## 4 Proposed Scheme  
### System Model  
As shown in Figure 1, a decentralised CP-ABE architecture was introduced for multi-scenario IoT applications. The architecture consists of four primary entities: the attribute authority (AA), CN, CR, and network routing devices (e.g., routers, switches, firewalls, or gateways). These entities collectively form a group, with multiple groups potentially coexisting within a single application domain, facilitating scalable and adaptable security management.  
For example, within a smart city, various interconnected smart scenarios may coexist, including traffic management, smart homes, emergency response, fire-fighting coordination, power grid optimisation, and industrial automation. In such environments, secure and efficient message access control is imperative. For instance, an ambulance system integrated with a smart transportation network can coordinate with traffic signals to optimise routes, ensuring the shortest arrival time while simultaneously enabling real-time medical data sharing during transit to support pre-hospital care [35]. Similarly, a smart grid can dynamically collaborate with industrial facilities to monitor energy consumption and adjust power distribution strategies in real time, thereby reducing peak loads and minimising energy waste [36].  
In all these scenarios, highly efficient, decentralised, and fine-grained access control mechanisms are essential to ensure secure communication and data sharing among diverse entities. The specific functions of each entity within this architecture are detailed below.  
* AA: This device enables communication between groups, denoted as \(AA_{i}\) (where \(i\) represents the group number). In the proposed method, through trust-based principles such as alliance strategies or smart contracts, the AA established system parameters among devices and combined attributes from each group to create a unified multi-attribute set. Finally, it generated an attribute key \(SK\) for the devices within its own group.
* CN: Given the resource constraints of IoT devices, the CR cannot perform complex encryption and decryption operations. To address this challenge, high-performance CNs were utilised to assist the CR in these operations. By offloading computationally  
Figure 1: System architecture for decentralisation in CP-ABE.  
intensive tasks to the CN, the CR was relieved of heavy processing demands, enabling it to efficiently manage access policies and generate proxy keys.
* CR: The CR serves as a central management unit for devices and data in the IoT ecosystem, enabling it to execute operations in the physical world--such as switching, adjusting, and moving--based on commands received from external systems. Within the IoT environment, the CR connects to end devices (e.g., sensors, actuators, drones) via various communication protocols, including Ethernet, TCP/IP-based protocols (such as HTTP, MQTT, and MODBUS TCP), Bluetooth, and wireless networks. In our scheme, the CR partially encrypted the collected information to generate \(CT_{1}\), which was then transmitted to the CN for secondary encryption, producing \(CT_{2}\). For decryption of messages received from other groups, the CR converted its attribute key \(SK\) into a proxy key \(tk\), ensuring that \(SK\) remained secure and was not exposed to the CN. The CN uses \(tk\) to perform decryption, generating an intermediate decryption message (IDM).
* Network routing (Router, Switch, Firewall, or Gateway): These devices transmit and receive network packets according to routing rules, serving as connection and data-flow management points within the IoT environment. Acting as bridges between different networks, they handle routing, filtering, forwarding, and firewall protection of data packets to ensure secure and efficient data transmission. This paper does not delve into the underlying principles of these devices but assumes they are configured and optimised for IoT application requirements.