Abstract: Aiming at the problem of permission determination after attributes revocation existing in the attribute based access control model, the paper proposes an efficient attribute revocation scheme supporting rights management. The scheme implements ciphertext access control by introducing attribute encryption mechanism CP-ABE based on ciphertext policy. On the basis of that, the scheme uses the main disjunctive normal form to express the access tree. Every subset in the main disjunctive normal form is called the minimum attribute set of the restrictive condition that the access subject needs to satisfy to access resource. Once occurring attribute revocation, the scheme considers the relationship between the minimum attribute set and the revoked attributes to determine whether the subject’s access permission is changed. The performance analysis shows that the scheme has high security, which not only can determine the authority after the attribute is revoked, but also can resist collusion attacks.

Key words: access control, attribute revocation, CP-ABE, minimum attribute set, permission