UR-CP-ABE: CP-ABE With Flexible Construction Mechanism and Efficient User Revocation Capability for Access Control in the Cloud

Ciphertext-Policy Attribute-Based Encryption (CP-ABE) schemes with user revocation allow for dynamic updates to users' access rights. However, existing schemes often encounter issues such as low re-encryption efficiency, inflexible access control, and susceptibility to collusion attacks. To address these challenges, we propose UR-CP-ABE, an efficient user revocation scheme built upon a double encryption method. Specifically, UR-CP-ABE stores both valid and revoked users' identity information in a binary tree. This design enables flexible user authority revocation by modifying only the binary tree's relevant secret sub-items. Moreover, the scheme limits the scope of revocation-induced binary tree updates to a single sub-item. This key optimization resolves the critical issue where re-encryption overhead scales linearly with the number of attributes of revoked users. In addition, we eliminate the possibility of attackers constructing secret sub-keys, preventing the collusion attacks. UR-CP-ABE also supports bidirectional revocation, allowing for the revocation and restoration of user rights, which is not available in other related schemes. Our theoretical analysis and experiments demonstrate that UR-CP-ABE has better performance than other schemes, especially in the re-encryption stages. Moreover, UR-CP-ABE has been proved to be secure based on the decisionalq-parallel BDHEhardness assumption in the standard model.