On the Security of Privacy-Preserving Bilateral Attribute-Based Encryption

In Internet-based services, the public cloud server performs the duty of data storage and works as an arbitrator between the data sender and receiver. Considering the curiosity of a cloud storage service provider and the sensitivity of data, one might concerned about the confidentiality and privacy of data. A bilateral attribute-based encryption is a customized version of attribute-based encryption (ABE) that facilitates both the ends of data communication (the sender and receiver) to specify the access control rules in a fine-grained manner. The sender may choose an access policy to decide who can decrypt the encrypted document, and a receiver can specify an access policy to limit the number of encrypted documents he wishes to receive. Its sender and receiver information should also be concealed to prevent statistical disclosure along with the data. In 2021, Sun et al. (IEEE Trans Indust Inform [1]) demonstrated a bilateral ABE with the objective of sender and receiver privacy preservation. In the thorough analysis of their paper, we have found that their scheme fails to provide both the sender and receiver privacy. This paper will prove the security flaws in the scheme Sun et al. presented.