## 3 Hierarchical Attribute-Based Encryption  
By merging the features of ciphertext-policy-attribute-based encryption (CP-ABE) and hierarchical identity-based encryption (HIBE), one can derive hierarchical attribute-based encryption (HABE). Further, this scheme deals for fine-grained access control and scalability and also achieves full delegation by yielding key delegation between attribute authorities. Compared to the conventional schemes, this scheme symbolically represents the hierarchical structure of the enterprise, which is more appropriate to the environment of an organization outsourcing data in a cloud. **CP-ABE:** It is an inverted model of key policy-attribute-based encryption (KP-ABE) that enables the data holder to explain the access strategy over the whole attributes that the data consumer wants to retain with the intention of decrypting the ciphertext. By doing so, confidentiality and data access control can be assured. The CP-ABE algorithm involves four steps and it is represented below. 1. **Setup 0**: This is a randomized part and it accepts only the unstated security parameter. Consequently, it yields the public key \(P_{K}\) and the master key \(M_{K}\). 2. **Encrypt (\(P_{K}\), \(S_{a}\), \(m\))**: This step fetches \(P_{K}\), a message \(m\) and the descriptive attribute \(S_{a}\) as input. It outputs a cipher text \(C_{T}\). 3. 3. **Keygen (\(M_{K}\), \(AS\))**: This step takes \(M_{K}\) and non-monotonic access structure \(AS\) as input and provides attribute secret key \(S_{K}\) for users as output. 4. **Decrypt (\(C_{T}\), \(S_{K}\))**: The input in this step is cipher text \(C_{T}\), which contains the access tree \(T\) and the user's secret key \(S_{K}\) that is related to their descriptive attribute \(S_{a}\), and the output is message \(m\). This step is completed only if \(S_{a}\) satisfies \(T\). The access structure of CP-ABE is attached with the cipher text until the key for decryption process is interpreted with the pack of descriptive attributes as shown above. Consequently, the responsibility of KP-ABE is to change the characters of the cipher text and the decryption key. Furthermore, in this system, encryption provides the monotonic access form along with a threshold value for appropriate attributes. However, when the decryption key attributes fulfill the access policy in a known ciphertext, then only the ciphertext can be decrypted with the key. This method is more enthusiastic though the trusted server is negotiated. Generally, the CP-ABE approach is greater than the KP-ABE in terms of imposing encrypted data's access control. The major constraints of CP-ABE are that it cannot fulfill the necessities of initiatives in their access control as it requires efficiency and flexibility. **HIBE:** The hybrid identity-based encryption (HIBE) is extended from IBE. Here, the private key is delivered by a solo private key generator (PKG) with the public keys as their primitive ID (PID), so-called as 1-HIBE in an overall identity-based encryption scheme and carry a drawback like heavy key managing. Therefore, to overcome this, a 2-HIBE scheme via a detailed definition of security is introduced that consists of domain PKG and a root PKG. The consumers and these are connected with a random string of PID. However, the domain PKG produces the private key to provide the requested domain secret key, which is acquired from the root PKG. Moreover, a root certificate authority (trustworthy third party) is involved by the cryptosystem, which permits a hierarchy of certificates. Through several levels of HIBE, the allotment of key escrow and root server workloads can be diminished. **HABE:** The HABE algorithm, which combines the CP-ABE and HIBE, consists of the following five steps as given below.