Methods and systems for secure sharing of data between user devices using a proxy re-encryption key (PRE)

1. A method for secure sharing of data between user devices in a cloud storage system, the method comprising:

sharing at least one encrypted data object of a plurality of encrypted data objects of at least one first user device of a plurality of user devices stored in at least one cloud device with at least one second user device of the plurality of user devices through a key server using a Proxy Re-Encryption (PRE);

generating a master secret key (MSK) at a time of registration with the key server;

using the generated MSK to derive a private key;

using a key generation function of the PRE to derive a public key;

deriving a master secret key encryption key (MSKEK) to encrypt the MSK using at least one of a password and a passphrase selected by a user of the at least one first user device;

sharing the encrypted MSK and the public key with the key server for storage;

obtaining and decrypting the encrypted MSK from the key server with at least one of the password and the passphrase selected by the user of the at least one first user device;

deriving the private key corresponding to the at least one first user device using the decrypted MSK;

retrieving a public key corresponding to the at least one second user device from the key server;

deriving the re-key using the private key corresponding to the at least one first user device, the public key corresponding to the at least one second user device and a re-key generation function of the PRE; and

sharing the re-key with the key server marking as a key from the at least one first user device to the at least one second user device for sharing the at least one encrypted data object stored in the at least one cloud device with the at least one first user device.

2. The method of claim 1 , wherein the PRE is a unidirectional single-use PRE for multiple hops that controls the sharing of the at least one encrypted data object between the at least one first user device and the at least one second user device.

3. The method of claim 1 , wherein sharing the at least one encrypted data object of the at least one first user device with the at least one second user device includes:

uploading, by the at least one first user device, the plurality of encrypted data objects along with an encrypted file encryption key (FEK) to the at least one cloud device;

selecting, by the at least one first user device, the at least one encrypted data object from the plurality of encrypted data objects stored in the at least one cloud device for sharing with the at least one second user device;

retrieving and re-encrypting, by the key server, the at least one encrypted data object selected by the at least one first user device from the at least one cloud device; and

sharing, by the key server, the re-encrypted at least one encrypted data object of the at least one first user device with the at least one second user device.

4. The method of claim 3 , wherein uploading, by the at least one first user device, the plurality of encrypted data objects along with the encrypted FEK to the at least one cloud device includes:

deriving a FEK using a Master Secret Key (MSK) generated at the time of registration with the key server;

encrypting the FEK using a public key corresponding to the at least one first user device and an encrypt function of the PRE;

encrypting a plurality of data objects using the FEK; and

uploading the encrypted plurality of data objects along with the encrypted FEK to the at least one cloud device.

5. The method of claim 4 , wherein, on uploading the plurality of encrypted data objects along with the encrypted FEK to the at least one cloud device, the method comprises:

downloading the at least one encrypted data object along with the associated encrypted FEK from the at least one cloud device;

decrypting the at least one encrypted FEK using a decrypt function of the PRE and the private key corresponding to the at least one first user device to obtain the FEK; and

decrypting the at least one encrypted data object using the obtained FEK to derive the at least one data object.

6. The method of claim 3 , wherein re-encrypting, by the key server, the at least one encrypted data object includes re-encrypting the at least one encrypted data object using a re-key from the at least one first user device to the at least one second user device and a re-encrypt function of the PRE.

7. The method of claim 3 , further comprising decrypting, by the at least one second device, the re-encrypted data object of the at least one first user device using a private key corresponding to the at least one second user device and the decrypt function of the PRE.

8. The method of claim 3 , further comprising:

sending, by the key server, at least one notification to the at least one first user device to obtain a re-key from the at least one first user device to at least one third device when the at least one second user device wants to share the at least one encrypted data object of the at least one first user device with the at least one third device of the plurality of user devices;

re-encrypting, by the key server, the at least one encrypted data object from the at least one first user device to the at least one third user device on receiving the re-key from the at least one first user device to at least one third device from the at least one first user device; and

storing, by the key server, the re-encrypted encrypted data object of the at least one first user device in the at least one cloud device preferred by the at least one third user device, wherein the at least one third user device downloads the encrypted data object of the at least one first user device from the preferred at least one cloud device and decrypts the encrypted data object with the private key corresponding to the at least one third user device to obtain the at least one data object.

9. A cloud storage system comprising of a plurality of user devices, at least one cloud device and a key server, wherein the key server is to:

share at least one encrypted data object of a plurality of encrypted data objects of at least one first user device of the plurality of user devices stored in the at least one cloud device with at least one second user device of the plurality of user devices using a Proxy Re-Encryption (PRE); and

wherein the at least one first user device is to:

generate a master secret key (MSK) at a time of registration with the key server;

use the generated MSK to derive a private key;

use a key generation function of the PRE to derive a public key;

derive a master secret key encryption key (MSKEK) to encrypt the MSK using at least one of a password and a passphrase selected by a user of the at least one first user device;

share the encrypted MSK and the public key with the key server for storage;

obtain and decrypt the encrypted MSK from the key server with at least one of the password and the passphrase selected by the user of the at least one first user device;

derive the private key corresponding to the at least one first user device using the decrypted MSK;

retrieve a public key corresponding to the at least one second user device from the key server;

derive the re-key using the private key corresponding to the at least one first user device, the public key corresponding to the at least one second user device and a re-key generation function of the PRE; and

share the re-key with the key server marking as a key from the at least one first user device to the at least one second user device for sharing the at least one encrypted data object stored in the at least one cloud device with the at least one first user device.

10. The cloud storage system of claim 9 , wherein the PRE does not involve a bilinear paring operation and the PRE is a unidirectional single-use PRE for multiple hops that controls the sharing of the at least one encrypted data object between the at least one first user device and the at least one second user device.

11. The cloud storage system of claim 9 , wherein the at least one first user device is to:

upload the plurality of encrypted data objects along with an encrypted file encryption key (FEK) to the at least one cloud device;

select the at least one encrypted data object from the plurality of encrypted data objects stored in the at least one cloud device for sharing with the at least one second user device; and

wherein the key server is to:

retrieve and re-encrypt the at least one encrypted data object selected by the at least one first user device from the at least one cloud device; and

share the re-encrypted at least one encrypted data object of the at least one first user device with the at least one second user device.

12. The cloud storage system of claim 11 , wherein the at least one first user device is to:

derive a FEK using a Master Secret Key (MSK) generated at the time of registration with the key server;

encrypt the FEK using the public key corresponding to the at least one first user device and an encrypt function of the PRE;

encrypt a plurality of data objects using the FEK; and

upload the encrypted plurality of data objects along with the encrypted FEK to the at least one cloud device.

13. The cloud storage system of claim 12 , wherein, on uploading the plurality of encrypted data objects along with the encrypted FEK to the at least one cloud device, the at least one first user device is to:

download the at least one encrypted data object along with the associated encrypted FEK from the at least one cloud device;

decrypt the at least one encrypted FEK using a decrypt function of the PRE and the private key corresponding to the at least one first user device to obtain the FEK; and

decrypt the at least one encrypted data object using the obtained FEK to derive the at least one data object.

14. The cloud storage system of claim 11 , wherein the key server is to re-encrypt the at least one encrypted data object using a re-key from the at least one first user device to the at least one second user device and a re-encrypt function of the PRE.

15. The cloud storage system of claim 11 , wherein the at least one second user device is to decrypt the re-encrypted data object of the at least one first user device using a private key corresponding to the at least one second user device and the decrypt function of the PRE.

16. The cloud storage system of claim 11 , wherein the key server is to:

send at least one notification to the at least one first user device to obtain a re-key from the at least one first user device to at least one third device when the at least one second user device wants to share the at least one encrypted data object of the at least one first user device with the at least one third device of the plurality of user devices;

re-encrypt the at least one encrypted data object from the at least one first user device to the at least one third user device on receiving the re-key from the at least one first user device to at least one third device from the at least one first user device; and

store the re-encrypted encrypted data object of the at least one first user device in the at least one cloud device preferred by the at least one third user device, wherein the at least one third user device downloads the encrypted data object of the at least one first user device from the preferred at least one cloud device and decrypts the encrypted data object with the private key corresponding to the at least one third user device to obtain the at least one data object.

17. A user device of a cloud storage system comprising of a plurality of user devices, at least one cloud device and a key server, wherein the user device is to:

upload a plurality of encrypted data objects and an associated encrypted file encryption key (FEK) to the at least one cloud device;

share at least one encrypted data objects of the plurality of encrypted data objects of the user device stored in the at least one cloud device with at least one other user device of the plurality of user devices through the key server using a Proxy-Re-Encryption (PRE);

generate a master secret key (MSK) at a time of registration with the key server;

use the generated MSK to derive a private key;

use a key generation function of the PRE to derive a public key;

derive a master secret key encryption key (MSKEK) to encrypt the MSK using at least one of a password and a passphrase selected by a user of the user device; and

share the encrypted MSK and the public key with the key server for storage;

obtain and decrypt the encrypted MSK from the key server with at least one of the password and the passphrase selected by the user of the user device;

derive the private key corresponding to the user device using the decrypted MSK;

retrieve a public key corresponding to the at least one other user device from the key server;

derive the re-key using the private key corresponding to the user device, the public key corresponding to the at least one other user device and a re-key generation function of the PRE;

share the re-key with the key server marking as a key from the user device to the at least one other user device for sharing the at least one encrypted data object stored in the at least one cloud device with the user device; and

share at least one re-encrypted data of the user with the at least one other user device through the key server using the PRE.

18. The user device of claim 17 wherein the user device further comprises:

an encryption module to:

derive a FEK using the MSK generated at the time of registration with the key server;

encrypt the FEK using the public key and an encrypt function of the PRE;

encrypt a plurality of data objects using the FEK for uploading the encrypted plurality of data objects along with the encrypted FEK to the at least one cloud device;

a decryption module to:

decrypt the at least one encrypted FEK using a decrypt function of the PRE and the private key corresponding to the user device to obtain the FEK on downloading the at least one encrypted data object and the associated FEK from the at least one cloud device; and

decrypt the at least one encrypted data object using the obtained FEK to derive at least one data object.