An Attribute-Revocable Hierarchical Access Control Scheme for Data Sharing in Cloud-Edge-End Environments

The hierarchical storage of sensitive data and user-layered access control are important directions for data sharing, but existing solutions rarely balance efficiency and security for layered access control. To address these challenges, we propose an attribute-revocable hierarchical access control scheme for data sharing in cloud-edge-end environments (ARH-DS-CE). Firstly, according to the data protection level and user authorization level, we construct a hierarchical access control tree and introduce attribute-based encryption to implement hierarchical access control for different users. Especially, ARH-DS-CE isolates low-level attribute users accessing high-level files through virtual nodes. Secondly, edge nodes are leveraged to offload partial encryption preprocessing tasks from data owners or users, thereby alleviating computational burdens on end devices. Lastly, a lightweight attribute update mechanism is introduced to maintain the stability of hierarchical access policies when some user attributes are modified or revoked. Security analysis demonstrates that the proposed scheme guarantees enhanced privacy and security while outperforming existing solutions in function and computational efficiency. Theoretical analysis shows that this scheme is feasible in practice, with advantages in terms of time and space complexity compared to similar schemes.