## 3 Background
### Ma-Cp-Abe  
Multi-Authority Ciphertext-Policy Attribute-Based Encryption (MA-CP-ABE) was initially proposed by [41] as an application of Attribute-Based Encryption in which any party can become an authority with no global coordination requirements. However, the scheme required a trusted central authority to collect all master private keys from all Attribute Authorities (AA) to compute the collective secret terms for system initialization. MA-CP-ABE was later extended by [7] introducing fully decentralized CP-ABE systems for both composite-order and prime-order groups by utilizing the user's Global Identifier (GID) in the key to resist collusion attempts. Several other works have extended the characteristics of the scheme to allow fine-grained data access with attribute revocation for cloud data storage [42], improved efficiency [43] and storage space saving by using hierarchical attributes to compress redundant ciphertext information ([44,45]). With an MA-CP-ABE scheme, multiple authorities agree on a set of global parameters GP and, based on these parameters, each authority X generates a public/secret key pair \(PK_{X}\), \(SK_{X}\). Data \(m\) can then be encrypted based on a mutually agreed access policy \(\mathbb{P}\) (in the form of a matrix), using the public keys of all the authorities, i.e., \(ct=Enc(m,\mathbb{P},\text{GP},\{PK\})\). With MA-CP-ABE schemes, any party can become an authority, and there is no requirement for a global root authority. More importantly, users can combine attributes issued by different authorities, provided that each user has a unique global identity GID. Any authority X may issue to any user \(U\), attribute keys for an attribute \(attr\), using its private key, the global parameters and the user identifier:  
\[K_{ULattr}=KeyGen(\text{GID}_{\text{U}},\text{GP},attr,SK_{X}).\]  
Finally, users can combine their attribute keys, issued by multiple authorities, to decrypt an ABE-encrypted ciphertext \(ct\), provided that their set of attributes satisfies an access rule within \(\mathbb{P}\), i.e., \(m=Dec(ct,\text{GP},\{K_{ULattr}\})\). Although the scheme enables a combination of attributes issued by different authorities, it remains collision resistant, meaning that different users cannot combine their attributes, since each attribute key is assigned to a different GID. An example of MA-CP-ABE is illustrated in Figure 1. Several organizations belonging to different domains may agree on inter-domain or cross-domain access policies. A domain-wise policy for hospitals may be, for example, to allow access to patient health for doctors at any hospital, if the patient is under emergency treatment. A cross-domain policy for the hospital domain may be to allow access to anonymized data to researchers, or, access the configuration data of medical devices to authorized manufacturer admins. Users may be given attribute keys from different organizations (authorities) and combine them, since each attribute key is linked to the global identifier of a user. However, keys issued to different users cannot be combined. The challenge, from an implementation perspective, is to create an architecture that supports efficient MA-ABE decentralization and distribution of the decryption functionality, without compromising security. In our system, we will utilize and properly modify the MA-CP-ABE scheme of [7] since: (i) It is a well recognized multi-authority ABE scheme which supports collision resistance, i.e., although the users may acquire attribute keys from different authorities, it is not possible to combine attribute keys that were issued to different users. (ii) It is supported by actual implementations. (iii) Its decryption process can be executed sequentially, where some attribute keys are applied first, for partial decryption. The partially decrypted data can then be fully decrypted in a second phase, possibly by another entity. In our system, we will exploit this to cryptographically enforce a single point of access for all users.