A Security-Level-Aware KP-ABE Scheme with Attribute Revocation and Verifiable Outsourced Decryption for Intelligent Cloud Systems

Abstract

Intelligent cloud systems are increasingly used to support AI model training, inference services, and cross-domain data collaboration among cloud platforms, edge devices, and organizations. In such environments, data objects such as training samples, inference records, model files, and sensitive user information are frequently shared under different authorization and protection requirements. This creates a strong demand for fine-grained access control, dynamic privilege revocation, security-level-aware data protection, and lightweight decryption for users with limited computing resources. To meet these requirements, this paper presents a security-level-aware KP-ABE scheme that enables verifiable outsourced decryption and attribute revocation. In our construction, a data security level is bound to each ciphertext, while an authorized security level is embedded into each user secret key. Plaintext can be recovered only when the attribute set embedded in the ciphertext satisfies the corresponding access policy and the user's security level dominates the ciphertext level. For efficient revocation, the scheme uses a KEK tree and a DMS to refresh attribute-group keys and update the affected ciphertext components. This mechanism lowers user-side computation and prevents revoked users from collaborating with valid users to gain unauthorized access. Furthermore, costly decryption operations are delegated to the CSP, while a verification mechanism allows users to check transformed ciphertexts and detect tampering. The proposed scheme is proven to be sCPA-secure in the standard model, with performance evaluation showing that final decryption incurs only one local exponentiation.