Abstract:
An obfuscated policy data encryption system and method for re-encrypting data to maintain the confidentiality and integrity of data about a user when the data is stored in a public cloud computing environment. The system and method allow a user to specify in a data-sharing policy who can obtain the data and how much of the data is available to them. This policy is obfuscated such that it is unintelligible to the cloud operator and others processing and storing the data. In some embodiments, a patient species with whom his health care data should be shared with and the encrypted health care data is stored in the cloud in an electronic medical records system. The obfuscated policy allows the electronic medial records system to dispense the health care data of the patient to those requesting the data without disclosing the details of the policy itself.

Description:
BACKGROUND 
     One major barrier to adoption of cloud services and storage is concern over privacy and security issues. In other words, the concern is about maintaining the confidentiality and the integrity of private data when that data is being stored in a public cloud. For example, unless they choose to host their own private cloud, hospitals and medical practitioners face the challenge of outsourcing the storage and handling of their patients&#39; data in a private, reliable, and secure way that complies with government regulations for handling sensitive data and protecting privacy. 
     At least one existing architecture uses cryptographic cloud storage to address this problem. This architecture uses existing and emerging cryptographic building blocks such a searchable encryption, attribute-based encryption (ABE), and proofs of storage. In an ABE-based approach, the owner of the data can give each potential recipient a decryption key that allows them to decrypt only those documents that satisfy a given policy. However, this technique has several disadvantages including that changing the access policy requires distributing new keys to all affected recipients, and revoking access rights requires changing the master key and downloading and re-encrypting all messages. 
     Using ABE is essentially a way to do key management by outsourcing key management to the cloud according to a pre-specified policy for handling of encrypted data. The policy specification itself is not private though. This policy may contain sensitive information that would then leak information about the data once the policy is known. This is undesirable in some application. For example, imagine a scenario whereby a company or an individual wishes to set up private policy for how to handle its sensitive data. This policy would determine the parties that would read the data, such that leaking the policy would reveal information about the parties, the type of data, and the preferences of the data owner. 
     Some approaches have the server implement the access policy, and then translate incoming ciphertexts into ciphertexts readable by the recipients. Of course, this should be done without allowing the server to actually decrypt any ciphertexts. This is called proxy re-encryption, which allows a server to translate messages intended for the data owner into messages intended for a given recipient. Proxy re-encryption has two problems, however. First, it is not possible to choose an appropriate recipient based on the encrypted message. Second, it is not possible to do this without revealing the access policy to the server. 
     SUMMARY 
     This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter. 
     Embodiments of the obfuscated policy data encryption system and method that allows for securely obfuscating functional re-encryption. Embodiments of the system and method allow a data owner (also called a user) to specify a data-sharing procedure or policy that dictates how and to whom the data may be distributed. A private version of this data-sharing policy is generated to obtain an obfuscated policy. 
     Embodiments of the system and method store the data in a public cloud computing environment. A cloud data management system residing on the cloud receives encrypted data from a data provider and then re-encrypts encrypted data according to the obfuscated policy. All the while, the policy remains unintelligible to the cloud. 
     A data consumer that desires access to the data can request the re-encrypted data from the cloud data management system as long as the user has given access privileges to the data consumer. Upon receiving the request, the cloud data management system sends the data consumer the requested data. The data consumer then uses a data consumer public key to decrypt and view the data. 
     In some embodiments, the system and method can be used to facilitate private handling of sensitive personal medical data. A patient using an electronic medical records (EMR) system built on embodiments of the system and method can specify a policy for access to portions of her encrypted records by various health care providers according to their role, specialty, or identity. The EMR system, which resides on the cloud, handles the uploading, re-encrypting, and accessing of the files, without learning anything about the policy or preferences according to which the data is being redistributed. 
     A patient can set their policy preferences so that when doctors or clinics upload encrypted, privately-indexed records for the patient, other providers, specialists, or family members registered with the system can access only those records to which the patient has allowed them access. In other embodiments, selective use is allowed of anonymized versions of patients&#39; records for medical research purposes. The EMR system could allow access by researchers who are registered users. Patients could include in their policy specification which portions of their records should be made available for medical research, perhaps of a specific nature such as cancer research, and those portions of the record would not contain personally identifiable information. 
     It should be noted that alternative embodiments are possible, and steps and elements discussed herein may be changed, added, or eliminated, depending on the particular embodiment. These alternative embodiments include alternative steps and alternative elements that may be used, and structural changes that may be made, without departing from the scope of the invention. 
    
    
     
       DRAWINGS DESCRIPTION 
       Referring now to the drawings in which like reference numbers represent corresponding parts throughout: 
         FIG. 1  is a block diagram illustrating a general overview of embodiments of the obfuscated policy data encryption system and method implemented in a computing environment. 
         FIG. 2  is a flow diagram illustrating the general operation of embodiments of the obfuscated policy data encryption system and method shown in  FIG. 1 . 
         FIG. 3  is a flow diagram illustrating the operational details of embodiments of the functional re-encryption program generator shown in  FIG. 1 . 
         FIG. 4  is a flow diagram illustrating the operational details of embodiments of the functional re-encryption module shown in  FIG. 1 . 
         FIG. 5  is a flow diagram illustrating the operational details of embodiments of the request processing module shown in  FIG. 1 . 
         FIG. 6  is a flow diagram illustrating the operational details of embodiments of the obfuscated policy data decryption module shown in  FIG. 1 . 
         FIG. 7  illustrates a simplified example of a general-purpose computer system on which various embodiments and elements of the obfuscated policy data encryption system and method, as described herein and shown in  FIGS. 1-6 , may be implemented. 
     
    
    
     DETAILED DESCRIPTION 
     In the following description of embodiments of a obfuscated policy data encryption system and method reference is made to the accompanying drawings, which form a part thereof, and in which is shown by way of illustration a specific example whereby embodiments of the obfuscated policy data encryption system and method may be practiced. It is to be understood that other embodiments may be utilized and structural changes may be made without departing from the scope of the claimed subject matter. 
     I. System Overview 
     Embodiments of the obfuscated policy data encryption system and method hide from others a policy set forth by a user to encrypt and distribute data about the user. This allows only those entities that the user specifies to view the data without letting those entities or any other intermediaries handling the data the details of the policy. Moreover, the user can specify how much of the data that each entity has access to view. 
       FIG. 1  is a block diagram illustrating a general overview of embodiments of the obfuscated policy data encryption system  100  and method implemented in a computing environment. In particular, embodiments of the obfuscated policy data encryption system  100  and method are shown implemented on a plurality of computing devices. Shown in  FIG. 1  are a first computing device  103 , a second computing device  106 , and a third computing device  109 . This computing devices  103 ,  106 ,  109  may be virtually any device that contains a processor, such as a desktop computer, notebook computer, and mobile phone. Moreover, although three computing devices are shown in  FIG. 1 , it should be appreciated that there may be more or fewer computing devices that are used in various embodiments. 
     Embodiments of the obfuscated policy data encryption system  100  and method include a user&#39;s private key  112  that is used by a user  115  to generate a data-sharing policy (not shown). The user  115  then uses the first computing device  103  to generate an obfuscated policy  118  from the data-sharing policy. The obfuscated policy  118  is a private version of the data-sharing policy. 
     The first computing device  103  also contains a functional re-encryption program generator  121  that generates a functional (or obfuscated) re-encryption program  124 . The functional re-encryption program generator  121  uses the user&#39;s private key  112 , the obfuscated policy  118 , and a data consumer&#39;s public key  122  to generate the functional re-encryption program  124 . The mathematical details of the program  124  are discussed in detail below. Moreover, it should noted that there may be more than one data consumer&#39;s public key, and they may come from a variety of data consumers. Typically, these data consumers are those entities that the user  115  gives access to the data about the user, as set forth in the data-sharing policy. 
     The second computing device  106  receives from the user  115  a user&#39;s public key  127 . The user&#39;s public key  127  is used by a data provider  130  to encrypt data about the user  115 . In particular, raw data  133  about the user  115  is encrypted by a data upload module  136  on the second computing device  106  to generated raw encrypted data  139 . As used in this document, the data provider  130  is an entity (such as a person or a corporation) that gathers and provides data about the user  115 . 
     The functional re-encryption program  124  is sent to a cloud data management system  142  that resides in a public cloud computing environment  145 . The cloud data management system  142  includes a functional re-encryption module  148  that receives the raw encrypted data  139  sent by the data provider  130 . The functional re-encryption module uses the functional re-encryption program  124  to re-encrypt the raw encrypted data  139  in accordance with the obfuscated policy  118 . This generates re-encrypted data  151  with an obfuscated policy. The data-sharing policy set forth by the user  115  is kept hidden from the cloud data management system  142  at all times, even when it is processing data. 
     The third computing device  109  is used by a data consumer  154  to request data about the user. As used in this document, the data consumer  154  refers to an entity that desires to obtain data about the user  115 . This data typically is stored in the public cloud computing environment  145 . It should be noted that is some embodiments of the obfuscated policy data encryption system  100  and method, the data provider  130  and the data consumer  154  may be one in the same. This may occur, for example, when an entity (acting as a data provider  130 ) uploads some data about the user  115  to the public cloud computing environment  145  and also requests data (now acting as a data consumer  154 ) about the user from the cloud data management system  142 . 
     The data consumer  154  uses the data consumer&#39;s public key  122  to issue a request  157  for data about the user  115 . This request  157  is sent to the cloud data management system  142  and then processed by a request processing module  160 . The request processing module  160  outputs recipient-specific ciphertext  163  that can only be decrypted by the data consumer&#39;s public key. The request processing module  160  uses the obfuscated policy to determine whether an entity requesting data has been given access to the data by the user  115  and how much of the data can be viewed. 
     The data consumer  154  uses an obfuscated policy data decryption module  166  on the third computing device  109  to decrypt the recipient-specific ciphertext  163 . The output of the module  166  is decrypted data  169 . This decrypted data  169  is displayed to the data consumer  154  to fulfill the request  157 . 
     II. Operational Overview 
       FIG. 2  is a flow diagram illustrating the general operation of embodiments of the obfuscated policy data encryption system  100  and method shown in  FIG. 1 . As shown in  FIG. 2 , the operation of embodiments of the obfuscated policy data encryption method begins by having the user specify a data-sharing policy for one or more data consumers (box  200 ). The user then generates an obfuscated policy that is a private version of the data-sharing policy (box  210 ). The obfuscated policy ensures that only the user will know the full details of the data-sharing policy. 
     Embodiments of the obfuscated policy data encryption method then send the obfuscated policy to the cloud data management system that resides in the public cloud computing environment (box  220 ). Moreover, embodiments of the method generate a functional re-encryption program for later use in re-encrypting data about the user (box  230 ). The functional re-encryption program is generated using the obfuscated policy, the user&#39;s private key, and the data consumer&#39;s public key. 
     Meanwhile, a data provider encrypts data about the user by using the user&#39;s public key (box  240 ). This encrypted data about the user is sent to the cloud data management system (box  250 ). The cloud data management system then re-encrypts the encrypted data about the user (box  260 ). This is performed using the functional re-encryption program and according to the obfuscated policy. The re-encrypted data about the user is stored in the public cloud computing environment. 
     When a data consumer desires to obtain data about the user, the data consumer makes a requests to obtain the data from the cloud data management system (box  270 ). The cloud data management system processes the request and sends the re-encrypted data to the data consumer (box  280 ). This request is sent in accordance with the data-sharing policy hidden within the obfuscated policy. The data consumer receives the requested data and decrypts the data using the data consumer&#39;s private key (box  290 ). 
     III. Operational Details 
     The operational details of embodiments of the obfuscated policy data encryption system  100  and method will now be discussed. This includes the operation of the functional re-encryption program generator  121 , the functional re-encryption module  148 , the request processing module  160 , and the obfuscated policy data decryption module  166 . Finally, the mathematical details of the functional re-encryption program  124  used to re-encrypt the data in accordance with the obfuscated policy will be presented. 
     III.A. Functional Re-Encryption Program Generator 
       FIG. 3  is a flow diagram illustrating the operational details of embodiments of the functional re-encryption program generator  121  shown in  FIG. 1 . As shown in  FIG. 3 , operation of the generator  121  begins by inputting the user&#39;s private key (box  300 ), inputting the data consumer&#39;s public key (box  310 ), and inputting the obfuscated policy created by the user (box  320 ). It should be noted that public keys from more than one data consumer may be used by the generator  121 . In some embodiments of the generator  121 , a public key is used for each data consumer that the user has allowed to access to the data as set forth in the data-sharing policy. 
     The generator  121  then generates the functional re-encryption program (box  330 ). The mathematical details of this process are given in detail below. In general, the generator  121  uses the user&#39;s private key, the data consumer&#39;s public key, and the obfuscated policy to generate the functional re-encryption program. 
     A determination then is made as to whether the user wants to modify the data-sharing policy for data consumer (box  340 ). If not, then the functional re-encryption program is output to the cloud data management system (box  350 ). If the user wants to change the data-sharing policy, then the generator  121  inputs a modified obfuscated policy that was created by the user (box  360 ). This modified obfuscated policy then is set as the current obfuscated policy (box  370 ). A replacement functional re-encryption program then is generated based on the updated obfuscated policy. 
     III.B. Functional Re-Encryption Module 
       FIG. 4  is a flow diagram illustrating the operational details of embodiments of the functional re-encryption module  148  shown in  FIG. 1 . The functional re-encryption module  148  resides on the cloud data management system  142 . As shown in  FIG. 4 , the operation of the module  148  begins by inputting raw encrypted data received from the data provider (box  400 ). As discussed above, this raw encrypted data was previously encrypted by the data provider using the user&#39;s public key. 
     The module  148  also inputs the functional (or obfuscated) re-encryption program (box  410 ) and the obfuscated policy (box  420 ). The module  148  then re-encrypts the raw encrypted data using the functional (or obfuscated) re-encryption program and the obfuscated policy (box  430 ). The result is re-encrypted data with obfuscated policy. 
     The obfuscated policy remains unintelligible to the cloud data management system (box  440 ). More specifically, the data-sharing policy authored by the user remains unknown to the cloud data management system because of the obfuscated policy. The data-sharing policy is contained in the obfuscated policy such that the details of the data-sharing policy cannot be known by the system. The re-encrypted data with obfuscated policy then is stored in the public cloud computing environment (box  450 ). 
     III.C. Request Processing Module 
       FIG. 5  is a flow diagram illustrating the operational details of embodiments of the request processing module  160  shown in  FIG. 1 . The request processing module  160  also resides on the cloud data management system  142 . As shown in  FIG. 5 , the operation of the module  160  begins by receiving a request for data about the user from a data consumer (box  500 ). 
     The module  160  then determines which part of the stored re-encrypted data that the data consumer is allowed to access (box  510 ). This is done by consulting the obfuscated policy. However, at all times the details of the obfuscated policy remains a mystery to the cloud data management system  142 . 
     The module  160  then obtains that part of the re-encrypted data that the data consumer has been given access (box  520 ). In some cases this may be all of the data, if the user has given the data consumer such access in the data-sharing policy. The module  160  then sends a ciphertext to the data consumer that is readable only by the desired data consumer (as desired by the user) (box  530 ). In general, ciphertext is an encryption performed on text using a cipher technique. It is unreadable by those without the cipher to be able to decrypt it. This recipient-specific ciphertext is readable only by the requesting data consumer. 
     III.D. Obfuscated Policy Data Decryption Module 
       FIG. 6  is a flow diagram illustrating the operational details of embodiments of the obfuscated policy data decryption module  166  shown in  FIG. 1 . The obfuscated policy data decryption module  166  resides on the third computing device  109 , shown in  FIG. 1 . Referring now to  FIG. 6 , the operation of the module  166  begins by receiving the ciphertext that is readable only by the desired data consumer (box  600 ). 
     The module  166  then decrypts the ciphertext using the data consumer&#39;s private key (box  610 ). Throughout the decryption process the obfuscated policy remains unintelligible to the data consumer and the module  166  (box  620 ). The module  166  then displays to the data consumer the decrypted data (box  630 ). It should be noted that this data decrypted and displayed to the user is only that data to which the data consumer has requested and been given access. 
     III.E. Mathematical Details of the Functional Re-Encryption Program 
     The functional (or obfuscated) re-encryption program is used to both re-encrypt data about the user (using the obfuscated policy) and to decrypt the re-encrypted data. Following are the mathematical details of the functional re-encryption program. 
     III.E.1. Preliminaries 
     Define λ as a security parameter. The term neg(λ) denotes some negligible function. Namely, for all c&gt;0 and all sufficiently large λ, let μ(λ)&lt;1/λ c . For two distributions, D 1  and D 2 , D 1              D 2  means that they are computationally indistinguishable. To be precise, this statement holds for ensembles of distributions.
     Let [l] denote the set {1, . . . l}. Vectors are denoted by bold-face letters, such as a. Let             be a group of prime order q. For a vector,
 
 a =( a   1   ,a   2   , . . . ,a   l )ε           q   l  
 
and group element gε         , g a  is written to mean the vector,
       (g α     1   , g α     2   , . . . , g α     l   ).       

     For two vectors a and b, where a and b are either both in              q   l  or both in            l , it is written ab to denote their component-wise product and a/b to denote their component-wise division. In case bε           q   l , term a b  denotes their component-wise exponentiation. For a vector a and scalar x, xa=ab, a/x=a/b, and a x =a b , where b=(x, x,  . . .  , x) of dimension l.
     Assume the existence of families of groups,
 
{             (λ) }λ&gt;0, {           (λ) }λ&gt;0 and {           T   (λ) }λ&gt;0
 
with prime order q=q(λ), endowed with a bilinear map,
 
 e   λ :           (λ) ×           (λ) →           T   (λ) .
 
When clear from the context, the superscript that refers to the security parameter is omitted from all these quantities. The mapping is efficiently computable, and is bilinear. Namely, for any generators gε          and hε         , and,
 
 a,bε             q   ,e ( {umlaut over (g)}   ä   ,h   {umlaut over (b)} )= e ( g,h ) a{dot over (b)} ,
 
It is also required that the bilinear map is non-degenerate, in the sense that if gε         , hε           generate           and           respectively, the e(g,h)≠1.

     Assume also that the Symmetric External Diffie-Hellman Assumption (SXDH) holds. The SXDH says that the decisional Diffie-Hellman (DDH) problem is hard in both of the groups             or          . In other words, the following two ensembles are indistinguishable:
   {(q.         ,          ,            T : e)←BilinSetup(1 λ ): g←         ; a, b←           q : (q:         ,          ,            T : e: g, g a , g b , g ab )}         
       {(q.         ,          ,            T . e)←BilinSetup(1 λ ): g←         ; a, b, c←           q : (q:         ,          ,            T ; e, g: g a : g b , g c )}
 
and a similar statement when gε           is replaced with hε          . In contrast, the assumption that DDH is hard in one of the two groups           or           is simply called the external Diffie-Hellman assumption (XDH).
 
III.E.2. Collusion-Resistant Functional Re-Encryption
   
       

     This section presents the construction of the functional re-encryption program from the symmetric external Diffie-Hellman (SXDH) assumption. First, the basic encryption scheme is set forth. Second, the details of the functional re-encryption program are discussed. 
     III.E.2.a. Construction of the Encryption Schemes 
     In general, a functional re-encryption program transforms a ciphertext under an input public key into a ciphertext of the same message under one of many output public keys. In some embodiments, the input and the output ciphertexts have different shapes. In other words, the input ciphertext lives in the “source group”             whereas the output ciphertext lives in the “target group”          T. The input and output encryption schemes will now be discussed.
     Parameters 
     The public parameters for both the input and the output encryption includes the description of three groups            ,           and            T  of prime order q         q(λ), with a bilinear map,
 
 e:             ×             →             T .

     Also included in the public parameters are two generators, gε             and hε          . Let,          =         (λ)  ⊂           
     denote the message space of both the input and output encryption. It is assumed that |           | is polynomial in λ.
     Input Encryption 
     The input encryption is parameterized by numbers d=d(λ) and n=n(λ). These are upper bounds on the size of the domain and the range of the policy function that is supported. Throughout this discussion, it is assumed that d≧n. Moreover, a NIZK proof system is used because it provides a efficient scheme for the type of statements used herein, which is perfectly sound and computationally zero-knowledge based on SXDH. 
     First, I-Gen(1 λ , 1 d , 1 n ). The program picks random vectors a 1 , . . . , a d , from              q   d . In addition, the program generates a CRS, which is a CRS for the NIZK proof system. The output is a public key, pk, and a private (or secret) key, sk. Here, pk=(CRS, g, g a   1 , . . . g a   d ), and sk=(a1, . . . , a d ). It should be noted that pk can be viewed as being made up of d public keys pk i =(g, g a   1 ) of a simpler scheme.
     Second, I-Enc(pk, iε [d], m). In order to encrypt a message mε            , with “identity” iε [d], the program selects random exponents r and r′ from            q   d , and compute the following:
     (a) C=g ra     i   ; D=g r m, and 
     C′=f r     ′     a     i   ; D′=g r     ′     
     (c) π, a proof that these values are correctly formed. In other words, that they correspond to one of the vectors g a   1  contained in the public key pk. 
     The ciphertext (E, E′, π) is output, where E=(C, D) and E′=(C′, D′). Note that E looks like an encryption of message m under pk i , while E′ looks like an encryption of 0 under pk i . E′ is used only by the re-encryption program for input re-randomization, and is ignored by the decryption technique I-Dec. 
     Third, I-Dec(sk, (E, E′)). If any of the components of the ciphertext E′ is             or if the proof π does not verify, then output ⊥. This is a check to ensure the security of the re-encryption program. Note that if (E, E′) is honestly generated, this event happens only with negligible probability.
     The program then ignores E′, π subsequently, and then parses E as (C, D). Then the program checks that for some iε [d] and mε            ,
 
 D{umlaut over (·)} ( C   1/a     i   ) −{umlaut over (1)} =( m, . . . ,m ).
 
If yes, then the program outputs (i, m). Otherwise, it outputs ⊥.
 
Output Encryption

     The output encryption is described as follows: 
     First, O-Gen(1 λ ). The program picks â←             q . Let          =h {dot over (a)}  and          =â.
     Second, O-Enc(           , m). The program encrypts a message,
   mε           ⊂            1 , as follows:   

     (a) Choose random numbers r, s←             q .
     (b) Compute Ŷ=(h â ) r  and Ŵ=h r . 
     (c) Output the ciphertext as.
 
[ {circumflex over (F)},Ĝ,Ĥ]:=[e ( g   s   ,Ŷ ), e ( g   s   ,Ŵ )· e ( m,h   s ), h   s ].
 
     Third, O-Dec (           =â, ({circumflex over (F)}, Ĝ, Ĥ)). The decryption technique does the following:
     (a) Computes {circumflex over (Q)}=Ĝ·{circumflex over (F)} −1/â , 
     For each mε            , test whether e (m, Ĥ)={circumflex over (Q)}. If so, then output m and halt.
     III.E.2.b. Obfuscation for Functional Re-Encryption 
     The technique for securely obfuscating the functional re-encryption functionality for the input and output encryption techniques described above will now be discussed. 
     Functional Re-Encryption Key 
     The functional re-encryption program obtains an input secret key Sk, the n output public keys              i , and the description of a function F: [d]→[n]. It outputs a functional re-encryption key which is a description of a program that takes as input a ciphertext of message mε           under public key pk, with Identity iε [d], outputs a ciphertext of m under          F(i).
     The functional re-encryption program does the following: 
     (a) Picks z←             q  and w i ←           q  for all iε [d] uniformly at random.
     (b) Solves for α=(α 1 , . . . , α d ) and β=(β 1 , . . . , β d ) such that for all iε [d],
 
             a   i   α             =w   i   ·â   F(i) , and
 
           a   i   ,β             =w   i −1.

     The re-encryption key consists of the tuple (Z, A, B) where Z=h z , A=h zα , and B=h zβ . It should be noted that computing the re-encryption key does not require the knowledge of the output secret keys. 
     Functional Re-Encryption Program 
     Given the functional re-encryption key (Z, A, B) and an input ciphertext (E, E′), where E=(C, D) and E′=(C′, D′), the functional re-encryption program performs the following steps: 
     (1) Sanity check. Specifically, if any of the components of the input ciphertext E′ is             or if the proof π does not verify, output ({circumflex over (F)}, Ĝ, Ĥ) for random{circumflex over (F)}, Ĝε           T  and random Ĥε          . The sanity check is to ensure that the next step (input re-randomization) randomizes the ciphertext E.
     (2) Input Re-Randomization. The program picks a random exponent t←             q  and computes Ĉ=C(C′) t  and {circumflex over (D)}=D(D′) t . Note that the random exponent t is used to re-randomize the encryption of 0, and this re-randomized encryption of 0 is multiplied with the encryption of a) to obtain a re-randomized encryption of m.
     (3) The main Re-Encryption step. The program writes,
         Ĉ:=(Ĉ 1 , . . . , Ĉ d ),   A:=(A 1 , . . . , A d ), and   B:=(B 1 , . . . , B d ).       

     Then it computes, 
     
       
         
           
             
               F 
               = 
               
                 
                   ∏ 
                   
                     j 
                     = 
                     1 
                   
                   d 
                 
                 ⁢ 
                 
                     
                 
                 ⁢ 
                 
                   e 
                   ⁡ 
                   
                     ( 
                     
                       
                         
                           C 
                           ^ 
                         
                         j 
                       
                       , 
                       
                         A 
                         j 
                       
                     
                     ) 
                   
                 
               
             
             , 
             and 
           
         
       
       
         
           
             G 
             = 
             
               
                 ∏ 
                 
                   j 
                   = 
                   1 
                 
                 d 
               
               ⁢ 
               
                   
               
               ⁢ 
               
                 
                   e 
                   ⁡ 
                   
                     ( 
                     
                       
                         
                           C 
                           ^ 
                         
                         j 
                       
                       , 
                       
                         B 
                         j 
                       
                     
                     ) 
                   
                 
                 · 
                 
                   e 
                   ⁡ 
                   
                     ( 
                     
                       
                         D 
                         ^ 
                       
                       , 
                       Z 
                     
                     ) 
                   
                 
               
             
           
         
       
     
     (4) Output Re-randomization. The program then selects a random exponent s←             q  and computes {circumflex over (F)}=F s , Ĝ=G s , and Ĥ=H s . The program then outputs the ciphertext ({circumflex over (F)}, Ĝ, Ĥ).
     Preserving Functionality 
     Let the input ciphertext be (C, D, C′, D′, π). Given that π verifies, it is known that these values will be of the form C=g ra     i   , D=g r m, and C′=g r     ′     a     i   , D=g r     ′   . Let the re-encryption key be given as (Z, A, B), where Z=h z , A=h zα , and B=h zβ . 
     First, the input re-randomization step computes,
 
 Ĉ=C ( C ′) t   =g   (r+tr     ′     )a     i     =g   {circumflex over (r)}a     i   , and
 
 {circumflex over (D)}=D ( D ′) t   =g   r+tr     ′     m=g   {circumflex over (r)}   m,  
 
where,
 
 {circumflex over (r)}               r+tr′.  

     Second, the main re-encryption step computes, 
     
       
         
           
             
               
                 
                   F 
                   = 
                     
                   ⁢ 
                   
                     
                       ∏ 
                       
                         j 
                         = 
                         1 
                       
                       d 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       e 
                       ⁡ 
                       
                         ( 
                         
                           
                             
                               C 
                               ^ 
                             
                             j 
                           
                           , 
                           
                             A 
                             j 
                           
                         
                         ) 
                       
                     
                   
                 
               
             
             
               
                 
                   = 
                     
                   ⁢ 
                   
                     
                       e 
                       ⁡ 
                       
                         ( 
                         
                           g 
                           , 
                           h 
                         
                         ) 
                       
                     
                     
                       
                         r 
                         ^ 
                       
                       ⁢ 
                       z 
                       ⁢ 
                       
                         〈 
                         
                           
                             a 
                             i 
                           
                           , 
                           α 
                         
                         〉 
                       
                     
                   
                 
               
             
             
               
                 
                   
                     = 
                       
                     ⁢ 
                     
                       
                         e 
                         ⁡ 
                         
                           ( 
                           
                             g 
                             , 
                             h 
                           
                           ) 
                         
                       
                       
                         
                           r 
                           ^ 
                         
                         ⁢ 
                         
                           zw 
                           i 
                         
                         ⁢ 
                         
                           
                             a 
                             ^ 
                           
                           
                             F 
                             ⁡ 
                             
                               ( 
                               i 
                               ) 
                             
                           
                         
                       
                     
                   
                   , 
                   and 
                 
               
             
           
         
       
       
         
           
             
               
                 
                   G 
                   = 
                     
                   ⁢ 
                   
                     
                       ∏ 
                       
                         j 
                         = 
                         1 
                       
                       d 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         e 
                         ⁡ 
                         
                           ( 
                           
                             
                               
                                 C 
                                 ^ 
                               
                               j 
                             
                             , 
                             
                               B 
                               j 
                             
                           
                           ) 
                         
                       
                       · 
                       
                         e 
                         ⁡ 
                         
                           ( 
                           
                             
                               D 
                               ^ 
                             
                             , 
                             Z 
                           
                           ) 
                         
                       
                     
                   
                 
               
             
             
               
                 
                   = 
                     
                   ⁢ 
                   
                     
                       
                         e 
                         ⁡ 
                         
                           ( 
                           
                             g 
                             , 
                             h 
                           
                           ) 
                         
                       
                       
                         
                           r 
                           ^ 
                         
                         ⁢ 
                         z 
                         ⁢ 
                         
                           〈 
                           
                             
                               a 
                               i 
                             
                             , 
                             β 
                           
                           〉 
                         
                       
                     
                     · 
                     
                       e 
                       ⁡ 
                       
                         ( 
                         
                           
                             
                               g 
                               
                                 r 
                                 ^ 
                               
                             
                             ⁢ 
                             m 
                           
                           , 
                           
                             h 
                             z 
                           
                         
                         ) 
                       
                     
                   
                 
               
             
             
               
                 
                   = 
                     
                   ⁢ 
                   
                     
                       
                         e 
                         ⁡ 
                         
                           ( 
                           
                             q 
                             , 
                             h 
                           
                           ) 
                         
                       
                       
                         
                           r 
                           ^ 
                         
                         ⁢ 
                         
                           z 
                           ⁡ 
                           
                             ( 
                             
                               
                                 w 
                                 i 
                               
                               - 
                               1 
                             
                             ) 
                           
                         
                       
                     
                     · 
                     
                       e 
                       ⁡ 
                       
                         ( 
                         
                           
                             g 
                             
                               r 
                               ^ 
                             
                           
                           , 
                           
                             h 
                             z 
                           
                         
                         ) 
                       
                     
                     · 
                     
                       e 
                       ⁡ 
                       
                         ( 
                         
                           m 
                           , 
                           
                             h 
                             z 
                           
                         
                         ) 
                       
                     
                   
                 
               
             
             
               
                 
                   = 
                     
                   ⁢ 
                   
                     
                       
                         e 
                         ⁡ 
                         
                           ( 
                           
                             g 
                             , 
                             h 
                           
                           ) 
                         
                       
                       
                         
                           r 
                           ^ 
                         
                         ⁢ 
                         
                           zw 
                           i 
                         
                       
                     
                     · 
                     
                       
                         e 
                         ⁡ 
                         
                           ( 
                           
                             m 
                             , 
                             
                               h 
                               z 
                             
                           
                           ) 
                         
                       
                       . 
                     
                   
                 
               
             
           
         
       
     
     After the output re-randomization step (using randomness S), the ciphertext looks like {circumflex over (F)}=e(g σ , h {circumflex over (α)}     F(i)ρ   ), G=e(g σ , h ρ )·e(m, h σ ), and H=h σ , where ρ={circumflex over (r)}w i  and σ=sz are both uniformly random in              q , even given all the randomness in the input ciphertext. The claim about ρ being uniformly random crucially relies on the “sanity check” step in re-encryption. Thus, the final ciphertext is distributed exactly like the output of O-Enc(           F(i) , m).
     IV. Exemplary Operating Environment 
     Embodiments of the obfuscated policy data encryption system  100  and method described herein are operational within numerous types of general purpose or special purpose computing system environments or configurations.  FIG. 7  illustrates a simplified example of a general-purpose computer system on which various embodiments and elements of the obfuscated policy data encryption system  100  and method, as described herein and shown in  FIGS. 1-6 , may be implemented. It should be noted that any boxes that are represented by broken or dashed lines in  FIG. 7  represent alternate embodiments of the simplified computing device, and that any or all of these alternate embodiments, as described below, may be used in combination with other alternate embodiments that are described throughout this document. 
     For example,  FIG. 7  shows a general system diagram showing a simplified computing device  10 . Such computing devices can be typically be found in devices having at least some minimum computational capability, including, but not limited to, personal computers, server computers, hand-held computing devices, laptop or mobile computers, communications devices such as cell phones and PDA&#39;s, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, audio or video media players, etc. 
     To allow a device to implement embodiments of the obfuscated policy data encryption system  100  and method described herein, the device should have a sufficient computational capability and system memory to enable basic computational operations. In particular, as illustrated by  FIG. 7 , the computational capability is generally illustrated by one or more processing unit(s)  12 , and may also include one or more GPUs  14 , either or both in communication with system memory  16 . Note that that the processing unit(s)  12  of the general computing device of may be specialized microprocessors, such as a DSP, a VLIW, or other micro-controller, or can be conventional CPUs having one or more processing cores, including specialized GPU-based cores in a multi-core CPU. 
     In addition, the simplified computing device of  FIG. 7  may also include other components, such as, for example, a communications interface  18 . The simplified computing device of  FIG. 7  may also include one or more conventional computer input devices  20  (e.g., pointing devices, keyboards, audio input devices, video input devices, haptic input devices, devices for receiving wired or wireless data transmissions, etc.). The simplified computing device of  FIG. 7  may also include other optional components, such as, for example, one or more conventional computer output devices  22  (e.g., display device(s)  24 , audio output devices, video output devices, devices for transmitting wired or wireless data transmissions, etc.). Note that typical communications interfaces  18 , input devices  20 , output devices  22 , and storage devices  26  for general-purpose computers are well known to those skilled in the art, and will not be described in detail herein. 
     The simplified computing device of  FIG. 7  may also include a variety of computer readable media. Computer readable media can be any available media that can be accessed by computer  10  via storage devices  26  and includes both volatile and nonvolatile media that is either removable  28  and/or non-removable  30 , for storage of information such as computer-readable or computer-executable instructions, data structures, program modules, or other data. By way of example, and not limitation, computer readable media may comprise computer storage media and communication media. Computer storage media includes, but is not limited to, computer or machine readable media or storage devices such as DVD&#39;s, CD&#39;s, floppy disks, tape drives, hard drives, optical drives, solid state memory devices, RAM, ROM, EEPROM, flash memory or other memory technology, magnetic cassettes, magnetic tapes, magnetic disk storage, or other magnetic storage devices, or any other device which can be used to store the desired information and which can be accessed by one or more computing devices. 
     Retention of information such as computer-readable or computer-executable instructions, data structures, program modules, etc., can also be accomplished by using any of a variety of the aforementioned communication media to encode one or more modulated data signals or carrier waves, or other transport mechanisms or communications protocols, and includes any wired or wireless information delivery mechanism. Note that the terms “modulated data signal” or “carrier wave” generally refer to a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. For example, communication media includes wired media such as a wired network or direct-wired connection carrying one or more modulated data signals, and wireless media such as acoustic, RF, infrared, laser, and other wireless media for transmitting and/or receiving one or more modulated data signals or carrier waves. Combinations of the any of the above should also be included within the scope of communication media. 
     Further, software, programs, and/or computer program products embodying the some or all of the various embodiments of the obfuscated policy data encryption system  100  and method described herein, or portions thereof, may be stored, received, transmitted, or read from any desired combination of computer or machine readable media or storage devices and communication media in the form of computer executable instructions or other data structures. 
     Finally, embodiments of the obfuscated policy data encryption system  100  and method described herein may be further described in the general context of computer-executable instructions, such as program modules, being executed by a computing device. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform particular tasks or implement particular abstract data types. The embodiments described herein may also be practiced in distributed computing environments where tasks are performed by one or more remote processing devices, or within a cloud of one or more devices, that are linked through one or more communications networks. In a distributed computing environment, program modules may be located in both local and remote computer storage media including media storage devices. Still further, the aforementioned instructions may be implemented, in part or in whole, as hardware logic circuits, which may or may not include a processor. 
     Moreover, although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.