I've got the requirement to put the company data onto blockchain for traceability and auditability. Some of that data is public, whilst some of this data is confidential to 1+ (could be many) user accounts. It still needs to be public, as there must be ordered chain of data updates to the system (Ledger). The public shall be able to see public data and verify hash continuity of all records. Authorized users on top of that would be able to see contents of data confidential to them.
I am looking for a way to encrypt that data in a way that each user has its own access key which can be used to decrypt that data.
I also need a way to revoke keys as needed. My understanding is that once data was encrypted and published onto blockchain, if user key gets leaked, then only data to which user had access to would be compromised. The key revocation would then disable his old key for any new data added to the blockchain. Since that time he would be able to use his new key.
I've found the:
Ciphertext-Policy Attribute-Based Encryption which perhaps might be solution to my problem. Then found this publication: https://www.researchgate.net/publication/311003750_New_directly_revocable_attribute-based_encryption_scheme_and_its_application_in_cloud_storage_environment
which mentions the
Revocation centre (URC),
n attributes set S.
I am kind of lost in all that. Initially I've assumed that each user in my system could have its 256-bit key assigned to his account. The data would be encrypted in a way that each key would be added to access list. E.g. like that: https://asecuritysite.com/encryption/abe02?a0=Message&a1=key1%20key2%20key3%20key4%201of4%20masterkey%201of2&a2=key1
So either of
masterkey can decrypt the message.
... but now in this context what's the
attribute, what's the
uid and what's the
Do you know any public material which shows the real example / practical usage of CP-ABE? So far I am I am going through vast amount of academical publication / materials and can't get my head around theoretical examples.
Is there any recommended security / key-management workflow for public (blockchain) data which needs to be public for auditability, however certain blocks needs to be encrypted, so public only knows about its existence (and can verify hash continuity), but can't see the content. Only certain users would be able to decrypt it and see the contents.
I am also not sure if CP-ABE is actually a fit here or I am looking for something else.
Any help much appreciated !