# Conditional Ciphertext-Policy Attribute-Based Encryption Scheme in Vehicular Cloud Computing

Authors: Zhitao Guan; Jing Li; Zijian Zhang; Liehuang Zhu
Journal: Mobile Information Systems
 (2016)

---

## Abstract

VCC (Vehicular Cloud Computing) is an emerging and promising paradigm, due to its significance in traffic management and road safety. However, it is difficult to maintain both data security and system efficiency in Vehicular Cloud, because the traffic and vehicular related data is large and complicated. In this paper, we propose a conditional ciphertext-policy attribute-based encryption (C-CP-ABE) scheme to solve this problem. Comparing with CP-ABE, this scheme enables data owner to add extra access trees and the corresponding conditions. Experimental analysis shows that our system brings a trivial amount of storage overhead and a lower amount of computation compared with CP-ABE.


---

## Body

## 1. Introduction

VANETs (vehicular ad hoc networks) gained great attention in recent years, which can not only improve road safety but also enhance traffic management [1, 2]. In VANET, the vehicles, V2V (Vehicle to Vehicle) and V2I (Vehicle to Infrastructure), generate an enormous amount of data. In order to enhance the scalability of the VANETs, some studies focus on VCC (Vehicular Cloud Computing), which combines cloud computing [3, 4] and VANETs together [5, 6]. The illustration of VCC is shown in Figure 1. In VCC, mass data from different VANET nodes are collected and stored in cloud servers efficiently.Figure 1
The illustration of VCC (Vehicular Cloud Computing).Meanwhile, VCC is faced with serious security and privacy challenges. For instance, the intruders can intrude the onboard infrastructure or the cloud server to get the sensitive data, which may leak the privacy of the data owner (DO), or even endanger the lives of passengers. To solve this problem, we introduce the CP-ABE [7], which also realizes the fine-grained access control on the encrypted data. However, the vehicular situation and surroundings are quite complicated; a one-off encryption under one access tree may be no longer adequate for the needs. In addition, the attributes consisted in access structure may denote more abundant information, not just descriptive information about users’ identities. According to these attributes’ features, we extract them from the access structure and take them as “conditions.” When inserting other access trees, the conditions extracted from them can be used for identifying the corresponding tree.Main contributions of this paper can be summarized as follows:(1)
In this paper, we propose a conditional ciphertext-policy attribute-based encryption (C-CP-ABE) scheme to allow users to add extra access trees based on the original ciphertext to their own ciphertexts.(2)
All the trees multiply by a parameter except only one tree multiplies by the message, which extends the expression compared with original CP-ABE in [7] without bringing a heavy computation and storage overhead.(3)
We further give the security analysis and performance evaluation, which prove that security and performance of our scheme are no weaker than those of traditional scheme.The rest of this paper is organized as follows. Section2 introduces the related work. In Section 3, some preliminaries are given. In Section 4, the definition of the condition is given. In Section 5, the proposed scheme is stated. In Section 6, security analysis is given. In Section 7, the performance of our scheme is evaluated. In Section 8, the paper is concluded.


## 2. Related Work

Cloud security has been a hot topic recently [8, 9]. It had developed a new field in the application and research of public key encryption since Shamir’s proposed Identity Based Encryption in [10]. Based on IBE, Sahai and Waters proposed a new encryption scheme called Fuzzy IBE; they thought that the users’ attributes did not have to be precisely matched to the attributes that are specified by data owners. The ciphertext could be decrypted provided the threshold value of attributes was achieved [11]. Chase constructed a multiauthority attribute-based encryption to compensate for the weaknesses of single authority in [12], allowing each authority to be in charge of a domain of attributes. Soon, they improved the privacy and security of their previous system by removing the central trusted authority, which had usability in practice [13]. In [14], Kapadia et al. proposed a scheme to hide the policies and plaintexts from the servers. Along with the increasing number of attributes, the ciphertext size grew as well. To solve this problem, Herranz et al. gave a method to keep the size constant. In the situation of the attribute universe was certain [15].The access structure adopted in the schemes before was monotonic, so Ostrovsky et al. tried to construct an attribute-based encryption scheme which is nonmonotonic, which was proven to be secure based on Decisional Bilinear Diffie-Hellman (DBDH) assumption [16]. Compared with the previous work, Lewko et al. constructed a scheme that had been proven to be fully secure rather than selectively secure in [17].In [7, 18], KP-ABE and CP-ABE are proposed, respectively. In KP-ABE, the ciphertext’s encryption policy is also associated with a set of attributes, but the attributes are organized into a tree structure (named access tree). In CP-ABE, the data owner constructs the access tree using visitors’ identity information. The user can decrypt the ciphertext only if attributes in his private key match the access tree. Both became the important branches of attribute-based encryption. In [19, 20] Attrapadung et al. adopted the nonmonotonic access structure to realize key-policy attribute-based encryption; what is more, the size of ciphertext was designed to be constant. In [21–24], the ciphertext-policy attribute-based encryption (CP-ABE) scheme with constant size ciphertexts for threshold predicates is proposed.CP-ABE is a promising research area that attracts more and more attention from lots of researchers. Ibraimi et al. constructed a mediated CP-ABE that provided attributes revocation in [25]. Similar to KP-ABE, the researches on multiauthority in CP-ABE are quite a lot. Li et al. proposed a multiauthority CP-ABE that allowed tracing the misbehaving users; although only the AND gates were supported, it extended the application of CP-ABE to some extent [26]. Further improvements were made in this respect [27, 28].In [29], with the case of the personal health record, Li et al. realized the security and scalable and fine-grained access control, supporting the modification of access policies and revocation of attributes. Liu et al. assumed that each attribute had different importance and constructed schemes that supported the access structure with different weights in CP-ABE [30] and KP-ABE [31]. Liu et al. added traceability to an existing expressive, efficient, and secure CP-ABE scheme without weakening its security, and change in the length of the ciphertext and decryption key does not cause too much overhead [32]. Then they realized the White-Box Traceable CP-ABE in a large universe and the storage for traitor tracing is constant [33]. In [34], Goyal et al. allowed the access structure to be represented by an access tree with a bounded size access tree with threshold gates as its nodes. All of these existing schemes enhance the function of the original CP-ABE [7] to adapt to different scenarios. In this paper, we will introduce a new scheme to raise the adaptability of original CP-ABE in VCC.


## 3. Preliminaries

### 3.1. Bilinear Maps

LetG0 and G1 be two cyclic multiplicative groups of prime order p and g be the generator of G0.The bilinear mape, e:G0×G0→G1, for all a,b∈Zp is as follows:(1)
Bilinearity:∀u,v∈G1, e(ua,vb)=e(u,v)ab(2)
Nondegeneracy:e(g,g)≠1(3)
Symmetry:e(ga,gb)=e(g,g)ab=e(gb,ga)


### 3.2. Complexity Assumption

The Discrete Logarithm (DL) problem is defined as follows.LetG be a multiplicative cyclic group of prime order p and g be its generator. DL problem is to compute x∈Zp such that y=gx, given y∈RG as input.The DL hardness assumption holds, if no probabilistic polynomial time algorithm can solve the DL problem.


### 3.3. Access Structure

LetP={P1,P2,…,Pn} be a set of participants; let U=2{P1,P2,…,Pn} be the universal set. If ∃AS⊆U∖⌀, then AS can be viewed as an access structure.IfA∈AS, ∀B∈U, A⊆B, and B∈AS, then AS is monotonic. Then sets in AS are defined as authorized sets, while the other sets are regarded as unauthorized sets.In this paper, we construct an access treeT to represent the access structure. All the leaves represent the attributes, while the interior nodes represent the threshold gates. Before encrypting the data, we randomly choose a secret s and generate a polynomial for each interior node from top to bottom to share this secret.To retrieve the secret, we define the Lagrange coefficientΔi,S.Fori∈Zp and for ∀x∈S, (1)Δi,Sx=∏j∈S,j=ix-ji-j.Only the authorized sets can succeed in decryption with polynomial interpolation.


## 3.1. Bilinear Maps

LetG0 and G1 be two cyclic multiplicative groups of prime order p and g be the generator of G0.The bilinear mape, e:G0×G0→G1, for all a,b∈Zp is as follows:(1)
Bilinearity:∀u,v∈G1, e(ua,vb)=e(u,v)ab(2)
Nondegeneracy:e(g,g)≠1(3)
Symmetry:e(ga,gb)=e(g,g)ab=e(gb,ga)


## 3.2. Complexity Assumption

The Discrete Logarithm (DL) problem is defined as follows.LetG be a multiplicative cyclic group of prime order p and g be its generator. DL problem is to compute x∈Zp such that y=gx, given y∈RG as input.The DL hardness assumption holds, if no probabilistic polynomial time algorithm can solve the DL problem.


## 3.3. Access Structure

LetP={P1,P2,…,Pn} be a set of participants; let U=2{P1,P2,…,Pn} be the universal set. If ∃AS⊆U∖⌀, then AS can be viewed as an access structure.IfA∈AS, ∀B∈U, A⊆B, and B∈AS, then AS is monotonic. Then sets in AS are defined as authorized sets, while the other sets are regarded as unauthorized sets.In this paper, we construct an access treeT to represent the access structure. All the leaves represent the attributes, while the interior nodes represent the threshold gates. Before encrypting the data, we randomly choose a secret s and generate a polynomial for each interior node from top to bottom to share this secret.To retrieve the secret, we define the Lagrange coefficientΔi,S.Fori∈Zp and for ∀x∈S, (1)Δi,Sx=∏j∈S,j=ix-ji-j.Only the authorized sets can succeed in decryption with polynomial interpolation.


## 4. The Condition

Definition 1 (condition primitivesc).
The condition primitives refer to the attributes in the access tree that are not closely related to the users’ identities.Definition 2 (conditionC).
The condition is a set of condition primitives, by which a specific access tree can be identified.In VCC, condition primitives can be the external objective factors, such as the weather, the traffic, and the status information released by traffic control department. Comparing with the attributes related to the user’s identities, we do not have to be concerned that the condition primitives may lead to user privacy disclosure. In our proposed scheme, the condition primitives will be extracted from each access tree to form the corresponding condition. In other words, a condition corresponds to a specific access tree.Trust Center Authority (TCA) is in charge of evaluating the current conditions and sends them to data users. ConditionCi may consist of several components: Ci:ca,cb,cc,…. Each element is a condition primitive, which corresponds to a specific value that is randomly generated when the system is set up. Once generated, all the values are fixed and different from each other. In our scheme, we consider the relation of these conditions that belong to the same access structure to be AND. We multiply these corresponding values to denote the current condition.With the support of the condition, when a data owner encrypts the data, more than one access tree can be added to the original ciphertext. When a data user requests data decryption, the current condition should be checked firstly to get the corresponding access tree, and then data decryption can be continued.


## 5. The Proposed System

### 5.1. System Model

In our system, four entities are included, namely, cloud servers (CS), data owners (DOs), data receivers (DRs), and Trust Center Authority (TCA), as shown in Figure2.Figure 2
System model.Generally, cloud servers are assumed to be semitrusted. We employ them to be in charge of storing our encrypted data. Data owners and data receivers are either vehicle or nonmobile users. The former ones decide the access policies and the corresponding conditions, outsourcing their storage to CS after encrypting. The latter one submits the requests to CS and obtains their secret keys that are related to the attributes from TCA. Only when their attributes satisfy the access policies of data can they correctly decrypt the ciphertext. TCA takes responsibility for evaluating DRs and assigns a set of attributes to DRs. In addition, conditions will be managed, determined, and finally transmitted to DRs by TCA.In this paper, we allow DOs to add extra access trees and conditions to their own ciphertexts. Each access tree is related to one or several conditions. Only when its corresponding condition is satisfied can it be valid.


### 5.2. Security Model

The following is a security game between adversaryA and challenger C.Init. A first chooses a challenge access structure AS∗ and sends it to C.Setup. C runs this algorithm and gives the public parameters PK to the adversary A.Phase 1. A issues queries for repeated private keys corresponding to sets of attributes S1,…,Sq1 (q and q1 are integers that are randomly chosen by A and 1<q1<q).(i)
If any of the setsS1,…,Sq1 satisfies the access structure AS∗, then it is aborted.(ii)
Else,C generates the corresponding secret keys to the sets for A.Challenge. A submits two equal length messages M0 and M1 to C. C randomly flips a coin b and encrypts Mb under the challenge access structure AS∗. Then the generated ciphertext CT∗ will be given to A.Phase 2. Repeat Phase 1, and the sets are turned from S1,…,Sq1 to Sq1+1,…,Sq.Guess. The adversary A outputs a guess b′ of b.The advantage of an adversaryA in this game is defined as Adv(A)=Pr[b′=b]-1/2.


### 5.3. Our Construction

Our construction is based on the ciphertext-policy attribute-based encryption in [7]. In this section, we will describe the details of each algorithm.


#### 5.3.1. Setup

This setup algorithm will choose a bilinear groupG0 of prime order p with generator g. Then, it will choose several random exponents: α,β,k,q∈Zp. Let U denote the total number of attributes. Let V denote the total number of conditions. The algorithm randomly generates u1,u2,…,uV∈Zp for each condition. We introduce hash functions Hatt, HC˘, and enough Hi for the access trees in ciphertext. The public key and the master key are published as(2)PK=G0,g,h=gβ,eg,gα,gkα,gu1,gu2,…,guV,MK=β,gα,k,q.


#### 5.3.2. Encryption

As shown in Figure3, the original access tree is rooted at node Ri (i denotes the id of the access tree), and the new root node is Ri′.Figure 3
Structure of access tree in this paper.At first, DO calls the data encryption subroutine to encrypt the plaintext into ciphertexts under access policies expressed in access tree structure. Compared with [7], we add a new root node and insert an extra node that denotes condition and its signature.(i) E n c ( P K , M , T ~ i , C i ) → C I D , C T. The encryption subroutine takes as inputs public key PK, message M, access structure T~i, symmetric encryption keys K1 and K2, and condition Ci and then outputs ciphertext CT and its CID. In this algorithm, it requires several steps to get CT being generated properly.① Encrypt Data. DO receives message M, condition Ci, and one access policy. The encryption algorithm encrypts M under the access structure T~i. From root node Ri′ to the subtree rooted at Ri, this encryption algorithm is similar to that Bethencourt et al. described in [7].First, the algorithm chooses a random numbersi∈Zp  for root node Ri′, which means qRi′(0)=si. Then it generates polynomial for each interior node and computes (let Y be the set of leaf nodes in T~i)(3)C~i=Meg,gαsi,Ci=hsi,C^i,y=gqi,y0,C^i,y′=Hattattyqi,y0,∀y∈Yi.② Generate CID. Simultaneously, (4)SetP1=gsi/k,P2=EncK1P1,EncK2P2=CID.When DO would like to add an extra access structureT~i+1 to his ciphertext, he first searches for the ciphertext from CS according to the CID and reencrypts it rather than reencrypting its original plaintext. What is different from before is that the part of the ciphertext associated with M is no longer involved in encryption. Thus, the computation burden is reduced.Equally, the algorithm selects a random numbersi+1∈Zp for the new access tree T~i+1 and computes according to CID:(5)C~i+1=DecK2CIDeg,gαsi+1=P2eg,gαsi+1.M is encrypted under only one of the access trees; we generally set C~1=Me(g,g)αs1.③ Generate a Signature and Share It. Obviously, the threshold relation of Ri′ is AND. Suppose that the polynomial of Ri′ is qi,R′=ax+si (a is randomly chosen by the algorithm). ESP randomly chooses a number ti∈Zp and makes the following calculation:(6)Setwi=tiq,Sigi=g2a+si/tigua+ub+uc⋯/ti=g2a+si-ua+ub+uc⋯/ti.S i g i can be viewed as a signature from DO. Assume the threshold relation of the node Ri is k of n; we first share Sigi with (k,n) secret sharing scheme in [35] and then generate n pairs of (xi,j,yi,j)1≤j≤n.As we know, the nodeRi holds n branches, and each branch holds several attributes. Thus, all the attributes can be divided into n disjoint sets that are shown in Figure 4.Figure 4
Partition of the set.We distribute(xi,j,yi,j)1≤j≤n to the sets that are shown as follows.Distribution of the shares:(7)xi,1,yi,1⟵Seti,1:⋯xi,2,yi,2⟵Seti,2:⋯xi,3,yi,3⟵Seti,3:⋯⋮⟵⋮xi,n,yi,n⟵Seti,n:⋯.We introduce a one-dimensional arrayAiu1≤u≤U for each access tree T~i and assign each attribute a unique number from 1 to U. According to the shares and sets, we set(8)Ai1=Hiatt1⊕xi,1∥yi,1att1∈Seti,1,Ai2=Hiatt2⊕xi,1∥yi,1att2∈Seti,1,⋮Aim=Hiattm⊕xi,2∥yi,2attm∈Seti,2,Aim+1=Hiattm+1⊕xi,2∥yi,2attm+1∈Seti,2,⋮AiU=HiattU⊕xi,n∥yi,nattU∈Seti,n.④ Record the Corresponding Condition. Condition Ci associated with this tree is ca,cb,cc,…. In our system, we consider that one condition term only relates to one access tree. For each c∈Ci, the algorithm computes(9)C^i,c=guc/ti,C˘=ca∥cb∥cc⋯,C˘⊕i∥wi⟵Hc˘C˘⊕CID.LetYi be the set of leaf nodes in T and C be the set of conditions. Finally, the complete ciphertext is as follows:(10)CT=T~1,C~1=Meg,gαs1,C1=hs1,A1,C^1,y=gq1,y0,C^1,y′=Hattyq1,y0,∀y∈Y1,C⌢1,c=guc/t1,∀c∈C,T~2,C~2=P2eg,gαs2,C2=hs2,A2,C^2,y=gq2,y0,C^2,y′=Hattyq2,y0,∀y∈Y2,C⌢2,c=guc/t2,∀c∈C,….


#### 5.3.3. Key Generation

DR should legally register to the attribute authorities, which will assign some attributes to this DR. Before decryption, the authorities will generate a corresponding SK for DR based on his attributes. The algorithm is as follows.(i) KeyGen ( P K , M S K , S ) → S K. This algorithm will take a set of attributes S as input and output a key that identifies with that set. First, a random r∈Zp was chosen for the key and random rj∈Zp for each attribute j∈S. Then it computes the key as(11)SK=D=gα+r/β,D^=grq,Dj=grHjrj,Dj′=grj,∀j∈S.


#### 5.3.4. Decryption

When there is a DR requirement to decrypt a ciphertext, TCA will first evaluate the current condition and send the current condition termC0=ca,cb,cc,… to DR.(a) Query_Tree_id ( C 0 , C I D ) → i , w i. DR gets condition term from TCA, according to the current conditions and CID that is requested by DR, computing as follows:(12)C˘=ca∥cb∥cc⋯Hc˘C˘⊕CID⟶C˘⊕i∥wiC˘⊕Hc˘C˘⊕CID⟶i∥wi.This algorithm gets the corresponding access tree idi and a parameter wi.(b) Compute_Condition ( i , C 0 , S K , C T ) → C o n i. For each  cj∈C0, (13)SeteC⌢i,j,D^=eguj/ti,grq=eg,grquj/ti,Coni=eg,grqua/tieg,grqub/tieg,grquc/ti⋯=eg,grq∑uj/ti.(c) Retrieve_Sig ( S , C T , P K ) → S i g i or ⊥. For each attu∈S, it computes(14)Aiu⊕Hiattu=xi∥yi.For each computation, the algorithm gets a pair of(x,y) that is shown as follows.Retrieve the shares:(15)
S
a
t
t
1
a
t
t
2
a
t
t
3
⋯
:
S
e
t
i
,
1
⟶
x
i
,
1
,
y
i
,
1
⋯
:
S
e
t
i
,
2
a
t
t
4
⋯
:
S
e
t
i
,
3
⟶
x
i
,
3
,
y
i
,
3
a
t
t
5
⋮
⟶
⋮
⋮
⋮
a
t
t
u
⋯
:
S
e
t
i
,
n
⟶
x
i
,
n
,
y
i
,
n
.As we first shareSigi with (k,n) secret sharing scheme, DR performs the polynomial interpolation and retrieves Sigi only based on no less than k different pairs of (x,y). Otherwise, it outputs ⊥.(d) D e c ( S , C T , i , w i , C o n i , S i g i ) → M or ⊥. Once wi, Sigi, and Coni are retrieved, DR computes(16)eSigi,D^wiConiwi=eg2a+si-ua+ub+uc⋯/ti,grqti/qeg,grq∑uj/titi/q=eg,gr2a+si.For the access tree rooted at nodeRi′, the algorithm can leverage the Lagrange interpolation and get A=e(g,g)rsi. Then it computes(17)B=C~iAeCi,D.Ifi=1,(18)B=C~1AeC1,D=Meg,gαs1eg,grs1ehs1,gα+r/β=Meg,gαs1eg,grs1eg,gs1a+r=M.Else,(19)B=C~iAeCi,D=P2eg,gαsieg,grsiehsi,gα+r/β=P2eg,gαsieg,grsieg,gsia+r=P2.The algorithm decryptsP2 with K1(20)P1=DecK1P2=gs1/kand recovers M by computing(21)M=C~1egkα,gs1/k=Meg,gαs1eg,gαs1.Otherwise, it outputs⊥.


## 5.1. System Model

In our system, four entities are included, namely, cloud servers (CS), data owners (DOs), data receivers (DRs), and Trust Center Authority (TCA), as shown in Figure2.Figure 2
System model.Generally, cloud servers are assumed to be semitrusted. We employ them to be in charge of storing our encrypted data. Data owners and data receivers are either vehicle or nonmobile users. The former ones decide the access policies and the corresponding conditions, outsourcing their storage to CS after encrypting. The latter one submits the requests to CS and obtains their secret keys that are related to the attributes from TCA. Only when their attributes satisfy the access policies of data can they correctly decrypt the ciphertext. TCA takes responsibility for evaluating DRs and assigns a set of attributes to DRs. In addition, conditions will be managed, determined, and finally transmitted to DRs by TCA.In this paper, we allow DOs to add extra access trees and conditions to their own ciphertexts. Each access tree is related to one or several conditions. Only when its corresponding condition is satisfied can it be valid.


## 5.2. Security Model

The following is a security game between adversaryA and challenger C.Init. A first chooses a challenge access structure AS∗ and sends it to C.Setup. C runs this algorithm and gives the public parameters PK to the adversary A.Phase 1. A issues queries for repeated private keys corresponding to sets of attributes S1,…,Sq1 (q and q1 are integers that are randomly chosen by A and 1<q1<q).(i)
If any of the setsS1,…,Sq1 satisfies the access structure AS∗, then it is aborted.(ii)
Else,C generates the corresponding secret keys to the sets for A.Challenge. A submits two equal length messages M0 and M1 to C. C randomly flips a coin b and encrypts Mb under the challenge access structure AS∗. Then the generated ciphertext CT∗ will be given to A.Phase 2. Repeat Phase 1, and the sets are turned from S1,…,Sq1 to Sq1+1,…,Sq.Guess. The adversary A outputs a guess b′ of b.The advantage of an adversaryA in this game is defined as Adv(A)=Pr[b′=b]-1/2.


## 5.3. Our Construction

Our construction is based on the ciphertext-policy attribute-based encryption in [7]. In this section, we will describe the details of each algorithm.


### 5.3.1. Setup

This setup algorithm will choose a bilinear groupG0 of prime order p with generator g. Then, it will choose several random exponents: α,β,k,q∈Zp. Let U denote the total number of attributes. Let V denote the total number of conditions. The algorithm randomly generates u1,u2,…,uV∈Zp for each condition. We introduce hash functions Hatt, HC˘, and enough Hi for the access trees in ciphertext. The public key and the master key are published as(2)PK=G0,g,h=gβ,eg,gα,gkα,gu1,gu2,…,guV,MK=β,gα,k,q.


### 5.3.2. Encryption

As shown in Figure3, the original access tree is rooted at node Ri (i denotes the id of the access tree), and the new root node is Ri′.Figure 3
Structure of access tree in this paper.At first, DO calls the data encryption subroutine to encrypt the plaintext into ciphertexts under access policies expressed in access tree structure. Compared with [7], we add a new root node and insert an extra node that denotes condition and its signature.(i) E n c ( P K , M , T ~ i , C i ) → C I D , C T. The encryption subroutine takes as inputs public key PK, message M, access structure T~i, symmetric encryption keys K1 and K2, and condition Ci and then outputs ciphertext CT and its CID. In this algorithm, it requires several steps to get CT being generated properly.① Encrypt Data. DO receives message M, condition Ci, and one access policy. The encryption algorithm encrypts M under the access structure T~i. From root node Ri′ to the subtree rooted at Ri, this encryption algorithm is similar to that Bethencourt et al. described in [7].First, the algorithm chooses a random numbersi∈Zp  for root node Ri′, which means qRi′(0)=si. Then it generates polynomial for each interior node and computes (let Y be the set of leaf nodes in T~i)(3)C~i=Meg,gαsi,Ci=hsi,C^i,y=gqi,y0,C^i,y′=Hattattyqi,y0,∀y∈Yi.② Generate CID. Simultaneously, (4)SetP1=gsi/k,P2=EncK1P1,EncK2P2=CID.When DO would like to add an extra access structureT~i+1 to his ciphertext, he first searches for the ciphertext from CS according to the CID and reencrypts it rather than reencrypting its original plaintext. What is different from before is that the part of the ciphertext associated with M is no longer involved in encryption. Thus, the computation burden is reduced.Equally, the algorithm selects a random numbersi+1∈Zp for the new access tree T~i+1 and computes according to CID:(5)C~i+1=DecK2CIDeg,gαsi+1=P2eg,gαsi+1.M is encrypted under only one of the access trees; we generally set C~1=Me(g,g)αs1.③ Generate a Signature and Share It. Obviously, the threshold relation of Ri′ is AND. Suppose that the polynomial of Ri′ is qi,R′=ax+si (a is randomly chosen by the algorithm). ESP randomly chooses a number ti∈Zp and makes the following calculation:(6)Setwi=tiq,Sigi=g2a+si/tigua+ub+uc⋯/ti=g2a+si-ua+ub+uc⋯/ti.S i g i can be viewed as a signature from DO. Assume the threshold relation of the node Ri is k of n; we first share Sigi with (k,n) secret sharing scheme in [35] and then generate n pairs of (xi,j,yi,j)1≤j≤n.As we know, the nodeRi holds n branches, and each branch holds several attributes. Thus, all the attributes can be divided into n disjoint sets that are shown in Figure 4.Figure 4
Partition of the set.We distribute(xi,j,yi,j)1≤j≤n to the sets that are shown as follows.Distribution of the shares:(7)xi,1,yi,1⟵Seti,1:⋯xi,2,yi,2⟵Seti,2:⋯xi,3,yi,3⟵Seti,3:⋯⋮⟵⋮xi,n,yi,n⟵Seti,n:⋯.We introduce a one-dimensional arrayAiu1≤u≤U for each access tree T~i and assign each attribute a unique number from 1 to U. According to the shares and sets, we set(8)Ai1=Hiatt1⊕xi,1∥yi,1att1∈Seti,1,Ai2=Hiatt2⊕xi,1∥yi,1att2∈Seti,1,⋮Aim=Hiattm⊕xi,2∥yi,2attm∈Seti,2,Aim+1=Hiattm+1⊕xi,2∥yi,2attm+1∈Seti,2,⋮AiU=HiattU⊕xi,n∥yi,nattU∈Seti,n.④ Record the Corresponding Condition. Condition Ci associated with this tree is ca,cb,cc,…. In our system, we consider that one condition term only relates to one access tree. For each c∈Ci, the algorithm computes(9)C^i,c=guc/ti,C˘=ca∥cb∥cc⋯,C˘⊕i∥wi⟵Hc˘C˘⊕CID.LetYi be the set of leaf nodes in T and C be the set of conditions. Finally, the complete ciphertext is as follows:(10)CT=T~1,C~1=Meg,gαs1,C1=hs1,A1,C^1,y=gq1,y0,C^1,y′=Hattyq1,y0,∀y∈Y1,C⌢1,c=guc/t1,∀c∈C,T~2,C~2=P2eg,gαs2,C2=hs2,A2,C^2,y=gq2,y0,C^2,y′=Hattyq2,y0,∀y∈Y2,C⌢2,c=guc/t2,∀c∈C,….


### 5.3.3. Key Generation

DR should legally register to the attribute authorities, which will assign some attributes to this DR. Before decryption, the authorities will generate a corresponding SK for DR based on his attributes. The algorithm is as follows.(i) KeyGen ( P K , M S K , S ) → S K. This algorithm will take a set of attributes S as input and output a key that identifies with that set. First, a random r∈Zp was chosen for the key and random rj∈Zp for each attribute j∈S. Then it computes the key as(11)SK=D=gα+r/β,D^=grq,Dj=grHjrj,Dj′=grj,∀j∈S.


### 5.3.4. Decryption

When there is a DR requirement to decrypt a ciphertext, TCA will first evaluate the current condition and send the current condition termC0=ca,cb,cc,… to DR.(a) Query_Tree_id ( C 0 , C I D ) → i , w i. DR gets condition term from TCA, according to the current conditions and CID that is requested by DR, computing as follows:(12)C˘=ca∥cb∥cc⋯Hc˘C˘⊕CID⟶C˘⊕i∥wiC˘⊕Hc˘C˘⊕CID⟶i∥wi.This algorithm gets the corresponding access tree idi and a parameter wi.(b) Compute_Condition ( i , C 0 , S K , C T ) → C o n i. For each  cj∈C0, (13)SeteC⌢i,j,D^=eguj/ti,grq=eg,grquj/ti,Coni=eg,grqua/tieg,grqub/tieg,grquc/ti⋯=eg,grq∑uj/ti.(c) Retrieve_Sig ( S , C T , P K ) → S i g i or ⊥. For each attu∈S, it computes(14)Aiu⊕Hiattu=xi∥yi.For each computation, the algorithm gets a pair of(x,y) that is shown as follows.Retrieve the shares:(15)
S
a
t
t
1
a
t
t
2
a
t
t
3
⋯
:
S
e
t
i
,
1
⟶
x
i
,
1
,
y
i
,
1
⋯
:
S
e
t
i
,
2
a
t
t
4
⋯
:
S
e
t
i
,
3
⟶
x
i
,
3
,
y
i
,
3
a
t
t
5
⋮
⟶
⋮
⋮
⋮
a
t
t
u
⋯
:
S
e
t
i
,
n
⟶
x
i
,
n
,
y
i
,
n
.As we first shareSigi with (k,n) secret sharing scheme, DR performs the polynomial interpolation and retrieves Sigi only based on no less than k different pairs of (x,y). Otherwise, it outputs ⊥.(d) D e c ( S , C T , i , w i , C o n i , S i g i ) → M or ⊥. Once wi, Sigi, and Coni are retrieved, DR computes(16)eSigi,D^wiConiwi=eg2a+si-ua+ub+uc⋯/ti,grqti/qeg,grq∑uj/titi/q=eg,gr2a+si.For the access tree rooted at nodeRi′, the algorithm can leverage the Lagrange interpolation and get A=e(g,g)rsi. Then it computes(17)B=C~iAeCi,D.Ifi=1,(18)B=C~1AeC1,D=Meg,gαs1eg,grs1ehs1,gα+r/β=Meg,gαs1eg,grs1eg,gs1a+r=M.Else,(19)B=C~iAeCi,D=P2eg,gαsieg,grsiehsi,gα+r/β=P2eg,gαsieg,grsieg,gsia+r=P2.The algorithm decryptsP2 with K1(20)P1=DecK1P2=gs1/kand recovers M by computing(21)M=C~1egkα,gs1/k=Meg,gαs1eg,gαs1.Otherwise, it outputs⊥.


## 5.3.1. Setup

This setup algorithm will choose a bilinear groupG0 of prime order p with generator g. Then, it will choose several random exponents: α,β,k,q∈Zp. Let U denote the total number of attributes. Let V denote the total number of conditions. The algorithm randomly generates u1,u2,…,uV∈Zp for each condition. We introduce hash functions Hatt, HC˘, and enough Hi for the access trees in ciphertext. The public key and the master key are published as(2)PK=G0,g,h=gβ,eg,gα,gkα,gu1,gu2,…,guV,MK=β,gα,k,q.


## 5.3.2. Encryption

As shown in Figure3, the original access tree is rooted at node Ri (i denotes the id of the access tree), and the new root node is Ri′.Figure 3
Structure of access tree in this paper.At first, DO calls the data encryption subroutine to encrypt the plaintext into ciphertexts under access policies expressed in access tree structure. Compared with [7], we add a new root node and insert an extra node that denotes condition and its signature.(i) E n c ( P K , M , T ~ i , C i ) → C I D , C T. The encryption subroutine takes as inputs public key PK, message M, access structure T~i, symmetric encryption keys K1 and K2, and condition Ci and then outputs ciphertext CT and its CID. In this algorithm, it requires several steps to get CT being generated properly.① Encrypt Data. DO receives message M, condition Ci, and one access policy. The encryption algorithm encrypts M under the access structure T~i. From root node Ri′ to the subtree rooted at Ri, this encryption algorithm is similar to that Bethencourt et al. described in [7].First, the algorithm chooses a random numbersi∈Zp  for root node Ri′, which means qRi′(0)=si. Then it generates polynomial for each interior node and computes (let Y be the set of leaf nodes in T~i)(3)C~i=Meg,gαsi,Ci=hsi,C^i,y=gqi,y0,C^i,y′=Hattattyqi,y0,∀y∈Yi.② Generate CID. Simultaneously, (4)SetP1=gsi/k,P2=EncK1P1,EncK2P2=CID.When DO would like to add an extra access structureT~i+1 to his ciphertext, he first searches for the ciphertext from CS according to the CID and reencrypts it rather than reencrypting its original plaintext. What is different from before is that the part of the ciphertext associated with M is no longer involved in encryption. Thus, the computation burden is reduced.Equally, the algorithm selects a random numbersi+1∈Zp for the new access tree T~i+1 and computes according to CID:(5)C~i+1=DecK2CIDeg,gαsi+1=P2eg,gαsi+1.M is encrypted under only one of the access trees; we generally set C~1=Me(g,g)αs1.③ Generate a Signature and Share It. Obviously, the threshold relation of Ri′ is AND. Suppose that the polynomial of Ri′ is qi,R′=ax+si (a is randomly chosen by the algorithm). ESP randomly chooses a number ti∈Zp and makes the following calculation:(6)Setwi=tiq,Sigi=g2a+si/tigua+ub+uc⋯/ti=g2a+si-ua+ub+uc⋯/ti.S i g i can be viewed as a signature from DO. Assume the threshold relation of the node Ri is k of n; we first share Sigi with (k,n) secret sharing scheme in [35] and then generate n pairs of (xi,j,yi,j)1≤j≤n.As we know, the nodeRi holds n branches, and each branch holds several attributes. Thus, all the attributes can be divided into n disjoint sets that are shown in Figure 4.Figure 4
Partition of the set.We distribute(xi,j,yi,j)1≤j≤n to the sets that are shown as follows.Distribution of the shares:(7)xi,1,yi,1⟵Seti,1:⋯xi,2,yi,2⟵Seti,2:⋯xi,3,yi,3⟵Seti,3:⋯⋮⟵⋮xi,n,yi,n⟵Seti,n:⋯.We introduce a one-dimensional arrayAiu1≤u≤U for each access tree T~i and assign each attribute a unique number from 1 to U. According to the shares and sets, we set(8)Ai1=Hiatt1⊕xi,1∥yi,1att1∈Seti,1,Ai2=Hiatt2⊕xi,1∥yi,1att2∈Seti,1,⋮Aim=Hiattm⊕xi,2∥yi,2attm∈Seti,2,Aim+1=Hiattm+1⊕xi,2∥yi,2attm+1∈Seti,2,⋮AiU=HiattU⊕xi,n∥yi,nattU∈Seti,n.④ Record the Corresponding Condition. Condition Ci associated with this tree is ca,cb,cc,…. In our system, we consider that one condition term only relates to one access tree. For each c∈Ci, the algorithm computes(9)C^i,c=guc/ti,C˘=ca∥cb∥cc⋯,C˘⊕i∥wi⟵Hc˘C˘⊕CID.LetYi be the set of leaf nodes in T and C be the set of conditions. Finally, the complete ciphertext is as follows:(10)CT=T~1,C~1=Meg,gαs1,C1=hs1,A1,C^1,y=gq1,y0,C^1,y′=Hattyq1,y0,∀y∈Y1,C⌢1,c=guc/t1,∀c∈C,T~2,C~2=P2eg,gαs2,C2=hs2,A2,C^2,y=gq2,y0,C^2,y′=Hattyq2,y0,∀y∈Y2,C⌢2,c=guc/t2,∀c∈C,….


## 5.3.3. Key Generation

DR should legally register to the attribute authorities, which will assign some attributes to this DR. Before decryption, the authorities will generate a corresponding SK for DR based on his attributes. The algorithm is as follows.(i) KeyGen ( P K , M S K , S ) → S K. This algorithm will take a set of attributes S as input and output a key that identifies with that set. First, a random r∈Zp was chosen for the key and random rj∈Zp for each attribute j∈S. Then it computes the key as(11)SK=D=gα+r/β,D^=grq,Dj=grHjrj,Dj′=grj,∀j∈S.


## 5.3.4. Decryption

When there is a DR requirement to decrypt a ciphertext, TCA will first evaluate the current condition and send the current condition termC0=ca,cb,cc,… to DR.(a) Query_Tree_id ( C 0 , C I D ) → i , w i. DR gets condition term from TCA, according to the current conditions and CID that is requested by DR, computing as follows:(12)C˘=ca∥cb∥cc⋯Hc˘C˘⊕CID⟶C˘⊕i∥wiC˘⊕Hc˘C˘⊕CID⟶i∥wi.This algorithm gets the corresponding access tree idi and a parameter wi.(b) Compute_Condition ( i , C 0 , S K , C T ) → C o n i. For each  cj∈C0, (13)SeteC⌢i,j,D^=eguj/ti,grq=eg,grquj/ti,Coni=eg,grqua/tieg,grqub/tieg,grquc/ti⋯=eg,grq∑uj/ti.(c) Retrieve_Sig ( S , C T , P K ) → S i g i or ⊥. For each attu∈S, it computes(14)Aiu⊕Hiattu=xi∥yi.For each computation, the algorithm gets a pair of(x,y) that is shown as follows.Retrieve the shares:(15)
S
a
t
t
1
a
t
t
2
a
t
t
3
⋯
:
S
e
t
i
,
1
⟶
x
i
,
1
,
y
i
,
1
⋯
:
S
e
t
i
,
2
a
t
t
4
⋯
:
S
e
t
i
,
3
⟶
x
i
,
3
,
y
i
,
3
a
t
t
5
⋮
⟶
⋮
⋮
⋮
a
t
t
u
⋯
:
S
e
t
i
,
n
⟶
x
i
,
n
,
y
i
,
n
.As we first shareSigi with (k,n) secret sharing scheme, DR performs the polynomial interpolation and retrieves Sigi only based on no less than k different pairs of (x,y). Otherwise, it outputs ⊥.(d) D e c ( S , C T , i , w i , C o n i , S i g i ) → M or ⊥. Once wi, Sigi, and Coni are retrieved, DR computes(16)eSigi,D^wiConiwi=eg2a+si-ua+ub+uc⋯/ti,grqti/qeg,grq∑uj/titi/q=eg,gr2a+si.For the access tree rooted at nodeRi′, the algorithm can leverage the Lagrange interpolation and get A=e(g,g)rsi. Then it computes(17)B=C~iAeCi,D.Ifi=1,(18)B=C~1AeC1,D=Meg,gαs1eg,grs1ehs1,gα+r/β=Meg,gαs1eg,grs1eg,gs1a+r=M.Else,(19)B=C~iAeCi,D=P2eg,gαsieg,grsiehsi,gα+r/β=P2eg,gαsieg,grsieg,gsia+r=P2.The algorithm decryptsP2 with K1(20)P1=DecK1P2=gs1/kand recovers M by computing(21)M=C~1egkα,gs1/k=Meg,gαs1eg,gαs1.Otherwise, it outputs⊥.


## 6. Security Analysis

We make the traditional CP-ABE more expressive by allowing DOs to add extra access trees and conditions as they like. To reduce the computation cost and storage overhead, we replaceM with CID within the reencryption. And before decryption, condition values are to be computed first.The modification of the ciphertexts and the way of decryption may affect the security of the system.Theorem 3.
If hash functionH is collision resistant, our system is secure against chosen plaintext attack in random oracle model.Proof.
Since ciphertexts areCID:CT, data that is exposed to the adversary is(22)T~i,C~i=Pmeg,gαs1,Ci=hsi,Ai,C^1,i=gqi,y0,C^i,y′=Hattyqi,y0,∀y∈Yi,where P0=M.
We then use a random functionf to replace the hash function H. Therefore, the adversary A can obtain (23)T~i,C~i=Pmeg,gαs1,Ci=hsi,Ai,C^1,i=gqi,yj0,C^i,y′=fattyjqi,yj0,∀yj∈Yi,where P0=M. This scheme is named as the alternative scheme.
Finally, we construct an experiment to simulate the chosen plaintext attack here.
(1)A calls the encryption oracle to query a cipher for plaintext yj in the probabilistic polynomial time; we run the alternative scheme and return f(att(yj))qi,yj(0), as the cipher, to the adversary.
(2)A chooses two messages yj1 and yj2, and we return f(att(yj1))qi,yj1(0),f(att(yj2))qiyj2(0) to the adversary.
(3)A asks a challenge plaintext; we flip a coin to generate a random number yjb, b∈{0,1}, and send f(att(yjb))qyjb(0) to the adversary.
(4)A continues to query some plaintexts which is the same as the first step.
(5) Finally, adversaryA outputs b′; it wins if b=b′. Otherwise, it fails.
There are two ways to win the experiment for the adversary.
(1)sj can be recovered. This contradicts DL problem.
(2) There must exist twoy and y′, such that f(att(y))qy0=f(att(y′))qy′(0). The probability is negligible as f is a random function.
Above all, the adversary is negligible to win in the simulation experiment.
Furthermore, since the hash function cannot be distinguished with a random function in the random oracle model, the proposed system is secure to resist chosen plaintext attack.
The advantage of an adversaryA is defined as(24)AdvA=PrHCollision+PrRecoversj+PrDwins.We define negl(k) as a function that is negligible with a security parameter k. Assume that the probability that H collision occurs is Pr[HCollision]. Since H is collision resistant, Pr[HCollision] is negl1(k). D is used to distinguish f with a random function. Since f is a pseudorandom function, therefore Pr[Dwins] is negl2(k). Since it is computationally infeasible to solve DL problem, Pr[Recoversj] is negl3(k). In sum, Adv(A)≤negl1[k]+negl2k+negl3[k].
We complete the proof.


## 7. Performance Evaluation

In this section, we analyze our proposed scheme numerically, mainly discussing the computation and storage overhead.


### 7.1. Computation Overhead

#### 7.1.1. Setup

This algorithm is used to define a cyclic multiplicative group and to generate a PK and MK that will be used in encryption and key generation especially. The number of random numbers is fixed, which means that there is no relationship between computing time and number of attributes. Time complexity of the algorithm isO(1).


#### 7.1.2. Encrypt

DO first encryptsM under an access tree, and the computation cost is proportional to the number of attributes in this tree. If the universal attributes set in T is I (I denotes the total number of attributes in set I), for each element in I, we need 2 exponentiation operations. Hence, total computation complexity is O(I). Additionally, in C-CP-ABE, one ciphertext is allowed to be associated with more than one access tree; if there are m access trees, for each tree, computation cost is proportional to the number of attributes, and the total computation complexity is mO(I).


#### 7.1.3. KeyGen

This algorithm is used to generate SK for DR. Computing cost is proportional to the number of attributes in SK. For each attribute, the algorithm requires 2 pairing operations and 1 multiplication operation. If the universal attributes set isS (S is the total number of attributes in set, S≤I), then the time complexity of SK computation is O(S).


#### 7.1.4. Decrypt

Computing and checking the conditions are the first step within decryption. TCA evaluates the current conditions and sends them to DR. The computation cost is fixed, and the computation complexity isO(1). Once the valid tree is found, the following steps are similar to CP-ABE; the overhead mainly occurs during computing each attribute of the tree. Total cost is proportional to the number of attributes in the tree. Thus, the complexity is O(I).


### 7.2. Storage Overhead

To realize more expressive access control, more storage cost has been inevitably introduced. One ciphertext is associated with more than one access tree. Only one tree’s secret multiplies byM, while others multiply by a parameter. Along with the increasing number of access trees, the size of ciphertext grows. However, it is of low storage overhead compared with the component C~=Me(g,g)αs in CT.In addition, we create a one-dimensional array for each access tree in CT, whose length is equal to the number of the tree’s leaf nodes. The total storage cost would not be a significant burden for CS.


### 7.3. Experimental Results

With the help of the CPABE-toolkit [36], we evaluate the performance of our system and compare it with CP-ABE [7].In order to strengthen the expression of access structure, we make the ciphertext to be associated with more than one access tree. Compared with only one access tree in the traditional CPABE, introducing more trees may affect the time of encryption and decryption. However, we encrypt the message only once when it has more than one access tree; the other trees are multiplied with a parameter that includes decryption information. We set the size of the message as 1 G and the number of attributes in each tree as 100.For the purposes of comparison, all the access trees have the same number of leaves nodes. Figure5(a) shows the average time cost of [7] and our system within encryption. Figure 5(b) shows the average time cost of [7] and our system within decryption. From Figures 5(a) and 5(b), we can conclude that the average computation overheads in our system are lower than that in [7].Figure 5
(a) Comparison of the average encryption times between CPABE and our system, when the number of access trees is different. (b) Comparison of decryption times between CPABE and our system, when the number of access trees is different. (c) Changes in the ciphertext size of our system, when the number of access trees is different.
(a) (b) (c)When considering that there is only one ciphertext, introducing extra access trees is bound to cause the storage overhead. In traditional CP-ABE scheme, more trees mean more ciphertexts, while in our system one ciphertext is associated with a few access trees. In this case, it is obvious that our system reduces the storage overhead since the other trees are multiplied by a parameter rather than a message. Figure5(c) shows that along with the increasing number of access trees the ciphertext size of our system grows.Obviously, there exists a rough linear rise for the ciphertext size with the number of access trees, but even then it does not bring a high storage overhead when compared with the original ciphertext.


## 7.1. Computation Overhead

### 7.1.1. Setup

This algorithm is used to define a cyclic multiplicative group and to generate a PK and MK that will be used in encryption and key generation especially. The number of random numbers is fixed, which means that there is no relationship between computing time and number of attributes. Time complexity of the algorithm isO(1).


### 7.1.2. Encrypt

DO first encryptsM under an access tree, and the computation cost is proportional to the number of attributes in this tree. If the universal attributes set in T is I (I denotes the total number of attributes in set I), for each element in I, we need 2 exponentiation operations. Hence, total computation complexity is O(I). Additionally, in C-CP-ABE, one ciphertext is allowed to be associated with more than one access tree; if there are m access trees, for each tree, computation cost is proportional to the number of attributes, and the total computation complexity is mO(I).


### 7.1.3. KeyGen

This algorithm is used to generate SK for DR. Computing cost is proportional to the number of attributes in SK. For each attribute, the algorithm requires 2 pairing operations and 1 multiplication operation. If the universal attributes set isS (S is the total number of attributes in set, S≤I), then the time complexity of SK computation is O(S).


### 7.1.4. Decrypt

Computing and checking the conditions are the first step within decryption. TCA evaluates the current conditions and sends them to DR. The computation cost is fixed, and the computation complexity isO(1). Once the valid tree is found, the following steps are similar to CP-ABE; the overhead mainly occurs during computing each attribute of the tree. Total cost is proportional to the number of attributes in the tree. Thus, the complexity is O(I).


## 7.1.1. Setup

This algorithm is used to define a cyclic multiplicative group and to generate a PK and MK that will be used in encryption and key generation especially. The number of random numbers is fixed, which means that there is no relationship between computing time and number of attributes. Time complexity of the algorithm isO(1).


## 7.1.2. Encrypt

DO first encryptsM under an access tree, and the computation cost is proportional to the number of attributes in this tree. If the universal attributes set in T is I (I denotes the total number of attributes in set I), for each element in I, we need 2 exponentiation operations. Hence, total computation complexity is O(I). Additionally, in C-CP-ABE, one ciphertext is allowed to be associated with more than one access tree; if there are m access trees, for each tree, computation cost is proportional to the number of attributes, and the total computation complexity is mO(I).


## 7.1.3. KeyGen

This algorithm is used to generate SK for DR. Computing cost is proportional to the number of attributes in SK. For each attribute, the algorithm requires 2 pairing operations and 1 multiplication operation. If the universal attributes set isS (S is the total number of attributes in set, S≤I), then the time complexity of SK computation is O(S).


## 7.1.4. Decrypt

Computing and checking the conditions are the first step within decryption. TCA evaluates the current conditions and sends them to DR. The computation cost is fixed, and the computation complexity isO(1). Once the valid tree is found, the following steps are similar to CP-ABE; the overhead mainly occurs during computing each attribute of the tree. Total cost is proportional to the number of attributes in the tree. Thus, the complexity is O(I).


## 7.2. Storage Overhead

To realize more expressive access control, more storage cost has been inevitably introduced. One ciphertext is associated with more than one access tree. Only one tree’s secret multiplies byM, while others multiply by a parameter. Along with the increasing number of access trees, the size of ciphertext grows. However, it is of low storage overhead compared with the component C~=Me(g,g)αs in CT.In addition, we create a one-dimensional array for each access tree in CT, whose length is equal to the number of the tree’s leaf nodes. The total storage cost would not be a significant burden for CS.


## 7.3. Experimental Results

With the help of the CPABE-toolkit [36], we evaluate the performance of our system and compare it with CP-ABE [7].In order to strengthen the expression of access structure, we make the ciphertext to be associated with more than one access tree. Compared with only one access tree in the traditional CPABE, introducing more trees may affect the time of encryption and decryption. However, we encrypt the message only once when it has more than one access tree; the other trees are multiplied with a parameter that includes decryption information. We set the size of the message as 1 G and the number of attributes in each tree as 100.For the purposes of comparison, all the access trees have the same number of leaves nodes. Figure5(a) shows the average time cost of [7] and our system within encryption. Figure 5(b) shows the average time cost of [7] and our system within decryption. From Figures 5(a) and 5(b), we can conclude that the average computation overheads in our system are lower than that in [7].Figure 5
(a) Comparison of the average encryption times between CPABE and our system, when the number of access trees is different. (b) Comparison of decryption times between CPABE and our system, when the number of access trees is different. (c) Changes in the ciphertext size of our system, when the number of access trees is different.
(a) (b) (c)When considering that there is only one ciphertext, introducing extra access trees is bound to cause the storage overhead. In traditional CP-ABE scheme, more trees mean more ciphertexts, while in our system one ciphertext is associated with a few access trees. In this case, it is obvious that our system reduces the storage overhead since the other trees are multiplied by a parameter rather than a message. Figure5(c) shows that along with the increasing number of access trees the ciphertext size of our system grows.Obviously, there exists a rough linear rise for the ciphertext size with the number of access trees, but even then it does not bring a high storage overhead when compared with the original ciphertext.


## 8. Conclusion

In this paper, we propose an expressive and fine-grained access control scheme C-CP-ABE in Vehicle Cloud Computing, making it possible that one ciphertext can be able to be associated with more than one access tree, different access tree under different conditions. DOs are allowed to add new access trees and new conditions to their ciphertexts flexibly. And a parameter that is calculated by ESP usings replaces M, which can reduce the computation and storage overhead when adding other access trees. The detailed security and performance analysis have been stated. There are some failings in our system, such as conditions not being flexible enough. All of them will be our future work.



---

*Source: 1493290-2016-11-15.xml*