Policy-hiding Access Control in Open Environment Policy-hiding Access Control in Open Environment *

In Trust Management and attribute-based access control systems, access control decisions are based on the attributes (rather than the identity) of the requester: Access is granted if Alice’s attributes in her certificates satisfy Bob’s access policy. In this paper, we develop a policy-hiding access control scheme that protects both sensitive attributes and sensitive policies. That is, Bob can decide whether Alice’s certified attribute values satisfy Bob’s policy, without Bob learning any other information about Alice’s attribute values or Alice learning Bob’s policy. To enable policy-hiding access control, we introduce the notion of Certified Input Private Policy Evaluation (CIPPE). Our construction for CIPPE uses Yao’s scrambled circuit protocol and two new techniques introduced in this paper. One novel technique is constructing circuits with uniform topology that can compute arbitrary functions in a family. The other technique is Committed-Integer-based Oblivious Transfer.