Mona: Secure Multi-Owner Data Sharing

for Dynamic Groups in the Cloud

Xuefeng Liu, Yuqing Zhang, Member, IEEE, Boyang Wang, and Jingbo Yan
AbstractWith the character of low maintenance, cloud computing provides an economical and efficient solution for sharing group
resource among cloud users. Unfortunately, sharing data in a multi-owner manner while preserving data and identity privacy from an
untrusted cloud is still a challenging issue, due to the frequent change of the membership. In this paper, we propose a secure multi-
owner data sharing scheme, named Mona, for dynamic groups in the cloud. By leveraging group signature and dynamic broadcast
encryption techniques, any cloud user can anonymously share data with others. Meanwhile, the storage overhead and encryption
computation cost of our scheme are independent with the number of revoked users. In addition, we analyze the security of our scheme
with rigorous proofs, and demonstrate the efficiency of our scheme in experiments.
Index TermsCloud computing, data sharing, privacy-preserving, access control, dynamic groups

1 INTRODUCTION
C
LOUD computing is recognized as an alternative to
traditional information technology [1] due to its
intrinsic resource-sharing and low-maintenance character-
istics. In cloud computing, the cloud service providers
(CSPs), such as Amazon, are able to deliver various services
to cloud users with the help of powerful datacenters. By
migrating the local data management systems into cloud
servers, users can enjoy high-quality services and save
significant investments on their local infrastructures.
One of the most fundamental services offered by cloud
providers is data storage. Let us consider a practical data
application. A company allows its staffs in the same group
or department to store and share files in the cloud. By
utilizing the cloud, the staffs can be completely released
from the troublesome local data storage and maintenance.
However, it also poses a significant risk to the confidenti-
ality of those stored files. Specifically, the cloud servers
managed by cloud providers are not fully trusted by users
while the data files stored in the cloud may be sensitive and
confidential, such as business plans. To preserve data
privacy, a basic solution is to encrypt data files, and then
upload the encrypted data into the cloud [2]. Unfortunately,
designing an efficient and secure data sharing scheme for
groups in the cloud is not an easy task due to the following
challenging issues.
First, identity privacy is one of the most significant
obstacles for the wide deployment of cloud computing.
Without the guarantee of identity privacy, users may be
unwilling to join in cloud computing systems because their
real identities could be easily disclosed to cloud providers
and attackers. On the other hand, unconditional identity
privacy may incur the abuse of privacy. For example, a
misbehaved staff can deceive others in the company by
sharing false files without being traceable. Therefore,
traceability, which enables the group manager (e.g., a
company manager) to reveal the real identity of a user, is
also highly desirable.
Second, it is highly recommended that any member in a
group should be able to fully enjoy the data storing and
sharing services provided by the cloud, which is defined as
the multiple-owner manner. Compared with the single-owner
manner [3], where only the group manager can store and
modify data in the cloud, the multiple-owner manner is more
flexible in practical applications. More concretely, each user
inthe groupis able to not only readdata, but also modify his/
her part of data in the entire data file shared by the company.
Last but not least, groups are normally dynamic in
practice, e.g., new staff participation and current employee
revocation in a company. The changes of membership make
secure data sharing extremely difficult. On one hand, the
anonymous system challenges new granted users to learn
the content of data files stored before their participation,
because it is impossible for new granted users to contact
with anonymous data owners, and obtain the correspond-
ing decryption keys. On the other hand, an efficient
membership revocation mechanism without updating the
secret keys of the remaining users is also desired to
minimize the complexity of key management.
Several security schemes for data sharing on untrusted
servers have been proposed [4], [5], [6]. In these approaches,
data owners store the encrypted data files in untrusted
storage and distribute the corresponding decryption keys
only to authorized users. Thus, unauthorized users as well
as storage servers cannot learn the content of the data files
because they have no knowledge of the decryption keys.
1182 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 24, NO. 6, JUNE 2013
. X. Liu, B. Wang, and J. Yan are with the National Key Laboratory of
Integrated Services Networks, Xidian University, No. 2, Taibai Road, Xan
city 710071, Shaanxi province, China.
E-mail: {liuxf, bywang, yanjb}@mail.xidian.edu.cn, [email protected].
. Y. Zhang is with the National Computer Network Intrusion Protection
Center, Graduate University of Chinese Academy of Sciences, No. 19,
Yuquan Road, Beijing 100049, China.
E-mail: [email protected], [email protected].
Manuscript received 29 Feb. 2012; revised 1 Oct. 2012; accepted 22 Nov.
2012; published online 4 Dec. 2012.
Recommended for acceptance by V.B. Misic, R. Buyya, D. Milojicic, and
Y. Cui.
For information on obtaining reprints of this article, please send e-mail to:
[email protected], and reference IEEECS Log Number
TPDSSI-2012-02-0167.
Digital Object Identifier no. 10.1109/TPDS.2012.331.
1045-9219/13/$31.00 2013 IEEE Published by the IEEE Computer Society
However, the complexities of user participation and revoca-
tion in these schemes are linearly increasing with the
number of data owners and the number of revoked users,
respectively. By setting a group with a single attribute, Lu et
al. [7] proposed a secure provenance scheme based on the
ciphertext-policy attribute-based encryption technique [8],
which allows any member in a group to share data with
others. However, the issue of user revocation is not
addressed in their scheme. Yu et al. [3] presented a scalable
and fine-grained data access control scheme in cloud
computing based on the key policy attribute-based encryp-
tion (KP-ABE) technique [9]. Unfortunately, the single-
owner manner hinders the adoption of their scheme into the
case, where any user is granted to store and share data.
Our contributions. To solve the challenges presented
above, we propose Mona, a secure multi-owner data
sharing scheme for dynamic groups in the cloud. The main
contributions of this paper include:
1. We propose a secure multi-owner data sharing
scheme. It implies that any user in the group can
securely share data with others by the untrusted
cloud.
2. Our proposed scheme is able to support dynamic
groups efficiently. Specifically, new granted users
can directly decrypt data files uploaded before their
participation without contacting with data owners.
User revocation can be easily achieved through a
novel revocation list without updating the secret
keys of the remaining users. The size and computa-
tion overhead of encryption are constant and
independent with the number of revoked users.
3. We provide secure and privacy-preserving access
control to users, which guarantees any member in a
group to anonymously utilize the cloud resource.
Moreover, the real identities of data owners can be
revealed by the group manager when disputes occur.
4. We provide rigorous security analysis, and per-
form extensive simulations to demonstrate the
efficiency of our scheme in terms of storage and
computation overhead.
The remainder of this paper is organized as follows:
Section 2 overviews the related work. In Section 3, some
preliminaries and cryptographic primitives are reviewed. In
Section 4, we describe the system model and our design
goals. In Section 5, the proposed scheme is presented in
detail, followed by the security analysis and the perfor-
mance analysis in Sections 6 and 7. Finally, we conclude the
paper in Section 8.
2 RELATED WORK
In [4], Kallahalla et al. proposed a cryptographic storage
system that enables secure file sharing on untrusted servers,
named Plutus. By dividing files into filegroups and encrypt-
ing each filegroup with a unique file-block key, the data
owner can share the filegroups with others through deliver-
ing the corresponding lockbox key, where the lockbox key is
used to encrypt the file-block keys. However, it brings about
a heavy key distribution overheadfor large-scale file sharing.
Additionally, the file-block key needs to be updated and
distributed again for a user revocation.
In [5], files stored on the untrusted server include two
parts: file metadata and file data. The file metadata implies
the access control information including a series of
encrypted key blocks, each of which is encrypted under
the public key of authorized users. Thus, the size of the file
metadata is proportional to the number of authorized users.
The user revocation in the scheme is an intractable issue
especially for large-scale sharing, since the file metadata
needs to be updated. In their extension version, the NNL
construction [10] is used for efficient key revocation.
However, when a new user joins the group, the private
key of each user in an NNL system needs to be recomputed,
which may limit the application for dynamic groups.
Another concern is that the computation overhead of
encryption linearly increases with the sharing scale.
Ateniese et al. [6] leveraged proxy reencryptions to
secure distributed storage. Specifically, the data owner
encrypts blocks of content with unique and symmetric
content keys, which are further encrypted under a master
public key. For access control, the server uses proxy
cryptography to directly reencrypt the appropriate content
key(s) from the master public key to a granted users public
key. Unfortunately, a collusion attack between the un-
trusted server and any revoked malicious user can be
launched, which enables them to learn the decryption keys
of all the encrypted blocks.
In [3], Yu et al. presented a scalable and fine-grained data
access control scheme in cloud computing based on the KP-
ABE technique. The data owner uses a random key to
encrypt a file, where the random key is further encrypted
with a set of attributes using KP-ABE. Then, the group
manager assigns an access structure and the corresponding
secret key to authorized users, such that a user can only
decrypt a ciphertext if and only if the data file attributes
satisfy the access structure. To achieve user revocation, the
manager delegates tasks of data file reencryption and user
secret key update to cloud servers. However, the single-
owner manner may hinder the implementation of applica-
tions with the scenario, where any member in a group
should be allowed to store and share data files with others.
Lu et al. [7] proposed a secure provenance scheme,
which is built upon group signatures and ciphertext-policy
attribute-based encryption techniques. Particularly, the
system in their scheme is set with a single attribute. Each
user obtains two keys after the registration: a group
signature key and an attribute key. Thus, any user is able
to encrypt a data file using attribute-based encryption and
others in the group can decrypt the encrypted data using
their attribute keys. Meanwhile, the user signs encrypted
data with her group signature key for privacy preserving
and traceability. However, user revocation is not supported
in their scheme.
From the above analysis, we can observe that how to
securely share data files in a multiple-owner manner for
dynamic groups while preserving identity privacy from an
untrusted cloud remains to be a challenging issue. In this
paper, we propose a novel Mona protocol for secure data
sharing in cloud computing. Compared with the existing
works, Mona offers unique features as follows:
1. Any user in the group can store and share data files
with others by the cloud.
LIU ET AL.: MONA: SECURE MULTI-OWNER DATA SHARING FOR DYNAMIC GROUPS IN THE CLOUD 1183
2. The encryption complexity and size of ciphertexts
are independent with the number of revoked users
in the system.
3. User revocation can be achieved without updating
the private keys of the remaining users.
4. A new user can directly decrypt the files stored in
the cloud before his participation.
3 PRELIMINARIES
3.1 Bilinear Maps
Let G
1
and G
2
be an additive cyclic group and a
multiplicative cyclic group of the same prime order ,
respectively [11]. Let c : G
1
G
1
! G
2
denote a bilinear
map constructed with the following properties:
1. Bilinear: For all o. / 2 7

and 1. Q 2 G
1
, co1. /Q
c1. Q
o/
.
2. Nondegenerate: There exists a point 1 such that
c1. 1 6 1.
3. Computable: There is an efficient algorithm to
compute c1. Q for any 1. Q 2 G
1
.
3.2 Complexity Assumptions
Definition 1 (-strong Diffie-Hellman (-SDH) Assump-
tion [12]). Given 1
1
. 1
2
. 1
2
.
2
1
2
. . . . .

1
2
, it is infeasible
to compute
1
r
1
1
, where r 2 7

.
Definition 2 (Decision linear (DL) Assumption [12]). Given
1
1
. 1
2
. 1
3
. o1
1
. /1
2
. c1
3
, it is infeasible to decide whether o
/ c mod .
Definition 3 (Weak Bilinear Diffie-Hellman Exponent
(WBDHE) Assumption [13]). For unknown o 2 7

, given
Y . oY . o
2
Y . ... o
|
Y . 1 2 G
1
, it is infeasible to compute cY . 1
1
o
.
Definition 4 ((t,n)-general Diffie-Hellman Exponent
(GDHE) Assumption [14]). Let )A
i
i1
A r
i
and
qA
ii
i1
A r
0
i
be the two random univariate poly-
nomials. For unknown /. 2 7

, given
G
0
. G
0
. ....
t1
G
0
. )G
0
. 1
0
. ....
t1
1
0
. /qH
0
2 G
1
and
cG
0
. H
0

)
2
q
2 G
2
.
it is infeasible to compute cG
0
. H
0

/)q
2 G
2
.
3.3 Group Signature
The concept of group signatures was first introduced in [15]
by Chaum and van Heyst. In general, a group signature
scheme allows any member of the group to sign messages
while keeping the identity secret from verifiers. Besides, the
designated group manager can reveal the identity of the
signatures originator when a dispute occurs, which is
denoted as traceability. In this paper, a variant of the short
group signature scheme [12] will be used to achieve
anonymous access control, as it supports efficient member-
ship revocation.
3.4 Dynamic Broadcast Encryption
Broadcast encryption [16] enables a broadcaster to
transmit encrypted data to a set of users so that only a
privileged subset of users can decrypt the data. Besides
the above characteristics, dynamic broadcast encryption
also allows the group manager to dynamically include
new members while preserving previously computed
information, i.e., user decryption keys need not be
recomputed, the morphology and size of ciphertexts are
unchanged and the group encryption key requires no
modification. The first formal definition and construction
of dynamic broadcast encryption are introduced based on
the bilinear pairing technique in [14], which will be used
as the basis for file sharing in dynamic groups.
4 SYSTEM MODEL AND DESIGN GOALS
4.1 System Model
We consider a cloud computing architecture by combining
with an example that a company uses a cloud to enable
its staffs in the same group or department to share files.
The system model consists of three different entities: the
cloud, a group manager (i.e., the company manager), and
a large number of group members (i.e., the staffs) as
illustrated in Fig. 1.
Cloud is operated by CSPs and provides priced abundant
storage services. However, the cloud is not fully trusted by
users since the CSPs are very likely to be outside of the
cloud users trusted domain. Similar to [3], [7], we assume
that the cloud server is honest but curious. That is, the cloud
server will not maliciously delete or modify user data due
to the protection of data auditing schemes [17], [18], but will
try to learn the content of the stored data and the identities
of cloud users.
Group manager takes charge of system parameters
generation, user registration, user revocation, and revealing
the real identity of a dispute data owner. In the given
example, the group manager is acted by the administrator
of the company. Therefore, we assume that the group
manager is fully trusted by the other parties.
Group members are a set of registered users that will store
their private data into the cloud server and share them with
others in the group. In our example, the staffs play the role
of group members. Note that, the group membership is
dynamically changed, due to the staff resignation and new
employee participation in the company.
4.2 Design Goals
In this section, we describe the main design goals of the
proposed scheme including access control, data confidenti-
ality, anonymity and traceability, and efficiency as follows:
Access control: The requirement of access control is twofold.
First, group members are able to use the cloud resource for
data operations. Second, unauthorized users cannot access
the cloud resource at any time, and revoked users will be
incapable of using the cloud again once they are revoked.
Data confidentiality: Data confidentiality requires that
unauthorized users including the cloud are incapable of
1184 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 24, NO. 6, JUNE 2013
Fig. 1. System model.
learning the content of the stored data. An important and
challenging issue for data confidentiality is to maintain its
availability for dynamic groups. Specifically, new users
should decrypt the data stored in the cloud before their
participation, and revoked users are unable to decrypt the
data moved into the cloud after the revocation.
Anonymity and traceability: Anonymity guarantees that
group members can access the cloud without revealing the
real identity. Although anonymity represents an effective
protection for user identity, it also poses a potential inside
attack risk to the system. For example, an inside attacker
may store and share a mendacious information to derive
substantial benefit. Thus, to tackle the inside attack, the
group manager should have the ability to reveal the real
identities of data owners.
Efficiency: The efficiency is defined as follows: Any group
member can store and share data files with others in the
group by the cloud . User revocation can be achieved
without involving the remaining users. That is, the
remaining users do not need to update their private keys
or reencryption operations. New granted users can learn all
the content data files stored before his participation without
contacting with the data owner.
5 THE PROPOSED SCHEME: MONA
5.1 Overview
To achieve secure data sharing for dynamic groups in the
cloud, we expect to combine the group signature and
dynamic broadcast encryption techniques. Specially, the
group signature scheme enables users to anonymously use
the cloud resources, and the dynamic broadcast encryption
technique allows data owners to securely share their data
files with others including new joining users.
Unfortunately, each user has to compute revocation
parameters to protect the confidentiality from the revoked
users in the dynamic broadcast encryption scheme, which
results in that both the computation overhead of the
encryption and the size of the ciphertext increase with the
number of revoked users. Thus, the heavy overhead and
large ciphertext size may hinder the adoption of the
broadcast encryption scheme to capacity-limited users.
To tackle this challenging issue, we let the group
manager compute the revocation parameters and make
the result public available by migrating them into the cloud.
Such a design can significantly reduce the computation
overhead of users to encrypt files and the ciphertext size.
Specially, the computation overhead of users for encryption
operations and the ciphertext size are constant and
independent of the revocation users.
5.2 Scheme Description
This section describes the details of Mona including system
initialization, user registration, user revocation, file genera-
tion, file deletion, file access and traceability.
5.2.1 System Initialization
The group manager takes charge of system initialization
as follows:
. Generating a bilinear map group system o . G
1
.
G
2
. c. .
. Selecting two random elements H. H
0
2 G
1
along
with two random numbers
1
.
2
2 7

, and comput-
i ng l
1
1
H and \
1
2
H 2 G
1
such t hat

1
l
2
\ H. In addition, the group manager
computes H
1

1
H
0
and H
2

2
H
0
2 G
1
.
. Randomly choosing two elements 1. G 2 G
1
and a
number 2 7

, and computing \ 1, Y G
and 7 cG. 1, respectively.
. Publishing the system parameters including o. 1.
H. H
0
. H
1
. H
2
. l. \ . \. Y . 7. ). )
1
. 1ic, where ) is
a one-way hash function: f0. 1g

! 7

; )
1
is hash
function: f0. 1g

! G
1
; and 1ic
/
is a secure
symmetric encryption algorithm with secret key /.
In the end, the parameter .
1
.
2
. G will be kept secret
as the master key of the group manager.
5.2.2 User Registration
For the registration of user i with identity 11
i
, the group
manager randomly selects a number r
i
2 7

and computes

i
. 1
i
as the following equation:

i

1
r
i
1 2 G
1
1
i

r
i
r
i
G 2 G
1
.
8
>
<
>
:
1
Then, the group manager adds
i
. r
i
. 11
i
into the
group user list, which will be used in the traceability phase.
After the registration, user i obtains a private key
r
i
.
i
. 1
i
, which will be used for group signature genera-
tion and file decryption.
5.2.3 User Revocation
User revocation is performed by the group manager via a
public available revocation list 11, based on which group
members can encrypt their data files and ensure the
confidentiality against the revoked users. As illustrated in
Table 1, the revocation list is characterized by a series of
time stamps (t
1
< t
2
<. .... t
i
). Let 11
qionj
denote the group
identity. The tuple
i
. r
i
. t
i
represents that user i with the
partial private key (
i
. r
i
) is revoked at time t
i
. 1
1
. 1
2
. .... 1
i
and 7
i
are calculated by the group manager with the
private secret as follows:
1
1

1
r
1
1 2 G
1
1
2

1
r
1
r
2

1 2 G
1

1
i

1
r
1
r
2
r
i

1 2 G
1
7
i
7
1
r
1
r
2
r
i

2 G
2
.
8
>
>
>
>
>
>
>
>
>
>
>
<
>
>
>
>
>
>
>
>
>
>
>
:
2
Motivated by the verifiable reply mechanism in [19], to
guarantee that users obtain the latest version of the
LIU ET AL.: MONA: SECURE MULTI-OWNER DATA SHARING FOR DYNAMIC GROUPS IN THE CLOUD 1185
TABLE 1
Revocation List
revocation list, we let the group manger update the
revocation list each day even no user has being revoked in
the day. In other words, the others can verify the freshness
of the revocation list from the contained current date t
11
. In
addition, the revocation list is bounded by a signature
:iq11 to declare its validity. The signature is generated by
the group manager with the BLS signature algorithm [20],
i.e., :iq11 )
1
11. Finally, the group manager mi-
grates the revocation list into the cloud for public usage.
5.2.4 File Generation
To store and share a data file in the cloud, a group member
performs the following operations:
1. Getting the revocation list from the cloud. In this
step, the member sends the group identity 11
qionj
as
a request to the cloud. Then, the cloud responds the
revocation list 11 to the member.
2. Verifying the validity of the received revocation list.
First, checking whether the marked date is fresh.
Second, verifying the contained signature :iq

11 by
the equation c\. )
1
11 c1. :iq11. If the
revocation list is invalid, the data owner stops this
scheme.
3. Encrypting the data file `. This encryption process
can be divided into two cases according to the
revocation list.
a. Case 1. There is no revoked user in the revocation
list:
i. Selecting a unique data file identity 11
doto
;
ii. Choosing a random number / 2 7

;
iii. Computing the parameters C
1
. C
2
. 1. C as
the following equation:
C
1
/ Y 2 G
1
C
2
/ 1 2 G
1
1 7
/
2 G
2
C 1ic
1
`.
8
>
>
<
>
>
:
3
b. Case 2. There are i revoked users in the revocation
list.
i. Selecting a unique data file identity 11
doto
;
ii. Choosing a random number / 2 7

;
iii. Computing the parameters C
1
. C
2
. 1. C as
the following equation:
C
1
/ Y 2 G
1
C
2
/ 1
i
2 G
1
1 7
/
i
2 G
2
C 1ic
1
`.
8
>
>
<
>
>
:
4
In (4), 7
i
and 1
i
are directly obtained
from the revocation list.
4. Selecting a random number t and computing )t.
The hash value will be used for data file deletion
operation. In addition, the data owner adds
11
doto
. t into his local storage.
5. Constructing the uploaded data file as shown in
Table 2, where t
doto
denotes the current time on the
member, and o is a group signature on 11
doto
. C
1
.
C
2
. C. )t. t
doto
computed by the data owner
through Algorithm 1 with the private key . r.
6. Uploading the data shown in Table 2 into the cloud
server and adding the 11
doto
into the local shared
data list maintained by the manager. On receiving the
data, the cloud first invokes Algorithm 2 to check its
validity. If the algorithm returns true, the group
signature is valid; otherwise, the cloud abandons the
data. In addition, if several users have been revoked
by the group manager, the cloud also performs
revocation verification by using Algorithm 3. Finally,
the data file will be stored in the cloud after successful
group signature and revocation verifications.
5.2.5 File Deletion
File stored in the cloud can be deleted by either the group
manager or the data owner (i.e., the member who uploaded
the file into the server). To delete a file 11
doto
, the group
manager computes a signature )
1
11
doto
and sends the
signature along with 11
doto
to the cloud. The cloud will
delete the file if the equation c)
1
11
doto
. 1 c\.
)
1
11
doto
holds.
Algorithm (1). Signature Generation
Input: Private key . r, system parameter 1. l. \ . H. \
and data `.
Output: Generate a valid group signature on `.
begin
Select random numbers c. u. i
c
. i
u
. i
r
. i
c
1
. i
c
2
2 7

Set c
1
rc and c
2
ru
Computes the following values
T
1
c l
T
2
u \
T
3

i
c u H
1
1
i
c
l
1
2
i
u
\
1
3
cT
3
. 1
i
r
cH. \
i
c
i
u
cH. 1
i
c
1
i
c
2
1
4
i
r
T
1
i
c
1
l
1
5
i
r
T
2
i
c
2
\
8
>
>
>
>
>
>
>
>
>
>
<
>
>
>
>
>
>
>
>
>
>
:
.
Set c )`. T
1
. T
2
. T
3
. 1
1
. 1
2
. 1
3
. 1
4
. 1
5

Construct the following numbers

:
c
i
c
cc
:
u
i
u
cu
:
r
i
r
cr
:
c
1
i
c
1
cc
1
:
c
2
i
c
2
cc
2
8
>
>
>
>
<
>
>
>
>
:
.
Return o T
1
. T
2
. T
3
. c. :
c
. :
u
. :
r
. :
c
1
. :
c
2

end
Algorithm (2). Signature Verification
Input: System parameter 1. l. \ . H. \, ` and a
signature o T
1
. T
2
. T
3
. c. :
c
. :
u
. :
r
. :
c
1
. :
c
2

1186 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 24, NO. 6, JUNE 2013
TABLE 2
Message Format for Uploading Data
Output: True or False.
begin
Compute the following values
~
1
1
:
c
l c T
1
~
1
2
:
u
\ c T
2
~
1
3

cT
3
. \
c1. 1

c
cT
3
. 1
:
r
cH. \
:
c
:
u
cH. 1
:
c
1
:
c
2
~
1
4
:
r
T
1
:
c
1
l
~
1
5
:
r
T
2
:
c
2
\
8
>
>
>
>
>
>
>
>
<
>
>
>
>
>
>
>
>
:
.
if c )`. T
1
. T
2
. T
3
.
f
1
1
.
f
1
2
.
f
1
3
.
f
1
4
.
f
1
5

Return True
else
Return False
end
Algorithm (3). Revocation Verification
Input: System parameter H
0
. H
1
. H
2
, a group signature
o, and a set of revocation keys
1
. ....
i
Output: Valid or Invalid.
begin
set tcij cT
1
. H
1
cT
2
. H
2

for i 1 to i
if cT
3

i
. H
0
tcij
Return Valid
end if
end for
Return Invalid
end
In addition, Mona also allows data owners to delete their
files stored in the cloud. Specially, the data owner does the
following actions:
. Obtaining the tuple 11
doto
. t from his local storage.
. Invoking Algorithm 1 to compute a group signature
on 11
doto
. t.
. Sending 11
doto
. t and the signature as a deletion
request to the cloud.
Upon receiving the deletion request, the cloud calls
Algorithms 2 and 3 to verify the group signature. After a
successful group signature verification, the cloud will
delete the data file if )t equals to the hash value
contained in the file.
5.2.6 File Access
To learn the content of a shared file, a member does the
following actions:
1. Getting the data file and the revocation list from the
cloud server. In this operation, the user first adopts
its private key . r to compute a signature o
n
on
the message 11
qionj
. 11
doto
. t by using Algorithm 1,
where t denote the current time, and the 11
doto
can
be obtained from the local shared file list maintained
by the manager. Then, the user sends a data request
containing 11
qionj
. 11
doto
. t. o
n
to the cloud server.
Upon receiving the request, the cloud server
employs Algorithm 2 to check the validity of the
signature and performs a revocation verification
with Algorithm 3 if necessary according to the
revocation list. After a successful verification, the
cloud server responds the corresponding data file
and the revocation list to the user.
2. Checking the validity of the revocation list. This
operation is similar to the step 2 of file generation
phase.
3. Verifying the validity of the file and decrypting it.
The format of the downloaded file coincides with
that given in Table 2. This operation can be divided
into three cases according to the time stamp t
doto
and
the revocation list. Suppose that there are i revoked
users in the revocation list.
a. Case 1 t
doto
< t
1
. This case indicates that there is
no revoked user before the data file is uploaded
i. Invoking Algorithm 2 to check the group
signature o. If the algorithm returns false,
the user stops this protocol.
ii. Using his partial private key . 1 to
compute
^
1 cC
1
. cC
2
. 1.
iii. Decrypting the ciphertext C with the com-
puted key
^
1.
Correctness:
^
1 cC
1
. cC
2
. 1
c / Y .
1
r
1

c / 1.
r
r
G

cG. 1
/
r
c1. G
/r
r
7
/
1.
b. Case 2 t
i
< t
doto
< t
i1
. This case indicates that i
revoked users have been revoked before the
data file is uploaded
i. Verifying the group signature o by using
Algorithm 2.
ii. Inputting
1
.
2
. ...
i
to call Algorithm 3. If
the algorithm returns invalid, the user
terminates this operation.
iii. Computing the value

i.i

1
r
Q
i
`1
r
`

1
by using Algorithm 4 with the input . r.
1
1
. r
1
. .... 1
i
. r
i
. The correctness of
i.i
is
due to the following relation:
1
r r
i
1
i

1
r
Q
i1
`1
r
`

1
!

1
r r
i
r r
i

r r
i

Q
i1
`1
r
`

!
1

1
r
Q
i
`1
r
`

1.
iv. Calculating the decryption key
^
1 cC
1
.

i.i
cC
2
. 1.
v. Decrypt the ciphertext C with the key
^
1.
LIU ET AL.: MONA: SECURE MULTI-OWNER DATA SHARING FOR DYNAMIC GROUPS IN THE CLOUD 1187
Correctness
cC
1
.
i.i
cC
2
. 1
c /Y .
1
r
Q
i
`1
r
`

1
!
c /1
i
.
r
r
G

c1. G
/
r
Q
i
`1
r
`

c1. G
/r
r
Q
i
`1
r
`

c1. G
//r
r
Q
i
`1
r
`

7
/
i
1.
c. Case 3 t
i
< t
doto
. This case indicates that i
revoked users have been revoked before the
data file is uploaded
i. Verifying the group signature o by using
Algorithm 2.
ii. Inputting
1
.
2
. ...
i
to call Algorithm 3. If
the algorithm returns invalid, the user
terminates this operation.
iii. Computing the value

i.i

1
r
Q
i
`1
r
`

1
by using Algorithm 4 with the input . r.
1
1
. r
1
. .... 1
i
. r
i
.
iv. Calculating the decryption key
^
1 cC
1
.

i.i
cC
2
. 1.
v. Decrypting the ciphertext C with the key
^
1.
5.2.7 Traceability
When a data dispute occurs, the tracing operation is
performed by the group manager to identify the real
identity of the data owner. Given a signature o T
1
. T
2
.
T
3
. c. :
c
. :
u
. :
r
. :
c
1
. :
c
2
, the group manager employs his
private key
1
.
2
to compute
i
T
3

1
T
1

2
T
2
.
Given the parameter
i
, the group manager can look up the
user list to find the corresponding identity.
Algorithm 4. Parameters Computing
Input: The revoked user parameters 1
1
. r
1
. .... 1
i
. r
i
,
and the private key . r.
Output:
i.i
or NULL
begin
set tcij
for ` 1 to i
if r r
`
return NULL
else
set tcij
1
rr
`
1
`
tcij
return tcij
end
6 SECURITY ANALYSIS
In this section, we prove the security of Mona in terms of
access control, data confidentiality, anonymity and trace-
ability that are defined in Section 4.2.
Theorem 1. Based on the group signature technique, the
proposed scheme can achieve efficient access control.
Proof. To access the cloud, a user needs to compute a group
signature for his/her authentication. The employed
group signature scheme can be regarded as a variant of
the short group signature [12], which inherits the inherent
unforgeability property, anonymous authentication, and
tracking capability. The demonstration of Theorem 1 can
be derived from the following three lemmas: tu
Lemma 1.1. Unrevoked users are able to access the cloud.
Proof. The proof of Lemma1.1 is equivalent tothe correctness
of Algorithm 2 (group signature verification).
~
1
1
1
1
holds since
~
1
1
:
c
l c T
1
i
c
ccl c c l
1
1
. Analogously, we can directly obtain
~
1
2
1
2
.
~
1
4
1
4
.
~
1
5
1
5
.
~
1
3
1
3
holds due to the following relations:
~
1
3

cT
3
. \
c1. 1

c
cT
3
. 1
:
r
cH. \
:
c
:
u
cH. 1
:
c
1
:
c
2

cT
3
. \
c1. 1

c
cT
3
. 1
i
r
cr
i
cH. \
i
c
cci
u
cu
cH. 1
i
c
1
cr
i
ci
c
2
cr
i
u

cT
3
. \
c1. 1

c
cT
3
. r
i
1
c
cc uH. \ r
i
1
c
cT
3
. 1
i
r
cH. \
i
c
i
u
cH. 1
i
c
1
i
c
2

cT
3
. \
c1. 1

c
cT
3
. r
i
1
c
cc uH. \ r
i
1
c
1
3

cT
3
. \
c1. 1

c
cT
3
c uH. \ r
i
1
c
cT
3
. \
c
1
3

c
i
. \ r
i
1
c1. 1

c
1
3
1
3
.
ut
Lemma 1.2. Revoked users cannot utilize the cloud after their
revocation.
Proof. Lemma 1.2 is equivalent to the correctness of
Algorithm 3 (revocation verification). The correctness of
revocation verification is based on the following relation:
cT
3

i
. H
0
c
i
c u H
i
. H
0

ccH. H
0
cuH. H
0

ccl.
1
H
0
cu\ .
2
H
0

cT
1
. H
1
cT
2
. H
2
.
ut
Lemma 1.3. An attacker is unable to access the cloud server based
on the assumption of the intractability of q-SDHproblem in G
1
.
Proof. The brief security analysis can be shown as follows:
Suppose that an attacker A succeeds to forge a valid
group signature with a nonnegligible probability in
polynomial time. In addition, we assume ) is a random
oracle. According to the Forking Lemma [21], by using the
1188 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 24, NO. 6, JUNE 2013
oracle replay technique, the attacker A obtains two valid
signatures `. o
0
. c. o
1
and `. o
0
. c
0
. o
0
1
as follows:
o
0
T
1
. T
2
. T
3
. c. 1
1
. 1
2
. 1
3
. 1
4
. 1
5

c )`. T
1
. T
2
. T
3
. 1
1
. 1
2
. 1
3
. 1
4
. 1
5

c
0
)
0
`. T
1
. T
2
. T
3
. 1
1
. 1
2
. 1
3
. 1
4
. 1
5

o
1
:
c
. :
u
. :
r
. :
c
1
. :
c
2

o
0
1
:
0
c
. :
0
u
. :
0
r
. :
0
c
1
. :
0
c
2

8
>
>
>
>
<
>
>
>
>
:
5
:
c
i
c
cc. :
0
c
i
c
c
0
c
:
u
i
u
cu. :
0
u
i
u
c
0
u
:
r
i
r
cr. :
0
r
i
r
c
0
r
:
c
1
i
c
1
cc
1
. :
0
c
1
i
c
1
c
0
c
1
:
c
2
i
c
2
cc
2
. :
0
c
2
i
c
2
c
0
c
2
.
8
>
>
>
>
>
<
>
>
>
>
>
:
6
Then, A can compute an SDH tuple ^ r :
r
,c.
^

T
3
:
c
:
u
,c H such that
^

1
^ r
and
c
^
. \ ^ r1 c1. 1.
where :
r
:
r
:
0
r
, c c c
0
, :
c
:
c
:
0
c
, and
:
u
:
u
:
0
u
. Obviously, this contradicts with q-SDH
assumption. tu
Theorem 2. The proposed scheme supports privacy preserving
and traceability.
Proof. The demonstration of this theoremis twofold. On one
hand, the groupmanager has the ability to identifythe real
signer. Given a valid group signature o T
1
. T
2
. T
3
. c. :
c
.
:
u
. :
r
. :
c
1
. :
c
2
and the private tuple
1
.
2
, the group
manger can compute the private key of the signer through
the equation
i
T
3

1
T
1

2
T
2
. The correctness
of the equation holds based on the following relation:
T
3

1
T
1

2
T
2

i
c u
H
1
c l
2
u \
i
.
On the other hand, other entities cannot reveal the
signers identity from a group signature. Otherwise, DL
assumption will be in contradiction. Further proofs about
the correctness, unforgeability, anonymity and traceabil-
ity of group signatures can be found in [12]. tu
Theorem 3. The proposed scheme protects data confidentiality
under the hardness of the WBDHEproblemandGDHEproblem.
Proof. Theorem 3 can be deduced from the following two
lemmas:
Lemma 3.1. The cloud server is unable to learn the content of the
stored files.
Proof. To prove this lemma, we take a data file C
1
. C
2
. C as
an example to demonstrate the data confidentiality,
where C
1
/ Y . C
2
/ 1. 1 7
/
. C 1ic
1
` and
no user has been revoked before the data file is uploaded.
Suppose that the cloud server can compute 1 7
/
, i.e.,
given C
1
/ Y . C
2
/ 1. 1, for unknown , comput-
ing cC
1
. 1
1

cG. 1
/
1. This contradicts with the
WBDHE assumption. On the other hand, given the
revocation list, the cloud server learns the partial private
key of a revoked user i, i.e.,
i
. r
i
for a revoked user.
Without the knowledge of the other part private key 1
i
, it
is also unable to compute the decryption key through the
equation cC
1
.
i
cC
2
. 1
i
7
/
. Thus, the correctness of
Lemma 3.1 can be ensured. tu
Lemma 3.2. Even under the collusion with revoked users, the
cloud server is also incapable of learning the content of the files
stored after their revocation.
Proof. We first define two polynomial functions )A

i
i1
A r
i
and qA
ii
i1
A r
0
i
. Let G
0
and 1
0
denote two elements in group G
1
. Then, we set G
)G
0
and 1 )q1
0
. To maintain the confidenti-
ality against the revoked users, the data owner computes
the header information C
1
. C
2
and the encryption key 1
as follows:
C
1
/Y /) G
0
C
2
/1
i

/
r
1
r
2
r
i

1 /q1
0
1 7
/
i
7
/
r
1
r
2
ri
7
/
)
cG. 1
)
cG
0
. H
0

/)q
.
8
>
>
>
>
<
>
>
>
>
:
7
We can observe that it is impossible for revoked users to
compute the encryption key 1, since given /) G
0
and/q1
0
, computing cG
0
. H
0

/)q
is an instance of
(t,n)-GDHE problem, which has been demonstrated to be
intractable in polynomial time [14]. tu
By the analysis above, we conclude that the proposed
scheme achieves the security goals including access control,
data confidentiality as well as anonymity and traceability.
7 PERFORMANCE EVALUATION
In this section, we first analyze the storage cost of Mona,
and then perform experiments to test its computation cost.
7.1 Storage
Without loss of generality, we set 160 and the elements
in G
1
and G
2
to be 161 and 1,024 bit, respectively. In
addition, we assume the size of the data identity is 16 bits,
which yield a group capacity of 2
16
data files. Similarly, the
size of user and group identity are also set as 16 bits.
Group manager. In Mona, the master private key of the
group manager is G. .
1
.
2
2 G
1
7

3
. Additionally,
the user list and the shared data list should be stored at the
group manager. Considering an actual systemwith 200 users
and assuming that each user share 50 files in average, the
total storage of the groupmanager is 80.125 42.125 200
2 10. 000 10
3
28.5 Kbytes, which is very acceptable.
Group members. Essentially, each user in our scheme only
needs to store its private key
i
. 1
i
. r
i
2 G
1
2
7

, which
is about 60 bytes. It is worth noting that there is a tradeoff
between the storage and the computation overhead. For
example, the four pairing operations including cH.
\. cH. 1. c1. 1. c
i
. 1 2 G
2
4
can be precomputed
once and stored for the group signature generation and
verification. Therefore, the total storage of each users is
about 572 bytes.
The extra storage overhead in the cloud. In Mona, the format
of files stored in the cloud is shown in Table 2. Since C
3
is the
ciphertext of the file under the symmetrical encryption, the
extra storage overhead to store the file is about 248 bytes,
which includes 11
qionj
. 11
doto
. C
1
. C
2
. C
3
. )t. t
doto
. o.
LIU ET AL.: MONA: SECURE MULTI-OWNER DATA SHARING FOR DYNAMIC GROUPS IN THE CLOUD 1189
7.2 Simulation
To study the performance, we have simulated Mona by
using C programming language with GMP Library [22],
Miracl Library [23], and PBC Library [24]. The simulation
consists of three components: client side, manager side as
well as cloud side. Both client-side and manager-side
processes are conducted on a laptop with Core 2 T7250
2.0 GHz, DDR2 800 2G, Ubuntu 10.04 X86. The cloud-side
process is implemented on a machine that equipped with
Core 2 i3-2350 2.3 GHz, DDR3 1066 2G,Ubuntu 12.04 X64. In
the simulation, we choose an elliptic curve with 160-bit
group order, which provides a competitive security level
with 1,024-bit RSA.
7.2.1 Client Computation Cost
In Fig. 2, we list the comparison on computation cost of
clients for data generation operations between Mona and the
way that directly using the original dynamic broadcast
encryption (ODBE) [14]. It is easily observed that the
computation cost in Mona is irrelevant to the number of
revoked users. On the contrary, the computation cost
increases with the number of revoked users in ODBE. The
reason is that the parameters 1
i
. 7
i
can be obtained from
the revocation list without sacrificing the security in Mona,
while several time-consuming operations including point
multiplications in G
1
and exponentiations in G
2
have to be
performed by clients to compute the parameters in ODBE.
FromFigs. 2a and2b, we can find out that sharing a 10-Mbyte
file and a 100-Mbyte one, cost a client about 0.2 and
1.4 seconds in our scheme, respectively, which implies that
the symmetrical encryption operation domains the compu-
tation cost when the file is large.
The computation cost of clients for file access operation
with the size of 10 and 100 Mbytes are illustrated in Fig. 3.
The computation cost in Mona increases with the number of
revoked users, as clients require to perform Algorithms 3
and 4 to compute the parameter
i.i
and check whether the
data owner is a revoked user. Besides the above operations,
1
1
. 1
2
. .... 1
i
need to be computed by clients in ODBE.
Therefore, Mona is still superior than ODBE in terms of
computation cost. Similar to the data generation operation,
the total computation cost is mainly determined by the
symmetrical decryption operation if the accessed file is large,
which can be verified from Figs. 3a and 3b. In addition, the
file deletion for clients is about 0.075 seconds, because it only
costs a group signature on a message 11
doto
. t, where t is a
160-bit number in 7

.
7.2.2 Cloud Computation Cost
To evaluate the performance of the cloud in Mona, we test
its computation cost to respond various client operation
requests including file generation, file access, and file
deletion. Assuming the sizes of requested files are 100 and
10 MB, the test results are given in Table 3. It can be seen that
the computation cost of the cloud is deemed acceptable,
even when the number of revoked users is large. This is
because the cloud only involves group signature and
revocation verifications to ensure the validity of the
requestor for all operations. In addition, it is worth noting
that the computation cost is independent with the size of the
requested file for access and deletion operations, since the
size of signed message is constant, e.g., 11
qionj
. 11
doto
. t in
file access and 11
doto
. t in file deletion requests as
described in Section 5.
8 CONCLUSION
In this paper, we design a secure data sharing scheme,
Mona, for dynamic groups in an untrusted cloud. In Mona,
a user is able to share data with others in the group without
revealing identity privacy to the cloud. Additionally, Mona
supports efficient user revocation and new user joining.
More specially, efficient user revocation can be achieved
through a public revocation list without updating the
private keys of the remaining users, and new users can
directly decrypt files stored in the cloud before their
participation. Moreover, the storage overhead and the
encryption computation cost are constant. Extensive ana-
lyses show that our proposed scheme satisfies the desired
security requirements and guarantees efficiency as well.
1190 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 24, NO. 6, JUNE 2013
Fig. 2. Comparison on computation cost for file generation between
Mona and ODBE [14].
Fig. 3. Comparison on computation cost for file access between Mona
and ODBE [14].
TABLE 3
Computation Cost of the Cloud (s)
ACKNOWLEDGMENTS
The authors thank the editors and anonymous reviewers for
their valuable comments to significantly improve the
quality of this paper. This work was supported in part by
the National Science Foundation of China under Grant
Nos. 60970140, 61272481, and 61272522.
REFERENCES
[1] M. Armbrust, A. Fox, R. Griffith, A.D. Joseph, R.H. Katz, A.
Konwinski, G. Lee, D.A. Patterson, A. Rabkin, I. Stoica, and M.
Zaharia, A View of Cloud Computing, Comm. ACM, vol. 53,
no. 4, pp. 50-58, Apr. 2010.
[2] S. Kamara and K. Lauter, Cryptographic Cloud Storage, Proc.
Intl Conf. Financial Cryptography and Data Security (FC), pp. 136-
149, Jan. 2010.
[3] S. Yu, C. Wang, K. Ren, and W. Lou, Achieving Secure, Scalable,
and Fine-Grained Data Access Control in Cloud Computing,
Proc. IEEE INFOCOM, pp. 534-542, 2010.
[4] M. Kallahalla, E. Riedel, R. Swaminathan, Q. Wang, and K. Fu,
Plutus: Scalable Secure File Sharing on Untrusted Storage, Proc.
USENIX Conf. File and Storage Technologies, pp. 29-42, 2003.
[5] E. Goh, H. Shacham, N. Modadugu, and D. Boneh, Sirius:
Securing Remote Untrusted Storage, Proc. Network and Distributed
Systems Security Symp. (NDSS), pp. 131-145, 2003.
[6] G. Ateniese, K. Fu, M. Green, and S. Hohenberger, Improved
Proxy Re-Encryption Schemes with Applications to Secure
Distributed Storage, Proc. Network and Distributed Systems Security
Symp. (NDSS), pp. 29-43, 2005.
[7] R. Lu, X. Lin, X. Liang, and X. Shen, Secure Provenance: The
Essential of Bread and Butter of Data Forensics in Cloud
Computing, Proc. ACM Symp. Information, Computer and Comm.
Security, pp. 282-292, 2010.
[8] B. Waters, Ciphertext-Policy Attribute-Based Encryption: An
Expressive, Efficient, and Provably Secure Realization, Proc. Intl
Conf. Practice and Theory in Public Key Cryptography Conf. Public Key
Cryptography, http://eprint.iacr.org/2008/290.pdf, 2008.
[9] V. Goyal, O. Pandey, A. Sahai, and B. Waters, Attribute-Based
Encryption for Fine-Grained Access Control of Encrypted
Data, Proc. ACM Conf. Computer and Comm. Security (CCS),
pp. 89-98, 2006.
[10] D. Naor, M. Naor, and J.B. Lotspiech, Revocation and Tracing
Schemes for Stateless Receivers, Proc. Ann. Intl Cryptology Conf.
Advances in Cryptology (CRYPTO), pp. 41-62, 2001.
[11] D. Boneh and M. Franklin, Identity-Based Encryption from the
Weil Pairing, Proc. Intl Cryptology Conf. Advances in Cryptology
(CRYPTO), pp. 213-229, 2001.
[12] D. Boneh, X. Boyen, and H. Shacham, Short Group Signature,
Proc. Intl Cryptology Conf. Advances in Cryptology (CRYPTO),
pp. 41-55, 2004.
[13] D. Boneh, X. Boyen, and E. Goh, Hierarchical Identity Based
Encryption with Constant Size Ciphertext, Proc. Ann. Intl Conf.
Theory and Applications of Cryptographic Techniques (EUROCRYPT),
pp. 440-456, 2005.
[14] C. Delerablee, P. Paillier, and D. Pointcheval, Fully Collusion
Secure Dynamic Broadcast Encryption with Constant-Size Ci-
phertexts or Decryption Keys, Proc. First Intl Conf. Pairing-Based
Cryptography, pp. 39-59, 2007.
[15] D. Chaum and E. van Heyst, Group Signatures, Proc. Intl Conf.
Theory and Applications of Cryptographic Techniques (EUROCRYPT),
pp. 257-265, 1991.
[16] A. Fiat and M. Naor, Broadcast Encryption, Proc. Intl Cryptology
Conf. Advances in Cryptology (CRYPTO), pp. 480-491, 1993.
[17] B. Wang, B. Li, and H. Li, Knox: Privacy-Preserving Auditing for
Shared Data with Large Groups in the Cloud, Proc. 10th Intl
Conf. Applied Cryptography and Network Security, pp. 507-525, 2012.
[18] C. Wang, Q. Wang, K. Ren, and W. Lou, Privacy-Preserving
Public Auditing for Data Storage Security in Cloud Computing,
Proc. IEEE INFOCOM, pp. 525-533, 2010.
[19] B. Sheng and Q. Li, Verifiable Privacy-Preserving Range Query
in Two-Tiered Sensor Networks, Proc. IEEE INFOCOM, pp. 46-
50, 2008.
[20] D. Boneh, B. Lynn, and H. Shacham, Short Signature from the
Weil Pairing, Proc. Intl Conf. Theory and Application of Cryptology
and Information Security: Advances in Cryptology, pp. 514-532, 2001.
[21] D. Pointcheval and J. Stern, Security Arguments for Digital
Signatures and Blind Signatures, J. Cryptology, vol. 13, no. 3,
pp. 361-396, 2000.
[22] The GNU Multiple Precision Arithmetic Library (GMP), http://
gmplib.org/, 2013.
[23] Multiprecision Integer and Rational Arithmetic C/C++ Library
(MIRACL), http://certivox.com/, 2013.
[24] The Pairing-Based Cryptography Library (PBC), http://crypto.
stanford.edu/pbc/howto.html, 2013.
Xuefeng Liu received the BSc degree in
information security from Xidian University,
China, 2007. He joined Xidian University in
2007 for the MSc and PhD degrees. His
research interests include wireless network
security, cloud computing, mobile computing
and applied cryptography.
Yuqing Zhang received the BSc and MSc
degrees in computer science from Xidian Uni-
versity, China, in 1987 and 1990, respectively.
He received the PhD degree in cryptography
from Xidian University in 2000. He is a professor
and supervisor of PhD students at the Graduate
University of Chinese Academy of Sciences. His
research interests include cryptography, wire-
less security and trust management. He is a
member of the IEEE.
Boyang Wang received the BS degree in
information security from Xidian University in
2007. He is currently working toward the PhD
degree from Xidian University, Xian, China. His
research interests focus on security and privacy
issues in cloud computing, social network and
network coding.
Jingbo Yan received the BSc degree in
information security from Xidian University,
China, 2009. He joined Xidian University in
2009 for the MSc and PhD degrees. His
research interests include privacy, applied cryp-
tography and computer security.
> For more information on this or any other computing topic,
please visit our Digital Library at www.computer.org/publications/dlib.
LIU ET AL.: MONA: SECURE MULTI-OWNER DATA SHARING FOR DYNAMIC GROUPS IN THE CLOUD 1191