The increasing popularity of remote Cloud File Sharing (CFS) has become a major concern for privacy breach of sensitive data. Aiming at this concern, we present a new resource sharing framework by integrating enterprise-side Attribute-Based Access Control/eXtensible Access Control Markup Language (ABAC/XACML) model, client-side Ciphertext-Policy Attribute-Based Encryption (CP-ABE) scheme, and cloud-side CFS service. Moreover, the framework workflow is provided to support the encrypted-file writing and reading algorithms in accordance with ABAC/XACML-based access policy and attribute credentials. However, an actual problem of realizing this framework is that policy matrix, derived from access policy, seriously affects the performance of existing CP-ABE from Lattice (CP-ABE-L) schemes. To end it, we present an optimal generation algorithm of Small Policy Matrix (SPM), which only consists of small elements, and generates an all-one reconstruction vector. Based on such a matrix, the improved CP-ABE-L scheme is proposed to reduce the cumulative errors to the minimum and prevent the enlargement of error bounds. Furthermore, we give the optimal estimation of system parameters to implement a valid Error Proportion Allocation (EPA). Our experimental results indicate that our scheme has short size of parameters and enjoys efficient computation and storage overloads. Thus, our new framework with optimization methods is conducive to enhancing the security and efficiency of remote work on CFS.

Attribute-Based Encryption (ABE) plays an important role in current secure data sharing through fine-grained customizable policies. However, the existing ABE schemes only support simple predicates, = and ≠, but cannot express a more general membership predicates, ∈ and ∉, in policies. The low expressivity of ABE will enlarge the ciphertext storage and reduce the communication efficiency. To overcome this problem, we propose an ABE supporting Dual Membership (DM-ABE). The core problem for implementing this scheme is how to use cryptographic methods to decide the membership between the verified element and the given set. In order to solve this problem, we design a cryptographic algorithm, called Secure Decision of Membership (SDM), based on aggregation functions. In this algorithm, any set can be aggregated into one cryptographic element, and the verified element and the given set can be converted into another cryptographic element in decision process. The membership between them can be decided by the above two cryptographic elements. Furthermore, we construct the DM-ABE by using SDM. Because of the good expressivity of our DM-ABE, we further propose a novel cryptographic data sharing framework by integrating DM-ABE and attribute-based access control to provide fine-grained access control and security protection for private data. In the security proof of DM-ABE, we prove that the DM-ABE satisfies the semantic security against chosen-plaintext attacks under the DBDHE assumption in the standard model through a unified way, considering both two encryption methods for ∈ and ∉ at the same time. Finally, we analyze our scheme in terms of time and space complexity, and compare it with some existing schemes. The results show that our DM-ABE has a better expressive ability on the boolean logic of general membership predicates, ∈ and ∉.