Abstract:
Dataspace is an important infrastructure for achieving effective data sharing and circulation. However, problems such as privacy leakage, data theft, and illegal abuse during the data sharing process bring big challenges to the implementation of industry dataspaces. Attribute-based Encryption (ABE) can ensure the confidentiality and fine-grained access control of shared data, but there are still many problems when directly applied to dataspaces. For example, traditional ABE have high computational overhead in user revocation, which cannot meet performance requirements if a lot of dynamic users joining or leaving the dataspace. Besides, many industry dataspaces need to exert flexible access control on shared data based on user attribute comparison and access time, and verify the decryption results. To overcome these problems, this paper proposes a data access control approach based on comparable attributes in dataspaces, which realizes flexible and efficient user revocation to ensure forward security. The approach can make flexible decisions on access behavior based on access time and attribute comparison, and also support verification of the decryption process. Through formal security analysis, the approach has semantic security under chosen plaintext attacks. In addition, a large number of experimental analyses show that the approach is suitable for actual data sharing applications in dataspaces.