & Related papers  (2024-10-10T17:02:49Z)
• Enc2DB: A Hybrid and Adaptive Encrypted Query Processing Framework [47.11111145443189]
  We introduce Enc2DB, a novel secure database system following a hybrid strategy on and openGauss. We present a micro-benchmarking test and self-adaptive mode switch strategy that can choose the best execution path (cryptography or TEE) to answer a given query. We also design and implement a ciphertext index compatible with native cost model and querys to accelerate query processing.
  arXiv  Detail & Related papers  (2024-04-10T08:11:12Z)
• On the Efficacy of Eviction Policy for Key-Value Constrained Generative Language Model Inference [40.789027180025286]
  Large Language Models (LLMs) are notably cost-prohibitive to deploy in resource-constrained environments. We introduce RoCo, a robust cache omission policy based on temporal attention scores and robustness measures. We release EasyKV, a versatile software package dedicated to user-friendly key-value constrained generative inference.
  arXiv  Detail & Related papers  (2024-02-09T09:20:59Z)
• Recovering AES Keys with a Deep Cold Boot Attack [91.22679787578438]
  Cold boot attacks inspect the corrupted random access memory soon after the power has been shut down. In this work, we combine a novel cryptographic variant of a deep error correcting code technique with a modified SAT solver scheme to apply the attack on AES keys. Our results show that our methods outperform the state of the art attack methods by a very large margin.
  arXiv  Detail & Related papers  (2021-06-09T07:57:01Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.