Cloud Storage Access Control Using Ciphertext Policy Abe — Complete Documentation & Simulation

Overview & System Context

Cloud Storage Access Control Using Ciphertext Policy Abe: Comprehensive Web-Sourced Technical Investigation Exhaustive Research Dossier · Pure Web-Scraped Content: ~1692 Words · Real Software Screenshots: 3 1. Executive Overview & Technical Background Cloud computing security or cloud security refers to a broad set of policies, technologies, applications, and controls used to protect data, applications, services, and the associated infrastructure of cloud computing. It is a sub-domain of computer security, network security and, more broadly, information security.

Deterrent controls Administrative mechanisms intended to reduce attacks by informing attackers of consequences. Preventive controls Controls designed to reduce vulnerabilities and prevent unauthorized access. Detective controls Controls that detect and respond to security events. Includes monitoring, SIEM, IDS/IPS, malware detection. Corrective controls Controls that reduce the impact of an incident and restore systems.

Business continuity and data recovery Cloud providers have business continuity and data recovery plans in place to ensure service continuity and data protection. Log and audit trail In addition to producing logs and audit trails, cloud providers work with their customers to secure these logs and ensure they're accessible for forensic investigation (e.g., eDiscovery). Unique compliance requirements In addition to the requirements on customers, data centers used by cloud providers may be subject to additional compliance obligations. Using a cloud service provider (CSP) can lead to extra security concerns around data jurisdiction since customer or tenant data may not remain in the same location or provider's cloud.

Aside from the security and compliance issues already discussed, cloud providers and their customers negotiate terms around liability (stipulating how incidents involving data loss or compromise will be resolved, for example), intellectual property, and end-of-service (when data and applications are ultimately returned to the customer). These issues are typically addressed in service-level agreements (SLAs).

Figure 1: Towards Virtuous Cloud Data Storage Using Access Policy Hiding in ... Attribute-based encryption is a generalisation of public-key encryption which enables fine grained access control of encrypted data using authorisation policies. The secret key of a user and the ciphertext are dependent upon attributes (e.g. their email address, the country in which they live, or the kind of subscription they have). In such a system, the decryption of a ciphertext is possible only if the set of attributes of the user key matches the attributes of the ciphertext. A crucial security aspect of attribute-based encryption is collusion-resistance: An adversary that holds multiple keys should only be able to access data if at least one individual key grants access.

Each user X needs to periodically receive from the central authority the fresh private key corresponding to the time attribute, otherwise X will not be able to decrypt any message. It is a lazy revocation technique. The revoked user is not purged from the system until the current time period expires. This scheme requires an implicit time synchronization (a loose time synchronization may be sufficient) among the authority and the users.

This project is a secure cloud storage platform designed to ensure data privacy and fine-grained access control. Unlike traditional systems, this platform encrypts files locally before upload and uses Ciphertext-Policy Attribute-Based Encryption (CP-ABE) to manage access. Cloud file storage system with fine-grained access control using Attribute-Based Encryption (CP-ABE).

Figure 2: PPT - Cryptographic Approach for Delegation and Authorization in Cloud ... A comprehensive enterprise-grade file storage system implementing Hybrid Ciphertext-Policy Attribute-Based Encryption (CP-ABE) integrated with Supabase, AWS S3, Google Cloud Storage, and Local Storage , providing highly secure file management, multi-layer Attribute-Based Access Control (ABAC), and high-performance caching.

2. System Architecture & Core Working Principles PQC Only Repository: This main branch exclusively supports Post-Quantum Cryptography (PQC) features. The legacy CP-ABE only version is maintained in the legacy branch. Post-Quantum TLS Requirement: This system strictly enforces Hybrid ML-KEM-768 (Kyber) key exchange and ML-DSA-87 certificates. You MUST use Chrome or Edge version 150+ to successfully complete the TLS handshake. Older browsers or browsers without ML-DSA support will fail to connect.

This repository contains a robust Django-based implementation of a secure file sharing system. The system shifts away from traditional role-based security by enabling fine-grained access control mathematically bound to user attributes, providing zero-trust security for sensitive data. Note: The required C++ cryptography library ( libhybrid-cp-abe v4.0.0) is already included in the src/lib/ directory of this repository by default. You only need to visit the Hybrid-PQ-CP-ABE-Library repository if you wish to compile or update to a newer version.

Figure 3: A revocable storage CP-ABE scheme with constant ciphertext length in ... The system uses Docker Compose to orchestrate Django, Redis, Nginx, Vault, and OpenVPN. A start.py script is provided to simplify commands. Once the containers are successfully running ( python start.py --vpn status ), initialize the system. The initdata command will automatically migrate the database, seed ABAC policies, configure HashiCorp Vault, and create a default super admin account.

If you wish to access the internal network securely via OpenVPN, you can generate client profiles automatically. Ensure VPN_PUBLIC_IP and DOMAIN_NAME are correctly set in your .env . This command outputs two .ovpn files to your host machine ( johndoe_pqc.ovpn and johndoe_classic.ovpn ), complete with embedded keys and TLS-Crypt-V2 metadata.

(Advanced) You can also generate your own PQC Root CA and Server certificates to a specific directory: 3. Software Implementation, Frameworks & Protocols Detailed Swagger/OpenAPI documentation is available at /api/docs/ when the server is running. A comprehensive system implementing Post-Quantum Ready Hybrid Ciphertext-Policy Attribute-Based Encryption (CP-ABE) with Cloud Database integration, providing secure file storage, user management, Dual-Layer ML-DSA Signatures, and attribute-based access control resistant to quantum computing threats.

A comprehensive enterprise-grade file storage system implementing Hybrid Ciphertext-Policy Attribute-Based Encryption (CP-ABE) integrated with Supabase, AWS S3, Google Cloud Storage, and Local Storage , providing highly secure file management, multi-layer Attribute-Based Access Control (ABAC), and high-performance caching. PQC Only Repository: This main branch exclusively supports Post-Quantum Cryptography (PQC) features. The legacy CP-ABE only version is maintained in the legacy branch.

Post-Quantum TLS Requirement: This system strictly enforces Hybrid ML-KEM-768 (Kyber) key exchange and ML-DSA-87 certificates. You MUST use Chrome or Edge version 150+ to successfully complete the TLS handshake. Older browsers or browsers without ML-DSA support will fail to connect. This repository contains a robust Django-based implementation of a secure file sharing system. The system shifts away from traditional role-based security by enabling fine-grained access control mathematically bound to user attributes, providing zero-trust security for sensitive data.

Note: The required C++ cryptography library ( libhybrid-cp-abe v4.0.0) is already included in the src/lib/ directory of this repository by default. You only need to visit the Hybrid-PQ-CP-ABE-Library repository if you wish to compile or update to a newer version. The system uses Docker Compose to orchestrate Django, Redis, Nginx, Vault, and OpenVPN. A start.py script is provided to simplify commands.

Once the containers are successfully running ( python start.py --vpn status ), initialize the system. The initdata command will automatically migrate the database, seed ABAC policies, configure HashiCorp Vault, and create a default super admin account. 4. Practical Deployment, Analysis & Case Studies If you wish to access the internal network securely via OpenVPN, you can generate client profiles automatically. Ensure VPN_PUBLIC_IP and DOMAIN_NAME are correctly set in your .env .

This command outputs two .ovpn files to your host machine ( johndoe_pqc.ovpn and johndoe_classic.ovpn ), complete with embedded keys and TLS-Crypt-V2 metadata. (Advanced) You can also generate your own PQC Root CA and Server certificates to a specific directory: Detailed Swagger/OpenAPI documentation is available at /api/docs/ when the server is running.

A comprehensive system implementing Post-Quantum Ready Hybrid Ciphertext-Policy Attribute-Based Encryption (CP-ABE) with Cloud Database integration, providing secure file storage, user management, Dual-Layer ML-DSA Signatures, and attribute-based access control resistant to quantum computing threats. This project presents a secure cloud data-sharing prototype that demonstrates attribute-based access control using a simplified Ciphertext-Policy Attribute-Based Encryption (CP-ABE) workflow. The system integrates three layers: a Node.js/Express backend for persistence and API services, a Python Flask service that simulates the cryptographic policy engine, and a React/Vite frontend for user interaction and visual demonstration.

The objective of the system is to provide a practical and educational implementation of how access to encrypted data can be governed by attributes and policy expressions, rather than by static user roles alone. Although the cryptographic logic is simulated for prototype purposes, the overall architecture and interaction flow closely resemble a real CP-ABE-based system. Modern secure cloud-sharing systems often require access decisions to be made dynamically based on user attributes such as department, role, or organizational affiliation. Traditional role-based models are limited because they typically assign a single access level to a user. In contrast, attribute-based access control allows access to be granted when a user's attributes satisfy a policy condition.

This project implements a demonstration of that concept in a simple and understandable web application. It allows a user to: 5. Performance Evaluation & Extended Technical Observations Many cloud-sharing applications rely on basic identity checks or static permissions. These models often do not capture real-world access requirements in highly dynamic environments where users need access based on a combination of attributes rather than fixed predefined roles.

The project addresses this by illustrating how a policy-driven access model can be built and demonstrated through a lightweight prototype. It focuses on the workflow associated with attribute-based encryption concepts, rather than on delivering a production-grade cryptographic framework. The backend is implemented in Node.js using Express and Mongoose. It is responsible for: If MongoDB is unreachable, the system can continue in fallback mode using an in-memory strategy so the prototype remains usable for demonstration.

A Python Flask service is included to simulate the encryption and decryption policy engine. It exposes health and encryption/decryption endpoints and demonstrates the CP-ABE-style behavior required by the rest of the platform. The frontend is built with React and Vite. It provides a modern security-portal interface for: This approach allows the project to remain understandable for educational purposes while still modeling a realistic secure-sharing workflow.

The backend uses JWT-based authentication and password hashing for secure local demonstration. Uploaded files are stored locally, and metadata is persisted in the system database. The encrypted artifact is also saved on disk for demonstration. Harvested Online Documentation & Reference Sources • https://en.wikipedia.org/wiki/Cloud%20computing%20security • https://en.wikipedia.org/wiki/Attribute-based%20encryption • https://github.com/VictorMwango-Dev/Secure-Cloud-Storage-ABE • https://github.com/WanThinnn/Cloud-Policy-Quantum-Access • https://github.com/WanThinnn/Cloud-Policy-Crypto-Access/tree/main/ • https://github.com/Itop19/cpabe-cloud-sharing