# A Secure Key Aggregate Searchable Encryption with Multi Delegation in Cloud Data Sharing Service
###### Abstract  
As the amount of data generated in various distributed environments is rapidly increasing, cloud servers and computing technologies are attracting considerable attention. However, the cloud server has privacy issues, including personal information and requires the help of a Trusted Third Party (TTP) for data sharing. However, because the amount of data generated and value increases, the data owner who produces data must become the subject of data sharing. In this study, we use key aggregate searchable encryption (KASE) technology, which enables keyword search, to efficiently share data without using TTP. The traditional KASE scheme approach only discusses delegation of authority from the data owner to another user. However, if the delegated entity cannot perform time-critical tasks because the shared data are unavailable, the delegate must further delegate the rights given to other users. Consequently, this paper proposes a new KASE scheme that enables multi-delegation without TTP and includes an authentication technique between the user and the server. After that, we perform informal and formal analysis using BAN logic and AVISPA for security evaluation, and compare the security and performance aspects with existing schemes. KASE; cloud server; data sharing; delegation; BAN logic; AVISPA; MIRACl 202125550  
data owner (DO). (ii) The efficiency of the key for data management should be considered. This is because as the data increases, the key also increases. (iii) The data owner must store the data in an encrypted form in order to maintain the confidentiality and integrity of the data, and the data access policy is required for sharing with data users (DUs). DO outsources data or computational work to cloud servers. In addition, DOs can optionally share outsourced data with DU groups with the help of cloud computing services through access control. For this purpose, research on cryptosystems such as user-based access control cryptosystem [6], role-based access control cryptosystem [7], and attribute-based access control cryptosystem [8] was studied. However, the computation overhead of encryption and key generation increases with the number of attributes or users in these user-centric data sharing methods. When DO grants a new user access to their data, the DO must either generate a new ciphertext or modify the ciphertext stored in the cloud. Furthermore, because the TTP defines and manages the user's rules and attributes, the DO cannot be the subject of data management. To address these limitations, a data-centric shared encryption scheme called Key Aggregate Encryption (KAE) [9] has beenproposed. In KAE, the DO first defines the document set S to which the data that the DO intends to share to users of data belongs, and then aggregates the secret keys of all documents in the set \(S\). Then, DO shares a single key, known as the aggregate key, with the user to grant access to \(S\). Moreover, an extended encryption scheme called Key Aggregate Searchable Encryption (KASE) [10] was proposed, which allows DOs to use aggregation keys to delegate search authority over selected data sets and allow users to retrieve shared data by submitting a single aggregation trapdoor to the cloud. In addition to delegating search rights to data users by data owners, it is also important to consider when the delegated users may need to transfer rights to other users for time-sensitive tasks, processing and creation of various information, and smooth data management. However, there is no KASE structure given that an authorized user needs to further delegate privileges to other users. Therefore, this paper proposes a KASE cloud data sharing scheme that simultaneously provides user authentication and delegation functions without using TTP. To analyze the safety verification of the proposed scheme, we conduct informal security analysis and formal security analysis using \"Burrows-Abadi-Needham (BAN) logic\" [11] and \"Automated Validation of Internet Security Protocols and Applications (AVISPA)\" [12].