Nowadays, vast and rapidly growing information acts as digital records of social activities and is widely collected and stored as economic assets. To reduce the difficulty and local data management’s cost significantly, cloud storage services provide a highly available, high-performance, and low-cost solution for user data hosting, enabling remote access, backup, and sharing of data stored by the cloud. However, this service model is not without security risks, including user privacy exposure, low trustworthiness of data, and unauthorized access. To address these concerns, attribute-based encryption
(ABE) schemes allow for the implementation of fine-grained access policies while ensure the confidentiality and availability of data stored under the cloud environment. The issues of collusion among authorities, excessive decryption computation overhead, and high complexity in attribute revocation have aroused many researchers’ attention, and many works have emerged. However, expanding the functionality of ABE schemes to satisfy multiple requirements and improving existing functionality of ABE schemes are still urgent problems to be solved.
Motivated by these problems, a research team led by Yanqing YAO published their new research on 15 April 2026 in Frontiers of Computer Science co-published by Higher Education Press and Springer Nature.
The team proposed a novel multi-functional multi-authority ABE scheme that incorporates functional features such as multi-authority key generation, outsourced decryption, malicious user tracking, flexible attribute revocation, and real-time policy updates, thereby providing fine-grained access control as well as confidentiality for data stored under cloud environments. Similar to prior works, they analyzed the static security, forward security, and resistance to collusion attacks of their proposed scheme for completeness. Storage and computational efficiency evaluation shows that their proposed scheme achieves lower storage costs and computational overhead compared to existing schemes with similar functionalities.
In the research, they present a multi-functional multi-authority ABE data sharing model. Based on the above model, they propose a multi-functional multi-authority ABE access control scheme which is traceable and revocable with high efficiency. This scheme adopts the multi-authority approach in ciphertext-policy ABE to achieve fine-grained access control while guaranteeing the confidentiality of cloud data. Here, data users can utilize the outsourcing servers to perform high-cost decryption operations, thereby reducing the computational burden on local terminals. By introducing attribute version keys in the scheme, authorities and cloud servers collaborate to execute efficient attribute revocation algorithms, achieving dual updates of keys and ciphertexts. Through delegating tracking servers to execute the white-box tracking algorithm, authorities can obtain the identities of users that maliciously leak decryption keys and expel them from the system. In addition, this scheme holds a flexible access policy update mechanism that allows data owners to change access permissions at any time and promptly updates the ciphertexts and access policies stored in the cloud.
They provide the correctness verification, security proofs and performance comparison results for their proposed scheme. The correctness verification confirms that their scheme can be performed correctly in algorithms such as encryption, decryption and outsourcing decryption. Similar to prior works, they give security proofs under a q−type assumption called q-1 assumption. They prove that this scheme can resist collusion attacks while maintaining static and forward security. By testing the operating costs of each algorithm module under different data scales, this scheme can significantly improve time efficiency, reduce key size, and shorten ciphertext length compared to known schemes, effectively decreasing the computation and storage costs.
Future work can focus on increasing the efficiency of the scheme and applying it to specific access control in the cloud environment.

DOI:10.1007/s11704-025-41356-7