# An Efficient Revocable Identity-Based Encryption with Equality Test Scheme for the Wireless Body Area Network

Authors: Tung-Tso Tsai; Han-Yu Lin; Hsiao-Chieh Chang
Journal: Journal of Sensors
 (2022)

---

## Abstract

With the rapid development and popularization of cloud computing, people are willing to upload their own data to the cloud to enjoy the services. However, some personal and private data are not suitable for uploading directly to the cloud. Therefore, these data must be encrypted before uploading to the cloud to ensure the confidentiality. To achieve the confidentiality of data and enjoy cloud services, a notion of identity-based encryption with equality test (IBEET) was proposed. Using IBEET, two ciphertexts encrypted under different public keys can be tested to confirm whether they contain the same plaintext. The equality test can be applied to the wireless body area network system in which the cloud can utilize ciphertexts from patients and medical institutions to perform equality tests to determine whether which patient’s status is abnormal. Indeed, revoking illegal or expired users on any cryptosystem is an important issue. To the best of our knowledge, there is little research on the design mechanism of user revocation in the IBEET. In this paper, we propose a novel notion of revocable identity-based encryption with an equality test, called RIBEET. Based on the notion, we present the first RIBEET scheme. Meanwhile, the proposed scheme will be proven to be secure under the bilinear Diffie-Hellman (BDH) assumption.


---

## Body

## 1. Introduction

With the rapid development and popularization of cloud computing, people are willing to upload their own data to the cloud to enjoy the services. However, some personal and private data are not suitable for uploading directly to the cloud. To ensure the confidentiality of data, several encryption mechanisms [1–4] have been applied to cloud computing. Identity-based encryption (IBE) [5] is one of the encryption mechanisms of public key systems. The system of an IBE contains two roles: the private key generator (PKG) and users (including senders and receivers). Each user utilizes his own identity (e.g., e-mail address, name, or social security number) to register with the PKG to obtain a private key. Senders can regard the identity of the receiver as a public key to encrypt private data. After receiving the encrypted message (ciphertext), the receiver can decrypt it with her/his own private key.To achieve the confidentiality of data and enjoy cloud services, the first identity-based encryption with equality test (IBEET) was proposed by Ma [6]. Using IBEET, two ciphertexts encrypted under different public keys can be tested to confirm whether they contain the same plaintext. Ma [6] also gave an application of IBEET used to classify encrypted e-mails. Each encrypted e-mail can be attached with a tag for classification, while the tag can be encrypted under different public keys in the IBEET system. An e-mail server in the cloud can test the equality of any two encrypted tags to classify encrypted e-mails. Subsequently, many studies on IBEET have been published in the literature [7–11].The equality test can be applied to the wireless body area network (WBAN) system [12–17] in which the cloud can utilize ciphertexts from patients and medical institutions to perform equality tests to determine whether the patient’s status is abnormal. Figure 1 shows the architecture of WBANs. A patient is equipped with wearable sensors to collect her/his health record data from sensors of electroencephalogram (EEG), electrocardiogram (ECG), blood pressure, pulse oximeter, insulin pump, electromyogram (EMG), and motion. These health record data are encrypted through the mobile device and uploaded to the cloud server. On the other hand, the medical institution also uploads the patient’s encrypted health data to the cloud server. The ciphertexts can be tested for equality without knowing the health data of the patient by the cloud server. If the patient’s health data are different from the medical institution’s health data, it means that the patient’s health data are abnormal.Figure 1
The architecture of WBAN.Indeed, revoking illegal or expired users on any cryptosystem is an important issue. In the traditional public key cryptosystem (PKC), public key infrastructures (PKI) must be established to manage each user’s certificate which links the user’s identity and public key. In addition, the certificate revocation list [18] is also included in the PKI to revoke illegal or expired users. In identity-based public key cryptosystems (ID-PKC), the first IBE was presented by Boneh and Franklin [5] in which a user can be revoked by the PKG, who sends new private keys for all nonrevoked users at each period, if the user did not receive the new private key. So far, many literatures related to revocable IBE [19–26] have been published. To the best of our knowledge, there is little research on design mechanism of user revocation in the IBEET. In this paper, we propose a novel notion of revocable identity-based encryption with equality test, called RIBEET. Based on the notion, we present the first RIBEET scheme. Meanwhile, the scheme will be proven to be secure under the bilinear Diffie-Hellman (BDH) assumption.


### 1.1. Related Work

In the era of advanced network communication, cloud computing is an indispensable part. The terminal devices on the user side usually do not have high-performance computing power. However, users can entrust large computing tasks to the cloud. Then, the cloud will return the corresponding results to users after finishing the tasks. Indeed, the cloud can assist each user in performing tasks that require a lot of computation, but it also means that the cloud can know each user’s data if the data is not encrypted. Typically, users will encrypt data to the cloud if the data is sensitive or private. In addition, encrypted data also needs to be quickly retrieved from the cloud. To achieve this function, several schemes [3, 4, 27, 28] related to public key encryption with a keyword search were proposed. Although these schemes can retrieve encrypted data, only data encrypted under the same public key can be retrieved.To support searchable encrypted data under different public keys, Yang et al. [29] proposed a comparison mechanism of two ciphertexts encrypted under different public keys in the traditional public key cryptosystem, called public key encryption with equality test (PKEET). However, the traditional public key cryptosystem must rely on the public key infrastructure to manage each user’s certificate which links the user’s identity and her/his public key. To avoid the use of public key infrastructure and certificates, Shamir [30] introduced a new concept of ID-PKC in which a user’s public key is her/his identity such as name, e-mail, or telephone number. In this way, certificates will no longer be needed in the ID-PKC since the public key is meaningful and can represent the user’s identity. Combining the concepts of PKEET and ID-PKC, Ma [6] proposed the first identity-based encryption with equality test, called IBEET. To consider more types of authorizations, Li et al. [31] proposed the IBEET scheme with four types of authorizations. Unfortunately, the proposed scheme of Li et al. [31] is not suitable for the IoT environment because the performance of the scheme is not good. Immediately, Elhabob et al. [10] proposed another IBEET scheme with four types of authorizations which has higher performance.For the issue of user revocation in the ID-PKC, Boneh and Franklin [5] suggested that the new private keys should be resent to users who have not been revoked at different periods. As a result, secure channels will be established to send these private keys, and the PKG’s workload will also increase. To reduce the PKG’s workload, Boldyreva et al. [19] hired a binary tree to propose an IBE scheme with user revocation, named revocable IBE (RIBE). However, Boldyreva et al.’s scheme [19] only satisfied the selective-ID security. Later, Libert and Vergnaud [20] proposed another RIBE scheme which meets the adaptive-ID security. A mechanism for revoking users through public channels was proposed by Tseng and Tsai [21], in which each user’s full private key is divided into two parts: a fixed key and a time updated key. The fixed key is delivered to the user through secure channels only once, while the time updated key is delivered to the user through public channels at different periods. Users can be revoked if they do not receive the new time updated keys. For the security of decryption key exposure, Seo and Emura [22] proposed a new RIBE scheme to enhance the security. To reduce the length of public parameters and meet the security of decryption key exposure resistance, Watanabe et al. [23] presented another RIBE scheme. In addition, several lattice-based RIBE schemes [24–26] were proposed to resist quantum attacks.


### 1.2. Motivation

As mentioned earlier, revoking illegal or expired users on any cryptosystem is still an important issue. In the traditional PKC, the PKEET [29] can hire the certificate revocation list [18] to revoke illegal or expired users. However, the IBE [5] cannot effectively revoke illegal or expired users in the ID-PKC, so the RIBE [21] was proposed. To the best of our knowledge, there is little research on the design mechanism of user revocation in the IBEET [6]. Table 1 shows the comparisons between the PKEET [29], the IBE [5], the RIBE [21], the IBEET [6], and our RIBEET in terms of public key setting, avoiding the use of certificates, supporting the equality test of ciphertexts, and providing user revocation. Hence, we attempt to propose the first revocable identity-based encryption with equality test, called RIBEET.Table 1
Comparisons between the existing schemes and our RIBEET scheme.
SchemesPublic key settingAvoiding the use of certificatesSupporting equality test of ciphertextsProviding user revocationPKEET [29]PKI-basedNoYesYesIBE [5]ID-basedYesNoNoRIBE [21]ID-basedYesNoYesIBEET [6]ID-basedYesYesNoOur RIBEETID-basedYesYesYes


### 1.3. Contribution and Organization

Although the existing RIBE schemes [21–26] provide a mechanism to revoke users, they do not extend to support the equality test for ciphertexts. On the other hand, the existing IBEET schemes [6, 10, 31] do not support to revoke users. To the best of our knowledge, there is little research on the design mechanism of user revocation in the IBEET. In this paper, we propose a novel notion of revocable identity-based encryption with equality test, called RIBEET. In the following, we list specific contributions.
(i)
Based on the existing syntax and security notions of IBEET, we consider the property of user revocation to define a new syntax and security notions of RIBEET(ii)
Following the syntax of RIBEET, a concrete RIBEET scheme is proposed(iii)
In the security notions of RIBEET, the proposed scheme is proven to be secure under the bilinear Diffie-Hellman (BDH) assumption(iv)
We compare the proposed scheme with the previous RIBE scheme and IBEET scheme. We demonstrate that the proposed scheme not only provides user revocation but also supports the equality test for ciphertextsThe rest of the article includes six sections. Preliminaries are given in Section2. Section 3 presents the syntax and security notions of RIBEET. A concrete RIBEET scheme is proposed in Section 4. The security analysis of the RIBEET scheme is shown in Section 5. We compare the RIBEET scheme with other existing schemes in Section 6. The last section gives the conclusion.


## 1.1. Related Work

In the era of advanced network communication, cloud computing is an indispensable part. The terminal devices on the user side usually do not have high-performance computing power. However, users can entrust large computing tasks to the cloud. Then, the cloud will return the corresponding results to users after finishing the tasks. Indeed, the cloud can assist each user in performing tasks that require a lot of computation, but it also means that the cloud can know each user’s data if the data is not encrypted. Typically, users will encrypt data to the cloud if the data is sensitive or private. In addition, encrypted data also needs to be quickly retrieved from the cloud. To achieve this function, several schemes [3, 4, 27, 28] related to public key encryption with a keyword search were proposed. Although these schemes can retrieve encrypted data, only data encrypted under the same public key can be retrieved.To support searchable encrypted data under different public keys, Yang et al. [29] proposed a comparison mechanism of two ciphertexts encrypted under different public keys in the traditional public key cryptosystem, called public key encryption with equality test (PKEET). However, the traditional public key cryptosystem must rely on the public key infrastructure to manage each user’s certificate which links the user’s identity and her/his public key. To avoid the use of public key infrastructure and certificates, Shamir [30] introduced a new concept of ID-PKC in which a user’s public key is her/his identity such as name, e-mail, or telephone number. In this way, certificates will no longer be needed in the ID-PKC since the public key is meaningful and can represent the user’s identity. Combining the concepts of PKEET and ID-PKC, Ma [6] proposed the first identity-based encryption with equality test, called IBEET. To consider more types of authorizations, Li et al. [31] proposed the IBEET scheme with four types of authorizations. Unfortunately, the proposed scheme of Li et al. [31] is not suitable for the IoT environment because the performance of the scheme is not good. Immediately, Elhabob et al. [10] proposed another IBEET scheme with four types of authorizations which has higher performance.For the issue of user revocation in the ID-PKC, Boneh and Franklin [5] suggested that the new private keys should be resent to users who have not been revoked at different periods. As a result, secure channels will be established to send these private keys, and the PKG’s workload will also increase. To reduce the PKG’s workload, Boldyreva et al. [19] hired a binary tree to propose an IBE scheme with user revocation, named revocable IBE (RIBE). However, Boldyreva et al.’s scheme [19] only satisfied the selective-ID security. Later, Libert and Vergnaud [20] proposed another RIBE scheme which meets the adaptive-ID security. A mechanism for revoking users through public channels was proposed by Tseng and Tsai [21], in which each user’s full private key is divided into two parts: a fixed key and a time updated key. The fixed key is delivered to the user through secure channels only once, while the time updated key is delivered to the user through public channels at different periods. Users can be revoked if they do not receive the new time updated keys. For the security of decryption key exposure, Seo and Emura [22] proposed a new RIBE scheme to enhance the security. To reduce the length of public parameters and meet the security of decryption key exposure resistance, Watanabe et al. [23] presented another RIBE scheme. In addition, several lattice-based RIBE schemes [24–26] were proposed to resist quantum attacks.


## 1.2. Motivation

As mentioned earlier, revoking illegal or expired users on any cryptosystem is still an important issue. In the traditional PKC, the PKEET [29] can hire the certificate revocation list [18] to revoke illegal or expired users. However, the IBE [5] cannot effectively revoke illegal or expired users in the ID-PKC, so the RIBE [21] was proposed. To the best of our knowledge, there is little research on the design mechanism of user revocation in the IBEET [6]. Table 1 shows the comparisons between the PKEET [29], the IBE [5], the RIBE [21], the IBEET [6], and our RIBEET in terms of public key setting, avoiding the use of certificates, supporting the equality test of ciphertexts, and providing user revocation. Hence, we attempt to propose the first revocable identity-based encryption with equality test, called RIBEET.Table 1
Comparisons between the existing schemes and our RIBEET scheme.
SchemesPublic key settingAvoiding the use of certificatesSupporting equality test of ciphertextsProviding user revocationPKEET [29]PKI-basedNoYesYesIBE [5]ID-basedYesNoNoRIBE [21]ID-basedYesNoYesIBEET [6]ID-basedYesYesNoOur RIBEETID-basedYesYesYes


## 1.3. Contribution and Organization

Although the existing RIBE schemes [21–26] provide a mechanism to revoke users, they do not extend to support the equality test for ciphertexts. On the other hand, the existing IBEET schemes [6, 10, 31] do not support to revoke users. To the best of our knowledge, there is little research on the design mechanism of user revocation in the IBEET. In this paper, we propose a novel notion of revocable identity-based encryption with equality test, called RIBEET. In the following, we list specific contributions.
(i)
Based on the existing syntax and security notions of IBEET, we consider the property of user revocation to define a new syntax and security notions of RIBEET(ii)
Following the syntax of RIBEET, a concrete RIBEET scheme is proposed(iii)
In the security notions of RIBEET, the proposed scheme is proven to be secure under the bilinear Diffie-Hellman (BDH) assumption(iv)
We compare the proposed scheme with the previous RIBE scheme and IBEET scheme. We demonstrate that the proposed scheme not only provides user revocation but also supports the equality test for ciphertextsThe rest of the article includes six sections. Preliminaries are given in Section2. Section 3 presents the syntax and security notions of RIBEET. A concrete RIBEET scheme is proposed in Section 4. The security analysis of the RIBEET scheme is shown in Section 5. We compare the RIBEET scheme with other existing schemes in Section 6. The last section gives the conclusion.


## 2. Preliminaries

In this section, we introduce two definitions related to a mathematical tool and security assumption. We hire the bilinear pairings [5] as a mathematical tool to construct our RIBEET scheme. To prove the security of the proposed scheme, we consider the bilinear Diffie-Hellman (BDH) problem and then give a BDH assumption [6]. The definition of the bilinear pairings is given as follows.Definition 1.
LetG1, G2, and GT be three multiplicative cyclic groups of a prime order q. Assume that a mapping e^:G1×G2⟶GT is an asymmetric bilinear map. Then, the map e^ satisfies the following properties.
(1)
Bilinearity:e^g1a,g2b=e^g1,g2ab for g1∈G1, g2∈G2, and a,b∈Zq∗(2)
Nondegeneracy:e^g1,g2≠1 for some g1∈G1 and g2∈G2(3)
Computability:e^g1,g2 can be efficiently computed for g1∈G1,g2∈G2For the asymmetric bilinear map, the BDH problem is to computee^g1,g2abc by given a tuple q,G1,G2,GT,e^,g1,g1a,g1c,g2,g2a,g2b. We define the BDH assumption as follows.Definition 2.
On inputting a tupleq,G1,G2,GT,e^,g1,g1a,g1c,g2,g2a,g2b, we say that the BDH problem holds if no algorithm A has nonnegligible advantage in computing e^g1,g2abc. The advantage can be denoted as PrAg1,g1a,g1c,g2,g2a,g2b=e^g1,g2abc<ε.


## 3. Syntax and Security Notions

### 3.1. Syntax of RIBEET

Based on the syntax of IBEET schemes [6], we employ the revocation technique [21] to present a new syntax of RIBEET depicted in Figure 2 which consists of three roles and seven algorithms, namely Setup, InitialKey, TimeKey, Encryption, Decryption, Trapdoor, and Test. The first role is the private key generator (PKG) who is responsible for executing the first three algorithms, and the second role is the users who can, respectively, utilize Encryption, Decryption, and Trapdoor algorithms for encryption, decryption, and authorization. The last role is the cloud server (CS) who runs the Test algorithm to compare the two ciphertexts. For the user revocation, we use Figure 3 to illustrate how users are revoked by the PKG. If the PKG stops sending the time key to a user, it means that the user has been revoked since both initial key and time key are required to execute Decryption and Trapdoor algorithms. Here, we arrange some notations used in these algorithms in Table 2. The algorithms of RIBEET are described in detail as follows.
(i)
Setup: this algorithm is performed by the PKG who takes a security parameterk and a time period t as input to produce the public system parameters PSP, the system life time SLT, and the master private key mpk(ii)
InitialKey: this algorithm is performed by the PKG who takes the public system parameterPSP, the master private key mpk, and a user’s identity ID∈0,1∗ as input to produce user initial key IKID(iii)
TimeKey: this algorithm is performed by the PKG who takes the public system parameterPSP, the master private key mpk, a user’s identity ID∈0,1∗, and a period T∈SLT as input to produce user time key TKID(iv)
Encryption: this algorithm is performed by a user (sender) who takes the public system parameterPSP, a user’s identity ID∈0,1∗, a period T∈SLT, and a message M∈0,1λ as input to produce a ciphertext CT(v)
Decryption: this algorithm is performed by a user (receiver) who takes the public system parameterPSP, the receiver’s initial key IKID, the receiver’s time key TKID, and the ciphertext CT as input to produce the message M(vi)
Trapdoor: this algorithm is performed by a user who takes her/his initial keyIKID and time key TKID as input to produce the trapdoor TDID(vii)
Test: this algorithm is performed by the CS who takes the public system parametersPSP and two ciphertext-trapdoor pairs CTζ,TDζ and CTη,TDη from any two users Uζ and Uη as input to produce 1 or 0Figure 2
The syntax of RIBEET.Figure 3
The procedure for user revocation.Table 2
Notations.
NotationsMeaningPSPThe public system parametersSLTThe system life timempkThe master private keyIDThe user’s identityIKIDThe user initial keyTKIDThe user time keyMThe messageCTThe ciphertextTDIDThe trapdoorCTζ,TDζThe ciphertext-trapdoor pair of the userUζCTη,TDηThe ciphertext-trapdoor pair of the userUη


### 3.2. Security Notions of RIBEET

In this section, we define the security notions of RIBEET which includes four types of adversaries. Two of these types are the same as the security notions of IBEET [6]. Considering the revoked users from RIBEET, we need to add two types of adversaries in the security notions. These four types of adversaries are presented as follows.
(1)
Type I adversary: such an adversary can obtain all information (including time keyTKID) transmitted through public channels. The adversary can be regarded as an outside attacker(2)
Type II adversary: such an adversary owns her/his initial keyIKID, but he does not have the current time key TKID. The adversary can be regarded as a revoked user(3)
Type III adversary: this adversary is identical to the type I adversary, except that she/he possesses the trapdoorTD(4)
Type IV adversary: this adversary is identical to the type II adversary, except that she/he possesses the trapdoorTDFollowing the security notions of IBEET [6], we consider revoked users to define the new security notions of RIBEET. Definitions 3 and 4, respectively, are given to state IND-ID-CCA and OW-ID-CCA security of an RIBEET scheme.Definition 3 (IND-ID-CCA).
LetA be a type I or type II adversary for an RIBEET scheme and B be a challenger in the following game. The scheme is IND-ID-CCA secure if the advantage that A wins the game is negligible.
(1)
Setup. The challengerB takes a security parameter k and a time period t as input to produce the public system parameters PSP, the system life time SLT, and the master private key mpk. The public system parameters PSP and the system life time SLT are sent to the adversary A(2)
Phase 1. Several queries below can be issued by the adversaryA(a)
InitialKeyqueryID: given an identity ID, the challenger B generates an initial key IKID as the response by running the InitialKey algorithm of the RIBEET scheme(b)
TimeKeyqueryID,T: given an identity ID and a period T, the challenger B generates a time key TKID as the response by running the TimeKey algorithm of the RIBEET scheme(c)
DecryptionqueryID,T,CT: given an identity ID, a period T, and a ciphertext CT, the challenger B generates the resulting message M as the response by running the Decryption of the RIBEET scheme(d)
TrapdoorqueryID,T: given an identity ID and a period T, the challenger B generates a trapdoor TDID as the response by running the Trapdoor of the RIBEET scheme(3)
Challenge. Two messagesM0∗, M1∗, an identity ID∗, and a period T∗ are submitted by the adversary A. The challenger B chooses Mb∗ from these two messages, where b∈0,1 is a random coin. The challenger B then generates a ciphertext CT∗ as the challenge one by running the Encryption of the RIBEET scheme with ID∗,T∗,Mb∗. Here, the following restrictions must be satisfied
(i)
The adversaryA cannot issue the Trapdoor query with ID∗(ii)
The adversaryA cannot issue the InitialKey query with ID∗ if it is the type I adversary(iii)
The adversaryA cannot issue the TimeKey query with ID∗,T∗ if it is the type II adversary(4)
Phase 2. Under the above restrictions,A can execute the same tasks as in phase 1(5)
Guess. The adversaryA outputs a guess b′∈0,1 and wins the game if b′=b. The advantage that A wins the game can be denoted as AdvAk=Prb′=b−1/2Definition 4 (OW-ID-CCA).
LetA be a type III or type IV adversary for an RIBEET scheme and B be a challenger in the following game. The scheme is OW-ID-CCA secure if the advantage that A wins the game is negligible.
(1)
Setup. The challengerB takes a security parameter k and a time period t as input to produce the public system parameters PSP, the system life time SLT, and the master private key mpk. The public system parameters PSP and the system life time SLT are sent to the adversary A(2)
Phase 1. Several queries below can be issued by the adversaryA(a)
InitialKeyqueryID: given an identity ID, the challenger B generates an initial key IKID as the response by running the InitialKey algorithm of the RIBEET scheme(b)
TimeKeyqueryID,T: given an identity ID and a period T, the challenger B generates a time key TKID as the response by running the TimeKey algorithm of the RIBEET scheme(c)
DecryptionqueryID,T,CT: given an identity ID, a period T, and a ciphertext CT, the challenger B generates the resulting message M as the response by running the Decryption of the RIBEET scheme(d)
TrapdoorqueryID,T: given an identity ID and a period T, the challenger B generates a trapdoor TDID as the response by running the Trapdoor of the RIBEET scheme(3)
Challenge. An identityID∗ and a period T∗ are submitted by the adversary A. The challenger B randomly chooses M∗ and then generates a ciphertext CT∗ as the challenge one by running the Encryption of the RIBEET scheme with ID∗,T∗,M∗. Here, the following restrictions must be satisfied(a)
The adversaryA cannot issue the InitialKey query with ID∗ if it is the type III adversary(b)
The adversaryA cannot issue the TimeKey query with ID∗,T∗ if it is the type IV adversary(4)
Phase 2. Under the above restrictions,A can execute the same tasks as in phase 1(5)
Guess. The adversaryA outputs a guess M′ and wins the game if M∗=M′. The advantage that A wins the game can be denoted as AdvAk=PrM∗=M′.


## 3.1. Syntax of RIBEET

Based on the syntax of IBEET schemes [6], we employ the revocation technique [21] to present a new syntax of RIBEET depicted in Figure 2 which consists of three roles and seven algorithms, namely Setup, InitialKey, TimeKey, Encryption, Decryption, Trapdoor, and Test. The first role is the private key generator (PKG) who is responsible for executing the first three algorithms, and the second role is the users who can, respectively, utilize Encryption, Decryption, and Trapdoor algorithms for encryption, decryption, and authorization. The last role is the cloud server (CS) who runs the Test algorithm to compare the two ciphertexts. For the user revocation, we use Figure 3 to illustrate how users are revoked by the PKG. If the PKG stops sending the time key to a user, it means that the user has been revoked since both initial key and time key are required to execute Decryption and Trapdoor algorithms. Here, we arrange some notations used in these algorithms in Table 2. The algorithms of RIBEET are described in detail as follows.
(i)
Setup: this algorithm is performed by the PKG who takes a security parameterk and a time period t as input to produce the public system parameters PSP, the system life time SLT, and the master private key mpk(ii)
InitialKey: this algorithm is performed by the PKG who takes the public system parameterPSP, the master private key mpk, and a user’s identity ID∈0,1∗ as input to produce user initial key IKID(iii)
TimeKey: this algorithm is performed by the PKG who takes the public system parameterPSP, the master private key mpk, a user’s identity ID∈0,1∗, and a period T∈SLT as input to produce user time key TKID(iv)
Encryption: this algorithm is performed by a user (sender) who takes the public system parameterPSP, a user’s identity ID∈0,1∗, a period T∈SLT, and a message M∈0,1λ as input to produce a ciphertext CT(v)
Decryption: this algorithm is performed by a user (receiver) who takes the public system parameterPSP, the receiver’s initial key IKID, the receiver’s time key TKID, and the ciphertext CT as input to produce the message M(vi)
Trapdoor: this algorithm is performed by a user who takes her/his initial keyIKID and time key TKID as input to produce the trapdoor TDID(vii)
Test: this algorithm is performed by the CS who takes the public system parametersPSP and two ciphertext-trapdoor pairs CTζ,TDζ and CTη,TDη from any two users Uζ and Uη as input to produce 1 or 0Figure 2
The syntax of RIBEET.Figure 3
The procedure for user revocation.Table 2
Notations.
NotationsMeaningPSPThe public system parametersSLTThe system life timempkThe master private keyIDThe user’s identityIKIDThe user initial keyTKIDThe user time keyMThe messageCTThe ciphertextTDIDThe trapdoorCTζ,TDζThe ciphertext-trapdoor pair of the userUζCTη,TDηThe ciphertext-trapdoor pair of the userUη


## 3.2. Security Notions of RIBEET

In this section, we define the security notions of RIBEET which includes four types of adversaries. Two of these types are the same as the security notions of IBEET [6]. Considering the revoked users from RIBEET, we need to add two types of adversaries in the security notions. These four types of adversaries are presented as follows.
(1)
Type I adversary: such an adversary can obtain all information (including time keyTKID) transmitted through public channels. The adversary can be regarded as an outside attacker(2)
Type II adversary: such an adversary owns her/his initial keyIKID, but he does not have the current time key TKID. The adversary can be regarded as a revoked user(3)
Type III adversary: this adversary is identical to the type I adversary, except that she/he possesses the trapdoorTD(4)
Type IV adversary: this adversary is identical to the type II adversary, except that she/he possesses the trapdoorTDFollowing the security notions of IBEET [6], we consider revoked users to define the new security notions of RIBEET. Definitions 3 and 4, respectively, are given to state IND-ID-CCA and OW-ID-CCA security of an RIBEET scheme.Definition 3 (IND-ID-CCA).
LetA be a type I or type II adversary for an RIBEET scheme and B be a challenger in the following game. The scheme is IND-ID-CCA secure if the advantage that A wins the game is negligible.
(1)
Setup. The challengerB takes a security parameter k and a time period t as input to produce the public system parameters PSP, the system life time SLT, and the master private key mpk. The public system parameters PSP and the system life time SLT are sent to the adversary A(2)
Phase 1. Several queries below can be issued by the adversaryA(a)
InitialKeyqueryID: given an identity ID, the challenger B generates an initial key IKID as the response by running the InitialKey algorithm of the RIBEET scheme(b)
TimeKeyqueryID,T: given an identity ID and a period T, the challenger B generates a time key TKID as the response by running the TimeKey algorithm of the RIBEET scheme(c)
DecryptionqueryID,T,CT: given an identity ID, a period T, and a ciphertext CT, the challenger B generates the resulting message M as the response by running the Decryption of the RIBEET scheme(d)
TrapdoorqueryID,T: given an identity ID and a period T, the challenger B generates a trapdoor TDID as the response by running the Trapdoor of the RIBEET scheme(3)
Challenge. Two messagesM0∗, M1∗, an identity ID∗, and a period T∗ are submitted by the adversary A. The challenger B chooses Mb∗ from these two messages, where b∈0,1 is a random coin. The challenger B then generates a ciphertext CT∗ as the challenge one by running the Encryption of the RIBEET scheme with ID∗,T∗,Mb∗. Here, the following restrictions must be satisfied
(i)
The adversaryA cannot issue the Trapdoor query with ID∗(ii)
The adversaryA cannot issue the InitialKey query with ID∗ if it is the type I adversary(iii)
The adversaryA cannot issue the TimeKey query with ID∗,T∗ if it is the type II adversary(4)
Phase 2. Under the above restrictions,A can execute the same tasks as in phase 1(5)
Guess. The adversaryA outputs a guess b′∈0,1 and wins the game if b′=b. The advantage that A wins the game can be denoted as AdvAk=Prb′=b−1/2Definition 4 (OW-ID-CCA).
LetA be a type III or type IV adversary for an RIBEET scheme and B be a challenger in the following game. The scheme is OW-ID-CCA secure if the advantage that A wins the game is negligible.
(1)
Setup. The challengerB takes a security parameter k and a time period t as input to produce the public system parameters PSP, the system life time SLT, and the master private key mpk. The public system parameters PSP and the system life time SLT are sent to the adversary A(2)
Phase 1. Several queries below can be issued by the adversaryA(a)
InitialKeyqueryID: given an identity ID, the challenger B generates an initial key IKID as the response by running the InitialKey algorithm of the RIBEET scheme(b)
TimeKeyqueryID,T: given an identity ID and a period T, the challenger B generates a time key TKID as the response by running the TimeKey algorithm of the RIBEET scheme(c)
DecryptionqueryID,T,CT: given an identity ID, a period T, and a ciphertext CT, the challenger B generates the resulting message M as the response by running the Decryption of the RIBEET scheme(d)
TrapdoorqueryID,T: given an identity ID and a period T, the challenger B generates a trapdoor TDID as the response by running the Trapdoor of the RIBEET scheme(3)
Challenge. An identityID∗ and a period T∗ are submitted by the adversary A. The challenger B randomly chooses M∗ and then generates a ciphertext CT∗ as the challenge one by running the Encryption of the RIBEET scheme with ID∗,T∗,M∗. Here, the following restrictions must be satisfied(a)
The adversaryA cannot issue the InitialKey query with ID∗ if it is the type III adversary(b)
The adversaryA cannot issue the TimeKey query with ID∗,T∗ if it is the type IV adversary(4)
Phase 2. Under the above restrictions,A can execute the same tasks as in phase 1(5)
Guess. The adversaryA outputs a guess M′ and wins the game if M∗=M′. The advantage that A wins the game can be denoted as AdvAk=PrM∗=M′.


## 4. Concrete RIBEET Scheme

A revocable identity-based encryption with equality test scheme, which we denote by RIBEET, consists of algorithms Setup, InitialKey, TimeKey, Encryption, Decryption, Trapdoor, and Test. Each of the algorithms is described as follows.(1)
Setup: this algorithm is performed by the PKG who takes a security parameterk and a time period t as input to produce an asymmetric bilinear map e^:G1×G2⟶GT and a system life time SLT=T0,T1,⋯,Tt, where G1, G2, and GT are multiplicative cyclic groups of prime order q. The PKG first chooses two arbitrary generators g1∈G1 and g2∈G2 and picks eight cryptographic one-way hash functions H1:0,1∗⟶G2, H2:0,1∗⟶G2, H3:0,1∗⟶G2, H4:0,1∗⟶G2, H5:GT×G1×G1⟶0,1λ+l, H6:0,1λ⟶G2, H7:0,1λ+l⟶Zq∗, and H8:GT⟶G2, where λ and l are fixed lengths. Then, a random value s∈Zq∗ is chosen, and Ppub=g1s is computed. The public system parameters are PSP=q,G1,G2,GT,e^,g1,g2,Ppub,H1,H2,H3,H4,H5,H6,H7,H8, the system life time is SLT=T0,T1,⋯,Tt, and the master private key is mpk=s(2)
InitialKey: this algorithm is performed by the PKG who takes the public system parameterPSP, the master private key mpk, and a user’s identity ID∈0,1∗ as input to produce user initial key
(1)IKID=IKID1,IKID2=H1IDmpk,H2IDmpk=H1IDs,H2IDs.Here, the procedure of this algorithm is depicted in Figure4.
(3)
TimeKey: this algorithm is performed by the PKG who takes the public system parameterPSP, the master private key mpk, a user’s identity ID∈0,1∗, and a period T∈SLT as input to produce user time key
(2)TKID=TKID1,TKID2=H3ID,Tmpk,H4ID,Tmpk=H3ID,Ts,H4ID,Ts.Figure 4
InitialKey procedure.Here, the procedure of this algorithm is depicted in Figure5.
(4)
Encryption: this algorithm is performed by a sender who takes the public system parameterPSP, a user’s identity ID∈0,1∗, a period T∈SLT, and a message M∈0,1λ as input to produce ciphertexts CT=CT1,CT2,CT3,CT4 which are shown as follows(a)
CT1=g1r(b)
CT2=g1u(c)
CT3=H5e^Ppub,H1ID·H3ID,Tu,CT1,CT2⊕MV(d)
CT4=H6Mr·H8e^Ppub,H2ID·H4ID,TuFigure 5
TimeKey procedure.Here,r=H7M,V and the two values V∈0,1l and u∈Zq∗ are chosen in random.
(5)
Decryption: this algorithm is performed by a receiver who takes the public system parameterPSP, the receiver’s initial key IKID=IKID1,IKID2, the receiver’s time key TKID=TKID1,TKID2, and the ciphertext CT=CT1,CT2,CT3,CT4 as input to produce the message M. The detailed process is shown as follows:(a)
ComputeCT3⊕H5e^CT2,IKID1·TKID1,CT1,CT2 to obtain M′V′(b)
Computer′=H7M′,V′(c)
Produce the messageM′ as M if CT1=g1r′ and CT4=H6Mr′·H8e^CT2,IKID2·TKID2 both holdThe correctness of obtainingM′V′ can be demonstrated as follows.
(3)CT3⊕H5e^CT2,IKID1·TKID1,CT1,CT2=H5e^Ppub,H1ID·H3ID,Tu,CT1,CT2⊕M′V′⊕H5e^CT2,IKID1·TKID1,CT1,CT2=H5e^g1s,H1ID·H3ID,Tu,CT1,CT2⊕M′V′⊕H5e^g1u,H1IDs·H3ID,Ts,CT1,CT2=H5e^g1,H1ID·H3ID,Tsu,CT1,CT2⊕M′V′⊕H5e^g1,H1ID·H3ID,Tsu,CT1,CT2=M′V′.(6)
Trapdoor: this algorithm is performed by a user who takes her/his initial keyIKID=IKID1,IKID2 and time key TKID=TKID1,TKID2 as input to produce the trapdoor TDID=IKID2·TKID2=H2IDs·H4ID,Ts(7)
Test: this algorithm is performed by the CS who takes the public system parametersPSP and two ciphertext-trapdoor pairs CTζ,TDζ and CTη,TDη, where CTζ=CTζ1,CTζ2,CTζ3,CTζ4 and CTη=CTη1,CTη2,CTη3,CTη4, from any two users Uζ and Uη as input to produce 1 or 0 according to the following steps(a)
ComputeRζ and Rη as follows:(i)
Rζ=CTζ4/H8e^CTζ2,TDζ=H6MζH7Mζ,Vζ(ii)
Rη=CTη4/H8e^CTη2,TDη=H6MηH7Mη,Vη(b)
Computee^CTζ1,Rη and e^CTη1,Rζ(i)
e^CTζ1,Rη=e^g1H7Mζ,Vζ,H6MηH7Mη,Vη=e^g1,H6MηH7Mζ,Vζ·H7Mη,Vη(ii)
e^CTη1,Rζ=e^g1H7Mη,Vη,H6MζH7Mζ,Vζ=e^g1,H6MζH7Mζ,Vζ·H7Mη,Vη(c)
Return 1 ife^CTζ1,Rη=e^CTη1,Rζ. Otherwise, return 0In the following, we present the details ofleftmargin=0em(i)
Rζ=CTζ4/H8e^CTζ2,TDζ=H6Mζrζ·H8e^Ppub,H2IDζ·H4IDζ,Tuζ/H8e^g1uζ,H2IDζs·H4IDζ,Ts=H6Mζrζ·H8e^g1s,H2IDζ·H4IDζ,Tuζ/H8e^g1uζ,H2IDζs·H4IDζ,Ts=H6Mζrζ·H8e^g1,H2IDζ·H4IDζ,Tsuζ/H8e^g1,H2IDζ·H4IDζ,Tsuζ=H6MζH7Mζ,Vζ(ii)
Rη=CTη4/H8e^CTη2,TDη=H6Mηrη·H8e^Ppub,H2IDη·H4IDη,Tuη/H8e^g1uη,H2IDηs·H4IDη,Ts=H6Mηrη·H8e^g1s,H2IDη·H4IDη,Tuη/H8e^g1uη,H2IDηs·H4IDη,Ts=H6Mηrη·H8e^g1,H2IDη·H4IDη,Tsuη/H8e^g1,H2IDη·H4IDη,Tsuη=H6MηH7Mη,Vη


## 5. Security Analysis

In this section, we give four theorems to show that the proposed scheme has the IND-ID-CCA security for type I and II adversaries and the OW-ID-CCA security for type III and IV adversaries.Theorem 5.
If the BDH assumption holds, the proposed RIBEET scheme satisfies the IND-ID-CCA security in the security game. More precisely, suppose thatA1 is a PPT type 1 adversary who has at least ε advantage to break the RIBEET scheme. Then, there exists an algorithm B to solve the BDH problem with the advantage
(4)ε′≥1qH5εeqIK+qT+1−qDq−qH8q,where qH5, qH8, qIK, qT, qD, and e, respectively, are the number of queries to random oracle H5, random oracle H8, Initialkey query, Trapdoor query, Decryption query, and Euler’s number.Proof.
An algorithmB is constructed to solve the BDH problem. The algorithm B is given a BDH tuple q,G1,G2,GT,e^,g1,g1a,g1c,g2,g2a,g2b which is defined in Section 2. The algorithm B can be seen as a challenger to find the answer of the BDH problem. The answer A=e^g1,g2abc can be found by interacting with the PPT type I adversary A1 in the following security game.
(1)
Setup: the challenger B utilizes the BDH tuple to set Ppub=g1a and then generates the public system parameters PSP=q,G1,G2,GT,e^,g1,g2,Ppub,H1,H2,H3,H4,H5,H6,H7,H8, where Hi is a random oracle for i=1,2,⋯,8. In addition, the system life time SLT=T0,T1,⋯,Tt can be generated by the challenger B. Then, B gives A1 the public system parameters PSP and system life time SLT. Here, the adversary A1 can issue queries to each random oracle as follows
(a)
H1queryID: A1 can utilize ID to obtain a response to the random oracle H1 from the challenger B. To obtain the response, B maintains a list, called ListH1 which is composed of tuples, and the format of the tuple is ID,UID,u,rb. The response is acquired from the ListH1 which is initially empty and can be updated by the following steps
(i)
B returns UID as the response if ID exists in a tuple ID,UID,u,rb from the ListH1(ii)
Otherwise,B picks a random value u∈Zq∗ and a random bit rb∈0,1 to compute(5)UID=g2u,ifrb=0,g2bu,ifrb=1,where Prrb=0=δ and Prrb=1=1−δ (which will be discussed later). Then, B adds the tuple ID,UID,u,rb to the ListH1 and returns UID to A1(b)
H2queryID: A1 can utilize ID to obtain a response to the random oracle H2 from the challenger B. To obtain the response, B maintains a list, called ListH2 which is composed of tuples, and the format of the tuple is ID,VID,v,rb. The response is acquired from the ListH2 which is initially empty and can be updated by the following steps:(a)
B returns VID as the response if ID exists in a tuple ID,VID,v,rb from the ListH2(b)
Otherwise,B picks a random value v∈Zq∗ and utilizes ID to find rb in the ListH2. Then, B computes(6)VID=g2v,ifrb=0,g2bv,ifrb=1,and adds the tuple ID,VID,v,rb to ListH2. B returns VID to A1(c)
H3queryID,T: A1 can utilize ID,T to obtain a response to the random oracle H3 from the challenger B. To obtain the response, B maintains a list, called ListH3 which is composed of tuples, and the format of the tuple is ID,T,UIDT,η. The response is acquired from the ListH3 which is initially empty and can be updated by the following steps(i)
B returns UIDT as the response if ID,T exists in a tuple ID,T,UIDT,η from the ListH3(ii)
Otherwise,B picks a random value η∈Zq∗ to compute UIDT=g2η. Then, B adds the tuple ID,T,UIDT,η to the ListH3 and returns UIDT to A1(d)
H4queryID,T: A1 can utilize ID,T to obtain a response to the random oracle H4 from the challenger B. To obtain the response, B maintains a list, called ListH4 which is composed of tuples, and the format of the tuple is ID,T,VIDT,ζ. The response is acquired from the ListH4 which is initially empty and can be updated by the following steps(i)
B returns VIDT as the response if ID,T exists in a tuple ID,T,VIDT,ζ from the ListH4(ii)
Otherwise,B picks a random value ζ∈Zq∗ to compute VIDT=g2ζ. Then, B adds the tuple ID,T,VIDT,ζ to the ListH4 and returns VIDT to A1(e)
H5queryW,CT1,CT2: A1 can utilize W,CT1,CT2 to obtain a response to the random oracle H5 from the challenger B. To obtain the response, B maintains a list, called ListH5 which is composed of tuples, and the format of the tuple is W,CT1,CT2,ω. The response is acquired from the ListH5 which is initially empty and can be updated by the following steps(i)
B returns ω as the response if W,CT1,CT2 exists in a tuple W,CT1,CT2,ω from the ListH5(ii)
Otherwise,B picks a random value ω∈0,1λ+l and adds the tuple W,CT1,CT2,ω to the ListH5. Then, B returns ω to A1(f)
H6queryM: A1 can utilize M to obtain a response to the random oracle H6 from the challenger B. To obtain the response, B maintains a list, called ListH6 which is composed of tuples, and the format of the tuple is M,Q. The response is acquired from the ListH6 which is initially empty and can be updated by the following steps(i)
B returns Q as the response if M exists in a tuple M,Q from the ListH6(ii)
Otherwise,B picks a random point Q∈G2 and adds the tuple M,Q to the ListH6. Then, B returns Q to A1(g)
H7queryM,V: A1 can utilize M,V to obtain a response to the random oracle H7 from the challenger B. To obtain the response, B maintains a list, called ListH7 which is composed of tuples, and the format of the tuple is M,V,γ. The response is acquired from the ListH7 which is initially empty and can be updated by the following steps(i)
B returns γ as the response if M,V exists in a tuple M,V,γ from the ListH7(ii)
Otherwise,B picks a random value γ∈Zq∗ and adds the tuple M,V,γ to the ListH7. Then, B returns γ to A1(h)
H8queryN: A1 can utilize N to obtain a response to the random oracle H8 from the challenger B. To obtain the response, B maintains a list, called ListH8 which is composed of tuples, and the format of the tuple is N,S. The response is acquired from the ListH8 which is initially empty and can be updated by the following steps(i)
B returns S as the response if N exists in a tuple N,S from the ListH8(ii)
Otherwise,B picks a random point S∈G2 and adds the tuple N,S to the ListH8. Then, B returns S to A1(2)
Phase 1: the adversaryA1 can, respectively, utilize ID, ID,T, ID,T,CT and ID,T to issue the InitialKeyquery, Timekeyquery, Decryptionquery, and Trapdoorquery. The response to each query can be obtained as follows(a)
InitialKey queryID: A1 utilizes ID to issue the query, while B, respectively, finds the corresponding tuples ID,UID,u,rb and ID,VID,v,rb from the ListH1 and the ListH2 according to ID. If rb=1, B interrupts this game. If rb=0, B use u and v to define IKID=IKID1,IKID2=g2au,g2av. Then B returns IKID as the user initial key to A1(b)
TimekeyqueryID,T: A1 utilizes ID,T to issue the query, while B, respectively, finds the corresponding tuples ID,T,UIDT,η and ID,T,VIDT,ζ from the ListH3 and the ListH4 according to ID,T. B use η and ζ to define TKID=TKID1,TKID2=g2aη,g2aζ. Then, B returns TKID as the user time key to A1(c)
Decryption queryID,T,CT: A1 utilizes ID,T,CT to issue the query, while B, respectively, finds the corresponding tuples ID,UID,u,rb, ID,VID,v,rb, ID,T,UIDT,η, and ID,T,VIDT,ζ from the ListH1, ListH2, ListH3, and the ListH4 according to ID and T. The response of this query is acquired from these lists by performing the following tasks(i)
Ifrb=0, B, respectively, uses ID and ID,T to run InitialKeyquery and Timekeyquery to obtain IKID and TKID. Then, B utilizes IKID, TKID, and CT to run the Decryption algorithm to produce the message M which is sent to A1(ii)
Ifrb=1, B utilizes CT1 and CT2, which are from CT=CT1,CT2,CT3,CT4, to find the corresponding tuple W,CT1,CT2,ω from the ListH5. Then, M′V′=CT3⊕ω can be computed by using CT3 and ω. Further, B utilizes M′ and V′ to find the corresponding tuples M,V,γ from the ListH7 and M,Q from the ListH6. Obviously, γ and Q can be obtained. If S can be found in the corresponding tuple N,S from the ListH8 such that CT4=Qγ·S holds, B will confirm whether CT1=g1γ holds. If CT1=g1γ, the message M′ is sent to A1(d)
Trapdoor queryID,T: A1 utilizes ID,T to issue the query, while B, respectively, uses ID and ID,T to run InitialKeyquery and Timekeyquery to obtain IKID=IKID1,IKID2 and TKID=TKID1,TKID2. Then, B utilizes IKID2 and TKID2 to produce the trapdoor TDID=IKID2·TKID2 which is sent to A1(3)
Challenge: when the phase 1 is over,A1 outputs a tuple ID∗,T∗,M0∗,M1∗ as the target of the challenge. B utilizes ID∗ to find the corresponding tuples ID,UID,u,rb from the ListH1. If rb=0, B interrupts this game. If rb=1, B randomly selects b∈0,1 and V∈0,1l to run H7query with Mb∗ and V. Then, γ can be obtained. B utilizes γ to set CT1∗=g1γ. In addition, B sets CT2∗=g1c, while a random value CT3∈0,1λ+l and a random point CT4∗∈G2 are chosen. Finally, the challenge ciphertext CT∗=CT1∗,CT2∗,CT3∗,CT4∗ is sent to A1(4)
Phase 2:A1 can issue the same query as phase 1, but it must be under the condition of ID≠ID∗ and CT≠CT∗(5)
Guess:A1 responds to B with a guess b′∈0,1. If b′≠b, B responds with failure and terminates. Otherwise, A1 wins the game. Then, B randomly selects a tuple W∗,CT1∗,CT2∗,ω∗ from the ListH5 and calculates H5e^g1,g2abcu∗·e^g1ac,g2η∗,CT1∗,CT2∗=Mρ∗V⊕CT3∗, where e^g1,g2abcu∗·e^g1ac,g2η∗=W∗. Hence, B can output the BDH solution A=W∗/e∧g1ac,g2η∗u∗−1 due to e^g1,g2abc=W∗/e∧g1ac,g2η∗u∗−1Analysis. Let us start with two cases, namely, the simulation ofHiquery for i=1,2,⋯,8 and the simulation of decryptionquery. For the H1,H2,H3,H4,H6, and H7queries, it is obvious that the simulations are perfect because there exists no relationship between the constructions of these queries and the solution of the BDH problem. For the H5 and H8queries, we consider two events EH5∗ and EH8∗ which, respectively, issues the H5query with e^g1,g2abcu∗e^g1ac,g2η∗,CT1∗,CT2∗ and the H8query with e^g1,g2abcv∗·e^g1a,g2cζ∗. We say that the simulations of H5 and H8queries are perfect if EH5∗ and EH8∗ do not happen. For the decryptionquery, we consider an event EDecErr where the challenger B cannot decrypt the ciphertext. Assume that qD is the number of decryptionquery. Then, we obtain PrEDecErr≤qD/qNext, we discuss an eventE which states that the simulation of this security game will not be interrupted. Here, we can obtain E=EH5∗∨EH8∗∨EDecErr¬EAbort, where EAbort is defined as the event that the challenger B interrupts this security game. Since B guesses b′ with the advantage ≤1/2, the Prb=b′¬E≤1/2 can be obtained if E does not occur. Further, we have
(7)Prb=b′=Prb=b′∣EPrE+Prb=b′¬EPr¬E≤PrE+12·Pr¬E=PrE+12·1−PrE=12·PrE+12.According to above inequality,ε=Prb=b′−1/2 and E=EH5∗∨EH8∗∨EDecErr¬EAbort, we have
(8)ε=Prb=b′−12≤PrE≤PrEH5∗+PrEH8∗+PrEDecErrPr¬EAbort.Moreover, we obtain(9)PrEH5∗≥ε·Pr¬EAbort−PrEDecErr−PrEH8∗.SincePr¬EAbort=δqIK+qT1−δ, we can gain Pr¬EAbort≥1/eqIK+qT+1 when δ=1−1/qIK+qT+1. Then, we have
(10)PrEH5∗≥εeqIK+qT+1−qDq−qH8q.Here, the adversaryA1 can distinguish the target ciphertext CT∗ is the real one when EH5∗ occurs. In addition, the tuple e^g1,g2abcu∗·e^g1ac,g2η∗,CT1∗,CT2∗ has been added in the ListH5. If the challenger B picks the correct tuple from the ListH5, B wins this security game. Meanwhile, the advantage of solving the BDH problem is
(11)ε′≥1qH5PrEH5∗≥1qH5εeqIK+qT+1−qDq−qH8q.Theorem 6.
If the BDH assumption holds, the proposed RIBEET scheme satisfies the IND-ID-CCA security in the security game. More precisely, suppose thatA2 is a PPT type 2 adversary who has at least ε advantage to break the RIBEET scheme. Then, there exists an algorithm B to solve the BDH problem with the advantage
(12)ε′≥1qH5εeqTK+qT+1−qDq−qH8q,where qH5, qH8, qTK, qT, qD, and e, respectively, are the number of queries to random oracle H5, random oracle H8, Timekey query, Trapdoor query, Decryption query, and Euler’s number.Proof.
An algorithmB is constructed to solve the BDH problem. The algorithm B is given a BDH tuple q,G1,G2,GT,e^,g1,g1a,g1c,g2,g2a,g2b which is defined in Section 2. The algorithm B can be seen as a challenger to find the answer of the BDH problem. The answer A=e^g1,g2abc can be found by interacting with the PPT type II adversary A2 in the following security game.
(1)
Setup: the challengerB utilizes the BDH tuple to set Ppub=g1a and then generates the public system parameters PSP=q,G1,G2,GT,e^,g1,g2,Ppub,H1,H2,H3,H4,H5,H6,H7,H8, where Hi is a random oracle for i=1,2,⋯,8. In addition, the system life time SLT=T0,T1,⋯,Tt can be generated by the challenger B. Then, B gives A2 the public system parameters PSP and system life time SLT. Here, the adversary A2 can issue queries to each random oracle as follows(a)
H1queryID: A2 can utilize ID to obtain a response to the random oracle H1 from the challenger B. To obtain the response, B maintains a list, called ListH1 which is composed of tuples, and the format of the tuple is ID,UID,u. The response is acquired from the ListH1 which is initially empty and can be updated by the following steps(i)
B returns UID as the response if ID exists in a tuple ID,UID,u from the ListH1(ii)
Otherwise,B picks a random value u∈Zq∗ to compute UID=g2u. Then, B adds the tuple ID,UID,u to the ListH1 and returns UID to A2(b)
H2queryID: A2 can utilize ID to obtain a response to the random oracle H2 from the challenger B. To obtain the response, B maintains a list, called ListH2 which is composed of tuples, and the format of the tuple is ID,VID,v. The response is acquired from the ListH2 which is initially empty and can be updated by the following steps(i)
B returns VID as the response if ID exists in a tuple ID,VID,v from the ListH2(ii)
Otherwise,B picks a random value v∈Zq∗ to compute VID=g2v. Then, B adds the tuple ID,VID,v to the ListH2 and returns VID to A2(c)
H3queryID,T: A2 can utilize ID,T to obtain a response to the random oracle H3 from the challenger B. To obtain the response, B maintains a list, called ListH3 which is composed of tuples, and the format of the tuple is ID,T,UIDT,η,rb. The response is acquired from the ListH3 which is initially empty and can be updated by the following steps(i)
B returns UIDT as the response if ID,T exists in a tuple ID,T,UIDT,η,rb from the ListH3(ii)
Otherwise,B picks a random value η∈Zq∗ and a random bit rb∈0,1 to compute
(13)UIDT=g2η,ifrb=0,g2bη,ifrb=1,where Prrb=0=δ and Prrb=1=1−δ (which will be discussed later). Then, B adds the tuple ID,T,UIDT,η,rb to the ListH3 and returns UIDT to A2(d)
H4queryID,T: A2 can utilize ID,T to obtain a response to the random oracle H4 from the challenger B. To obtain the response, B maintains a list, called ListH4 which is composed of tuples, and the format of the tuple is ID,T,VIDT,ζ,rb. The response is acquired from the ListH4 which is initially empty and can be updated by the following steps(i)
B returns VIDT as the response if ID,T exists in a tuple ID,T,VIDT,ζ,rb from the ListH4(ii)
Otherwise,B picks a random value ζ∈Zq∗ and utilizes ID,T to find rb in the ListH4. Then, B computes
(14)VIDT=g2ζ,ifrb=0,g2bζ,ifrb=1,and add the tuple ID,T,VIDT,ζ,rb to ListH4. B returns VIDT to A2(e)
H5queryW,CT1,CT2: A2 can utilize W,CT1,CT2 to obtain a response to the random oracle H5 from the challenger B. To obtain the response, B maintains a list, called ListH5 which is composed of tuples, and the format of the tuple is W,CT1,CT2,ω. The response is acquired from the ListH5 which is initially empty and can be updated by the following steps(i)
B returns ω as the response if W,CT1,CT2 exists in a tuple W,CT1,CT2,ω from the ListH5(ii)
Otherwise,B picks a random value ω∈0,1λ+l and adds the tuple W,CT1,CT2,ω to the ListH5. Then, B returns ω to A2(f)
H6queryM: A2 can utilize M to obtain a response to the random oracle H6 from the challenger B. To obtain the response, B maintains a list, called ListH6 which is composed of tuples, and the format of the tuple is M,Q. The response is acquired from the ListH6 which is initially empty and can be updated by the following steps(i)
B returns Q as the response if M exists in a tuple M,Q from the ListH6(ii)
Otherwise,B picks a random point Q∈G2 and adds the tuple M,Q to the ListH6. Then, B returns Q to A2(g)
H7queryM,V: A2 can utilize M,V to obtain a response to the random oracle H7 from the challenger B. To obtain the response, B maintains a list, called ListH7 which is composed of tuples, and the format of the tuple is M,V,γ. The response is acquired from the ListH7 which is initially empty and can be updated by the following steps(i)
B returns γ as the response if M,V exists in a tuple M,V,γ from the ListH7(ii)
Otherwise,B picks a random value γ∈Zq∗ and adds the tuple M,V,γ to the ListH7. Then, B returns γ to A2(h)
H8queryN: A2 can utilize N to obtain a response to the random oracle H8 from the challenger B. To obtain the response, B maintains a list, called ListH8 which is composed of tuples, and the format of the tuple is N,S. The response is acquired from the ListH8 which is initially empty and can be updated by the following steps(i)
B returns S as the response if N exists in a tuple N,S from the ListH8(ii)
Otherwise,B picks a random point S∈G2 and adds the tuple N,S to the ListH8. Then, B returns S to A2(2)
Phase 1: the adversaryA2 can, respectively, utilize ID, ID,T, ID,T,CT, and ID,T to issue the InitialKeyquery, Timekeyquery, Decryptionquery, and Trapdoorquery. The response to each query can be obtained as follows(a)
InitialKey queryID: A2 utilizes ID to issue the query, while B, respectively, finds the corresponding tuples ID,UID,u and ID,VID,v from the ListH1 and the ListH2 according to ID. B use u and v to define IKID=IKID1,IKID2=g2au,g2av. Then, B returns IKID as the user initial key to A1(b)
Timekey queryID,T: A2 utilizes ID,T to issue the query, while B, respectively, finds the corresponding tuples ID,T,UIDT,η,rb and ID,T,VIDT,ζ,rb from the ListH3 and the ListH4 according to ID,T. If rb=1, B interrupts this game. If rb=0, B use η and ζ to define TKID=TKID1,TKID2=g2aη,g2aζ. Then, B returns TKID as the user time key to A2(c)
Decryption queryID,T,CT: A2 utilizes ID,T,CT to issue the query, while B, respectively, finds the corresponding tuples ID,UID,u, ID,VID,v, ID,T,UIDT,η,rb, and ID,T,VIDT,ζ,rb from the ListH1, ListH2, ListH3, and ListH4 according to ID and T. The response of this query is acquired from these lists by performing the following tasks(i)
Ifrb=0, B, respectively, uses ID and ID,T to run InitialKeyquery and Timekeyquery to obtain IKID and TKID. Then, B utilizes IKID, TKID, and CT to run the Decryption algorithm to produce the message M which is sent to A2(ii)
Ifrb=1, B utilizes CT1 and CT2, which are from CT=CT1,CT2,CT3,CT4, to find the corresponding tuple W,CT1,CT2,ω from the ListH5. Then, M′V′=CT3⊕ω can be computed by using CT3 and ω. Further, B utilizes M′ and V′ to find the corresponding tuples M,V,γ from the ListH7 and M,Q from the ListH6. Obviously, γ and Q can be obtained. If S can be found in the corresponding tuple N,S from the ListH8 such that CT4=Qγ·S holds, B will confirm whether CT1=g1γ holds. If CT1=g1γ, the message M′ is sent to A2(1)
Trapdoor queryID,T: A2 utilizes ID,T to issue the query, while B, respectively, uses ID and ID,T to run InitialKeyquery and Timekeyquery to obtain IKID=IKID1,IKID2 and TKID=TKID1,TKID2. Then, B utilizes IKID2 and TKID2 to produce the trapdoor TDID=IKID2·TKID2 which is sent to A2(3)
Challenge: when phase 1 is over,A2 outputs a tuple ID∗,T∗,M0∗,M1∗ as the target of the challenge. B utilizes ID∗,T∗ to find the corresponding tuples ID,T,UIDT,η,rb from the ListH3. If rb=0, B interrupts this game. If rb=1, B randomly selects b∈0,1 and V∈0,1l to run H7query with Mb∗ and V. Then, γ can be obtained. B utilizes γ to set CT1∗=g1γ. In addition, B sets CT2∗=g1c, while a random value CT3∈0,1λ+l and a random point CT4∗∈G2 are chosen. Finally, the challenge ciphertext CT∗=CT1∗,CT2∗,CT3∗,CT4∗ is sent to A2(2)
Phase 2:A2 can issue the same query as phase 1, but it must be under the condition of ID≠ID∗ and CT≠CT∗(3)
Guess:A2 responds to B with a guess b′∈0,1. If b′≠b, B responds with failure and terminates. Otherwise, A2 wins the game. Then, B randomly selects a tuple W∗,CT1∗,CT2∗,ω∗ from the ListH5 and outputs the BDH solution A=W∗/e∧g1ac,g2u∗η∗−1 due to e^g1,g2abc=W∗/e∧g1ac,g2u∗η∗−1
The security analysis is similar to Theorem5. We obtain that B’s advantage to solve the BDH problem is ε′≥1/qH5PrEH5∗≥1/qH5ε/eqTK+qT+1−qD/q−qH8/q.Theorem 7.
If the BDH assumption holds, the proposed RIBEET scheme satisfies the OW-ID-CCA security in the security game. More precisely, suppose thatA3 is a PPT type 3 adversary who has at least ε advantage to break the RIBEET scheme. Then, there exists an algorithm B to solve the BDH problem with the advantage
(15)ε′≥1qH5ε−1/2λeqIK+1−qDq,where qH5, qIK, qD, and e, respectively, are the number of queries to random oracle H5, Initialkey query, Decryption query, and Euler’s number.Proof.
An algorithmB is constructed to solve the BDH problem. The algorithm B is given a BDH tuple q,G1,G2,GT,e^,g1,g1a,g1c,g2,g2a,g2b which is defined in Section 2. The algorithm B can be seen as a challenger to find the answer of the BDH problem. The answer A=e^g1,g2abc can be found by interacting with the PPT type III adversary A3 in the following security game.
(i)
Setup: The challengerB utilizes the BDH tuple to set Ppub=g1a, and then generates the public system parameters PSP=q,G1,G2,GT,e^,g1,g2,Ppub,H1,H2,H3,H4,H5,H6,H7,H8, where Hi is a random oracle for i=1,2,⋯,8. In addition, the system life time SLT=T0,T1,⋯,Tt can be generated by the challenger B. Then B gives A3 the public system parameters PSP and system life time SLT. Here, the adversary A3 can issue queries to each random oracle as below(a)
H1queryID: B answers A3 in the same form as the proof of Theorem 5(b)
H2queryID: A3 can utilize ID to obtain a response to the random oracle H2 from the challenger B. To obtain the response, B maintains a list, called ListH2 which is composed of tuples, and the format of the tuple is ID,VID,v,rb. The response is acquired from the ListH2 which is initially empty and can be updated by the following steps(i)
B returns VID as the response if ID exists in a tuple ID,VID,v,rb from the ListH2(ii)
Otherwise,B picks a random value v∈Zq∗ and utilizes ID to find rb in the ListH2. Then B computes VID=g2v and adds the tuple ID,VID,v,rb to ListH2. B returns VID to A3(c)
H3−H8queries: B answers A3 in the same form as the proof of Theorem 5(ii)
Phase 1: The adversary A3 can, respectively, utilize ID, ID,T, ID,T,CT and ID,T to issue the InitialKeyquery, Timekeyquery, Decryptionquery and Trapdoorquery. The response to each query can be obtained as follows(1)
InitialKey queryID: B answers A3 in the same form as the proof of Theorem 5(2)
Timekey queryID,T: B answers A3 in the same form as the proof of Theorem 5(3)
Decryption queryID,T,CT: A3 utilizes ID,T,CT to issue the query, while B, respectively, finds the corresponding tuples ID,UID,u,rb, ID,VID,v,rb, ID,T,UIDT,η and ID,T,VIDT,ζ from the ListH1, ListH2, ListH3 and the ListH4 according to ID and T. The response of this query is acquired from these lists by performing the following tasks(i)
Ifrb=0, B, respectively, uses ID and ID,T to run InitialKeyquery and Timekeyquery to obtain IKID and TKID. Then B utilizes IKID, TKID and CT to run Decryption algorithm to produce the message M which is sent to A3(ii)
Ifrb=1, B utilizes CT1 and CT2, which are from CT=CT1,CT2,CT3,CT4, to find the corresponding tuple W,CT1,CT2,ω from the ListH5. Then M′V′=CT3⊕ω can be computed by using CT3 and ω. Further, B utilizes M′ and V′ to find the corresponding tuples M,V,γ from the ListH7 and M,Q from the ListH6. Obviously, γ and Q can be obtained. After that, B utilizes ID and ID,T to run InitialKeyquery and Timekeyquery to obtain IKID2 and TKID2 and computes IKID2·TKID2=g2av+ζ. If S can be found in the corresponding tuple e^CT2,g2av+ζ,S from the ListH8 such that CT4=Qγ·S holds, B will confirm whether CT1=g1γ holds. If CT1=g1γ, the message M′ is sent to A3(d)
Trapdoor queryID,T: A3 utilizes ID,T to issue the query, while B, respectively, uses ID and ID,T to run InitialKeyquery and Timekeyquery to obtain IKID=IKID1,IKID2 and TKID=TKID1,TKID2. Then B utilizes IKID2 and TKID2 to produce the trapdoor TDID=IKID2·TKID2 which is sent to A3(e)
Challenge: When the phase 1 is over, A3 outputs a tuple ID∗,T∗,M∗ as the target of the challenge. B utilizes ID∗ to find the corresponding tuples ID,UID,u,rb from the ListH1 If rb=0, B interrupts this game. If rb=1, B randomly selects V∈0,1l to run H7query with M∗ and V. Then γ can be obtained. B utilizes γ to set CT1∗=g1γ and find H6queryM∗γ and H8querye^CT2∗,g2av∗+ζ∗ to get Q and S such that CT4∗=Qγ·S. In addition, B sets CT2∗=g1c, while a random value CT3∈0,1λ+l is chosen. Finally, the challenge ciphertext CT∗=CT1∗,CT2∗,CT3∗,CT4∗ is sent to A3(f)
Phase 2: A3 can issue the same query as the phase 1, but it must be under the condition of ID≠ID∗ and CT≠CT∗(g)
Guess: A3 responds to B with a guess M′∈0,1λ. If M′≠M, B responds with failure and terminates. Otherwise, A3 wins the game. Then B randomly selects a tuple W∗,CT1∗,CT2∗,ω∗ from the ListH5, and outputs the BDH solution A = W∗/e∧g1ac,g2η∗u∗−1 due to e^g1,g2abc=W∗/e∧g1ac,g2η∗u∗−1
The security analysis is similar to Theorem5. We obtain that B’s advantage to solve the BDH problem is ε′≥1/qH5PrEH5∗≥1/qH5ε−1/2λ/eqIK+1−qD/q.Theorem 8.
If the BDH assumption holds, the proposed RIBEET scheme satisfies the OW-ID-CCA security in the security game. More precisely, suppose thatA4 is a PPT type 4 adversary who has at least ε advantage to break the RIBEET scheme. Then, there exists an algorithm B to solve the BDH problem with the advantage.
(16)ε′≥1qH5ε−1/2λeqTK+1−qDq,where qH5, qTK, qD, and e, respectively, are the number of queries to random oracle H5, Timekey query, Decryption query, and Euler’s number.Proof.
An algorithmB is constructed to solve the BDH problem. The algorithm B is given a BDH tuple q,G1,G2,GT,e^,g1,g1a,g1c,g2,g2a,g2b which is defined in Section 2. The algorithm B can be seen as a challenger to find the answer of the BDH problem. The answer A=e^g1,g2abc can be found by interacting with the PPT type IV adversary A4 in the following security game.
(i)
Setup: The challenger B utilizes the BDH tuple to set Ppub=g1a, and then generates the public system parameters PSP=q,G1,G2,GT,e^,g1,g2,Ppub,H1,H2,H3,H4,H5,H6,H7,H8, where Hi is a random oracle for i=1,2,⋯,8. In addition, the system life time SLT=T0,T1,⋯,Tt can be generated by the challenger B. Then B gives A4 the public system parameters PSP and system life time SLT. Here, the adversary A4 can issue queries to each random oracle as below(a)
H1−H3queries: B answers A4 in the same form as the proof of Theorem 6(b)
H4−H8queries: B answers A4 in the same form as the proof of Theorem 5(ii)
Phase 1: The adversaryA4 can, respectively, utilize ID, ID,T, ID,T,CT and ID,T to issue the InitialKeyquery, Timekeyquery, Decryptionquery and Trapdoorquery. The response to each query can be obtained as follows(a)
InitialKey queryID: B answers A4 in the same form as the proof of Theorem 6(b)
Timekey queryID,T: B answers A4 in the same form as the proof of Theorem 6(c)
Decryption queryID,T,CT: B answers A4 in the same form as the proof of Theorem 7(d)
Trapdoor queryID,T: B answers A4 in the same form as the proof of Theorem 7(1)
Challenge: When the phase 1 is over, A4 outputs a tuple ID∗,T∗,M∗ as the target of the challenge. B utilizes ID∗,T∗ to find the corresponding tuples ID,T,UIDT,η,rb from the ListH3 If rb=0, B interrupts this game. If rb=1, B randomly selects V∈0,1l to run H7query with M∗ and V. Then γ can be obtained. B utilizes γ to set CT1∗=g1γ and find H6queryM∗γ and H8querye^CT2∗,g2av∗+ζ∗ to get Q and S such that CT4∗=Qγ·S. In addition, B sets CT2∗=g1c, while a random value CT3∈0,1λ+l is chosen. Finally, the challenge ciphertext CT∗=CT1∗,CT2∗,CT3∗,CT4∗ is sent to A4(2)
Phase 2: A4 can issue the same query as the phase 1, but it must be under the condition of ID≠ID∗ and CT≠CT∗(3)
Guess: A4 responds to B with a guess M′∈0,1λ. If M′≠M, B responds with failure and terminates. Otherwise, A4 wins the game. Then B randomly selects a tuple W∗,CT1∗,CT2∗,ω∗ from the ListH5, and outputs the BDH solution A = W∗/e∧g1ac,g2u∗η∗−1 due to e^g1,g2abc=W∗/e∧g1ac,g2u∗η∗−1
The security analysis is similar to Theorem5. We obtain that B’s advantage to solve the BDH problem is ε′≥1/qH5PrEH5∗≥1/qH5ε−1/2λ/eqTK+1−qD/q.Theorem 9.
The proposed RIBEET scheme is secure for brute force attacks if the discrete logarithm problem is hard.Proof.
As mentioned in the concrete RIBEET scheme, the public system parameters arePSP = {q, G1, G2, GT, e^, g1, g2, Ppub, H1, H2, H3, H4, H5, H6, H7, H8}, the system life time is SLT = {T0, T1,⋯, Tt} and the master private key is mpk = s. Based on the discrete logarithm problem, we ensure that the adversary cannot recover the master private key mpk = s form Ppub = g1s. In addition, the security of the user initial key IKID and user time key TKID is also based on the discrete logarithm problem due to IKID = (IKID1, IKID2) = (H1IDmpk, H2IDmpk) = (H1IDs, H2IDs) and TKID = (TKID1,TKID2) = (H3ID,Tmpk, H4ID,Tmpk) = (H3ID,Ts, H4ID,Ts). Hence, the proposed RIBEET scheme can resist brute force attacks.


## 6. Comparison

In this section, we compare the proposed RIBEET scheme with the previous RIBE scheme [21] and IBEET scheme [6]. In order to analyze the cost of performing encryption, decryption and equality test, we first define two notations as follows.
(1)
Pair: time to perform a bilinear pairing e^:G1×G2⟶GT(2)
Exp: time to perform an exponentiation in G1, G2 or GTWe gainPair=7.8351 ms and Exp=0.4746 ms from the literature [32]. These two execution times are obtained under the hardware device with Intel Core i7-8550U 1.80 GHz processor. Meanwhile, the prime number q selected in the cryptosystem setting phase is 256-bit. In addition, three multiplicative cyclic groups G1, G2, and GT of the prime order q are chosen in the simulation.In Table3, we list the comparisons of our proposed RIBEET scheme with the RIBE scheme [21] and several IBEET schemes [6, 10, 11] in terms of the cost of performing encryption, decryption and equality test, and two properties related to user revocation and equality test of ciphertexts. For the cost of performing encryption and decryption, Tseng and Tsai’s RIBE scheme [21] has better performance than the other two schemes. However, Tseng and Tsai’s RIBE scheme does not support equality test of ciphertexts. Although the existing IBEET schemes [6, 10, 11] and our proposed RIBEET scheme support equality test of ciphertexts, the IBEET schemes does not have a mechanism to revoke users. Conversely, our proposed RIBEET scheme not only provides user revocation, but also retains the cost of encryption, decryption and equality test with the existing IBEET schemes. Additionally, Table 4 compares our RIBEET scheme with the RIBE scheme [21] and several IBEET schemes [6, 10, 11] in terms of PK, CT, and TD which are, respectively, denoted as the bit length of user public key, ciphertext and trapdoor. We observed that the communication cost of our RIBEET scheme is similar to that of other schemes.Table 3
Comparisons of the proposed RIBEET with the existing RIBE and several IBEET.
SchemesThe cost of performing encryptionThe cost of performing decryptionThe cost of performing equality testSupporting equality test of ciphertextsProviding user revocationRIBE [21]1·Pair+2·Exp1·Pair—NoYes(8.7843 ms)(7.8351 ms)IBEET [6]2·Pair+6·Exp2·Pair+2·Exp4·PairYesNo(18.5178 ms)(16.6194 ms)(31.3404 ms)IBEET [10]2·Pair+4·Exp2·Pair+1·Exp2·Pair+2·ExpYesNo(17.5686 ms)(16.1448 ms)(16.6194 ms)IBEET [11]2·Pair+9·Exp2·Pair+2·Exp2·Pair+2·ExpYesNo(19.9416 ms)(16.6194 ms)(16.6194 ms)Our RIBEET2·Pair+5·Exp2·Pair+2·Exp4·PairYesYes(18.0432 ms)(16.6194 ms)(31.3404 ms)Table 4
Comparison of communication cost.
SchemesPKCTTDRIBE [21]2G1G1+Zq—IBEET [6]G14G1+ZqG1IBEET [10]G12G1+2ZqG1IBEET [11]G1+Zq3G1+Zq4G1Our RIBEET2G23G1+ZqG2As mentioned in Section1, the data collected from sensors on the patients is finally encrypted by the mobile device and then transmitted to the cloud. For the analysis of energy cost, we employ the “ampere” app to measure the voltage and current on the mobile device. After running this app, we obtain 14.28 V and 2856 mA on the mobile device. Table 5 lists the energy cost of performing encryption on the mobile device by using the formula W=U·I·t, where W, U, I, and t, respectively, are watt, voltage, current, and time.Table 5
Comparison of energy cost.
Energy costRIBE [21]IBEET [6]IBEET [10]IBEET [11]Our RIBEETPerforming encryption358.256μJ755.224μJ716.508μJ813.292μJ735.868μJ


## 7. Conclusions

We considered the existing syntax of IBEET and the property of user revocation to present the new syntax of RIBEET. Under the new syntax, we proposed a concrete RIBEET scheme. Meanwhile, we demonstrated that the proposed scheme has the IND-ID-CCA security for type I and II adversaries and the OW-ID-CCA security for type III and IV adversaries. We compared the proposed scheme with the previous RIBE scheme and IBEET scheme. We showed that the proposed scheme not only supports equality test for ciphertexts but also provides user revocation.



---

*Source: 1628344-2022-08-13.xml*