# Traceable Ciphertext-Policy Attribute-Based Encryption with Verifiable Outsourced Decryption in eHealth Cloud

Authors: Qi Li; Hongbo Zhu; Zuobin Ying; Tao Zhang
Journal: Wireless Communications and Mobile Computing
 (2018)

---

## Abstract

In cloud-assisted electronic health care (eHealth) systems, a patient can enforce access control on his/her personal health information (PHI) in a cryptographic way by employing ciphertext-policy attribute-based encryption (CP-ABE) mechanism. There are two features worthy of consideration in real eHealth applications. On the one hand, although the outsourced decryption technique can significantly reduce the decryption cost of a physician, the correctness of the returned result should be guaranteed. On the other hand, the malicious physician who leaks the private key intentionally should be caught. Existing systems mostly aim to provide only one of the above properties. In this work, we present a verifiable and traceable CP-ABE scheme (VTCP-ABE) in eHealth cloud, which simultaneously supports the properties of verifiable outsourced decryption and white-box traceability without compromising the physician’s identity privacy. An authorized physician can obtain an ElGamal-type partial decrypted ciphertext (PDC) element of original ciphertext from the eHealth cloud decryption server (CDS) and then verify the correctness of returned PDC. Moreover, the illegal behaviour of malicious physician can be precisely (white-box) traced. We further exploit a delegation method to help the resource-limited physician authorize someone else to interact with the CDS. The formal security proof and extensive simulations illustrate that our VTCP-ABE scheme is secure, efficient, and practical.


---

## Body

## 1. Introduction

Electronic health care (eHealth) system is regarded as an outstanding approach to provide well health care service through various emerging technologies, including Internet of Things, cloud computing, mobile computing, and wireless sensor networks. In cloud-assisted eHealth systems, an individual patient integrates his/her personal health information (PHI) collected via various wearable and embedded sensors, stores the PHI in the cloud, and receives real-time and high-quality medical treatment. Unfortunately, when the patient enjoys convenient storage services provided by cloud server, the risk of privacy exposure also raises. The sensitive PHI may be exposed to the cloud server which can not be fully trusted. Even worse, the PHI may be widely propagated to unauthorized parties for commerce benefit or other purposes. Thus, the PHI must be encrypted before hosted to the eHealth cloud. Meanwhile, an access policy must be specified to point out who are authorized to access the PHI.Aiming to realize access control on encrypted message, attribute-based encryption (ABE) [1] was presented to provide an efficient solution to this kind of applications. According to the place where the access policy is embedded, the ABE schemes are divided into two forms, key-policy ABE (KP-ABE) [2] and another type of ABE named ciphertext-policy ABE (CP-ABE) [3]. In the former framework, every user’s key is labeled with an access policy while the ciphertexts are annotated with chosen sets of attributes. On the contrary, the user’s key in CP-ABE is issued according to his/her attributes while the ciphertext is encrypted under an access policy. Since that ABE is a feasible mechanism which preserves the security and privacy of patients’ PHI, a series of attribute-based access control systems [4–8] have been proposed, aiming at expressive policies, security, or efficiency. In particular, there remain two significant features to be considered in utilizing ABE technique in eHealth systems.The first feature is verifiability of outsourced decryption. In most ABE systems [1–3, 9–12], the decryption overhead is linear to the scale of involved attributes and expensive for energy-constrained terminals. The decryption outsourcing technique [13] is proposed to reduce the number of exponential operations and bilinear pairing operations on user side by offloading the heavy decryption computation to a third-party server, e.g., the cloud server. The user then recovers the plaintext by executing only one exponential operation over ElGamal-style partial decrypted ciphertext element generated by the third-party server. However, such outsourced scheme can not guarantee the correctness of returned ElGamal-style element. Laiet al. [14] presented the verifiable approach in ABE to check whether the third-party server has honestly executed the decryption service. They also bring redundant overhead in both encryption computation and ciphertext size. Qinet al. [15] provided an efficient verifiable ABE scheme which significantly reduces the computation cost in encryption and the decryption overhead for users.Another considerable feature is traceability. We take CP-ABE as an instance; the private key is generated from some descriptive attributes rather than from a unique identity. Each attribute may be possessed by multiple users. It could be impossible to distinguish who is the original owner of a given private key. Imagine two physicians in eHealth systems, Tomas and Jack. They have the attribute set ‘{orthopedics department, chief physician}’ which is not possessed by any other users. By the key delegate technique [3], both Tomas and Jack can regenerate a private key responding to the set ‘{orthopedics department, chief physician}’, if there is a third user who can decrypt the ciphertext labeled by access policy ‘‘orthopedics department’AND ‘chief physician’’. Where did the key come from? Tomas or Jack? To solve the problem above, Liuet al. [16] extended an adaptively secure CP-ABE scheme [9] to support ‘white-box’ traceability, where the malicious user directly leaks his/her private key. Subsequently, Ninget al. [17] constructed a large attribute universe and traceable CP-ABE scheme. On the contrary to the ‘small universe’ in [3, 10, 14–16], the ‘large universe’ means that the scale of attribute universe is unbounded [18].However, existing works mostly aimed to support the property of verifiable outsourced decryption or traceability separately. There is no CP-ABE scheme with both verifiable outsourced decryption and white-box traceability in practice: (1) the CP-ABE schemes [16, 17] support the traceability well, but the user’s decryption cost grow with the attribute number; (2) these CP-ABE schemes [14, 15, 19, 20] provide decryption assistance for users, and the correctness of returned PDC element is guaranteed; however, the traceability property is not addressed.In this work, we propose a novel verifiable and traceable CP-ABE scheme named VTCP-ABE for eHealth cloud applications. The VTCP-ABE scheme is the first scheme which simultaneously achieves white-box traceability and verifiable outsourced decryption without exposing the physician’s identity information. Since we take the ‘large universe’ scheme [18] as the basis, the attribute universe in our scheme is inherently unbounded. We further extend the VTCP-ABE to support another delegation property. We also provide the formal proof of the selective CPA security, verifiability, and traceability for VTCP-ABE. The comparison and simulation results show that our VTCP-ABE is applicable for practical eHealth cloud applications. In particularly, we make the following contributions:(1) We propose a new VTCP-ABE scheme which simultaneously achieves the properties of verifiable outsourced decryption, white-box traceability, and large universe. An authorized physician can check the correctness of partial decrypted ciphertext (PDC) which is requested from the eHealth CDS. Given a private key, the original owner can be precisely tracked. The attribute universe can be exponentially large and the number of public parameter elements is constant no matter how many attributes are chosen.(2) We present an efficient approach to prevent the CDS from knowing the fixed identification information of physician during offering decryption service. The original ciphertext and the transmission private key will be pre-processed before being sent to the CDS. This method is acceptable since only two additional exponential operations for each decryption request are added.(3) We exploit an additional property of delegation for our VTCP-ABE, with which a resource-constrained physician can delegate someone to obtain a PDC element without compromising the privacy of PHI.


### 1.1. Related Works

ABE was first introduced in [1]. The first KP-ABE scheme with threshold tree access structures was presented in [2]. The first CP-ABE scheme with the same structures was presented in [3]. Waters [21] presented several CP-ABE schemes to support the access policy defined as Linear Secret Sharing Schemes (LSSS). Yuet al. [22] demonstrated the deployment of ABE technique in cloud computing. In [4], Liet al. presented a personal health record (PHR) secure sharing scheme in cloud computing. Subsequently, various constructions of ABE schemes were presented in [9, 23–29].Greenet al. [13] constructed the first decryption outsourcing ABE, where the most decryption overhead is hosted to a third party. With the returned partial decrypted ciphertext, a user could recover the plaintext message by executing only one exponential operation. Based on the outsourced method [13], Liet al. [7] presented a PHR data sharing scheme for cloud storage applications in the multi-authority settings. In both [7, 13], the correctness of returned PDC is not guaranteed. Laiet al. [14] presented an approach to check whether the partial decrypted ciphertext element (transformed ciphertext element) is correctly calculated. Their technique incurred noticeable overhead in both decryption and encryption. Based on key encapsulation mechanism, Linet al. [19] and Qinet al. [15] separately proposed a fascinating method to support verifiable outsourced decryption in ABE. The difference between [19] and [15] is that, in [19], the hash value of a random group element R is set as the symmetric key to encrypt the original data, then R is encrypted by a ABE scheme to obtain a ABE-type ciphertext, which will be used to generate the verification key. In [15], the original data M is encrypted along with a randomly chosen bit string r, while the verification key is set by executing exponential operations in the group by taking the hash values of M and r as exponents.Liuet al. presented the first adaptively secure and white-box traceable CP-ABE scheme in [16], where any monotonic LSSS access structure is supported. They further constructed another CP-ABE scheme with black-box traceability in [30]. Based on the scheme [31], Ninget al. [17] exploited the white-box traceability for CP-ABE in large universe settings. From then on, many traceable ABE constructions are proposed in [6, 32, 33]. However, in these traceable schemes [6, 16, 17, 30, 32, 33], the decryption overhead grows with the scale of attribute set adopted in decryption.Table1 compares the characteristics between some related works and our VTCP-ABE. From Table 1, our VTCP-ABE scheme is the only practical scheme to simultaneously support the properties of large universe, verifiable outsourced decryption, white-box traceability, and delegation in CP-ABE.Table 1
Comparison between ours and some related works.
Systems CP/KP A U 1 O D 2 Verifiability Traceability Delegation Rouselakiset al. [18] CP,KP Large No No No No Greenet al. [13] CP,KP Small Yes No No No Laiet al. [14] CP Small Yes Yes No No Qinet al. [15] CP Small Yes Yes No No Liuet al. [16] CP Small No No Yes No Ninget al. [17] CP Large No No Yes No Our VTCP-ABE CP Large Yes Yes Yes Yes A U   1 is the abbreviation of attribute universe. O D   2 is the abbreviation of outsourced decryption.


## 1.1. Related Works

ABE was first introduced in [1]. The first KP-ABE scheme with threshold tree access structures was presented in [2]. The first CP-ABE scheme with the same structures was presented in [3]. Waters [21] presented several CP-ABE schemes to support the access policy defined as Linear Secret Sharing Schemes (LSSS). Yuet al. [22] demonstrated the deployment of ABE technique in cloud computing. In [4], Liet al. presented a personal health record (PHR) secure sharing scheme in cloud computing. Subsequently, various constructions of ABE schemes were presented in [9, 23–29].Greenet al. [13] constructed the first decryption outsourcing ABE, where the most decryption overhead is hosted to a third party. With the returned partial decrypted ciphertext, a user could recover the plaintext message by executing only one exponential operation. Based on the outsourced method [13], Liet al. [7] presented a PHR data sharing scheme for cloud storage applications in the multi-authority settings. In both [7, 13], the correctness of returned PDC is not guaranteed. Laiet al. [14] presented an approach to check whether the partial decrypted ciphertext element (transformed ciphertext element) is correctly calculated. Their technique incurred noticeable overhead in both decryption and encryption. Based on key encapsulation mechanism, Linet al. [19] and Qinet al. [15] separately proposed a fascinating method to support verifiable outsourced decryption in ABE. The difference between [19] and [15] is that, in [19], the hash value of a random group element R is set as the symmetric key to encrypt the original data, then R is encrypted by a ABE scheme to obtain a ABE-type ciphertext, which will be used to generate the verification key. In [15], the original data M is encrypted along with a randomly chosen bit string r, while the verification key is set by executing exponential operations in the group by taking the hash values of M and r as exponents.Liuet al. presented the first adaptively secure and white-box traceable CP-ABE scheme in [16], where any monotonic LSSS access structure is supported. They further constructed another CP-ABE scheme with black-box traceability in [30]. Based on the scheme [31], Ninget al. [17] exploited the white-box traceability for CP-ABE in large universe settings. From then on, many traceable ABE constructions are proposed in [6, 32, 33]. However, in these traceable schemes [6, 16, 17, 30, 32, 33], the decryption overhead grows with the scale of attribute set adopted in decryption.Table1 compares the characteristics between some related works and our VTCP-ABE. From Table 1, our VTCP-ABE scheme is the only practical scheme to simultaneously support the properties of large universe, verifiable outsourced decryption, white-box traceability, and delegation in CP-ABE.Table 1
Comparison between ours and some related works.
Systems CP/KP A U 1 O D 2 Verifiability Traceability Delegation Rouselakiset al. [18] CP,KP Large No No No No Greenet al. [13] CP,KP Small Yes No No No Laiet al. [14] CP Small Yes Yes No No Qinet al. [15] CP Small Yes Yes No No Liuet al. [16] CP Small No No Yes No Ninget al. [17] CP Large No No Yes No Our VTCP-ABE CP Large Yes Yes Yes Yes A U   1 is the abbreviation of attribute universe. O D   2 is the abbreviation of outsourced decryption.


## 2. Preliminaries

### 2.1. Bilinear Maps

DenoteG and G1 as two multiplicative cyclic groups with prime order p. g is a generator of group G. The bilinear map e:G×G→G1 has the following properties:(1)
Bilinearity:∀ς,η∈G and ι,υ∈Zp, e(ςι,ηυ)=e(ς,η)ιυ.(2)
Non-degeneracy:e(g,g)≠1.(3)
Computability: for allς,η∈G, e(ς,η) are efficiently computable.Since thate(gι,gυ)=e(g,g)ιυ=e(gυ,gι), e is symmetric.


### 2.2. Linear Secret Sharing Schemes (LSSS)

Definition 1.
Linear Secret Sharing Schemes [21, 34]: let P denote a set of attributes, and let p be a chosen prime. Let T∈Zpm×n be a matrix. For all i=1,…,m, a function ρ labels the i-th row of T with an attribute (i.e.,ρ∈F([m]→P)). A secret sharing scheme Π over the attribute universe P is linear if one has the following:
(1) The shares for each attribute make a vector overZp.
(2) In order to generate the shares of a secrets∈Zp, we select the column vector ϱ→=(s,ϱ2,…,ϱn)⊤, where ϱ2,…,ϱn are randomly selected from Zp, then Tϱ→ is the shares of s according to Π. The share (Tϱ→)i belongs to the attribute ρ(i).As demonstrated in [34], the linear reconstruction property of LSSS is defined as follows: Suppose (T,ρ) is the access structure T and S is an authorized set. Let I={i:ρ(i)∈S} be the index set of rows which are linked with the attributes in S. There exist constants {ψi∈Zp}i∈I which satisfy that if {λi=(Tϱ→)i} are valid, then we have ∑i∈I‍ψiλi=s.


### 2.3.φ-Type Assumption

The security of VTCP-ABE is reduced to aφ-type assumption [18].SupposeG is a cyclic group and prime p is the group order. Randomly pick g∈G and choose ι,s,υ1,υ2,…,υφ∈Zp. If an adversary A is given the group description (p,G,G1,e) and Ξ including all of the following terms:Ξ=g,gsgιi,gυj,gsυj,gιiυj,gιi/υj2, ∀(i,j)∈[φ,φ]gιi/υj, ∀(i,j)∈[2φ,φ] with i≠φ+1gιiυj/υj′2, ∀(i,j,j′)∈[2φ,φ,φ] with j≠j′gsιiυj/υj′,gsιiυj/υj′2∀(i,j,j′)∈[φ,φ,φ] with j≠j′It must be hard forA to distinguish the element e(g,g)ιφ+1s∈G1 from a randomly chosen element F∈G1.The advantage of an algorithmA which solves the above q-type problem is(1)AdvAλ=Pr⁡AΞ,W=eg,gιφ+1s=0-Pr⁡AΞ,W=F=0Definition 2.
We claim that theφ-type assumption holds if the advantage of all polynomial time adversaries is negligible in the above φ-type game.


### 2.4.ϑ-Strong Diffie-Hellman Assumption (ϑ-SDH)

Theϑ-SDH problem [35, 36]: suppose G is a cyclic group. Let prime p be the group order. g is randomly selected from G. Given a (ϑ+1)-tuple (g,gϖ,gϖ2,…,gϖϑ), output a pair (δ,g1/(ϖ+δ))∈Zp×G. An algorithm A has advantage ϵ in solving ϑ-SDH problem if Pr[A(g,gϖ,gϖ2,…,gϖϑ)=(δ,g1/(ϖ+δ))]≥ϵ, where the probability is over the random bits consumed by A and the randomness of ϖ∈Zp.Definition 3.
We claim that the(ϑ,t,ϵ)-SDH assumption holds if the advantage of all t-time adversaries is at most ϵ in solving the above ϑ-SDH problem.


## 2.1. Bilinear Maps

DenoteG and G1 as two multiplicative cyclic groups with prime order p. g is a generator of group G. The bilinear map e:G×G→G1 has the following properties:(1)
Bilinearity:∀ς,η∈G and ι,υ∈Zp, e(ςι,ηυ)=e(ς,η)ιυ.(2)
Non-degeneracy:e(g,g)≠1.(3)
Computability: for allς,η∈G, e(ς,η) are efficiently computable.Since thate(gι,gυ)=e(g,g)ιυ=e(gυ,gι), e is symmetric.


## 2.2. Linear Secret Sharing Schemes (LSSS)

Definition 1.
Linear Secret Sharing Schemes [21, 34]: let P denote a set of attributes, and let p be a chosen prime. Let T∈Zpm×n be a matrix. For all i=1,…,m, a function ρ labels the i-th row of T with an attribute (i.e.,ρ∈F([m]→P)). A secret sharing scheme Π over the attribute universe P is linear if one has the following:
(1) The shares for each attribute make a vector overZp.
(2) In order to generate the shares of a secrets∈Zp, we select the column vector ϱ→=(s,ϱ2,…,ϱn)⊤, where ϱ2,…,ϱn are randomly selected from Zp, then Tϱ→ is the shares of s according to Π. The share (Tϱ→)i belongs to the attribute ρ(i).As demonstrated in [34], the linear reconstruction property of LSSS is defined as follows: Suppose (T,ρ) is the access structure T and S is an authorized set. Let I={i:ρ(i)∈S} be the index set of rows which are linked with the attributes in S. There exist constants {ψi∈Zp}i∈I which satisfy that if {λi=(Tϱ→)i} are valid, then we have ∑i∈I‍ψiλi=s.


## 2.3.φ-Type Assumption

The security of VTCP-ABE is reduced to aφ-type assumption [18].SupposeG is a cyclic group and prime p is the group order. Randomly pick g∈G and choose ι,s,υ1,υ2,…,υφ∈Zp. If an adversary A is given the group description (p,G,G1,e) and Ξ including all of the following terms:Ξ=g,gsgιi,gυj,gsυj,gιiυj,gιi/υj2, ∀(i,j)∈[φ,φ]gιi/υj, ∀(i,j)∈[2φ,φ] with i≠φ+1gιiυj/υj′2, ∀(i,j,j′)∈[2φ,φ,φ] with j≠j′gsιiυj/υj′,gsιiυj/υj′2∀(i,j,j′)∈[φ,φ,φ] with j≠j′It must be hard forA to distinguish the element e(g,g)ιφ+1s∈G1 from a randomly chosen element F∈G1.The advantage of an algorithmA which solves the above q-type problem is(1)AdvAλ=Pr⁡AΞ,W=eg,gιφ+1s=0-Pr⁡AΞ,W=F=0Definition 2.
We claim that theφ-type assumption holds if the advantage of all polynomial time adversaries is negligible in the above φ-type game.


## 2.4.ϑ-Strong Diffie-Hellman Assumption (ϑ-SDH)

Theϑ-SDH problem [35, 36]: suppose G is a cyclic group. Let prime p be the group order. g is randomly selected from G. Given a (ϑ+1)-tuple (g,gϖ,gϖ2,…,gϖϑ), output a pair (δ,g1/(ϖ+δ))∈Zp×G. An algorithm A has advantage ϵ in solving ϑ-SDH problem if Pr[A(g,gϖ,gϖ2,…,gϖϑ)=(δ,g1/(ϖ+δ))]≥ϵ, where the probability is over the random bits consumed by A and the randomness of ϖ∈Zp.Definition 3.
We claim that the(ϑ,t,ϵ)-SDH assumption holds if the advantage of all t-time adversaries is at most ϵ in solving the above ϑ-SDH problem.


## 3. System Architecture and Security Model

### 3.1. System Description

As shown in Figure1, our VTCP-ABE framework in the eHealth cloud mainly consists of the following components.Figure 1
Architecture of VTCP-ABE in eHealth cloud.The authority: the authority produces the system parameters and generates private keys for the legal physicians depending on their attributes. It is also in charge of tracing the malicious physicians.The patient: with the help of IOT techniques, the patient integrates and then encrypts his/her PHI under appropriate access policy and further uploads the ciphertext to the eHealth cloud storage server.The eHealth cloud storage server (CSS): the eHealth CSS provides storage service for the patient. If necessary, the patient can call CSS to delete his/her PHI data.The eHealth cloud decryption server (CDS): the eHealth CDS provides pre-decryption service of the encrypted PHI and returns the partial decrypted ciphertext to the authorized physician.The physician: the physician takes responsibility of medical treatment for the patient whose access policy accepts his/her attributes. The physician is also enabled to check the correctness of returned pre-decryption results from the CDS. The malicious physician may leak his private key for economic benefit or some malignant purpose.We note that the eHealth CSS and CDS are assumed to be semi-trusted as in [22]. That is, the CSS and CDS honestly execute the pre-set algorithms. But they attempts to get useful information of the encrypted PHI as much as possible. In addition, the eHealth CDS may want to obtain the identification information of physician.As one of the important applications in IOT environments, the eHealth cloud system enables the patient to collect his PHI via wearable devices, physiologic sensor nodes and body area networks, etc. Before uploading the PHI to the cloud sever to get real-time health care services, the patient can define expressive access policy of his PHI over descriptive attributes by VTCP-ABE. According to the assigned attributes, the individual physicians have differential flexible access rights. They can provide various (free or paid) health care services by smart devices on condition that their attributes match the access policy of patient’s PHI. Our VTCP-ABE also offers the traceability to prevent the key abuse problem and the verifiable outsourced decryption technique to offload most decryption cost to the cloud server and guarantee the returned results.


### 3.2. Definition of VTCP-ABE

Our VTCP-ABE is comprised by the following seven algorithms.Setup ( κ , U ) → ( P K , M S K ): this algorithm takes in a security parameter κ and the system attribute universe U. It then outputs the system public parameters PK and the master secret key MSK. Besides, it initializes an identity table IT=⌀.Encrypt ( M , P K , T ) → ( C T , V K ). This algorithm takes in a message M, PK, and an access structure T. It then outputs a ciphertext CT and a verification key VK.KeyGen ( P K , M S K , i d , S ) → ( T K , D K ). This algorithm takes in PK, MSK, an identity information id and an attribute set S. It then outputs a transmission private key TK and a user decryption key DK.Pre-Process ( P K , C T , T K ) → ( P C T , P T K ). This algorithm takes in CT and TK. It then outputs a pre-processed ciphertext PCT and a pre-processed private key PTK.Pre-Decrypt ( P C T , P T K ) → ( P D C ). This algorithm takes in PCT and PTK. If S matches T, the algorithm outputs a partial decrypted ciphertext PDC. Otherwise, it outputs ⊥.Decrypt ( P D C , D K , V K ) → ( M ). This algorithm takes in PDC, DK, and VK. If PDC is not valid, it outputs ⊥. Otherwise, it outputs a message M.Trace ( I T , P K , T K , D K ) → i d or ⊤. This algorithm takes in IT, PK, TK, and DK. It first verifies whether TK and DK are well-formed. If so, this algorithm outputs the id annotated with TK and DK. Otherwise, it outputs ⊤ implying that TK and DK are not required to be traced. If TK and DK can pass a "key sanity check" which means that they can be used in the normal decryption phase, they are called well-formed [16].


### 3.3. CPA Security Model

Similar to [17, 18], the definition of selective security model of VTCP-ABE against chosen plaintext attack (CPA) is given as follows:Init. The adversary A gives the simulator B the challenge access policy T∗.Setup. B runsSetup to produce (PK,MSK) and passes PK to A.Phase 1. A can ask B to produce the private keys for ((id1,S1),(id2,S2),…,(idQ1,SQ1)). For each (idi,Si), B returns by the corresponding private key pairs (TKi,DKi). Note that, for each i∈[Q1], Si can not match T∗.Challenge Phase. A submits two messages M0 and M1 of equal length. B encrypts Mμ under T∗ to obtain CT∗ and VK∗, where μ is randomly chosen from {0,1}. It then gives CT∗ and VK∗ to A.Phase 2. As inPhase 1, B is asked to produce the private keys of ((idQ1+1,SQ1+1),…,(idQ,SQ)).Guess. A guesses μ′ for μ. A’s advantage is defined as Pr[μ′=μ]-1/2.Definition 4.
We claim that a VTCP-ABE scheme is selectively CPA secure if the advantage is negligible for all PPT adversaries in the above selective security game.


### 3.4. Security Game for Verifiability

Based on the replayable chosen ciphertext attack (RCCA) security model [13, 15], we briefly introduce the verifiability game as follows.Setup. The challenger B generates (PK,MSK) and sends PK to the attacker A.Phase 1. B queries the results from the Create, Corrupt, and Decrypt oracles as in [15].Challenge Phase. The attacker A submits an access policy T∗ and a message M∗. B encrypts M∗ under T∗ to obtain (CT∗,VK∗) and sends them to A.Phase 2. A repeats the key queries as inPhase 1.Output. A gives B  PDC∗ and an attribute set S∗ which satisfies T∗.The attackerA wins the above game ifDecrypt  (PDC∗,DK∗,VK∗)∉{M,⊥}. A’s advantage in this game is defined as ADVVTCP-ABEA.Definition 5.
We claim that a VTCP-ABE scheme is verifiable ifADVVTCP-ABEA is negligible for all PPT attackers in the above game.


### 3.5. Security Game for Traceability

The traceability game of our VTCP-ABE is defined as follows.Setup. The challenger B generates (PK,MSK) and sends PK to the attacker A. It keeps MSK as a secret key.Key Query. A submits the tuples (id1,S1),(id2,S2),…,(idq,Sq) to B, where q refers to the query number that A can make.Key Forgery. A outputs DK⋆ and TK⋆. A wins ifTrace  (IT,PK,DK⋆,TK⋆)≠⊤ andTrace(IT,PK,DK⋆,TK⋆)∉{id1,id2,…,idq}. A’s advantage is defined as Pr⁡[Trace(IT,PK,DK⋆,TK⋆)≠{⊤}∪{id1,id2,…,idq}].Definition 6.
We claim that a VTCP-ABE scheme is fully traceable if the advantage is negligible for all PPT attackers in the above game.


## 3.1. System Description

As shown in Figure1, our VTCP-ABE framework in the eHealth cloud mainly consists of the following components.Figure 1
Architecture of VTCP-ABE in eHealth cloud.The authority: the authority produces the system parameters and generates private keys for the legal physicians depending on their attributes. It is also in charge of tracing the malicious physicians.The patient: with the help of IOT techniques, the patient integrates and then encrypts his/her PHI under appropriate access policy and further uploads the ciphertext to the eHealth cloud storage server.The eHealth cloud storage server (CSS): the eHealth CSS provides storage service for the patient. If necessary, the patient can call CSS to delete his/her PHI data.The eHealth cloud decryption server (CDS): the eHealth CDS provides pre-decryption service of the encrypted PHI and returns the partial decrypted ciphertext to the authorized physician.The physician: the physician takes responsibility of medical treatment for the patient whose access policy accepts his/her attributes. The physician is also enabled to check the correctness of returned pre-decryption results from the CDS. The malicious physician may leak his private key for economic benefit or some malignant purpose.We note that the eHealth CSS and CDS are assumed to be semi-trusted as in [22]. That is, the CSS and CDS honestly execute the pre-set algorithms. But they attempts to get useful information of the encrypted PHI as much as possible. In addition, the eHealth CDS may want to obtain the identification information of physician.As one of the important applications in IOT environments, the eHealth cloud system enables the patient to collect his PHI via wearable devices, physiologic sensor nodes and body area networks, etc. Before uploading the PHI to the cloud sever to get real-time health care services, the patient can define expressive access policy of his PHI over descriptive attributes by VTCP-ABE. According to the assigned attributes, the individual physicians have differential flexible access rights. They can provide various (free or paid) health care services by smart devices on condition that their attributes match the access policy of patient’s PHI. Our VTCP-ABE also offers the traceability to prevent the key abuse problem and the verifiable outsourced decryption technique to offload most decryption cost to the cloud server and guarantee the returned results.


## 3.2. Definition of VTCP-ABE

Our VTCP-ABE is comprised by the following seven algorithms.Setup ( κ , U ) → ( P K , M S K ): this algorithm takes in a security parameter κ and the system attribute universe U. It then outputs the system public parameters PK and the master secret key MSK. Besides, it initializes an identity table IT=⌀.Encrypt ( M , P K , T ) → ( C T , V K ). This algorithm takes in a message M, PK, and an access structure T. It then outputs a ciphertext CT and a verification key VK.KeyGen ( P K , M S K , i d , S ) → ( T K , D K ). This algorithm takes in PK, MSK, an identity information id and an attribute set S. It then outputs a transmission private key TK and a user decryption key DK.Pre-Process ( P K , C T , T K ) → ( P C T , P T K ). This algorithm takes in CT and TK. It then outputs a pre-processed ciphertext PCT and a pre-processed private key PTK.Pre-Decrypt ( P C T , P T K ) → ( P D C ). This algorithm takes in PCT and PTK. If S matches T, the algorithm outputs a partial decrypted ciphertext PDC. Otherwise, it outputs ⊥.Decrypt ( P D C , D K , V K ) → ( M ). This algorithm takes in PDC, DK, and VK. If PDC is not valid, it outputs ⊥. Otherwise, it outputs a message M.Trace ( I T , P K , T K , D K ) → i d or ⊤. This algorithm takes in IT, PK, TK, and DK. It first verifies whether TK and DK are well-formed. If so, this algorithm outputs the id annotated with TK and DK. Otherwise, it outputs ⊤ implying that TK and DK are not required to be traced. If TK and DK can pass a "key sanity check" which means that they can be used in the normal decryption phase, they are called well-formed [16].


## 3.3. CPA Security Model

Similar to [17, 18], the definition of selective security model of VTCP-ABE against chosen plaintext attack (CPA) is given as follows:Init. The adversary A gives the simulator B the challenge access policy T∗.Setup. B runsSetup to produce (PK,MSK) and passes PK to A.Phase 1. A can ask B to produce the private keys for ((id1,S1),(id2,S2),…,(idQ1,SQ1)). For each (idi,Si), B returns by the corresponding private key pairs (TKi,DKi). Note that, for each i∈[Q1], Si can not match T∗.Challenge Phase. A submits two messages M0 and M1 of equal length. B encrypts Mμ under T∗ to obtain CT∗ and VK∗, where μ is randomly chosen from {0,1}. It then gives CT∗ and VK∗ to A.Phase 2. As inPhase 1, B is asked to produce the private keys of ((idQ1+1,SQ1+1),…,(idQ,SQ)).Guess. A guesses μ′ for μ. A’s advantage is defined as Pr[μ′=μ]-1/2.Definition 4.
We claim that a VTCP-ABE scheme is selectively CPA secure if the advantage is negligible for all PPT adversaries in the above selective security game.


## 3.4. Security Game for Verifiability

Based on the replayable chosen ciphertext attack (RCCA) security model [13, 15], we briefly introduce the verifiability game as follows.Setup. The challenger B generates (PK,MSK) and sends PK to the attacker A.Phase 1. B queries the results from the Create, Corrupt, and Decrypt oracles as in [15].Challenge Phase. The attacker A submits an access policy T∗ and a message M∗. B encrypts M∗ under T∗ to obtain (CT∗,VK∗) and sends them to A.Phase 2. A repeats the key queries as inPhase 1.Output. A gives B  PDC∗ and an attribute set S∗ which satisfies T∗.The attackerA wins the above game ifDecrypt  (PDC∗,DK∗,VK∗)∉{M,⊥}. A’s advantage in this game is defined as ADVVTCP-ABEA.Definition 5.
We claim that a VTCP-ABE scheme is verifiable ifADVVTCP-ABEA is negligible for all PPT attackers in the above game.


## 3.5. Security Game for Traceability

The traceability game of our VTCP-ABE is defined as follows.Setup. The challenger B generates (PK,MSK) and sends PK to the attacker A. It keeps MSK as a secret key.Key Query. A submits the tuples (id1,S1),(id2,S2),…,(idq,Sq) to B, where q refers to the query number that A can make.Key Forgery. A outputs DK⋆ and TK⋆. A wins ifTrace  (IT,PK,DK⋆,TK⋆)≠⊤ andTrace(IT,PK,DK⋆,TK⋆)∉{id1,id2,…,idq}. A’s advantage is defined as Pr⁡[Trace(IT,PK,DK⋆,TK⋆)≠{⊤}∪{id1,id2,…,idq}].Definition 6.
We claim that a VTCP-ABE scheme is fully traceable if the advantage is negligible for all PPT attackers in the above game.


## 4. The Proposed VTCP-ABE

In this section, we first briefly introduce the techniques of constructing a verifiable and traceable CP-ABE scheme and then give the details of VTCP-ABE construction.


### 4.1. Technical Overview

To achieve the traceability in [17], each private key is associated with a unique fixed number δ so that the key owner cannot re-randomize his own private key to get a completely new key. In the verifiable CP-ABE scheme with outsourced decryption [15], the private key is composed of a transmission key and a user decryption key. The transmission key is sent to a third party to get the partial decryption result and the user decryption key is used to decrypt the partial decryption result and check its correctness.Our goal is to achieve the efficient user decryption and traceability without compromising the security and privacy. However, if we combine the traceable CP-ABE [17] and the verifiable outsourced decryption approach [15] in a naive way, the fixed identifier number δ will be exposed to the eHealth CDS. Even worse, the CDS may use δ and the transmission private key to fabricate a key which could pass the check in the traceable algorithm of [17]. That is, a legal physician may be framed to be malicious and further revoked from the system. To prevent the CDS from knowing δ, we process the transmission private key and original ciphertext before submitting them to the eHealth CDS. Meanwhile, we add the user decryption key as input of the traceable algorithm. Finally, we add the property of verifiable outsourced decryption into the traceable CP-ABE scheme [17] at a very low cost on the physician side (one additional element in private key, two additional exponential operations in pre-processing)


### 4.2. Detailed Construction

We now give the detailed construction of the VTCP-ABE.Setup. Given a group description G=(p,G,G1,e), where prime order p is the order of groups (G,G1) and e denotes a map e:G×G→G1. The system attribute universe is set as U=Zp. Then randomly pick g,u,ħ,w,ν∈G and α,a∈Zp.Select two collision-resistant hash functionsHA1:G1→{0,1}lHA1 and HA2:{0,1}∗→{0,1}lHA2. SE=(SE-Keygen,SE-Encrypt,SE-Decrypt) refers to a one-time symmetric encryption scheme and the key space is defined as {0,1}lSE. Select HA3:G1→{0,1}lSE from H, which denotes a party of pairwise independent hash functions.It sets(G,g,u,ħ,w,ν,e(g,g)α,ga,SE,HA1,HA2,HA3) as PK and (α,a) as MSK. It also initializes IT=⌀.Encrypt. Given the PHI data M∈ℵ and a LSSS policy T=(T,ρ)∈(Zpm×n,ρ:[m]→Zp), the encryption algorithm acts as follows.Randomly selectχ∈G1 and ϱ→=(s,ϱ2,…,ϱn)⊤∈Zpn×1. Calculate λ→=T·ϱ→=(λ1,λ2,…,λn)⊤. Choose t1,t2,…,tm randomly from Zp and computeC=χ·e(g,g)αs,C1=gs,C2=gas.For eachi∈[m], compute Ci,1=wλiνti, Ci,2=(uρ(i)ħ)-ti and Ci,3=gti.The ciphertext ofχ is CTχ=(T,C,C1,C2,{Ci,1,Ci,2,Ci,3}i∈[m]).After that, this algorithm setsTAG1=HA1(χ) and computes a symmetric key SEK=HA3(χ). Then it calls SE to create a ciphertext CTM=SE-Encrypt(M,SEK) and the verification key VK=TAG2=HA2(TAG1∥CTM).Finally, the ciphertext of PHI dataCT=(CTχ,CTM) is uploaded to the eHealth CSS as well as VK.KeyGen. Given a tuple (id,S={AT1,AT2,…,ATk}⊆Zp), this algorithm randomly selects b,δ,β,β1,…,βk∈Zp and then calculatesKK=gα/b(a+δ)wβ,KK1=δ,L1=gβ,L2=gaβ.For eachτ∈[k], it computes KKτ,1=gβτ and KKτ,2=(uATτħ)βτν-(a+δ)β.Finally, it outputs the private key for(id,S) as TK=(S,KK,KK1,L1,L2,{KKτ,1,KKτ,2}τ∈[k]) and DK=b. Simultaneously, the tuple (id,δ) is added to IT.Pre-Process. The physician can request the PHI ciphertext CT=(CTχ,CTM) and VK from the eHealth CSS, which will response by the elements C1, C2, CTM, and VK while the other elements will be sent to the eHealth CDS.Before calling the pre-decryption service, he/she processes theC1, C2, and TK by calculating C3=C1KK1C2=g(a+δ)s and L3=L1KK1L2=g(a+δ)β.ThenPCTχ=C3 and PTK=(KK,L3,{KKτ,1,KKτ,2}τ∈[k]) are sent to the eHealth CDS.Pre-Decrypt. Once receiving PCTχ and PTK, this algorithm works as follows.IfS does not match T, this algorithm aborts. Otherwise, it sets I={i:ρ(i)∈S} and calculates constants {ψi∈Zp}i∈I such that ∑i∈I‍ψiTi=(1,0,…,0), where Ti refers to the i-th row of T. Then it calculates(2)C′=eKK,C3∏i∈IeL3,Ci,1eKKτ,1,Ci,2eKKτ,2,Ci,3ψi=eg,gαs/bew,ga+δβs∏i∈Ieg,wa+δβλieg,νa+δβtieg,u-tiρiβτeg,ħ-tiβτeu,gtiATτβτeħ,gtiβτeν,g-a+δβtiψi=eg,gαs/bew,ga+δβs∏i∈Ieg,wa+δβλiψi=eg,gαs/bew,ga+δβseg,wa+δβs=eg,gαs/bFinally, it outputsPDC=C′.Decrypt. This algorithm first computes χ=C/(C′)b. Then it calculates TAG1=HA1(χ). If HA2(TAG1∥CTM)≠VK, it aborts immediately. Otherwise, it calculates SEK=HA3(χ) and recovers M≔SE-Decrypt(CTM,SEK).Trace. This algorithm first verifies whether TK and DK are well-formed by the following checks:(1)TK is expressed as (S,KK,KK1,L1,L2,{KKτ,1,KKτ,2}τ∈[k]), where KK1∈Zp and KK,L1,L2,KKτ,1,KKτ,2∈G.(2)DK=b∈Zp.(3)e(g,L2)=e(ga,L1).(4)e(KK,ga·gKK1)=e(g,g)α/be(L1KK1L2,w).(5)∃τ∈[k],s.t.e(KKτ,2,g)e(L1KK1L2,ν)=e(KKτ,1,ħ)e(KKτ,1,u)ATτ.IfTK and DK fail to pass the above five checks, it outputs ⊤. Otherwise, it searches KK1 in IT: if KK1 exists, it outputs the corresponding id. If KK1 does not exist, it aborts.


## 4.1. Technical Overview

To achieve the traceability in [17], each private key is associated with a unique fixed number δ so that the key owner cannot re-randomize his own private key to get a completely new key. In the verifiable CP-ABE scheme with outsourced decryption [15], the private key is composed of a transmission key and a user decryption key. The transmission key is sent to a third party to get the partial decryption result and the user decryption key is used to decrypt the partial decryption result and check its correctness.Our goal is to achieve the efficient user decryption and traceability without compromising the security and privacy. However, if we combine the traceable CP-ABE [17] and the verifiable outsourced decryption approach [15] in a naive way, the fixed identifier number δ will be exposed to the eHealth CDS. Even worse, the CDS may use δ and the transmission private key to fabricate a key which could pass the check in the traceable algorithm of [17]. That is, a legal physician may be framed to be malicious and further revoked from the system. To prevent the CDS from knowing δ, we process the transmission private key and original ciphertext before submitting them to the eHealth CDS. Meanwhile, we add the user decryption key as input of the traceable algorithm. Finally, we add the property of verifiable outsourced decryption into the traceable CP-ABE scheme [17] at a very low cost on the physician side (one additional element in private key, two additional exponential operations in pre-processing)


## 4.2. Detailed Construction

We now give the detailed construction of the VTCP-ABE.Setup. Given a group description G=(p,G,G1,e), where prime order p is the order of groups (G,G1) and e denotes a map e:G×G→G1. The system attribute universe is set as U=Zp. Then randomly pick g,u,ħ,w,ν∈G and α,a∈Zp.Select two collision-resistant hash functionsHA1:G1→{0,1}lHA1 and HA2:{0,1}∗→{0,1}lHA2. SE=(SE-Keygen,SE-Encrypt,SE-Decrypt) refers to a one-time symmetric encryption scheme and the key space is defined as {0,1}lSE. Select HA3:G1→{0,1}lSE from H, which denotes a party of pairwise independent hash functions.It sets(G,g,u,ħ,w,ν,e(g,g)α,ga,SE,HA1,HA2,HA3) as PK and (α,a) as MSK. It also initializes IT=⌀.Encrypt. Given the PHI data M∈ℵ and a LSSS policy T=(T,ρ)∈(Zpm×n,ρ:[m]→Zp), the encryption algorithm acts as follows.Randomly selectχ∈G1 and ϱ→=(s,ϱ2,…,ϱn)⊤∈Zpn×1. Calculate λ→=T·ϱ→=(λ1,λ2,…,λn)⊤. Choose t1,t2,…,tm randomly from Zp and computeC=χ·e(g,g)αs,C1=gs,C2=gas.For eachi∈[m], compute Ci,1=wλiνti, Ci,2=(uρ(i)ħ)-ti and Ci,3=gti.The ciphertext ofχ is CTχ=(T,C,C1,C2,{Ci,1,Ci,2,Ci,3}i∈[m]).After that, this algorithm setsTAG1=HA1(χ) and computes a symmetric key SEK=HA3(χ). Then it calls SE to create a ciphertext CTM=SE-Encrypt(M,SEK) and the verification key VK=TAG2=HA2(TAG1∥CTM).Finally, the ciphertext of PHI dataCT=(CTχ,CTM) is uploaded to the eHealth CSS as well as VK.KeyGen. Given a tuple (id,S={AT1,AT2,…,ATk}⊆Zp), this algorithm randomly selects b,δ,β,β1,…,βk∈Zp and then calculatesKK=gα/b(a+δ)wβ,KK1=δ,L1=gβ,L2=gaβ.For eachτ∈[k], it computes KKτ,1=gβτ and KKτ,2=(uATτħ)βτν-(a+δ)β.Finally, it outputs the private key for(id,S) as TK=(S,KK,KK1,L1,L2,{KKτ,1,KKτ,2}τ∈[k]) and DK=b. Simultaneously, the tuple (id,δ) is added to IT.Pre-Process. The physician can request the PHI ciphertext CT=(CTχ,CTM) and VK from the eHealth CSS, which will response by the elements C1, C2, CTM, and VK while the other elements will be sent to the eHealth CDS.Before calling the pre-decryption service, he/she processes theC1, C2, and TK by calculating C3=C1KK1C2=g(a+δ)s and L3=L1KK1L2=g(a+δ)β.ThenPCTχ=C3 and PTK=(KK,L3,{KKτ,1,KKτ,2}τ∈[k]) are sent to the eHealth CDS.Pre-Decrypt. Once receiving PCTχ and PTK, this algorithm works as follows.IfS does not match T, this algorithm aborts. Otherwise, it sets I={i:ρ(i)∈S} and calculates constants {ψi∈Zp}i∈I such that ∑i∈I‍ψiTi=(1,0,…,0), where Ti refers to the i-th row of T. Then it calculates(2)C′=eKK,C3∏i∈IeL3,Ci,1eKKτ,1,Ci,2eKKτ,2,Ci,3ψi=eg,gαs/bew,ga+δβs∏i∈Ieg,wa+δβλieg,νa+δβtieg,u-tiρiβτeg,ħ-tiβτeu,gtiATτβτeħ,gtiβτeν,g-a+δβtiψi=eg,gαs/bew,ga+δβs∏i∈Ieg,wa+δβλiψi=eg,gαs/bew,ga+δβseg,wa+δβs=eg,gαs/bFinally, it outputsPDC=C′.Decrypt. This algorithm first computes χ=C/(C′)b. Then it calculates TAG1=HA1(χ). If HA2(TAG1∥CTM)≠VK, it aborts immediately. Otherwise, it calculates SEK=HA3(χ) and recovers M≔SE-Decrypt(CTM,SEK).Trace. This algorithm first verifies whether TK and DK are well-formed by the following checks:(1)TK is expressed as (S,KK,KK1,L1,L2,{KKτ,1,KKτ,2}τ∈[k]), where KK1∈Zp and KK,L1,L2,KKτ,1,KKτ,2∈G.(2)DK=b∈Zp.(3)e(g,L2)=e(ga,L1).(4)e(KK,ga·gKK1)=e(g,g)α/be(L1KK1L2,w).(5)∃τ∈[k],s.t.e(KKτ,2,g)e(L1KK1L2,ν)=e(KKτ,1,ħ)e(KKτ,1,u)ATτ.IfTK and DK fail to pass the above five checks, it outputs ⊤. Otherwise, it searches KK1 in IT: if KK1 exists, it outputs the corresponding id. If KK1 does not exist, it aborts.


## 5. Security Proof

### 5.1. CPA Security

For simplicity, the security of the presented VTCP-ABE scheme is reduced to that of the traceable scheme [17] which is proved under the φ-type assumption. We let ∑TCP-ABE‍ and ∑VTCP-ABE‍ denote the traceable scheme [17] and our VTCP-ABE scheme, respectively.Theorem 7.
Suppose that∑TCP-ABE‍ is selectively secure, the one-time symmetric encryption scheme SE is semantically secure, HA3 is chosen from a party of pairwise independent hash functions, and the parameters satisfy 0<lSE≤(log⁡ℵ-lHA1)-2log⁡(1/ϵHA2). Then, the proposed ∑VTCP-ABE‍ is selectively secure.Proof.
Similar to the proof in [15], we define a series of hybrid argument of games as in [37].
G a m e 0. Identical to the original security game as defined in Section 3.3.
G a m e 1. Identical to Game0, except that TAG1∗ and SEK∗ are computed by selecting another random key R∗ rather than χ∗ in CTχ.
G a m e 2. Identical to Game1, except that we replace SEK∗ by a randomly selected string SEKR∗∈{0,1}lSE.
LetSPBi be the success probability of the attacker in Gamei.Lemma 8.
If∑TCP-ABE‍ is selectively secure, then the attacker can not distinguish Game0 from Game1 with a non-negligible advantage.Proof.
Suppose that an attackerA can distinguish Game0 from Game1, then we can build a PPT algorithm B to break ∑TCP-ABE‍.
Init. The attacker A submits the challenge access policy T∗ to B. B then sends T∗ to ∑TCP-ABE‍.
Setup. Based on T∗, ∑TCP-ABE‍ gives B the parameter PKTCP-ABE=(G,g,u,ħ,w,ν,e(g,g)α,ga) as in [17]. After that, B chooses SE∗ and sets HA1∗, HA2∗ and HA3∗ as random oracles. It also sets IT∗. Finally, it sends PK∗=(PKTCP-ABE,SE∗,HA1∗,HA2∗,HA3∗) to A.
Phase 1. To reply the key query of (id,S) from A, B transmits (id,S) to ∑TCP-ABE‍ and obtains SKTCP-ABE=(S,KK^,KK1^,L1^,L2^,{KKτ,1^,KKτ,2^}τ∈[k]), whereKK^=gα/(a+δ)wβ^,KK1^=δ,L1^=gβ^,L2^=gaβ^.∀τ∈[k], KKτ,1^=gβτ^ and KKτ,2^=(uATτħ)βτ^ν-(a+δ)β^.
B randomly picks b∈Zp and setsKK=(KK^)1/b=gα/b(a+δ)wβ,KK1=KK1^=δ,L1=(L1^)1/b=gβ,L2=(L2^)1/b=gaβ.For eachτ∈[k], it computes KKτ,1=(KKτ,1^)1/b=gβτ and KKτ,2=(KKτ,2^)1/b=(uATτħ)βτν-(a+δ)β.B implicitly sets β=(β^)1/b and βτ=(βτ^)1/b.Finally,B sends TK=(S,KK,KK1,L1,L2,{KKτ,1,KKτ,2}τ∈[k]) and DK=b to A. Simultaneously, it adds (id,δ) to IT∗.Challenge. A submits two equal-length messages M0 and M1, and B first picks two independent random keys χ∗ and R∗ from G1. It sends ((M0∗=χ∗,M1∗=R∗),T∗) to ∑TCP-ABE‍. ∑TCP-ABE‍ responds by a challenge ciphertext CTMμ∗=(T∗,C,C1,C2,{Ci,1,Ci,2,Ci,3}i∈[m]). Then, B computes SEK∗=HA3(R∗) and TAG1∗=HA1∗(R∗). It randomly picks μ∈{0,1} and calculates CTMμ=SE-Encrypt(Mμ,SEK∗). It also computes VK∗=TAG2∗=HA2∗(TAG1∗∥CTMμ).Finally, it sendsCT∗=(CTMμ∗,CTMμ) and VK∗ to the attacker.Note that, if the key encrypted underT∗ in CTMμ∗ is R∗, CT∗ is regarded as a challenge ciphertext in Game0. Otherwise, CT∗ can be regarded as a challenge ciphertext in Game1.Phase 2. Similar toPhase 1.Finally,A gives B a μ′. B then sends μ′ to ∑TCP-ABE‍. From the above game, we have |Pr[SPB0]-Pr[SPB1]|≤2ADVB∑TCP-ABE‍.Lemma 9.
Suppose thatH is a family of pairwise independent hash functions, then Game1 can not be distinguished from Game2 with a non-negligible advantage.Proof.
The keyR∗ is completely independent of PK, CTMμ∗, and HA3∗ in both Game1 and Game2. Moreover, the number of possible values of TAG1∗=HA1∗(R∗) is at most 2lHA1. According to the analysis in [15] and 0<lSE≤(log⁡ℵ-lHA1)-2log⁡(1/ϵHA2), the SEK∗=HA3(R∗) is ϵHA2-statistically indistinguishable from the randomly selected RSE∗∈{0,1}lSE. Hence, we have |Pr⁡SPB1-Pr⁡[SPB2]|≤ϵHA2.Lemma 10.
Suppose thatSE is a semantically secure symmetric encryption scheme, then the attacker can not win Game2 with a non-negligible advantage.Proof.
InGame2, RSE∗∈{0,1}lSE is a truly random symmetric key. An algorithm B can be directly constructed from A to break the semantic security of SE∗. Therefore, we have |Pr⁡[SPB1]-1/2|≤ADVBSE∗.Remark thatGame0 is identical to the selective security game for our proposed VTCP-ABE scheme. The advantage is |Pr⁡[SPB0]-1/2|. Thus, the security of our ∑VTCP-ABE‍ follows.


### 5.2. Verifiability

Theorem 11.
Suppose that these two hash functionsHA1 and HA2 are collision-resistant, our proposed VTCP-ABE scheme is privately verifiable.Proof.
Suppose that an attackerA can win the verifiability game, we can employ A to build an algorithm B to break the collision-resistance of HA1 and HA2.
Given the challenge hash functionsHA1∗ and HA2∗, B processes as follows.
B runsSetup to generate PK and MSK, except for HA1∗ and HA2∗. To answer the key queries, B acts as inPhase 1 andPhase 2.
In theChallenge phase, B invokes theEncrypt to obtain the CTχ∗. Then, it computes TAG1∗=HA1∗(χ∗) and SEK∗=HA3∗(χ∗). It also calculates CTM∗=SE-Encrypt(M∗,SEK∗) and VK∗=TAG2∗=HA2∗(TAG1∗∥CTM∗). It sends CT∗=(CTχ∗,CTM∗) and VK∗ to A.
A outputs an attribute set S∗ which satisfies T∗ and a partially decrypted ciphertext PDC∗=C′ and CTM.
IfA wins the verifiability game, B will get a message M∉{M∗,⊥}. Note that theDecrypt algorithm outputs ⊥ if HA2∗(TAG1∥CTM)≠TAG2∗, where TAG1=HA1∗(χ) and χ is recovered from PDC∗ and CTM.
We now analyze the success probability ofA by considering the following cases:
(1)(TAG1,CTM)≠(TAG1∗,CTM∗). If this case happens, B gets a collision of HA2∗ immediately.
(2)(TAG1,CTM)=(TAG1∗,CTM∗), but χ≠χ∗. Note that HA1∗(χ∗)=TAG1∗=TAG1=HA1∗(χ). Thus, B gets a collision of HA1∗.


### 5.3. Traceability

Theorem 12.
If theϑ-SDH assumption holds, then our proposed VTCP-ABE scheme is fully traceable on condition that q<ϑ, where q is the number of key queries made by the attacker A.Proof.
We here briefly introduce the traceability proof. Given(G=(p,G,G1,e),g¯,g¯ϖ,g¯ϖ2,…,g¯ϖϑ), the simulator B has to generate a pair (δ,g¯1/(ϖ+δ))∈Zp×G to solve the ϑ-SDH problem.
Setup. Assuming ϑ=q+1, B sets Di=g¯ϖi for each i∈[ϑ] and randomly selects q distinct numbers δ1,…,δq from Zp∗. It then sets f(z)=∏i=1q‍(z+δi)=∑i=0q‍aizi, where {ai} are the coefficients of f(z). The simulator computes g←∏i=0q‍(Di)ai=g¯f(ϖ) and gϖ←∏i=1q+1‍(Di)ϖi-1=g¯ϖ·f(ϖ). It then randomly picks u,ħ∈G and α,θ1,θ2∈Zp. Finally, B sets (G,g,u,ħ,w=gθ1,ν=gθ2,e(g,g)α,gϖ,SE,HA1,HA2,HA3,IT) as PK, where SE, HA1, HA2, HA3, and IT are set as in the CPA game. It gives PK to A.
Key Query. B answers the i-th query of (idi,Si) as follows.
B sets fi(z)=f(z)/(z+δi)=∏j=1,j≠iq‍(z+δj)=∑j=0q-1‍bjzj and computes ζi←∏j=0q-1‍(Dj)bj=g¯fi(ϖ)=g¯f(ϖ)/(ϖ+δi)=g1/(ϖ+δi). Then B randomly selects b,β,β1,…,βk∈Zp and calculates TK by computing:KK=(ζi)α/b=gα/b(ϖ+δi)wβ,KK1=δi,L1=gβ,L2=gϖβ.
For eachτ∈[k], it computes KKτ,1=gβτ and KKτ,2=(uATτħ)βτ((gϖ)θ2·νδi)-β=(uATτħ)βτν-(ϖ+δi)β.
It givesTK and DK=b to A and add (idi,δi) to IT.
Key Forgery. A submits TK⋆=(S,KK,KK1,L1,L2,{KKτ,1,KKτ,2}τ∈[k]) and DK⋆=b to B. ΨA refers to the event that A wins, i.e., TK⋆ and DK⋆=b are well-formed and KK1∉{δ1,δ2,…,δq}.
IfΨA happens, B writes f(z) as f(z)=ϕ(z)(z+KK1)+ϕ-1 for some polynomial ϕ(z)=∑i=0q-1‍ϕizi and some ϕ-1≠0∈Zp. Note that β in TK⋆ is unknown to B. B then computesσ←(KK/L1θ1)b/α=g¯ϕ(ϖ)g¯ϕ-1/(ϖ+KK1),ws←(σ·∏i=0q-1‍Di-ϕi)1/ϕ-1=g¯1/ϖ+KK1,δs←KK1modp∈Zp.
Sincee(g¯ϖ·g¯δs,ws)=e(g¯,g¯), (δs,ws) is the solution for the ϑ-SDH problem.
IfΨA does not happen, B randomly picks (δs,ws)∈Zp×G as the solution.
As analyzed in [17], B’s advantage is non-negligible in solving the ϑ-SDH problem.


## 5.1. CPA Security

For simplicity, the security of the presented VTCP-ABE scheme is reduced to that of the traceable scheme [17] which is proved under the φ-type assumption. We let ∑TCP-ABE‍ and ∑VTCP-ABE‍ denote the traceable scheme [17] and our VTCP-ABE scheme, respectively.Theorem 7.
Suppose that∑TCP-ABE‍ is selectively secure, the one-time symmetric encryption scheme SE is semantically secure, HA3 is chosen from a party of pairwise independent hash functions, and the parameters satisfy 0<lSE≤(log⁡ℵ-lHA1)-2log⁡(1/ϵHA2). Then, the proposed ∑VTCP-ABE‍ is selectively secure.Proof.
Similar to the proof in [15], we define a series of hybrid argument of games as in [37].
G a m e 0. Identical to the original security game as defined in Section 3.3.
G a m e 1. Identical to Game0, except that TAG1∗ and SEK∗ are computed by selecting another random key R∗ rather than χ∗ in CTχ.
G a m e 2. Identical to Game1, except that we replace SEK∗ by a randomly selected string SEKR∗∈{0,1}lSE.
LetSPBi be the success probability of the attacker in Gamei.Lemma 8.
If∑TCP-ABE‍ is selectively secure, then the attacker can not distinguish Game0 from Game1 with a non-negligible advantage.Proof.
Suppose that an attackerA can distinguish Game0 from Game1, then we can build a PPT algorithm B to break ∑TCP-ABE‍.
Init. The attacker A submits the challenge access policy T∗ to B. B then sends T∗ to ∑TCP-ABE‍.
Setup. Based on T∗, ∑TCP-ABE‍ gives B the parameter PKTCP-ABE=(G,g,u,ħ,w,ν,e(g,g)α,ga) as in [17]. After that, B chooses SE∗ and sets HA1∗, HA2∗ and HA3∗ as random oracles. It also sets IT∗. Finally, it sends PK∗=(PKTCP-ABE,SE∗,HA1∗,HA2∗,HA3∗) to A.
Phase 1. To reply the key query of (id,S) from A, B transmits (id,S) to ∑TCP-ABE‍ and obtains SKTCP-ABE=(S,KK^,KK1^,L1^,L2^,{KKτ,1^,KKτ,2^}τ∈[k]), whereKK^=gα/(a+δ)wβ^,KK1^=δ,L1^=gβ^,L2^=gaβ^.∀τ∈[k], KKτ,1^=gβτ^ and KKτ,2^=(uATτħ)βτ^ν-(a+δ)β^.
B randomly picks b∈Zp and setsKK=(KK^)1/b=gα/b(a+δ)wβ,KK1=KK1^=δ,L1=(L1^)1/b=gβ,L2=(L2^)1/b=gaβ.For eachτ∈[k], it computes KKτ,1=(KKτ,1^)1/b=gβτ and KKτ,2=(KKτ,2^)1/b=(uATτħ)βτν-(a+δ)β.B implicitly sets β=(β^)1/b and βτ=(βτ^)1/b.Finally,B sends TK=(S,KK,KK1,L1,L2,{KKτ,1,KKτ,2}τ∈[k]) and DK=b to A. Simultaneously, it adds (id,δ) to IT∗.Challenge. A submits two equal-length messages M0 and M1, and B first picks two independent random keys χ∗ and R∗ from G1. It sends ((M0∗=χ∗,M1∗=R∗),T∗) to ∑TCP-ABE‍. ∑TCP-ABE‍ responds by a challenge ciphertext CTMμ∗=(T∗,C,C1,C2,{Ci,1,Ci,2,Ci,3}i∈[m]). Then, B computes SEK∗=HA3(R∗) and TAG1∗=HA1∗(R∗). It randomly picks μ∈{0,1} and calculates CTMμ=SE-Encrypt(Mμ,SEK∗). It also computes VK∗=TAG2∗=HA2∗(TAG1∗∥CTMμ).Finally, it sendsCT∗=(CTMμ∗,CTMμ) and VK∗ to the attacker.Note that, if the key encrypted underT∗ in CTMμ∗ is R∗, CT∗ is regarded as a challenge ciphertext in Game0. Otherwise, CT∗ can be regarded as a challenge ciphertext in Game1.Phase 2. Similar toPhase 1.Finally,A gives B a μ′. B then sends μ′ to ∑TCP-ABE‍. From the above game, we have |Pr[SPB0]-Pr[SPB1]|≤2ADVB∑TCP-ABE‍.Lemma 9.
Suppose thatH is a family of pairwise independent hash functions, then Game1 can not be distinguished from Game2 with a non-negligible advantage.Proof.
The keyR∗ is completely independent of PK, CTMμ∗, and HA3∗ in both Game1 and Game2. Moreover, the number of possible values of TAG1∗=HA1∗(R∗) is at most 2lHA1. According to the analysis in [15] and 0<lSE≤(log⁡ℵ-lHA1)-2log⁡(1/ϵHA2), the SEK∗=HA3(R∗) is ϵHA2-statistically indistinguishable from the randomly selected RSE∗∈{0,1}lSE. Hence, we have |Pr⁡SPB1-Pr⁡[SPB2]|≤ϵHA2.Lemma 10.
Suppose thatSE is a semantically secure symmetric encryption scheme, then the attacker can not win Game2 with a non-negligible advantage.Proof.
InGame2, RSE∗∈{0,1}lSE is a truly random symmetric key. An algorithm B can be directly constructed from A to break the semantic security of SE∗. Therefore, we have |Pr⁡[SPB1]-1/2|≤ADVBSE∗.Remark thatGame0 is identical to the selective security game for our proposed VTCP-ABE scheme. The advantage is |Pr⁡[SPB0]-1/2|. Thus, the security of our ∑VTCP-ABE‍ follows.


## 5.2. Verifiability

Theorem 11.
Suppose that these two hash functionsHA1 and HA2 are collision-resistant, our proposed VTCP-ABE scheme is privately verifiable.Proof.
Suppose that an attackerA can win the verifiability game, we can employ A to build an algorithm B to break the collision-resistance of HA1 and HA2.
Given the challenge hash functionsHA1∗ and HA2∗, B processes as follows.
B runsSetup to generate PK and MSK, except for HA1∗ and HA2∗. To answer the key queries, B acts as inPhase 1 andPhase 2.
In theChallenge phase, B invokes theEncrypt to obtain the CTχ∗. Then, it computes TAG1∗=HA1∗(χ∗) and SEK∗=HA3∗(χ∗). It also calculates CTM∗=SE-Encrypt(M∗,SEK∗) and VK∗=TAG2∗=HA2∗(TAG1∗∥CTM∗). It sends CT∗=(CTχ∗,CTM∗) and VK∗ to A.
A outputs an attribute set S∗ which satisfies T∗ and a partially decrypted ciphertext PDC∗=C′ and CTM.
IfA wins the verifiability game, B will get a message M∉{M∗,⊥}. Note that theDecrypt algorithm outputs ⊥ if HA2∗(TAG1∥CTM)≠TAG2∗, where TAG1=HA1∗(χ) and χ is recovered from PDC∗ and CTM.
We now analyze the success probability ofA by considering the following cases:
(1)(TAG1,CTM)≠(TAG1∗,CTM∗). If this case happens, B gets a collision of HA2∗ immediately.
(2)(TAG1,CTM)=(TAG1∗,CTM∗), but χ≠χ∗. Note that HA1∗(χ∗)=TAG1∗=TAG1=HA1∗(χ). Thus, B gets a collision of HA1∗.


## 5.3. Traceability

Theorem 12.
If theϑ-SDH assumption holds, then our proposed VTCP-ABE scheme is fully traceable on condition that q<ϑ, where q is the number of key queries made by the attacker A.Proof.
We here briefly introduce the traceability proof. Given(G=(p,G,G1,e),g¯,g¯ϖ,g¯ϖ2,…,g¯ϖϑ), the simulator B has to generate a pair (δ,g¯1/(ϖ+δ))∈Zp×G to solve the ϑ-SDH problem.
Setup. Assuming ϑ=q+1, B sets Di=g¯ϖi for each i∈[ϑ] and randomly selects q distinct numbers δ1,…,δq from Zp∗. It then sets f(z)=∏i=1q‍(z+δi)=∑i=0q‍aizi, where {ai} are the coefficients of f(z). The simulator computes g←∏i=0q‍(Di)ai=g¯f(ϖ) and gϖ←∏i=1q+1‍(Di)ϖi-1=g¯ϖ·f(ϖ). It then randomly picks u,ħ∈G and α,θ1,θ2∈Zp. Finally, B sets (G,g,u,ħ,w=gθ1,ν=gθ2,e(g,g)α,gϖ,SE,HA1,HA2,HA3,IT) as PK, where SE, HA1, HA2, HA3, and IT are set as in the CPA game. It gives PK to A.
Key Query. B answers the i-th query of (idi,Si) as follows.
B sets fi(z)=f(z)/(z+δi)=∏j=1,j≠iq‍(z+δj)=∑j=0q-1‍bjzj and computes ζi←∏j=0q-1‍(Dj)bj=g¯fi(ϖ)=g¯f(ϖ)/(ϖ+δi)=g1/(ϖ+δi). Then B randomly selects b,β,β1,…,βk∈Zp and calculates TK by computing:KK=(ζi)α/b=gα/b(ϖ+δi)wβ,KK1=δi,L1=gβ,L2=gϖβ.
For eachτ∈[k], it computes KKτ,1=gβτ and KKτ,2=(uATτħ)βτ((gϖ)θ2·νδi)-β=(uATτħ)βτν-(ϖ+δi)β.
It givesTK and DK=b to A and add (idi,δi) to IT.
Key Forgery. A submits TK⋆=(S,KK,KK1,L1,L2,{KKτ,1,KKτ,2}τ∈[k]) and DK⋆=b to B. ΨA refers to the event that A wins, i.e., TK⋆ and DK⋆=b are well-formed and KK1∉{δ1,δ2,…,δq}.
IfΨA happens, B writes f(z) as f(z)=ϕ(z)(z+KK1)+ϕ-1 for some polynomial ϕ(z)=∑i=0q-1‍ϕizi and some ϕ-1≠0∈Zp. Note that β in TK⋆ is unknown to B. B then computesσ←(KK/L1θ1)b/α=g¯ϕ(ϖ)g¯ϕ-1/(ϖ+KK1),ws←(σ·∏i=0q-1‍Di-ϕi)1/ϕ-1=g¯1/ϖ+KK1,δs←KK1modp∈Zp.
Sincee(g¯ϖ·g¯δs,ws)=e(g¯,g¯), (δs,ws) is the solution for the ϑ-SDH problem.
IfΨA does not happen, B randomly picks (δs,ws)∈Zp×G as the solution.
As analyzed in [17], B’s advantage is non-negligible in solving the ϑ-SDH problem.


## 6. Performance Comparison

We here compare the performance of the VTCP-ABE scheme with the TCP-ABE scheme [17] and the VCP-ABE scheme [15] in the setting of key encapsulation, where the PHI data is encrypted by a symmetric encryption key χ which will be encrypted under an access policy in ABE.


### 6.1. Numeric Result

Tables2 and 3 show the numeric comparison between our scheme and other two schemes [15, 17]. Let P, E, and E1 be the overhead in executing a bilinear pairing, an exponential operation in G and G1, respectively. U denotes the system attribute universe. SC, SK, and I refer to the set of attributes used in encryption, key generation, and decryption, respectively. Let lH2 be the output length of H2.Table 2
Computation cost comparison.
Encryption KeyGen Pre-Decrypt User Decrypt VCP-ABE [15] ( 3 | S C | + 1 ) E + 1 E 1 ( | S K | + 3 ) E | I | E 1 + ( 2 | I | + 1 ) P 1 E 1 TCP-ABE [17] ( 5 | S C | + 2 ) E + 1 E 1 ( 4 | S K | + 4 ) E ∖ 2 E + | I | E 1 VTCP-ABE ( 5 | S C | + 2 ) E + 1 E 1 ( 4 | S K | + 4 ) E | I | E 1 + ( 3 | I | + 1 ) P + 3 I + 1 P 3E1Table 3
The parameter length comparison.
Public Parameter Private Key Ciphertext VCP-ABE [15] ( | U | + 2 ) | G | + 1 | G 1 | ( | S K | + 2 ) | G | + 1 | Z p | ( 2 | S C | + 1 ) | G | + 1 | G 1 | + l H 2 TCP-ABE [17] 6 | G | + 1 | G 1 | ( 2 | S K | + 3 ) | G | + 1 | Z p | ( 3 | S C | + 2 ) | G | + 1 | G 1 | VTCP-ABE 6 | G | + 1 | G 1 | ( 2 | S K | + 3 ) | G | + 2 | Z p | ( 3 | S C | + 2 ) | G | + 1 | G 1 | + l H 2In Table2, we calculate the computation cost incurred in the following phases: encryption, key generation, pre-decryption, and user decryption. The user in VCP-ABE and our VTCP-ABE expends constant size computation cost of exponential operation in G1. Note that our VTCP-ABE requires two additional exponential operations in the user side since that the ciphertext and transmission key need to be processed before being transmitted to the eHealth CDS.In Table3, the length of system public parameter, private key, and ciphertext is calculated by the number of group elements. The VCP-ABE scheme requires more public parameters which are linear with the scale of system attribute universe due to the fact that all the possible attributes need to be listed during the system initialization phase. Compared with the non-outsourced TCP-ABE scheme, our VTCP-ABE requires an additional element as the user decryption key and an output of H2 as the verification key.


### 6.2. Implementation

We implement VCP-ABE scheme [15], TCP-ABE scheme [17], and the proposed VTCP-ABE on a windows 7 platform of an Intel(R) Core(TM) i5-3450 CPU at 3.10 GHz with 8.00 GB Memory. A Type A elliptic curve group is chosen from the JPBC library [38] and the order is a 512-bit prime. We mainly count the computation cost incurred by ABE relevant operations. The computation time of each algorithm is the average of 20 trials.Figure2 illustrates the computation cost comparison among VCP-ABE scheme, TCP-ABE scheme, and our proposed VTCP-ABE scheme.Figure 2
Comparisons of computation cost.
(a)
Setup (b)
KeyGen (c)
Encryption (d)
Pre-process (e)
User-decrypt (f)
TraceFigure2(a) shows the computation time in the initialization phase. In the three schemes, the computation cost is mainly incurred by computing the parameters e(g,g)α and ga.Figures2(b) and 2(c) show the computation time in the key generation phase and the encryption phase, respectively. It is observed that the key generation cost and encryption overhead in three schemes are linearly with the number of used attributes. More precisely, TCP-ABE and ours require more computation operation than VCP-ABE since that the combination of parameters u and ħ is employed to indicate an attribute.Figure2(d) shows the computation cost in the pre-process phase of our VTCP-ABE. Two exponential and multiplicative operations in group G are required in computing C3 and L3 no matter how many attributes are involved.Figure2(e) illustrates the computation cost comparison in the user decryption phase among three schemes. We can find that the user decryption cost in TCP-ABE scheme increases with the number of attributes. Thanks to the efficient outsourced decryption approach, the final decryption costs on the user side in VCP-ABE scheme and ours are significantly lower than that in TCP-ABE and independent of the attribute number.Figure2(f) gives the computation cost comparison in tracing the malicious users between TCP-ABE and ours. We can observe that the computation cost in both scheme grows with the number of attributes and our scheme only requires one additional exponential operation in group G1.


## 6.1. Numeric Result

Tables2 and 3 show the numeric comparison between our scheme and other two schemes [15, 17]. Let P, E, and E1 be the overhead in executing a bilinear pairing, an exponential operation in G and G1, respectively. U denotes the system attribute universe. SC, SK, and I refer to the set of attributes used in encryption, key generation, and decryption, respectively. Let lH2 be the output length of H2.Table 2
Computation cost comparison.
Encryption KeyGen Pre-Decrypt User Decrypt VCP-ABE [15] ( 3 | S C | + 1 ) E + 1 E 1 ( | S K | + 3 ) E | I | E 1 + ( 2 | I | + 1 ) P 1 E 1 TCP-ABE [17] ( 5 | S C | + 2 ) E + 1 E 1 ( 4 | S K | + 4 ) E ∖ 2 E + | I | E 1 VTCP-ABE ( 5 | S C | + 2 ) E + 1 E 1 ( 4 | S K | + 4 ) E | I | E 1 + ( 3 | I | + 1 ) P + 3 I + 1 P 3E1Table 3
The parameter length comparison.
Public Parameter Private Key Ciphertext VCP-ABE [15] ( | U | + 2 ) | G | + 1 | G 1 | ( | S K | + 2 ) | G | + 1 | Z p | ( 2 | S C | + 1 ) | G | + 1 | G 1 | + l H 2 TCP-ABE [17] 6 | G | + 1 | G 1 | ( 2 | S K | + 3 ) | G | + 1 | Z p | ( 3 | S C | + 2 ) | G | + 1 | G 1 | VTCP-ABE 6 | G | + 1 | G 1 | ( 2 | S K | + 3 ) | G | + 2 | Z p | ( 3 | S C | + 2 ) | G | + 1 | G 1 | + l H 2In Table2, we calculate the computation cost incurred in the following phases: encryption, key generation, pre-decryption, and user decryption. The user in VCP-ABE and our VTCP-ABE expends constant size computation cost of exponential operation in G1. Note that our VTCP-ABE requires two additional exponential operations in the user side since that the ciphertext and transmission key need to be processed before being transmitted to the eHealth CDS.In Table3, the length of system public parameter, private key, and ciphertext is calculated by the number of group elements. The VCP-ABE scheme requires more public parameters which are linear with the scale of system attribute universe due to the fact that all the possible attributes need to be listed during the system initialization phase. Compared with the non-outsourced TCP-ABE scheme, our VTCP-ABE requires an additional element as the user decryption key and an output of H2 as the verification key.


## 6.2. Implementation

We implement VCP-ABE scheme [15], TCP-ABE scheme [17], and the proposed VTCP-ABE on a windows 7 platform of an Intel(R) Core(TM) i5-3450 CPU at 3.10 GHz with 8.00 GB Memory. A Type A elliptic curve group is chosen from the JPBC library [38] and the order is a 512-bit prime. We mainly count the computation cost incurred by ABE relevant operations. The computation time of each algorithm is the average of 20 trials.Figure2 illustrates the computation cost comparison among VCP-ABE scheme, TCP-ABE scheme, and our proposed VTCP-ABE scheme.Figure 2
Comparisons of computation cost.
(a)
Setup (b)
KeyGen (c)
Encryption (d)
Pre-process (e)
User-decrypt (f)
TraceFigure2(a) shows the computation time in the initialization phase. In the three schemes, the computation cost is mainly incurred by computing the parameters e(g,g)α and ga.Figures2(b) and 2(c) show the computation time in the key generation phase and the encryption phase, respectively. It is observed that the key generation cost and encryption overhead in three schemes are linearly with the number of used attributes. More precisely, TCP-ABE and ours require more computation operation than VCP-ABE since that the combination of parameters u and ħ is employed to indicate an attribute.Figure2(d) shows the computation cost in the pre-process phase of our VTCP-ABE. Two exponential and multiplicative operations in group G are required in computing C3 and L3 no matter how many attributes are involved.Figure2(e) illustrates the computation cost comparison in the user decryption phase among three schemes. We can find that the user decryption cost in TCP-ABE scheme increases with the number of attributes. Thanks to the efficient outsourced decryption approach, the final decryption costs on the user side in VCP-ABE scheme and ours are significantly lower than that in TCP-ABE and independent of the attribute number.Figure2(f) gives the computation cost comparison in tracing the malicious users between TCP-ABE and ours. We can observe that the computation cost in both scheme grows with the number of attributes and our scheme only requires one additional exponential operation in group G1.


## 7. Delegate Extension

If a physician is in trouble to connect to the eHealth CSS and CDS, he/she can delegate someone to download the PHI ciphertext from the CSS and request the partial decrypted ciphertext from the CDS. However, the access privilege of delegated user has to be restricted. Inspired by [20, 39, 40], we employ a verifiable random function to limit the access of delegated users to maximum ξ times and propose a verifiable and traceable CP-ABE scheme with key delegation (VTDCP-ABE).Setup. Besides generating PK and MSK as in VTCP-ABE, this algorithm calculates Ω=e(g,g) and chooses a hash function HA4:{0,1}∗→Zp. The public parameter is PKD=(PK,Ω,HA4).TheEncrypt,KeyGen,Pre-Process,Pre-Decrypt, andTrace algorithms are as well as that in VTCP-ABE.Delegate KeyGen. Given a transmission key TK=(S,KK,KK1,L1,L2,{KKτ,1,KKτ,2}τ∈[k]) of an id for a set S, an identity information idD and a set SD={AT1,AT2,…,ATk^}⊆S. This algorithm generates a delegated transmission key TKD as follows.Randomly selectd∈Zp and compute Γpse,1=Ω1/d+HA4(pse), Γpse,2=g1/d+HA4(pse) and Γpse,3=gd, where pse refers to the unique and random pseudonym of a delegated user. Set ξ as the maximum number of pre-decryption request that a delegated user can make.Then computeKKpse=KK1/d=gα/bd(a+δ)wβ/d,KKpse,1=KK1=δ,Lpse,1=(L1)1/d=gβ/d,Lpse,2=(L2)1/d=gaβ/d.For eachτ∈[k^], compute KKpse,τ,1=(KKτ,1)1/d=gβτ/d and KKpse,τ,2=(KKτ,2)1/d=(uAτħ)βτ/dν-(a+δ)β/d.Theξ-times delegated transmission key is set as(3)TKD=ξ,pse,SD,Γpse,1,Γpse,2,Γpse,3,KKpse,KKpse,1,Lpse,1,Lpse,2,KKpse,τ,1,KKpse,τ,2τ∈k^.Delegate Pre-Process. The same asPre-Process, the delegated user requests CT=(CTχ,CTM) from eHealth CSS and computes Cpse,3=C1KKpse,1C2=g(a+δ)s and Lpse,3=(Lpse,1)KKpse,1Lpse,2=g(a+δ)r/d.The delegated user then sendsPCTD and PTKD to the eHealth CDS, wherePCTD=(T,Cpse,3,Ci,1,Ci,2,Ci,3i∈[m])(4)andPTKD=ξ,pse,SD,Γpse,1,Γpse,2,Γpse,3,KKpse,Lpse,3,KKpse,τ,1,KKpse,τ,2τ∈k^.Delegate Pre-Decrypt. The eHealth CDS first initializes a counter cou=0 and a set Spse={Γpse,1} for each delegated user and stores the tuple (cou,Spse) in a delegation list DL. Once receiving the Pre-Decrypt request from a delegated user, the CDS responds by the following way.IfS does not match T, it outputs ⊥.Otherwise, it searches(cou,Spse) in DL related to PTKD and checks(1)e(gHA4(pse)·Γpse,3,Γpse,2)=Ω and Γpse,1=e(g,Γpse,2);(2)cou+1≤ξ;(3)Γpse,1∈Spse.If the above three conditions do not hold, it aborts. Otherwise, it updatescou←cou+1 and computes the partial decryption ciphertext as(5)CD′=eKKpse,Cpse,3∏i∈IeLpse,3,Ci,1eKKpse,τ,1,Ci,2eKKpse,τ,q,Ci,3ψi=eg,gαs/bdFinally, the CDS responds the delegated user byPDCD=CD′. Then the delegated user gives PDCD and CTM to the physician.Decrypt. If the physician interacts with the CSS and CDS directly, this algorithm acts exactly as in theDecrypt algorithm of VTCP-ABE. If the physician asks a delegated user to get the ciphertext and request the outsourced decryption service, χ is recovered by χ=C/(CD′)bd. The verification and PHI decryption operations are identical to that of VTCP-ABE.Since that theDK of physician and d are kept secretly, the delegated user can not obtain any content of the PHI ciphertext except a partial decrypted ciphertext.


## 8. Conclusion

In this paper, we have constructed a verifiable and traceable CP-ABE (VTCP-ABE) scheme for eHealth cloud applications, which also achieves the properties of large universe and delegation. With VTCP-ABE, the patient can enforce fine-grained access control over his/her PHI in a cryptographical way. Before submitting the encrypted PHI to the eHealth cloud decryption server, a pre-process on the ciphertext and transmission key is employed to preserve the identity privacy of the physician. The correctness of returned ciphertext can be efficiently verified. Moreover, the malicious physician who leaks the private key can be precisely tracked. Besides, we extend the proposed VTCP-ABE to support the delegation property, with which a resource-limited physician can authorize someone else to obtain a partial decrypted ciphertext without exposing the PHI content. The security of VTCP-ABE is proved in the selective model. The extensive experiments illustrate that our VTCP-ABE scheme efficiently achieves verifiability, traceability, and large attribute universe.



---

*Source: 1701675-2018-06-06.xml*