# Lightweight Fine-Grained Multiowner Search over Encrypted Data in Cloud-Edge Computing

Authors: XueYan Liu; LiJuan Huan; RuiRui Sun; Jing Wang
Journal: Security and Communication Networks
 (2023)

---

## Abstract

Edge computing, as an extension of cloud computing, outsources encrypted sensitive data to edge nodes to decrease latency and improve broadband efficiency. Although attribute-based keyword search (ABKS) can ensure the security of outsourced data and promote fine-grained access control of data, deficiencies still exist under the general ABKS scheme in the cloud, as follows: shared files owned by a single data owner, inflexible access control, key escrow problem, and high computational overhead. We propose an attribute-based multidata owner searchable encryption scheme in cloud-edge computing with effective policy update to address these problems. The two-level access control is used to realize the common management and fine-grained sharing of data by the multidata owner. All user keys are jointly generated by the central authority and attribute authority, and a key escrow is no longer required. Moreover, partial encryption and decryption calculations are shifted from resource-constrained data owners and users to edge nodes. Furthermore, our scheme not only supports policy update but also realizes the dynamic updating of the index. The security proof and performance analysis show that the scheme has strong security and practicality in the edge computing environment.


---

## Body

## 1. Introduction

Cloud computing [1, 2] can provide services for massive resources and enable cloud clients to reduce the burden of local storage and computing. However, some new industries, such as smart cities, smart medicine, smart homes, and online education systems, in China start to emerge. Other smart devices, such as wearable medical devices, Internet of things (IoT) sensors, and smartphones, are also updated iteratively. The popularity of these applications poses a great challenge to centralised cloud computing, resulting in transmission delay and service degradation between users and the cloud. In particular, a large amount of data generated by IoT applications are usually stored in the cloud. Edge computing [3, 4] paradigm, which is an extension of cloud computing services to the network edge, has recently been studied to reduce delay and improve transmission efficiency. Edge computing is a distributed computing mode in which data storage is closer to the required location. It is mainly or completely executed on distributed device nodes. Edge computing can provide various services for users with limited resources. The edge nodes are closer to the user than the cloud, as shown in Figure 1. When sensitive data are outsourced to honest but curious edge nodes, the data security and privacy issues [5] are still drawbacks that hinder the application of edge computing because data owners lose physical control over their data in edge nodes or in the cloud.Figure 1
The infrastructure of edge computing.Encryption is a preferred method to protect data confidentiality and reduce data privacy leakage risks, but the retrieval of encrypted data becomes very difficult. The searchable encryption (SE) technology enables the user to securely and selectively retrieve the files containing the encrypted data according to the keywords specified by the user. In addition, access control on encrypted data is an essential function in practical applications. Attribute-based encryption (ABE) [6] is an effective option to provide fine-grained access control and realizes data security. Therefore, combining the advantages of the two aspects, attribute-based keyword search (ABKS) [7–10] has received extensive attention in industrial and academic fields, such as online education. In the ABKS scheme, a user can access shared information if and only if the submitted token matches the index, and the attribute set satisfies the access policy embedded in the ciphertext.ABKS is the most useful cryptographic tool for implementing fine-grained access control and keyword search functionalities, but most ABKS only consider the scenario of a single data owner, which is not suitable for many practical applications nowadays. In addition, there are also some issues to be concerned about: (1) the computing and storage overhead is proportional to the complexity of the access policy and the computing cost of the data owner and data user is too high. (2) When the attribute authority is maliciously attacked, the user’s key is at risk of leakage. (3) Data owners cannot support the update of the access policy when the encrypted data are stored in the cloud.Therefore, we design a lightweight and fine-grained multidata owner encryption scheme in cloud-edge computing to address existing issues and realize keyword search and policy update. The proposed scheme uses two-level access control to encrypt shared resources and generate index information to ensure data security. Miao et al. [11] also proposed a verifiable fine-grained keyword search scheme by multiple data owners in cloud environment, which realizes multidata owner sharing of resources. Compared with this scheme, our proposed scheme avoids key escrow, provides outsourcing encryption, and realizes policy update. Secondly, edge computing is introduced into our scheme. It allows edge computing to undertake part of the calculation, storage, and operation of search work, which not only reduces the computing burden of data owners and data users but also improves the transmission speed. In this way, the cloud server is also prevented from obtaining any information about the keywords submitted by the user, and the connection between the obtained file and the keyword cannot be inferred, thereby improving the privacy protection of the searchable encryption mechanism. Furthermore, compared with the previous CP-ABKS solution, our proposed scheme allows edge nodes to directly update the index information related to the access policy when the policy changes. Specifically, the main contributions of this paper are as follows:


### 1.1. Secure Multidata Owner Authorisation

Shared data are co-owned by multidata owners, and a two-level access structure is used to control the user’s access ability. The combination of these technologies strengthens authorization management and data access control.


### 1.2. Fast Data Retrieval

Edge nodes possess some storage and computing abilities; they can reduce the delay caused by transmission in cloud computing. Thus, the index is stored on edge nodes, and the search work is carried out on edge nodes, thereby improving the search efficiency.


### 1.3. Lightweight Encryption and Decryption

Most calculations of data encryption, index generation, and decryption are shifted to the edge nodes due to the introduction of edge computing, greatly reducing the amount of calculation of resource limited data owners and data users.


### 1.4. Flexible Policy Update

Dynamic policy update is supported in our scheme to enrich the expression ability of access policy and maintain the freshness of the algorithm, and it is only carried out by edge notes.The remainder of the paper is organized as follows: the literature review for the system is presented in Section2. Section 3 introduces the necessary background information of the paper. Section 4 defines the system model and security analysis for the system. Section 5 presents our construction and proves its correctness. Section 6 analyzes the security of the scheme. In Section 7, the performance and experiment of the proposed method are analyzed. Section 8 concludes this paper.


## 1.1. Secure Multidata Owner Authorisation

Shared data are co-owned by multidata owners, and a two-level access structure is used to control the user’s access ability. The combination of these technologies strengthens authorization management and data access control.


## 1.2. Fast Data Retrieval

Edge nodes possess some storage and computing abilities; they can reduce the delay caused by transmission in cloud computing. Thus, the index is stored on edge nodes, and the search work is carried out on edge nodes, thereby improving the search efficiency.


## 1.3. Lightweight Encryption and Decryption

Most calculations of data encryption, index generation, and decryption are shifted to the edge nodes due to the introduction of edge computing, greatly reducing the amount of calculation of resource limited data owners and data users.


## 1.4. Flexible Policy Update

Dynamic policy update is supported in our scheme to enrich the expression ability of access policy and maintain the freshness of the algorithm, and it is only carried out by edge notes.The remainder of the paper is organized as follows: the literature review for the system is presented in Section2. Section 3 introduces the necessary background information of the paper. Section 4 defines the system model and security analysis for the system. Section 5 presents our construction and proves its correctness. Section 6 analyzes the security of the scheme. In Section 7, the performance and experiment of the proposed method are analyzed. Section 8 concludes this paper.


## 2. Related Work

### 2.1. Attribute-Based Searchable Encryption

ABKS scheme has attracted much attention because of its fine-grained access control and search functions. Song et al. [12] first proposed the concept of searchable encryption in 2000 and implemented a searchable encryption scheme under the symmetric encryption system. Boneh et al. [13] proposed the first public key searchable encryption (PEKS) scheme in 2004, which can realize a single keyword search. In 2005, Park et al. [14] first proposed a multikeyword PEKS scheme. Kaushik et al. [15] combined attribute encryption and searchable encryption for the first time and proposed attribute-based keyword search (ABKS). Only data users whose attributes conform to the tree access structure can search for keywords. To enrich the functionality of ABKS scheme, Wang et al. [16] proposed a searchable and revocable encryption scheme based on multidata owner attributes, but the scheme did not realize the claimed multidata owner authorization function. Moreover, in most of the existing ABKS schemes, there are still some open problems that urgently need to be resolved, for example, the decryption and encryption overhead is very high. It makes them impractical for many applications, for example, smart devices have limited resources. As a remedy for this problem, Green et al. [17] proposed the first content-based outsourcing decryption scheme, and the decryption process is safely transferred to the cloud server. From then on, large numbers of outsourcing schemes have been proposed to achieve lightweight, Ali and Sadeghi [18] proposed an attribute-based keyword search scheme in cloud computing and outsourced some encryption and decryption work to cloud servers. In 2021, Meng et al. [19] proposed an attribute-based dynamic keyword search encryption in fog computing and outsourced part of the encryption and decryption work to fog nodes. Miao et al. [20] proposed a lightweight encryption and fine-grained search scheme for data in fog computing, which outsources part of the encryption and decryption calculation to fog nodes and supports conjunctive keyword search and attribute update. Unfortunately, this scheme reduces the load on data owners and users, but the interaction between fog nodes and data users increases the transmission load. However, although these schemes realize keyword search and support outsourcing encryption and decryption, they do not satisfy the practical requirements in the actual situation to realize the sharing of data by multidata owners, and the computing burden of encryption and decryption in cloud/fog computing is very heavy. With the development of 5G and IoT technology, edge computing is regarded as a new data resource, which can provide many high-quality outsourcing services. In edge computing, enabling multidata owners to share data and reducing the computational overhead of encryption and decryption is the first challenge.


### 2.2. Key Escrow

In general attribute-based encryption schemes and ABKS schemes, such as schemes in [21–23], the keys of the data users are generated by attribute authority, so it has the decryption ability of the data users. However, when attribute authority is maliciously attacked, the key of the data user will be leaked, which makes the data owner’s data face great challenges in terms of data privacy and confidentiality. Therefore, Liu et al. [24] proposed an anonymous hierarchical attribute encryption scheme in the electronic medical sharing environment, which introduces multiple authority attribute-based encryption technology to achieve fine-grained data access control and avoid the bottleneck of key escrow under a single authority. However, because multiple authorities have to communicate with each other, the system’s performance is significantly reduced. To sum up, solving the problem of key generation and distribution and realizing key-free escrow is the second challenge.


### 2.3. Policy Update

In a practical application, when the data owner needs to update the access policy, he needs to fetch back the resourced data and reencrypt it with the new access policy, which easily causes large communication and computing overhead. Therefore, Sahai et al. [25] proposed a support dynamic certificate and ciphertext authorization scheme. The idea of policy update is proposed for the first time, and the ciphertext is updated by the proxy method. Lai et al. [26] proposed an attribute-based ciphertext conversion scheme, in which the proxy server can update the access policy in the ciphertext without decryption. Li et al. [27] proposed a CP-ABE scheme in edge computing based on the CP-ABE scheme with dynamically updated access policies proposed by Yang et al. [28] and also provided an efficient online policy update method to manage attribute information. Besides, in schemes [29, 30], data owners can flexibly update access control policies and ciphertext. He will generate an update key and send it to the cloud. Using the update key, the cloud can update the access policy in the ciphertext to a new one. However, in these schemes, the issue of updating the index related to the new access policy is not concerned. Therefore, implementing policy updates and index updating is the third challenge.


## 2.1. Attribute-Based Searchable Encryption

ABKS scheme has attracted much attention because of its fine-grained access control and search functions. Song et al. [12] first proposed the concept of searchable encryption in 2000 and implemented a searchable encryption scheme under the symmetric encryption system. Boneh et al. [13] proposed the first public key searchable encryption (PEKS) scheme in 2004, which can realize a single keyword search. In 2005, Park et al. [14] first proposed a multikeyword PEKS scheme. Kaushik et al. [15] combined attribute encryption and searchable encryption for the first time and proposed attribute-based keyword search (ABKS). Only data users whose attributes conform to the tree access structure can search for keywords. To enrich the functionality of ABKS scheme, Wang et al. [16] proposed a searchable and revocable encryption scheme based on multidata owner attributes, but the scheme did not realize the claimed multidata owner authorization function. Moreover, in most of the existing ABKS schemes, there are still some open problems that urgently need to be resolved, for example, the decryption and encryption overhead is very high. It makes them impractical for many applications, for example, smart devices have limited resources. As a remedy for this problem, Green et al. [17] proposed the first content-based outsourcing decryption scheme, and the decryption process is safely transferred to the cloud server. From then on, large numbers of outsourcing schemes have been proposed to achieve lightweight, Ali and Sadeghi [18] proposed an attribute-based keyword search scheme in cloud computing and outsourced some encryption and decryption work to cloud servers. In 2021, Meng et al. [19] proposed an attribute-based dynamic keyword search encryption in fog computing and outsourced part of the encryption and decryption work to fog nodes. Miao et al. [20] proposed a lightweight encryption and fine-grained search scheme for data in fog computing, which outsources part of the encryption and decryption calculation to fog nodes and supports conjunctive keyword search and attribute update. Unfortunately, this scheme reduces the load on data owners and users, but the interaction between fog nodes and data users increases the transmission load. However, although these schemes realize keyword search and support outsourcing encryption and decryption, they do not satisfy the practical requirements in the actual situation to realize the sharing of data by multidata owners, and the computing burden of encryption and decryption in cloud/fog computing is very heavy. With the development of 5G and IoT technology, edge computing is regarded as a new data resource, which can provide many high-quality outsourcing services. In edge computing, enabling multidata owners to share data and reducing the computational overhead of encryption and decryption is the first challenge.


## 2.2. Key Escrow

In general attribute-based encryption schemes and ABKS schemes, such as schemes in [21–23], the keys of the data users are generated by attribute authority, so it has the decryption ability of the data users. However, when attribute authority is maliciously attacked, the key of the data user will be leaked, which makes the data owner’s data face great challenges in terms of data privacy and confidentiality. Therefore, Liu et al. [24] proposed an anonymous hierarchical attribute encryption scheme in the electronic medical sharing environment, which introduces multiple authority attribute-based encryption technology to achieve fine-grained data access control and avoid the bottleneck of key escrow under a single authority. However, because multiple authorities have to communicate with each other, the system’s performance is significantly reduced. To sum up, solving the problem of key generation and distribution and realizing key-free escrow is the second challenge.


## 2.3. Policy Update

In a practical application, when the data owner needs to update the access policy, he needs to fetch back the resourced data and reencrypt it with the new access policy, which easily causes large communication and computing overhead. Therefore, Sahai et al. [25] proposed a support dynamic certificate and ciphertext authorization scheme. The idea of policy update is proposed for the first time, and the ciphertext is updated by the proxy method. Lai et al. [26] proposed an attribute-based ciphertext conversion scheme, in which the proxy server can update the access policy in the ciphertext without decryption. Li et al. [27] proposed a CP-ABE scheme in edge computing based on the CP-ABE scheme with dynamically updated access policies proposed by Yang et al. [28] and also provided an efficient online policy update method to manage attribute information. Besides, in schemes [29, 30], data owners can flexibly update access control policies and ciphertext. He will generate an update key and send it to the cloud. Using the update key, the cloud can update the access policy in the ciphertext to a new one. However, in these schemes, the issue of updating the index related to the new access policy is not concerned. Therefore, implementing policy updates and index updating is the third challenge.


## 3. Preliminaries

### 3.1. Bilinear Pairing

LetG and GT to be two cyclic groups of prime order p and g is a generator of G. A bilinear map is a function e:G×G⟶GT with the following properties:(1)
Bilinearity:ega,gb=egb,ga=eg,gab for any a,b∈Zp and g∈G(2)
Nondegeneracy: there existsg∈G such that eg,g≠1(3)
Computability: there exists a polynomial-time algorithm to computeeg,h, for any g,h∈G


### 3.2. Decisional Bilinear Diffie–Hellman (DBDH) Assumption

Given the tupleA,B,C=ega,gb,gc,a,b,c,z∈RZP. The DBDH assumption is that no polynomial time (PPT) algorithm B is to be able to distinguish the tuple eg,gabc from the tuple eg,gz with negligible advantage.


### 3.3. Decisional Parallel Diffie–Hellman (BDHE) Assumption

The decisionalq−parallel bilinear Diffie–Hellman exponent (BDHE) problem is that for any PPT algorithm, given y⟶=g,gs,ga,…gaq,gaq+2,…,ga2q, ∀1≤j≤q,gs⋅bj,ga/gj,…,gaq/bj,gaq+2/bj,…,ga2q/bj, and ∀1≤j,k≤q,k≠j,ga⋅s⋅bk/bj,…,gaq⋅s⋅bk/bj. It is difficult to distinguish y⟶,eg,gaq+1⋅s from y⟶,z, where g∈G,z∈G,a,s,b1,…,bq∈Zp are chosen independently and uniformly at random.


### 3.4. Access Structure

Let there ben attributes U=U1,U2,…,Un in the system, and each attribute Uii∈1,n has a set of possible values Vi∈vi,1,vi,2,…,vi,ni. First, let Att=Att1,Att2,…Attn be a user attribute list, where Atti∈Vi. Then, the access policy is represented as Q=Q1,Q2,…,Qn, where Qi∈Vi. If the attribute list Att matches with the access policy QAtt|=Q, namely, Atti∈Qi, then the ciphertexts embedded with Q can be decrypted by the data user with Att.


## 3.1. Bilinear Pairing

LetG and GT to be two cyclic groups of prime order p and g is a generator of G. A bilinear map is a function e:G×G⟶GT with the following properties:(1)
Bilinearity:ega,gb=egb,ga=eg,gab for any a,b∈Zp and g∈G(2)
Nondegeneracy: there existsg∈G such that eg,g≠1(3)
Computability: there exists a polynomial-time algorithm to computeeg,h, for any g,h∈G


## 3.2. Decisional Bilinear Diffie–Hellman (DBDH) Assumption

Given the tupleA,B,C=ega,gb,gc,a,b,c,z∈RZP. The DBDH assumption is that no polynomial time (PPT) algorithm B is to be able to distinguish the tuple eg,gabc from the tuple eg,gz with negligible advantage.


## 3.3. Decisional Parallel Diffie–Hellman (BDHE) Assumption

The decisionalq−parallel bilinear Diffie–Hellman exponent (BDHE) problem is that for any PPT algorithm, given y⟶=g,gs,ga,…gaq,gaq+2,…,ga2q, ∀1≤j≤q,gs⋅bj,ga/gj,…,gaq/bj,gaq+2/bj,…,ga2q/bj, and ∀1≤j,k≤q,k≠j,ga⋅s⋅bk/bj,…,gaq⋅s⋅bk/bj. It is difficult to distinguish y⟶,eg,gaq+1⋅s from y⟶,z, where g∈G,z∈G,a,s,b1,…,bq∈Zp are chosen independently and uniformly at random.


## 3.4. Access Structure

Let there ben attributes U=U1,U2,…,Un in the system, and each attribute Uii∈1,n has a set of possible values Vi∈vi,1,vi,2,…,vi,ni. First, let Att=Att1,Att2,…Attn be a user attribute list, where Atti∈Vi. Then, the access policy is represented as Q=Q1,Q2,…,Qn, where Qi∈Vi. If the attribute list Att matches with the access policy QAtt|=Q, namely, Atti∈Qi, then the ciphertexts embedded with Q can be decrypted by the data user with Att.


## 4. System Model and Security Analysis

### 4.1. System Model

In this scheme, we consider a retrieval scenario in cloud-edge computing, which mainly involves six entities, namely, central authority (CA), attribute authority (AA), multidata owners (m-DOs), cloud server (CS), edge node (EN), and data user (DU), which are shown in Figure2. Assuming that AA, CS, and EN are semihonest, CA is a fully trusted entity, and the specific functions of each entity are as follows:(1)
Central authority (CA): CA generates the identity key for the user and the transformation public key and private key. It is also responsible for the registration of the data owner.(2)
Attribute authority (AA): AA generates attribute keys for users.(3)
Multidata owners (m-DOs): they work together to generate the ciphertext and index, respectively, using the access matrix and access policy.(4)
Cloud server (CS): CS provides storage services. When a qualified query is received, the corresponding ciphertext will be returned.(5)
Edge node (EN): EN has storage and computing capabilities, filling the gap between users and CS. It processes the ciphertext and index uploaded by m-DOs, reencrypts the ciphertext and index, and uploads the ciphertext to CS. Next, EN processes the search request of DU, retrieves the ciphertext from adjacent nodes and CS, predecrypts, and returns the results to DU. In addition, when the access policy is updated, EN updates the index.(6)
Data user (DU): DU issues search queries according to his attribute private key. Moreover, DU makes a bit decryption computation to obtain shared data.Figure 2
System model.


### 4.2. Scheme Definition

The system model includes seven stages, as follows:(1)
System initialization phase:Setup1λ⟶PK,MSK: given the security parameters λ and system attribute set U=U1,U2,…,Un, outputs public key and master key of CA and AA, and public-private key pair of the m-DOs.(2)
Key generation phase:KeyComCAMSKCA,MSKAA,μ⟶D: the algorithm is jointly executed by CA and AA to generate the user key. CA inputs the master key and authenticated the user, AA inputs secret value μ and authenticated the user, and CA calculates a secret value D.IssueKeyCAIDU⟶SKu,CA: CA inputs the identity of the user IDU and outputs the identity transformation key of the user.IssueKeyAAμ,Att⟶SKu,AA: AA inputs the random number μ and the user’s attribute set Att and outputs the user’s attribute key.(3)
Encryption phase:EncryptDOsm,PK,PKo,SKo,Md×l,kwk,W⟶CTDOs,IndDOs: input the public-private key pairs, access matrix Md×l, keywords kwkk∈Wφ and access policy W, and output the ciphertext CTDOs and index IndDOs.(4)
Outsourcing encryption phase:EncryptENPK,W,CTDOs,IndDOs⟶CT,Ind: input the ciphertext CTDOs, index IndDOs and access policy W, and output the ciphertext CT and index Ind.(5)
Retrieval phase:TokenGenAtt,kw′,SKu,AA⟶Tok: DU runs the algorithm, inputs the user’s private key SKu,AA, attribute set Att and keywords kw′, and outputs the token Tok.SearchAtt,Ind,Tok⟶⊥/Ciphertext: EN runs the algorithm, inputs index Ind, token Tok and the user’s attribute set Att. If the user’s attribute set satisfies the access policy and the verification equation is established, it continues; otherwise, it aborts.(6)
Outsourcing decryption and the user decryption phase:PartDecCT,TPK⟶CTout: EN runs the algorithm, inputs ciphertext CT and transformation public key TPK, and outputs part of the ciphertext.FinalDecCTout,TSK⟶K: DU runs the algorithm, inputs part of the ciphertext CTout and transformation private key TSK, and outputs plaintext m.(7)
Policy update phase:UP datepolicy IndexW′,Ind⟶Ind′: EN runs the algorithm, inputs the new access policy W′, and outputs the updated index Ind′.


### 4.3. Security Model

#### 4.3.1. Indistinguishability of Ciphertext

The ciphertext indistinguishability security under chosen-plaintext attacks of a multidata owner ABKS scheme is defined by the game between a challengerC and a probabilistic polynomial time (PPT) adversary A:Setup:C runs the Setup algorithm according to system parameters Param, outputs public key PKCA of CA to A, and retains master secret key MSKCA.Query Phase 1:A submits attribute set Att with identity IDU to C, C runs the key extraction query, and returns the private key to A.Challenge:A submits two messages K0∗ and K1∗ with the same length with access matrix to C. C randomly chooses a bit b∈0,1 and encrypts Kb∗. Finally, C sends the challenge ciphertext CT∗ to A.Query Phase 2:A continues to submit a series of attribute sets to C and still can make queries adaptively as in Query Phase 1.Guess:A outputs a guess b′∈0,1 for b and if b′=b, A wins the game. The advantage of the adversary for winning this confidentiality game is defined as AdvA=Prb′=b−1/2.Definition 1.
A multidata owner ABKS scheme without key escrow is secure under chosen-plaintext attacks, if the probability of the adversaryA winning the game is negligible in a PPT.


#### 4.3.2. Chosen Keyword Indistinguishability

The chosen keyword indistinguishability security of a multidata owner ABKS scheme is defined by the game between a challengerC and a PPT adversary A:Setup:A selects the challenging access policy W0,W1 and sends to challenger C. C runs Setup algorithm to return the public key PKAA to A and retain the master secret key MSKAA.Query Phase 1:A adaptively selects the attribute set Att and queries to the following queries:(i)
Private key query:C returns the associated private key to A by calling KeyGen if the attribute set Att satisfies access policy W0,W1.(ii)
Token query:A submits attribute set Att and kw′ to C for Token query. Then, C outputs the associated Token to A by calling Token.Challenge:A submits two challenging keywords kw0,kw1 with the same length, attribute set to C. If the attribute set satisfies the access policy W0,W1 defined in query phase 1, A can get the access Tkw′. We define kw0=kw1, and then C randomly selects b∈0,1 to generate the index ciphertext Wb and finally sends the index information to A.Query Phase 2:A continues to issue private key queries and token queries, and if the keywords are not equal kw0≠kw1, A cannot query the attribute set Att to satisfy the selected access policy W0,W1.Guess:A outputs a guess b′∈0,1 for b. If b′=b, A wins the game. The advantage of the adversary A for winning this confidentiality game is defined as AdvA=Prb′=b−1/2=ε.Definition 2.
A multidata owner ABKS scheme without key escrow is secure under chosen keywords attacks, if the advantageA defined above for any PPT adversary is negligible.
In addition, this scheme also satisfies the security requirements of data privacy:
Data privacy: for each file shared by the data owners, they sign with public-private key pairs and encrypt the file with two-level access control. If and only if the first-level access control is met, second-level access control can be requested. This is particularly important to ensure the security and confidentiality of data.


## 4.1. System Model

In this scheme, we consider a retrieval scenario in cloud-edge computing, which mainly involves six entities, namely, central authority (CA), attribute authority (AA), multidata owners (m-DOs), cloud server (CS), edge node (EN), and data user (DU), which are shown in Figure2. Assuming that AA, CS, and EN are semihonest, CA is a fully trusted entity, and the specific functions of each entity are as follows:(1)
Central authority (CA): CA generates the identity key for the user and the transformation public key and private key. It is also responsible for the registration of the data owner.(2)
Attribute authority (AA): AA generates attribute keys for users.(3)
Multidata owners (m-DOs): they work together to generate the ciphertext and index, respectively, using the access matrix and access policy.(4)
Cloud server (CS): CS provides storage services. When a qualified query is received, the corresponding ciphertext will be returned.(5)
Edge node (EN): EN has storage and computing capabilities, filling the gap between users and CS. It processes the ciphertext and index uploaded by m-DOs, reencrypts the ciphertext and index, and uploads the ciphertext to CS. Next, EN processes the search request of DU, retrieves the ciphertext from adjacent nodes and CS, predecrypts, and returns the results to DU. In addition, when the access policy is updated, EN updates the index.(6)
Data user (DU): DU issues search queries according to his attribute private key. Moreover, DU makes a bit decryption computation to obtain shared data.Figure 2
System model.


## 4.2. Scheme Definition

The system model includes seven stages, as follows:(1)
System initialization phase:Setup1λ⟶PK,MSK: given the security parameters λ and system attribute set U=U1,U2,…,Un, outputs public key and master key of CA and AA, and public-private key pair of the m-DOs.(2)
Key generation phase:KeyComCAMSKCA,MSKAA,μ⟶D: the algorithm is jointly executed by CA and AA to generate the user key. CA inputs the master key and authenticated the user, AA inputs secret value μ and authenticated the user, and CA calculates a secret value D.IssueKeyCAIDU⟶SKu,CA: CA inputs the identity of the user IDU and outputs the identity transformation key of the user.IssueKeyAAμ,Att⟶SKu,AA: AA inputs the random number μ and the user’s attribute set Att and outputs the user’s attribute key.(3)
Encryption phase:EncryptDOsm,PK,PKo,SKo,Md×l,kwk,W⟶CTDOs,IndDOs: input the public-private key pairs, access matrix Md×l, keywords kwkk∈Wφ and access policy W, and output the ciphertext CTDOs and index IndDOs.(4)
Outsourcing encryption phase:EncryptENPK,W,CTDOs,IndDOs⟶CT,Ind: input the ciphertext CTDOs, index IndDOs and access policy W, and output the ciphertext CT and index Ind.(5)
Retrieval phase:TokenGenAtt,kw′,SKu,AA⟶Tok: DU runs the algorithm, inputs the user’s private key SKu,AA, attribute set Att and keywords kw′, and outputs the token Tok.SearchAtt,Ind,Tok⟶⊥/Ciphertext: EN runs the algorithm, inputs index Ind, token Tok and the user’s attribute set Att. If the user’s attribute set satisfies the access policy and the verification equation is established, it continues; otherwise, it aborts.(6)
Outsourcing decryption and the user decryption phase:PartDecCT,TPK⟶CTout: EN runs the algorithm, inputs ciphertext CT and transformation public key TPK, and outputs part of the ciphertext.FinalDecCTout,TSK⟶K: DU runs the algorithm, inputs part of the ciphertext CTout and transformation private key TSK, and outputs plaintext m.(7)
Policy update phase:UP datepolicy IndexW′,Ind⟶Ind′: EN runs the algorithm, inputs the new access policy W′, and outputs the updated index Ind′.


## 4.3. Security Model

### 4.3.1. Indistinguishability of Ciphertext

The ciphertext indistinguishability security under chosen-plaintext attacks of a multidata owner ABKS scheme is defined by the game between a challengerC and a probabilistic polynomial time (PPT) adversary A:Setup:C runs the Setup algorithm according to system parameters Param, outputs public key PKCA of CA to A, and retains master secret key MSKCA.Query Phase 1:A submits attribute set Att with identity IDU to C, C runs the key extraction query, and returns the private key to A.Challenge:A submits two messages K0∗ and K1∗ with the same length with access matrix to C. C randomly chooses a bit b∈0,1 and encrypts Kb∗. Finally, C sends the challenge ciphertext CT∗ to A.Query Phase 2:A continues to submit a series of attribute sets to C and still can make queries adaptively as in Query Phase 1.Guess:A outputs a guess b′∈0,1 for b and if b′=b, A wins the game. The advantage of the adversary for winning this confidentiality game is defined as AdvA=Prb′=b−1/2.Definition 1.
A multidata owner ABKS scheme without key escrow is secure under chosen-plaintext attacks, if the probability of the adversaryA winning the game is negligible in a PPT.


### 4.3.2. Chosen Keyword Indistinguishability

The chosen keyword indistinguishability security of a multidata owner ABKS scheme is defined by the game between a challengerC and a PPT adversary A:Setup:A selects the challenging access policy W0,W1 and sends to challenger C. C runs Setup algorithm to return the public key PKAA to A and retain the master secret key MSKAA.Query Phase 1:A adaptively selects the attribute set Att and queries to the following queries:(i)
Private key query:C returns the associated private key to A by calling KeyGen if the attribute set Att satisfies access policy W0,W1.(ii)
Token query:A submits attribute set Att and kw′ to C for Token query. Then, C outputs the associated Token to A by calling Token.Challenge:A submits two challenging keywords kw0,kw1 with the same length, attribute set to C. If the attribute set satisfies the access policy W0,W1 defined in query phase 1, A can get the access Tkw′. We define kw0=kw1, and then C randomly selects b∈0,1 to generate the index ciphertext Wb and finally sends the index information to A.Query Phase 2:A continues to issue private key queries and token queries, and if the keywords are not equal kw0≠kw1, A cannot query the attribute set Att to satisfy the selected access policy W0,W1.Guess:A outputs a guess b′∈0,1 for b. If b′=b, A wins the game. The advantage of the adversary A for winning this confidentiality game is defined as AdvA=Prb′=b−1/2=ε.Definition 2.
A multidata owner ABKS scheme without key escrow is secure under chosen keywords attacks, if the advantageA defined above for any PPT adversary is negligible.
In addition, this scheme also satisfies the security requirements of data privacy:
Data privacy: for each file shared by the data owners, they sign with public-private key pairs and encrypt the file with two-level access control. If and only if the first-level access control is met, second-level access control can be requested. This is particularly important to ensure the security and confidentiality of data.


## 4.3.1. Indistinguishability of Ciphertext

The ciphertext indistinguishability security under chosen-plaintext attacks of a multidata owner ABKS scheme is defined by the game between a challengerC and a probabilistic polynomial time (PPT) adversary A:Setup:C runs the Setup algorithm according to system parameters Param, outputs public key PKCA of CA to A, and retains master secret key MSKCA.Query Phase 1:A submits attribute set Att with identity IDU to C, C runs the key extraction query, and returns the private key to A.Challenge:A submits two messages K0∗ and K1∗ with the same length with access matrix to C. C randomly chooses a bit b∈0,1 and encrypts Kb∗. Finally, C sends the challenge ciphertext CT∗ to A.Query Phase 2:A continues to submit a series of attribute sets to C and still can make queries adaptively as in Query Phase 1.Guess:A outputs a guess b′∈0,1 for b and if b′=b, A wins the game. The advantage of the adversary for winning this confidentiality game is defined as AdvA=Prb′=b−1/2.Definition 1.
A multidata owner ABKS scheme without key escrow is secure under chosen-plaintext attacks, if the probability of the adversaryA winning the game is negligible in a PPT.


## 4.3.2. Chosen Keyword Indistinguishability

The chosen keyword indistinguishability security of a multidata owner ABKS scheme is defined by the game between a challengerC and a PPT adversary A:Setup:A selects the challenging access policy W0,W1 and sends to challenger C. C runs Setup algorithm to return the public key PKAA to A and retain the master secret key MSKAA.Query Phase 1:A adaptively selects the attribute set Att and queries to the following queries:(i)
Private key query:C returns the associated private key to A by calling KeyGen if the attribute set Att satisfies access policy W0,W1.(ii)
Token query:A submits attribute set Att and kw′ to C for Token query. Then, C outputs the associated Token to A by calling Token.Challenge:A submits two challenging keywords kw0,kw1 with the same length, attribute set to C. If the attribute set satisfies the access policy W0,W1 defined in query phase 1, A can get the access Tkw′. We define kw0=kw1, and then C randomly selects b∈0,1 to generate the index ciphertext Wb and finally sends the index information to A.Query Phase 2:A continues to issue private key queries and token queries, and if the keywords are not equal kw0≠kw1, A cannot query the attribute set Att to satisfy the selected access policy W0,W1.Guess:A outputs a guess b′∈0,1 for b. If b′=b, A wins the game. The advantage of the adversary A for winning this confidentiality game is defined as AdvA=Prb′=b−1/2=ε.Definition 2.
A multidata owner ABKS scheme without key escrow is secure under chosen keywords attacks, if the advantageA defined above for any PPT adversary is negligible.
In addition, this scheme also satisfies the security requirements of data privacy:
Data privacy: for each file shared by the data owners, they sign with public-private key pairs and encrypt the file with two-level access control. If and only if the first-level access control is met, second-level access control can be requested. This is particularly important to ensure the security and confidentiality of data.


## 5. Our Construction

With low latency and high efficiency provided by edge computing, resource-limited DU and m-DOs can outsource partial computational burden to EN, leaving a small part of the operations to be performed by themselves. Compared with existing CP-ABKS schemes, our scheme can not only achieve fine-grained access control but also alleviate the computational burden on EN by adding a middle layer called EN. Thus, we consider the case of multiple owners where each file is co-owned by a group of DOs and give a general description for the system in Figure3. In step (1), the authorities distribute the keys to m-DOs, DU, and EN. We refer to the scheme [31] and design a two-level access control over encrypted files with step (2). File encryption is based on a Md×l access matrix, in which each row of the matrix corresponds to an owner. Its purpose is to realize m-DOs authorization for DUs based on LSSS technology, the LSSS matrix has been illustrated in [32], which is the second-level access control for users. The first-level of access control occurs in the search phase. EN receives the ciphertext and index information sent by m-DOs and continues to reencrypt them. EN saves the index information and uploads the ciphertext to CS finally. In order to filter users who want to obtain shared documents, m-DOs define access policies according to requirements and generate indexes embedded in access policies. DU must provide tokens embedded with their own attributes and identities for matching. Note that DU can request the second-level access control, if and only if, he satisfies the first-level access control. EN processes the search request of DU and retrieves the ciphertext from adjacent nodes and CS by step (3); after gaining the search results, EN first conducts the majority of operations to predecrypt with step (4) and returns partial ciphertext to DU. When the access policy used by m-DOs for encryption changes, which is shown by step (5). It is only necessary to send the new access policy to the ENs, and they will update the index. In the following, we show the main phase algorithms in the scheme, namely, system initialization phase, key generation phase, encryption and index generation phase, outsourcing encryption and index generation phase, retrieval phase, outsourcing decryption and user decryption phase, and policy update phase.Figure 3
Framework of the system.


### 5.1. System Initialization Phase

(i)
GlobalSetup: on input the security parameters λ and the system attributes U=U1,U2,…,Un, for each attribute value Ui, i∈1,n, there are a series of possible values Vi∈vi,1,vi,2,…,vi,ni and vi,jj∈1,ni∈Zp∗. G and GT are two groups of prime order p and g is a generator of G. e:G×G⟶GT is the bilinear map, and H,H′ is anticollision hash functions H:0,1∗⟶Zp∗,H′:0,1∗⟶G. Output system common parameters:(1)Param=p,g,G,GT,e,H,H′.(ii)
SetupCA: CA selects α∈Zp∗ randomly, then the master key and public key of CA is MSKCA=α,PKCA=eg,gα,gα.(iii)
SetupAA: AA selects xi,ji∈1,n,j∈1,ni, β∈Zp∗ randomly and calculates Ai,j=gxi,j, and generates the master key and public key of AA, where MSKAA=β,xi,ji∈1,n,j∈1,ni:(2)PKAA=gβ,Ai,ji∈1,n,j∈1,ni.(iv)
DataOwnerRegistration: m-DOs O=O1,O2,…,Od send their identity information to CA, and CA generates public-private key pairs PKo,SKoo∈1,d for them.


### 5.2. Key Generation Phase

(i)
KeyComCA: AA selects μ∈Zp randomly for authenticated users, which is unique to each user. AA and CA run two-party security protocols, AA inputs β,μ and CA inputs α. Under the condition that the two parties do not disclose any private information, CA obtains xCA=μαβ. This is achieved by using two-party secure computing protocol [33] and can also be achieved by the construction in the literature [34]. CA randomly selects γ∈Zp, then calculates Y=gγxCA, and sends Y to AA. After AA receives Y, it calculates T=Y1/β and returns it to CA. Finally, CA calculates D=T1/γ=gμα.(ii)
IssueKeyCA: CA outputs the user’s identity key for identified user IDU. CA randomly selects z∈Zp∗ as the transformation private key and calculates the transformation public key ko=gz, k1=g1+μαz/H′IDU,k2=gzμα+H′IDU. Last outputs user identity transformation key is TSK=z,TPK=k0,k1,k2, TPK=k0,k1,k2.(iii)
IssueKeyAA: AA is based on the random number μ selected in KeyComCA and inputs the user’s attribute set Att=Att1,Att2,…,Attn. Then, it selects r∈Zp randomly and output the attribute key:(3)SKu,AA=k3,i=grβμH′Atti,k4=grμ∑i=1nxi,j.Finally, the user can get his whole keySK=TSK,k3,ii∈1,n,j∈1,ni,k4, and TPK is uploaded to the edge node.


### 5.3. Encryption and Index Generation Phase

Given fileF=m and keywords kwkk∈Wφ, m-DOs generated file ciphertext and index:(i)
EncryptDOs: m-DOs first generate identity signatures σi,i=1,2,…,d for files F using public-private key pairs PKo,SKo. For file m∈F, m-DOs first encrypt the file m with a symmetric encryption key K∈GT∗ as Cm=EncKm. Then, m-DOs encrypt the symmetric key K with the attribute cryptography technology. Md×l is a matrix, a function ρi maps each row M of Md×l to a DO. m-DOs select a column vector v⟶=s,r2,r3,…,rl∈RZpl, compute λi=M⟶iv⟶i,i=1,2,…,l , and s is a secret value. We set ciphertext:(4)C0=Keg,gαs∑i=1dσi,C1,i=gλiασi,C′=gs.m-DOs output ciphertext:(5)CTDOs=Cm,C0,C′,C1,i,σii=1,2,…,d.(ii)
IndexDOs: m-DOs define access policies W=W1,W2,…,Wn firstly. For keywords kwkk∈Wφ, m-DOs select ηi∈Zp and compute η=∑i=1dηi. We set index I1=gαη/∑k∈WφHkwk,I′=gβη. Output index IndDOs=W,I1,I′.Finally, we uploadCTDOs and IndDOs to the edge node.


### 5.4. Outsourcing Encryption and Index Generation Phase

(i)
EncryptEN: inputs public key, ciphertext CTDOs, signatures σi, and EN selects ci∈Zp∗ randomly. We set ciphertext:(6)C2=C′∑i=1dciσi=gs∑i=1dciσi,C3=∏i=1dC′ciσiH′IDO=gs∑i=1dciσiH′IDO.Output ciphertext:(7)CT=Cm,C0,C′,C1,i,σii=1,2,…,d,C2,C3.(ii)
IndexEN: EN runs the algorithm and inputs index IndDOs. According to the defined access policy W=W1,W2,…,Wn and Wi∈Vii∈1,n. For each Wi=vi,j, EN selects τi∈Zp∗ randomly and sets(8)I2=∏i=1nAi,jτi=g∑i=1nxi,jτi,I3=gβ∑i=1nτiH′Wi.Output indexInd=W,I1,I′,I2,I3.Finally, we uploadCT to CS for storage and save Ind by themselves.


### 5.5. Retrieval Phase

(i)
TokenGen: let kwk′k∈Wφ be keywords set, DU with attribute sets Att first selects e∈Zp randomly and sets token T1,k=gβeHkwk′,T2=gαe,(9)T3=∏i=1nk3,ie=grμβe∑i=1nH′Atti,T4=k4e=greμ∑i=1nxi,j.Output tokenTok=T1,kk∈Wφ,T2,T3,T4.(ii)
Search: inputs user’s attribute set Att, access policy W, index and token. First, EN checks whether the user’s attribute set satisfies access policy. If not, the algorithm aborts. Otherwise, we judge whether the following equation holds eI2,T3eI′,T2/eT4,I3=eI1,∏k∈WφT1,k. If the equation holds, we output the storage address, otherwise abort.


### 5.6. Outsourcing Decryption and User Decryption Phase

(i)
PartDec: Suppose P is a matrix access structure and S∈P is an authorization set with I=i:ρi∈S⊂1,2,…,d, there are a set of constant ωi which makes the equation ∑i∈IωiM⟶i=1,0,…,0 hold and ∑i∈Iωiλi=s. EN computes CTout=ek2,C2/ek1,C3e∏i∈IC1,iωi,k0. Finally, outputs partial ciphertext CTout and sends it to DU.(ii)
FinalDec: DU performs simple calculation K=C0CTout1/z by using the transformation private key TSK to obtain symmetric key K and gets m=DecKCm.


### 5.7. Policy Update Phase

#### 5.7.1. UPdatepolicyIndes

When the access policy is updated, m-Dos only need to send the new access policyW′ to EN, and EN updates corresponding index.First, the EN runs algorithmPolicy Compare and compares the old and new policies. Output new index information and store it in Ind1,Ind2,Ind3. Let n/n′ represent the number of attributes in the old/new access policy W/W′, respectively. There are three cases:(a)
When the number of attributes in the access policyW′ is reduced to n′, and n′<n. EN updates the index as follows:(10)I2′=I2∏i=1ngxi,jτi,I3′=I3gβ∑i=1nτiH′Wi′,j,i∈Ind1.Then, updated index information is stored in theInd1.(b)
When the number of attributes in the access policyW′ is added to n′, and n′>n. EN updates the index as follows:(11)I2′=I2∏i=1n′gxi,jτi,I3′=I3gβ∑i=1n′τiH′Wi′,j,i∈Ind2.Then, updated index information is stored in theInd2.(c)
In the access policyW′, when the number of attributes changes in part and remains unchanged in part, EN randomly selects τj′∈Zp∗ and updates the index as follows:(12)I2′=∏i=1n′gxi,jτigxi,j′τj′,I3′=∏i=1n′gβτiH′Wigβτj′H′Wi′j,i∈Ind3.Then, updated index information is stored in theInd3.Output updated indexInd′=I1,I′,I2′,I3′.In this process, m-DOs only need to send a new access policy to EN, and EN uses the new access policy to update the index. Therefore, it reduces the calculation burden of DOs and ensures the security of the index.


### 5.8. Correctness

Correctness of the search phase:(13)eI2,T3eI′,T2eT4,I3=eg∑i=1nxi,jτi,grμβe∑i=1nH′Attiegβη,gαeegreμ∑i=1nxi,j,gβ∑i=1nτiH′Wi=eg,grμβe∑i=1nxi,jτi∑i=1nH′Attieg,gβηαeeg,grβμe∑i=1nxi,j∑i=1nτiH′Wi=egαη/∑k∈WφHkwk,∏k∈WφgβeHkwk′=eI1,∏k∈WφT1,k.Correctness of the part decryption phase:(14)CTout=ek2,C2ek1,C3e∏i∈IC1,iωi,k0=egμαz+H′IDU,gs∑i=1dciσieg1+μαz/H′IDU,gs∑i=1dciσiH′IDOeg∑i∈Iλiωiασi,gz=1eg,gszα∑i=1dσi.Correctness of the user decryption phase:(15)K=C0CTout1/z=Keg,gαs∑i=1dσi1eg,g1/zzsα∑i=1dσi.


## 5.1. System Initialization Phase

(i)
GlobalSetup: on input the security parameters λ and the system attributes U=U1,U2,…,Un, for each attribute value Ui, i∈1,n, there are a series of possible values Vi∈vi,1,vi,2,…,vi,ni and vi,jj∈1,ni∈Zp∗. G and GT are two groups of prime order p and g is a generator of G. e:G×G⟶GT is the bilinear map, and H,H′ is anticollision hash functions H:0,1∗⟶Zp∗,H′:0,1∗⟶G. Output system common parameters:(1)Param=p,g,G,GT,e,H,H′.(ii)
SetupCA: CA selects α∈Zp∗ randomly, then the master key and public key of CA is MSKCA=α,PKCA=eg,gα,gα.(iii)
SetupAA: AA selects xi,ji∈1,n,j∈1,ni, β∈Zp∗ randomly and calculates Ai,j=gxi,j, and generates the master key and public key of AA, where MSKAA=β,xi,ji∈1,n,j∈1,ni:(2)PKAA=gβ,Ai,ji∈1,n,j∈1,ni.(iv)
DataOwnerRegistration: m-DOs O=O1,O2,…,Od send their identity information to CA, and CA generates public-private key pairs PKo,SKoo∈1,d for them.


## 5.2. Key Generation Phase

(i)
KeyComCA: AA selects μ∈Zp randomly for authenticated users, which is unique to each user. AA and CA run two-party security protocols, AA inputs β,μ and CA inputs α. Under the condition that the two parties do not disclose any private information, CA obtains xCA=μαβ. This is achieved by using two-party secure computing protocol [33] and can also be achieved by the construction in the literature [34]. CA randomly selects γ∈Zp, then calculates Y=gγxCA, and sends Y to AA. After AA receives Y, it calculates T=Y1/β and returns it to CA. Finally, CA calculates D=T1/γ=gμα.(ii)
IssueKeyCA: CA outputs the user’s identity key for identified user IDU. CA randomly selects z∈Zp∗ as the transformation private key and calculates the transformation public key ko=gz, k1=g1+μαz/H′IDU,k2=gzμα+H′IDU. Last outputs user identity transformation key is TSK=z,TPK=k0,k1,k2, TPK=k0,k1,k2.(iii)
IssueKeyAA: AA is based on the random number μ selected in KeyComCA and inputs the user’s attribute set Att=Att1,Att2,…,Attn. Then, it selects r∈Zp randomly and output the attribute key:(3)SKu,AA=k3,i=grβμH′Atti,k4=grμ∑i=1nxi,j.Finally, the user can get his whole keySK=TSK,k3,ii∈1,n,j∈1,ni,k4, and TPK is uploaded to the edge node.


## 5.3. Encryption and Index Generation Phase

Given fileF=m and keywords kwkk∈Wφ, m-DOs generated file ciphertext and index:(i)
EncryptDOs: m-DOs first generate identity signatures σi,i=1,2,…,d for files F using public-private key pairs PKo,SKo. For file m∈F, m-DOs first encrypt the file m with a symmetric encryption key K∈GT∗ as Cm=EncKm. Then, m-DOs encrypt the symmetric key K with the attribute cryptography technology. Md×l is a matrix, a function ρi maps each row M of Md×l to a DO. m-DOs select a column vector v⟶=s,r2,r3,…,rl∈RZpl, compute λi=M⟶iv⟶i,i=1,2,…,l , and s is a secret value. We set ciphertext:(4)C0=Keg,gαs∑i=1dσi,C1,i=gλiασi,C′=gs.m-DOs output ciphertext:(5)CTDOs=Cm,C0,C′,C1,i,σii=1,2,…,d.(ii)
IndexDOs: m-DOs define access policies W=W1,W2,…,Wn firstly. For keywords kwkk∈Wφ, m-DOs select ηi∈Zp and compute η=∑i=1dηi. We set index I1=gαη/∑k∈WφHkwk,I′=gβη. Output index IndDOs=W,I1,I′.Finally, we uploadCTDOs and IndDOs to the edge node.


## 5.4. Outsourcing Encryption and Index Generation Phase

(i)
EncryptEN: inputs public key, ciphertext CTDOs, signatures σi, and EN selects ci∈Zp∗ randomly. We set ciphertext:(6)C2=C′∑i=1dciσi=gs∑i=1dciσi,C3=∏i=1dC′ciσiH′IDO=gs∑i=1dciσiH′IDO.Output ciphertext:(7)CT=Cm,C0,C′,C1,i,σii=1,2,…,d,C2,C3.(ii)
IndexEN: EN runs the algorithm and inputs index IndDOs. According to the defined access policy W=W1,W2,…,Wn and Wi∈Vii∈1,n. For each Wi=vi,j, EN selects τi∈Zp∗ randomly and sets(8)I2=∏i=1nAi,jτi=g∑i=1nxi,jτi,I3=gβ∑i=1nτiH′Wi.Output indexInd=W,I1,I′,I2,I3.Finally, we uploadCT to CS for storage and save Ind by themselves.


## 5.5. Retrieval Phase

(i)
TokenGen: let kwk′k∈Wφ be keywords set, DU with attribute sets Att first selects e∈Zp randomly and sets token T1,k=gβeHkwk′,T2=gαe,(9)T3=∏i=1nk3,ie=grμβe∑i=1nH′Atti,T4=k4e=greμ∑i=1nxi,j.Output tokenTok=T1,kk∈Wφ,T2,T3,T4.(ii)
Search: inputs user’s attribute set Att, access policy W, index and token. First, EN checks whether the user’s attribute set satisfies access policy. If not, the algorithm aborts. Otherwise, we judge whether the following equation holds eI2,T3eI′,T2/eT4,I3=eI1,∏k∈WφT1,k. If the equation holds, we output the storage address, otherwise abort.


## 5.6. Outsourcing Decryption and User Decryption Phase

(i)
PartDec: Suppose P is a matrix access structure and S∈P is an authorization set with I=i:ρi∈S⊂1,2,…,d, there are a set of constant ωi which makes the equation ∑i∈IωiM⟶i=1,0,…,0 hold and ∑i∈Iωiλi=s. EN computes CTout=ek2,C2/ek1,C3e∏i∈IC1,iωi,k0. Finally, outputs partial ciphertext CTout and sends it to DU.(ii)
FinalDec: DU performs simple calculation K=C0CTout1/z by using the transformation private key TSK to obtain symmetric key K and gets m=DecKCm.


## 5.7. Policy Update Phase

### 5.7.1. UPdatepolicyIndes

When the access policy is updated, m-Dos only need to send the new access policyW′ to EN, and EN updates corresponding index.First, the EN runs algorithmPolicy Compare and compares the old and new policies. Output new index information and store it in Ind1,Ind2,Ind3. Let n/n′ represent the number of attributes in the old/new access policy W/W′, respectively. There are three cases:(a)
When the number of attributes in the access policyW′ is reduced to n′, and n′<n. EN updates the index as follows:(10)I2′=I2∏i=1ngxi,jτi,I3′=I3gβ∑i=1nτiH′Wi′,j,i∈Ind1.Then, updated index information is stored in theInd1.(b)
When the number of attributes in the access policyW′ is added to n′, and n′>n. EN updates the index as follows:(11)I2′=I2∏i=1n′gxi,jτi,I3′=I3gβ∑i=1n′τiH′Wi′,j,i∈Ind2.Then, updated index information is stored in theInd2.(c)
In the access policyW′, when the number of attributes changes in part and remains unchanged in part, EN randomly selects τj′∈Zp∗ and updates the index as follows:(12)I2′=∏i=1n′gxi,jτigxi,j′τj′,I3′=∏i=1n′gβτiH′Wigβτj′H′Wi′j,i∈Ind3.Then, updated index information is stored in theInd3.Output updated indexInd′=I1,I′,I2′,I3′.In this process, m-DOs only need to send a new access policy to EN, and EN uses the new access policy to update the index. Therefore, it reduces the calculation burden of DOs and ensures the security of the index.


## 5.7.1. UPdatepolicyIndes

When the access policy is updated, m-Dos only need to send the new access policyW′ to EN, and EN updates corresponding index.First, the EN runs algorithmPolicy Compare and compares the old and new policies. Output new index information and store it in Ind1,Ind2,Ind3. Let n/n′ represent the number of attributes in the old/new access policy W/W′, respectively. There are three cases:(a)
When the number of attributes in the access policyW′ is reduced to n′, and n′<n. EN updates the index as follows:(10)I2′=I2∏i=1ngxi,jτi,I3′=I3gβ∑i=1nτiH′Wi′,j,i∈Ind1.Then, updated index information is stored in theInd1.(b)
When the number of attributes in the access policyW′ is added to n′, and n′>n. EN updates the index as follows:(11)I2′=I2∏i=1n′gxi,jτi,I3′=I3gβ∑i=1n′τiH′Wi′,j,i∈Ind2.Then, updated index information is stored in theInd2.(c)
In the access policyW′, when the number of attributes changes in part and remains unchanged in part, EN randomly selects τj′∈Zp∗ and updates the index as follows:(12)I2′=∏i=1n′gxi,jτigxi,j′τj′,I3′=∏i=1n′gβτiH′Wigβτj′H′Wi′j,i∈Ind3.Then, updated index information is stored in theInd3.Output updated indexInd′=I1,I′,I2′,I3′.In this process, m-DOs only need to send a new access policy to EN, and EN uses the new access policy to update the index. Therefore, it reduces the calculation burden of DOs and ensures the security of the index.


## 5.8. Correctness

Correctness of the search phase:(13)eI2,T3eI′,T2eT4,I3=eg∑i=1nxi,jτi,grμβe∑i=1nH′Attiegβη,gαeegreμ∑i=1nxi,j,gβ∑i=1nτiH′Wi=eg,grμβe∑i=1nxi,jτi∑i=1nH′Attieg,gβηαeeg,grβμe∑i=1nxi,j∑i=1nτiH′Wi=egαη/∑k∈WφHkwk,∏k∈WφgβeHkwk′=eI1,∏k∈WφT1,k.Correctness of the part decryption phase:(14)CTout=ek2,C2ek1,C3e∏i∈IC1,iωi,k0=egμαz+H′IDU,gs∑i=1dciσieg1+μαz/H′IDU,gs∑i=1dciσiH′IDOeg∑i∈Iλiωiασi,gz=1eg,gszα∑i=1dσi.Correctness of the user decryption phase:(15)K=C0CTout1/z=Keg,gαs∑i=1dσi1eg,g1/zzsα∑i=1dσi.


## 6. Security Analysis

Theorem 1.
Under the assumption ofq− Parallel BDHE, the multidata owner ABKS scheme without key escrow is secure against indistinguishable chosen-plaintext attacks.Proof.
Assume that there is a PPT adversaryA who can win the ciphertext indistinguishability security game with nonnegligible advantage ε:Setup:C runs the Setup algorithm according to system common parameters Param, outputs public key PKCA to A, and retains master secret key MSKCA.Query Phase 1:A queries the key to the challenger C. The key generated by the two-party secure computing protocol is secure and will not disclose private information. A submits attribute set Att with identity IDU to C, C randomly selects μ∗ running algorithm KeyComCA, sets identity key k1=g1+μαz/H′IDU, k2=gzμα+H′IDU, and returns the private key to A.Challenge:A submits two messages K0∗ and K1∗ with the same length with access matrix to C. C randomly chooses a bit b∈0,1 and sets C0∗=Kb∗eg,gαs∑i=1dσi and randomly selects vectors v⟶=s,r2′,r3′,…,rl′∈RZpl that are calculated by sharing secret value s and computes C1,i∗=gλiασi, C′∗=gs. Finally, C sends the challenge ciphertext CT∗ to A. Note that the security of the shared challenge ciphertext C1,i∗,C′∗ is guaranteed by the embedded access matrix information.Query Phase 2:A makes queries adaptively as in Query Phase 1.Guess:A outputs a guess b′∈0,1 for b and if b′=b, A wins the game. In other words, it is effective to CT∗ under the assumption of q− Parallel BDHE. The advantage of the adversary for winning this confidentiality game is defined as AdvA=Prb′=b−1/2. Then, the scheme is proved to achieve selective plaintext security.Theorem 2.
The multidata owner ABKS scheme without key escrow is secure under chosen keyword attack if the DBDH problem is hard.Proof.
A defines a challenging access policy W0,W1 before the system establishment stage. In the security game of nonselective identity, A can submit an attribute set Att and satisfy two access strategies W0,W1 at the same time, and then A can obtain the corresponding search results. During this period, in addition to the returned search results, A cannot obtain information about the access policy W0,W1, which corresponds to the access policy to be updated later:Setup:A selects the challenging access policy W0,W1 and sends to C. C runs Setup algorithm to return public key PKAA to A and retain master secret key MSKAA.Query Phase 1:A adaptively selects the attribute set Att and queries to the following queries:(i)
Private key query: if the attribute setAtt satisfies the selected access policy W0,W1 and C runs the key generation algorithm. Under the two-party security protocol, AA and CA randomly select r∈Zp to jointly generate user attribute private key k3,i=grβμH′Atti,k4=grμ∑i=1nxi,j and send it to A.(ii)
Token query:A submits attribute set Att and kw′ to C for token query. Then, C randomly selects e∈Zp, sets token(16)T1,k=gβeHkwk′,T2=gαe,T3=grμβe∑i=1nH′Atti,T4=greμ∑i=1nxi,jtoA.Challenge:A submits two challenging keywords kw0,kw1 with the same length, attribute set to C. If the attribute set satisfies the access policy W0,W1 defined in query phase 1, A can get the access Tkw′. We define kw0≠kw1, and then C randomly selects b∈0,1 to set token T1,b=gβeHkwb′, T2=gαe, T3=grμβe∑i=1nH′Atti, and T4=greμ∑i=1nxi,j and finally sends the token information to A.Query Phase 2:A continues to issue private key queries and token queries, If the keywords are not equal kw0≠kw1, A cannot query the attribute set Att to satisfy the selected access policy W0,W1.Guess:A outputs a guess b′∈0,1 for b . If b′=b , A wins the game. Outputs b′=b=1/2+ε . Otherwise, A outputs b′=b=1/2+ε. Thus, the adversary A of solving the DBDH problem is(17)12Prb′=b+12Prb′≠b=1212+ε+12⋅12−12=ε2.In addition, our scheme also satisfies the security and privacy requirements of data privacy under the assumption of DBDH.Data privacy: first, we encrypt sensitive data to prevent data leakage. Secondly, we use two layers of access control to prevent unauthorized users from leaking secrets (the first layer is to filter users’ identities and attribute sets, and the second layer is to satisfy the authorization of multiple data owners). Thirdly, although outsourcing decryption is adopted, the most critical calculations are completed by users to prevent EN from leaking secrets.


## 7. Performance Analysis

### 7.1. Theoretical Analysis

#### 7.1.1. Function Comparison

Table1 shows the comparison between our scheme and related schemes [29, 31, 34–36] in terms of the number of data owners, policy updates, without key escrow, computing outsourcing, and searchability. Our scheme realizes multikeyword search; schemes [31, 35] only support single keyword search, whereas schemes [29, 34, 36] do not provide a search function. Our scheme and scheme [31] realize the multidata owner authorization management of shared files, but scheme [31] does not discuss access policy updating. Our scheme avoids the problem of key escrow, as well as scheme [34]. However, other schemes fail to solve this problem. In terms of computing outsourcing, our scheme introduces edge computing, so most encryption and decryption works are outsourced to edge nodes, whereas the data owners and users only perform few calculations. In scheme [35], only the decryption is outsourced to the cloud, and the encryption calculation is still performed by the data owner. However, other schemes do not consider outsourcing calculations. Therefore, our scheme is functional.Table 1
Function comparison.
Multiple data ownersPolicy updateWithout key escrowSearchableComputing outsourcing[29]×√××Encryption/decryption[31]√××Single keyword×[34]××√××[35]×××Single keywordDecryption[36]×√××Encryption/decryptionOurs√√√Multiple keywordEncryption/decryption


#### 7.1.2. The Storage Cost

In this subsection, a storage cost comparison between our scheme and related schemes [29, 31, 35, 36] is presented in terms of the public key, transformation key, DO side ciphertext, cloud/fog/edge side ciphertext, side ciphertext, and token storage size, as shown in Table 2. The public key, transformation key, DO side ciphertext, and cloud/fog/edge side ciphertext occupy less storage space in our scheme. In terms of token storage, our scheme is independent of the number of attributes and related to the number of keywords, whereas the token storage in schemes [31, 35] increases linearly with the increase in the number of attributes. By contrast, our scheme has less storage overhead.Table 2
Storage cost.
PKTPKCT on DOCT on CS/Fog/ENToken[29]2UG+GTn+2G2l+1G+GT+2Zp∗lG—[31]2+UG+GT—2d+2n+2G+2GT—2n+1G+Zp∗[35]4G+GT—4+lG+GT—n+6G+Zp∗[36]2UG+GTn+1G2lG+l+1GT+3lZp∗3lG—Ours2UG+GT2G1+dG+GT2Gns+3G


#### 7.1.3. The Computational Cost

The computational overhead mainly involves bilinear pairing and modular exponential operations. LetU represent the number of system attributes, G/GT represents the size of the element in the G/GT, n indicates the number of the user attributes. ns represents the number of keywords used in token generation, l represents the number of attributes in the access policy, and d represents the number of data owners. Respectively, EG/EGT,EP represent the exponential operation in G/GT and pairing operation.For convenience, as shown in Table3, we divide the encryption stage into two parts: DO encryption and CS/Fog/EN encryption. In the DO encryption stage, DO has completed all encryption operations in schemes [31, 35]. Thus, the amount of calculation is larger than that of other schemes. In schemes [29, 36] and our scheme, part of the encryption work has been outsourced from a third party, so the calculation load of DOs is relatively low. In our scheme, edge computing is introduced; the amount of calculation at the DO end is d+1EG+EP, and the calculation amount at the EN end is 2EG. Similarly, the decryption phase is divided into two parts: CS/Fog/EN decryption and the user decryption. In these schemes, although the user decryption computation is one EP operation, the outsourcing decryption computation is evidently different. The amount of computation required by EN to predecrypt the ciphertext is 3EP in our scheme, whereas the amounts of computation in scheme [29, 36] are 2lEP and 3lEP, respectively. In schemes [31, 36], the decryption is completed by the user. Therefore, the overall encryption/decryption computation of our scheme is relatively low.Table 3
Computational cost.
Encryption on DOEncryption on CS/Fog/ENDecryption on CS/Fog/ENDecryption on DUTokenSearch[29]2l+1EG+EP2lEG2n+1EPEP——[31]2d+2n+2EG+2EP———ns2n+1EGEG+2n+1EP[35]2l+5EG+EP———nsn+7EG6EP[36]2lEG+l+1EP3lEG2n+4EPEP——Oursd+1EG+EP2EG3EPEPns+3EG4EPIn the search stage, the amount of token calculation in schemes [31, 35] increases linearly with the increase in the number of attributes and only realizes a single keyword search. If these schemes perform multiple keyword searches, then the calculation amount is also related to the number of keywords. However, in our scheme, the token generation is only related to the number of keywords, and multiple keyword search is implemented. In particular, the search work in our scheme is carried out by EN, and the amount of calculation is 4EP, which is smaller than those in schemes [31, 35].The theoretical analysis indicates that the calculation amount of our scheme is relatively low in the data user side (DO and user) and the outsourcing end.


### 7.2. Experimental Simulation

To further evaluate the performance of our scheme, we conducted a series of simulation experiments. Experiments are implemented on a platform Windows 10 with 2.70 GHz Intel (R) Core I i5-7200u CPU, 8 GB RAM by using paring-based cryptography (PBC) [37] with a large prime of 512 bits.Figure4shows the computational cost of encryption on DO side, as well as the outsourcing encryption and decryption. The experimental simulation diagram is no longer provided here given that the decryption cost of the user is the same. Figure 4(a) shows that the computational cost in schemes [29, 31, 35, 36] increases linearly with the number of attributes, whereas our scheme is independent of the number of attributes, which means that the time cost remains constant and is lower than that in other schemes. Figures 4(b) and 4(c) introduce the comparison of computational cost in outsourcing encryption and outsourcing decryption, respectively. The computational cost of outsourcing encryption and decryption time in schemes [29, 36] continues to increase linearly with the increase in the number of attributes, whereas the computational cost of our scheme is almost unchanged as the number of attributes increases. Schemes [29, 36] use cloud servers and fog nodes for outsourcing, respectively, whereas edge nodes are used to undertake the outsourcing work in our scheme. Therefore, the encryption and decryption computation of our scheme is lower.Figure 4
Time costs of DO encryption/outsourcing encryption/decryption phase. (a) DO enc. (b) Fog/CS/EN enc. (c) Fog/CS/EN dec.
(a)(b)(c)Figure5(a) shows the time cost of token generation, and Figure 5(b) shows the search time. When the token is generated, the number of attributes is fixed to 5, and only the number of keywords changes. Figure 5(a) shows that the token generation time of our scheme is evidently lower than that in other schemes [31, 35]. Although the search time is constant in our scheme and scheme [35], the time cost in our scheme is lower. The time in scheme [31] increases with the number of attributes.Figure 5
Time costs of token generation/search phase. (a) Token. (b) Search.
(a)(b)In conclusion, the experimental results are consistent with the theoretical analysis, and our scheme has better performance.


## 7.1. Theoretical Analysis

### 7.1.1. Function Comparison

Table1 shows the comparison between our scheme and related schemes [29, 31, 34–36] in terms of the number of data owners, policy updates, without key escrow, computing outsourcing, and searchability. Our scheme realizes multikeyword search; schemes [31, 35] only support single keyword search, whereas schemes [29, 34, 36] do not provide a search function. Our scheme and scheme [31] realize the multidata owner authorization management of shared files, but scheme [31] does not discuss access policy updating. Our scheme avoids the problem of key escrow, as well as scheme [34]. However, other schemes fail to solve this problem. In terms of computing outsourcing, our scheme introduces edge computing, so most encryption and decryption works are outsourced to edge nodes, whereas the data owners and users only perform few calculations. In scheme [35], only the decryption is outsourced to the cloud, and the encryption calculation is still performed by the data owner. However, other schemes do not consider outsourcing calculations. Therefore, our scheme is functional.Table 1
Function comparison.
Multiple data ownersPolicy updateWithout key escrowSearchableComputing outsourcing[29]×√××Encryption/decryption[31]√××Single keyword×[34]××√××[35]×××Single keywordDecryption[36]×√××Encryption/decryptionOurs√√√Multiple keywordEncryption/decryption


### 7.1.2. The Storage Cost

In this subsection, a storage cost comparison between our scheme and related schemes [29, 31, 35, 36] is presented in terms of the public key, transformation key, DO side ciphertext, cloud/fog/edge side ciphertext, side ciphertext, and token storage size, as shown in Table 2. The public key, transformation key, DO side ciphertext, and cloud/fog/edge side ciphertext occupy less storage space in our scheme. In terms of token storage, our scheme is independent of the number of attributes and related to the number of keywords, whereas the token storage in schemes [31, 35] increases linearly with the increase in the number of attributes. By contrast, our scheme has less storage overhead.Table 2
Storage cost.
PKTPKCT on DOCT on CS/Fog/ENToken[29]2UG+GTn+2G2l+1G+GT+2Zp∗lG—[31]2+UG+GT—2d+2n+2G+2GT—2n+1G+Zp∗[35]4G+GT—4+lG+GT—n+6G+Zp∗[36]2UG+GTn+1G2lG+l+1GT+3lZp∗3lG—Ours2UG+GT2G1+dG+GT2Gns+3G


### 7.1.3. The Computational Cost

The computational overhead mainly involves bilinear pairing and modular exponential operations. LetU represent the number of system attributes, G/GT represents the size of the element in the G/GT, n indicates the number of the user attributes. ns represents the number of keywords used in token generation, l represents the number of attributes in the access policy, and d represents the number of data owners. Respectively, EG/EGT,EP represent the exponential operation in G/GT and pairing operation.For convenience, as shown in Table3, we divide the encryption stage into two parts: DO encryption and CS/Fog/EN encryption. In the DO encryption stage, DO has completed all encryption operations in schemes [31, 35]. Thus, the amount of calculation is larger than that of other schemes. In schemes [29, 36] and our scheme, part of the encryption work has been outsourced from a third party, so the calculation load of DOs is relatively low. In our scheme, edge computing is introduced; the amount of calculation at the DO end is d+1EG+EP, and the calculation amount at the EN end is 2EG. Similarly, the decryption phase is divided into two parts: CS/Fog/EN decryption and the user decryption. In these schemes, although the user decryption computation is one EP operation, the outsourcing decryption computation is evidently different. The amount of computation required by EN to predecrypt the ciphertext is 3EP in our scheme, whereas the amounts of computation in scheme [29, 36] are 2lEP and 3lEP, respectively. In schemes [31, 36], the decryption is completed by the user. Therefore, the overall encryption/decryption computation of our scheme is relatively low.Table 3
Computational cost.
Encryption on DOEncryption on CS/Fog/ENDecryption on CS/Fog/ENDecryption on DUTokenSearch[29]2l+1EG+EP2lEG2n+1EPEP——[31]2d+2n+2EG+2EP———ns2n+1EGEG+2n+1EP[35]2l+5EG+EP———nsn+7EG6EP[36]2lEG+l+1EP3lEG2n+4EPEP——Oursd+1EG+EP2EG3EPEPns+3EG4EPIn the search stage, the amount of token calculation in schemes [31, 35] increases linearly with the increase in the number of attributes and only realizes a single keyword search. If these schemes perform multiple keyword searches, then the calculation amount is also related to the number of keywords. However, in our scheme, the token generation is only related to the number of keywords, and multiple keyword search is implemented. In particular, the search work in our scheme is carried out by EN, and the amount of calculation is 4EP, which is smaller than those in schemes [31, 35].The theoretical analysis indicates that the calculation amount of our scheme is relatively low in the data user side (DO and user) and the outsourcing end.


## 7.1.1. Function Comparison

Table1 shows the comparison between our scheme and related schemes [29, 31, 34–36] in terms of the number of data owners, policy updates, without key escrow, computing outsourcing, and searchability. Our scheme realizes multikeyword search; schemes [31, 35] only support single keyword search, whereas schemes [29, 34, 36] do not provide a search function. Our scheme and scheme [31] realize the multidata owner authorization management of shared files, but scheme [31] does not discuss access policy updating. Our scheme avoids the problem of key escrow, as well as scheme [34]. However, other schemes fail to solve this problem. In terms of computing outsourcing, our scheme introduces edge computing, so most encryption and decryption works are outsourced to edge nodes, whereas the data owners and users only perform few calculations. In scheme [35], only the decryption is outsourced to the cloud, and the encryption calculation is still performed by the data owner. However, other schemes do not consider outsourcing calculations. Therefore, our scheme is functional.Table 1
Function comparison.
Multiple data ownersPolicy updateWithout key escrowSearchableComputing outsourcing[29]×√××Encryption/decryption[31]√××Single keyword×[34]××√××[35]×××Single keywordDecryption[36]×√××Encryption/decryptionOurs√√√Multiple keywordEncryption/decryption


## 7.1.2. The Storage Cost

In this subsection, a storage cost comparison between our scheme and related schemes [29, 31, 35, 36] is presented in terms of the public key, transformation key, DO side ciphertext, cloud/fog/edge side ciphertext, side ciphertext, and token storage size, as shown in Table 2. The public key, transformation key, DO side ciphertext, and cloud/fog/edge side ciphertext occupy less storage space in our scheme. In terms of token storage, our scheme is independent of the number of attributes and related to the number of keywords, whereas the token storage in schemes [31, 35] increases linearly with the increase in the number of attributes. By contrast, our scheme has less storage overhead.Table 2
Storage cost.
PKTPKCT on DOCT on CS/Fog/ENToken[29]2UG+GTn+2G2l+1G+GT+2Zp∗lG—[31]2+UG+GT—2d+2n+2G+2GT—2n+1G+Zp∗[35]4G+GT—4+lG+GT—n+6G+Zp∗[36]2UG+GTn+1G2lG+l+1GT+3lZp∗3lG—Ours2UG+GT2G1+dG+GT2Gns+3G


## 7.1.3. The Computational Cost

The computational overhead mainly involves bilinear pairing and modular exponential operations. LetU represent the number of system attributes, G/GT represents the size of the element in the G/GT, n indicates the number of the user attributes. ns represents the number of keywords used in token generation, l represents the number of attributes in the access policy, and d represents the number of data owners. Respectively, EG/EGT,EP represent the exponential operation in G/GT and pairing operation.For convenience, as shown in Table3, we divide the encryption stage into two parts: DO encryption and CS/Fog/EN encryption. In the DO encryption stage, DO has completed all encryption operations in schemes [31, 35]. Thus, the amount of calculation is larger than that of other schemes. In schemes [29, 36] and our scheme, part of the encryption work has been outsourced from a third party, so the calculation load of DOs is relatively low. In our scheme, edge computing is introduced; the amount of calculation at the DO end is d+1EG+EP, and the calculation amount at the EN end is 2EG. Similarly, the decryption phase is divided into two parts: CS/Fog/EN decryption and the user decryption. In these schemes, although the user decryption computation is one EP operation, the outsourcing decryption computation is evidently different. The amount of computation required by EN to predecrypt the ciphertext is 3EP in our scheme, whereas the amounts of computation in scheme [29, 36] are 2lEP and 3lEP, respectively. In schemes [31, 36], the decryption is completed by the user. Therefore, the overall encryption/decryption computation of our scheme is relatively low.Table 3
Computational cost.
Encryption on DOEncryption on CS/Fog/ENDecryption on CS/Fog/ENDecryption on DUTokenSearch[29]2l+1EG+EP2lEG2n+1EPEP——[31]2d+2n+2EG+2EP———ns2n+1EGEG+2n+1EP[35]2l+5EG+EP———nsn+7EG6EP[36]2lEG+l+1EP3lEG2n+4EPEP——Oursd+1EG+EP2EG3EPEPns+3EG4EPIn the search stage, the amount of token calculation in schemes [31, 35] increases linearly with the increase in the number of attributes and only realizes a single keyword search. If these schemes perform multiple keyword searches, then the calculation amount is also related to the number of keywords. However, in our scheme, the token generation is only related to the number of keywords, and multiple keyword search is implemented. In particular, the search work in our scheme is carried out by EN, and the amount of calculation is 4EP, which is smaller than those in schemes [31, 35].The theoretical analysis indicates that the calculation amount of our scheme is relatively low in the data user side (DO and user) and the outsourcing end.


## 7.2. Experimental Simulation

To further evaluate the performance of our scheme, we conducted a series of simulation experiments. Experiments are implemented on a platform Windows 10 with 2.70 GHz Intel (R) Core I i5-7200u CPU, 8 GB RAM by using paring-based cryptography (PBC) [37] with a large prime of 512 bits.Figure4shows the computational cost of encryption on DO side, as well as the outsourcing encryption and decryption. The experimental simulation diagram is no longer provided here given that the decryption cost of the user is the same. Figure 4(a) shows that the computational cost in schemes [29, 31, 35, 36] increases linearly with the number of attributes, whereas our scheme is independent of the number of attributes, which means that the time cost remains constant and is lower than that in other schemes. Figures 4(b) and 4(c) introduce the comparison of computational cost in outsourcing encryption and outsourcing decryption, respectively. The computational cost of outsourcing encryption and decryption time in schemes [29, 36] continues to increase linearly with the increase in the number of attributes, whereas the computational cost of our scheme is almost unchanged as the number of attributes increases. Schemes [29, 36] use cloud servers and fog nodes for outsourcing, respectively, whereas edge nodes are used to undertake the outsourcing work in our scheme. Therefore, the encryption and decryption computation of our scheme is lower.Figure 4
Time costs of DO encryption/outsourcing encryption/decryption phase. (a) DO enc. (b) Fog/CS/EN enc. (c) Fog/CS/EN dec.
(a)(b)(c)Figure5(a) shows the time cost of token generation, and Figure 5(b) shows the search time. When the token is generated, the number of attributes is fixed to 5, and only the number of keywords changes. Figure 5(a) shows that the token generation time of our scheme is evidently lower than that in other schemes [31, 35]. Although the search time is constant in our scheme and scheme [35], the time cost in our scheme is lower. The time in scheme [31] increases with the number of attributes.Figure 5
Time costs of token generation/search phase. (a) Token. (b) Search.
(a)(b)In conclusion, the experimental results are consistent with the theoretical analysis, and our scheme has better performance.


## 8. Conclusion

In the article, we present an ABKS scheme with multidata owner supporting policy updates. On the one hand, when encrypting shared messages, m-DOs adopt two-level access control, which realizes not only access control for multiple users through users’ attribute sets and identities, but also the joint authorization management of multiple data owners, thereby improving the security of shared messages. On the contrary, based on the characteristics of low latency and low bandwidth operation, our scheme introduces edge computing. The edge node replaces the cloud server to complete the search task. As a result, the cloud cannot obtain keywords and other sensitive information, and the delay caused by data transmission is reduced. When the access policy needs to be updated, m-DOs only send the updated access policy to EN, whereas index updating is undertaken by EN, greatly saving calculation and communication costs of DOs. We also outsourced some encryption and decryption calculations to edge nodes to reduce the computational burden of data owners and users. Theoretical analysis and experimental simulation show that the scheme is effective and practical in the edge computing environment.As a part of our future work, we will continue to consider the hidden access policy to ensure the integrity and confidentiality of shared data and realize the secure storage of resources.



---

*Source: 1701874-2023-01-06.xml*