# A Lightweight Attribute-Based Security Scheme for Fog-Enabled Cyber Physical Systems

Authors: Aisha Kanwal Junejo; Nikos Komninos
Journal: Wireless Communications and Mobile Computing
 (2020)

---

## Abstract

In this paper, a lightweight attribute-based security scheme based on elliptic curve cryptography (ECC) is proposed for fog-enabled cyber physical systems (Fog-CPS). A novel aspect of the proposed scheme is that the communication between Fog-CPS entities is secure even when the certification authority (CA) is compromised. This is achieved by dividing the attributes into two sets, namely, secret and shared, and subsequently generating two key pairs, referred to as the partial and final key pairs, for each entity of the Fog-CPS system. Unlike existing attribute-based encryption (ABE) and identity-based encryption schemes, in the proposed scheme, each entity calculates the final public key of the communicating CPS devices without the need of generating and transmitting digital certificates. Moreover, the proposed security scheme considers an efficient and secure key pair update approach in which the calculation overhead is limited to one group element. To show the effectiveness of the proposed scheme, we have calculated and compared the memory and processing complexity with other bilinear and elliptic curve schemes. We have also implemented our scheme in a Raspberry Pi (3B+ model) for CPS simulations. The proposed scheme guarantees the confidentiality, integrity, privacy, and authenticity in Fog-CPS systems.


---

## Body

## 1. Introduction

Fog computing can improve the monitoring and management of next-generation cyber physical systems (CPS). A general fog-enabled cyber physical system (Fog-CPS) as shown in Figure1 consists of three layers, namely, the CPS device, fog, and cloud. Fog-CPS systems are vulnerable to numerous security, privacy, and trust challenges. With regard to security, different attacks, namely, interception, interruption, modification, fabrication, unauthorized authentication, and access, can be carried out to disrupt the communication between Fog-CPS entities. The abovementioned challenges could be addressed by employing lightweight cryptographic techniques. However, the existing solutions have a number of limitations. Firstly, in public key encryption (PKE) schemes, the generation, verification, and distribution of certificates incur extra computation and communication overhead which is not desirable for resource-limited CPS devices. Secondly, in attribute-based encryption (ABE) schemes, there is a certification authority (CA) which generates the secret keys based on a set of attributes. However, the compromise of CA can endanger the secret keys and therefore the secrecy of encrypted messages. Thirdly, the existing ABE schemes which are based on bilinear pairing require large security parameters and therefore are not suitable for resource-constrained CPS devices.Figure 1
Fog-enabled cyber physical systems (Fog-CPS).Considering the limitations of existing solutions, in this paper, a lightweight security scheme is proposed. The proposed scheme guarantees that the communication between entities is secure in cases where the CA might be compromised.


### 1.1. Motivation

The motivation for designing such a solution comes from the identity-based encryption (IBE) and ABE schemes as it is believed that inherent attributes of CPS devices can be used for identification, authentication, and access control. From here onwards, the proposed scheme is called as Fog-CPS.Moreover, in the proposed scheme, the CA (i.e., FA in this case) cannot decrypt the messages exchanged among CPS devices, thus maintaining their privacy. This is achieved by dividing the attribute setA into two subsets, a secret AS and a shared AK attribute subset. Precisely, each entity in a Fog-CPS system will have two key pairs, namely, a “partial key pair” and a “final key pair” generated from secret AS and shared AK attribute sets, respectively. The secret AS attributes are only known to FA which registers the entities and generates the partial key pair. The registration of CPS entities with FA ensures that published public keys are authentic and do not require any further verification.However, as the secretAS attributes are only known to FA; the other collaborating CPS devices cannot verify them. To address this problem, a notion of “shared” AK attributes is introduced. The shared AK attributes are known to collaborating Fog-CPS entities which generate the final public and secret keys. The encryption and decryption would take place using final public and secret keys. Such an approach is advantageous for two reasons: (1) the secret AS attributes are only shared with the FA and the leakage of partial secret keys would not risk the communication of collaborating entities and (2) the scheme is scalable because the final public keys are generated by the collaborating devices themselves without the aid of FA. Any device can generate the final public keys of other devices.Furthermore, upon key update, the key regeneration process is lightweight, since the key generation process as found in Algorithms1–3 is not repeated.Algorithm 1: Partial key pair generation.
1:Input: Security parameter λ, secret attribute set AS.2:Output:PKAS/SKASPKAS=G,Pi,H1,∀i=0,1,⋯,t.SKAS=s.3: Choose elliptic curve groupG, where P is a base point on the elliptic curve Epa,b defined over the finite field Zp.4: Choose a one-way collision resistance hash function,H1 defined as:H1:0,1∗→Zp∗.5: Create a secret random numberr∈Zp.6: Mapt<n attributes in secret set As to Zp using hash function H1 and compute secret number s.si=H1imodp,∀i∈AS,1s´=∑i=1tsi,2s=rs´.37: Next, compute public key componentsPi as:Pi=siP,∀i=0,1,..⋯,t.4Algorithm 2: Final public key generation.
1:Input: Public Key PKAS and shared attribute set AK.2:Output:PKAK=Ui,∀i=0,1,⋯,t.3: LetAK=a1a2⋯.at be the device attribute string over shared attribute set.4: Mapt<n attributes in shared set AK to Zp using hash function H1 and compute k.ki=H1imodp,∀i∈AK,5k=∑i=1tki.65: Next, compute final public key componentsUi,∀i=0,1,⋯,t as:Ui=kiPi.7Algorithm 3: Final secret key generation.
1:Input: Secret key SKAS and shared attribute set AK.2:Output:SKAK=u1.3: Compute secret numberα as follows:α=sk,8wheres is the secret key component from SKAS and k is computed similar to Equation (6) in Algorithm 2.4: Next, compute Equation (9),fα,AK which is a t-degree at most polynomial in Zpx.fα,AK=∏i=1tα+H1i1−ai.95: Pick two random numbersru,tu∈ZP. Compute su such that the following condition holds.1/fα,AK=su−rutumodp,su=1/fα,AK+rutu.106: Next, compute secret key componentu1u1=su−rutumodp.11


### 1.2. Contributions

The contributions of this paper are enumerated below:(1)
First, a lightweight attribute-based security scheme is proposed for Fog-CPS systems(2)
Second, the Fog-CPS scheme considers an efficient and secure key pair update approach in which the calculation overhead is limited to one group element(3)
Third, the proposed scheme is compared with other schemes based on bilinear pairing and elliptic curves by calculating its memory and processing overhead(4)
Fourth, the proposed scheme is implemented on a resource-limited Raspberry Pi (3B+ model) for CPS simulations.The remaining parts of this paper are organized as follows: the related work is discussed in Section2. The proposed scheme is presented in Section 3. Next, the experimental results are presented in Section 4. The conclusion and future work are discussed in Section 5.


## 1.1. Motivation

The motivation for designing such a solution comes from the identity-based encryption (IBE) and ABE schemes as it is believed that inherent attributes of CPS devices can be used for identification, authentication, and access control. From here onwards, the proposed scheme is called as Fog-CPS.Moreover, in the proposed scheme, the CA (i.e., FA in this case) cannot decrypt the messages exchanged among CPS devices, thus maintaining their privacy. This is achieved by dividing the attribute setA into two subsets, a secret AS and a shared AK attribute subset. Precisely, each entity in a Fog-CPS system will have two key pairs, namely, a “partial key pair” and a “final key pair” generated from secret AS and shared AK attribute sets, respectively. The secret AS attributes are only known to FA which registers the entities and generates the partial key pair. The registration of CPS entities with FA ensures that published public keys are authentic and do not require any further verification.However, as the secretAS attributes are only known to FA; the other collaborating CPS devices cannot verify them. To address this problem, a notion of “shared” AK attributes is introduced. The shared AK attributes are known to collaborating Fog-CPS entities which generate the final public and secret keys. The encryption and decryption would take place using final public and secret keys. Such an approach is advantageous for two reasons: (1) the secret AS attributes are only shared with the FA and the leakage of partial secret keys would not risk the communication of collaborating entities and (2) the scheme is scalable because the final public keys are generated by the collaborating devices themselves without the aid of FA. Any device can generate the final public keys of other devices.Furthermore, upon key update, the key regeneration process is lightweight, since the key generation process as found in Algorithms1–3 is not repeated.Algorithm 1: Partial key pair generation.
1:Input: Security parameter λ, secret attribute set AS.2:Output:PKAS/SKASPKAS=G,Pi,H1,∀i=0,1,⋯,t.SKAS=s.3: Choose elliptic curve groupG, where P is a base point on the elliptic curve Epa,b defined over the finite field Zp.4: Choose a one-way collision resistance hash function,H1 defined as:H1:0,1∗→Zp∗.5: Create a secret random numberr∈Zp.6: Mapt<n attributes in secret set As to Zp using hash function H1 and compute secret number s.si=H1imodp,∀i∈AS,1s´=∑i=1tsi,2s=rs´.37: Next, compute public key componentsPi as:Pi=siP,∀i=0,1,..⋯,t.4Algorithm 2: Final public key generation.
1:Input: Public Key PKAS and shared attribute set AK.2:Output:PKAK=Ui,∀i=0,1,⋯,t.3: LetAK=a1a2⋯.at be the device attribute string over shared attribute set.4: Mapt<n attributes in shared set AK to Zp using hash function H1 and compute k.ki=H1imodp,∀i∈AK,5k=∑i=1tki.65: Next, compute final public key componentsUi,∀i=0,1,⋯,t as:Ui=kiPi.7Algorithm 3: Final secret key generation.
1:Input: Secret key SKAS and shared attribute set AK.2:Output:SKAK=u1.3: Compute secret numberα as follows:α=sk,8wheres is the secret key component from SKAS and k is computed similar to Equation (6) in Algorithm 2.4: Next, compute Equation (9),fα,AK which is a t-degree at most polynomial in Zpx.fα,AK=∏i=1tα+H1i1−ai.95: Pick two random numbersru,tu∈ZP. Compute su such that the following condition holds.1/fα,AK=su−rutumodp,su=1/fα,AK+rutu.106: Next, compute secret key componentu1u1=su−rutumodp.11


## 1.2. Contributions

The contributions of this paper are enumerated below:(1)
First, a lightweight attribute-based security scheme is proposed for Fog-CPS systems(2)
Second, the Fog-CPS scheme considers an efficient and secure key pair update approach in which the calculation overhead is limited to one group element(3)
Third, the proposed scheme is compared with other schemes based on bilinear pairing and elliptic curves by calculating its memory and processing overhead(4)
Fourth, the proposed scheme is implemented on a resource-limited Raspberry Pi (3B+ model) for CPS simulations.The remaining parts of this paper are organized as follows: the related work is discussed in Section2. The proposed scheme is presented in Section 3. Next, the experimental results are presented in Section 4. The conclusion and future work are discussed in Section 5.


## 2. Related Work

To secure the communication in CPS systems, the literature adopts a hybrid approach in which both symmetric (AES-based) and asymmetric (RSA-based and ABE) encryption techniques are used. AES (Advanced Encryption Standard) is used to encrypt the communication between sensor nodes and the gateway, whereas the asymmetric schemes are used to encrypt the communication between the gateway and the service provider.Recently, Mahmood et al. [1] propose an authentication scheme for a smart grid. The scheme has a few limitations: (1) the scalability in case of large-scale CPS systems with hundreds of nodes and (2) the inconsideration of access control mechanism. In a smart grid system, there are several heterogeneous devices at different layers, so including access control mechanisms is crucial. Kocabas et al. [2] present a medical cloud-assisted CPS architecture consisting of acquisition, preprocessing, cloud, and action layers. The study proposes an AES (Advanced Encryption Standard) symmetric key encryption scheme for communication between the acquisition and preprocessing layers. The main disadvantage of [2] is the key management of symmetric keys in such a complex environment with hundreds of CPS devices. Shuo et al. [3] propose a distributed authentication framework for the multidomain M2M environment. The proposed framework employs a hybrid encryption scheme involving IBE and AES symmetric encryption.Sravani et al. [4] present a signature-based authenticated key establishment scheme for IoT applications. Hu et al. [5] propose a communication architecture for Body Area Networks (BANs) and design a scheme to secure the data communication between wearable sensors and data consumers (doctors and nurses). They propose the CP-ABE and signature-based schemes to store the encrypted data at the data sink. Guo et al. [6] propose a CP-ABE scheme with constant-size decryption keys. Chen et al. [7] propose fully secure KP-ABE and CP-ABE with constant-size ciphertexts and a fully secure ABS with constant-size signatures. Odelu and Das [8] propose a lightweight and constant-size secret key ABE scheme based on ECC. However, key update/revocation and key generation are some of the limitations of the scheme in [8].A major limitation of the existing ABE schemes [5, 7, 9, 10, 11, 12] is the complexity; these schemes require large security parameters (i.e., 1024- or 2048-bit size). Besides that, in the above cited ABE schemes, CA generates and distributes the secret keys. Nonetheless, sharing of private attributes with CA can risk the privacy, since the CA can also decrypt messages and retrieve CPS system data. Moreover, the compromise of CA can also risk the secrecy of communication between the sender and receiver. Additionally, some studies propose symmetric key schemes for resource-constrained devices. However, in large-scale Fog-CPS systems, the symmetric key management process becomes very complicated and complex. Symmetric schemes require a separate protocol for session key agreement and generation. Furthermore, when the short-size data is encrypted with a symmetric key, then the information which is revealed about the key may be critical for ciphertext-only attack.Henceforth, it is believed a lightweight encryption scheme based on ECC wherein the CA only generates the partial key pair is the appropriate choice. ECC-based schemes require smaller security parameters (i.e., 128 or 256 bits) and therefore can be implemented in resource-limited CPS devices.


## 3. Proposed Fog-CPS Security Scheme

In this section, the proposed Fog-CPS scheme is presented. Table1 lists the notations used throughout the paper.Table 1
Notation table.
NotationDescriptionλSecurity parameterpA sufficiently large prime numberEpa,bAn elliptic curvey2=x3+ax+bmodp defined over the finite field Zp;Zp=0,1,⋯,p−1PA base point inEpa,bxPScalar multiplication,PϵEpa,bP+QElliptic curve point additionGElliptic curve group generated byPH1One-way collision resistance hash functionsADevice attribute setASSecret attribute setAKShared attribute setℙAccess policy,ℙ⊆AKPi,UiPublic key componentsPKAS/SKASPublic and secret key pair generated fromASPKAK/SKAKPublic and secret keys generated fromAKu1Final secret key componentsCTCiphertextZp∗Finite field overp


### 3.1. Preliminaries

In this section, the attributes, access structures, and the computational hard problems are discussed.


#### 3.1.1. Secret and Shared Attribute Sets

All CPS devices and fog nodes possess a set of attributes. LetA=AS∪AK be the attribute set of each CPS device consisting of both secret AS and shared AK attributes. As an example, a few attributes for both sets are listed in Table 2.Table 2
Attributes shared between CPS devices and fog assist node.
(a)Secret attribute set shared between Fog-CPS entities and FAA´1A´2A´3……ASDevice IDIP addressLocationMalicious activities reportedNumber of key updatesTrust(b)Shared attribute set shared between Fog-CPS entitiesA1A2A3……AKEntity IDEntity typeApplication IDApplication typeData identifierTrust


#### 3.1.2. Access Structure

The attribute string of a device is presented with ann-bit string a1a2⋯an. To further elaborate the attribute string, the example of shared attribute set AK is considered. The attribute string is defined as follows: ai=1,ifAi∈AK and ai=0,ifAi∉AK. For example, if n=5 and 4 attributes are considered for final key pair generation, then AK=A1,A2,A4,A5; the 5-bit string AK becomes 11011. Likewise, an access policy is defined by ℙ and specified with attributes in the shared attribute set AK. The access policy is also represented with n-bit string b1b2⋯bn where bi=1, for Ai∈ℙ, and bi=0, for Ai∉ℙ. If the access policy is defined on attributes A1,A2,A4, then the policy string is ℙ=11010. Additionally, the proposed scheme is based on the AND-gate access control structure. The attribute set AK fulfills the access policy ℙ, if and only if ℙ⊆A and ai≥bi, for all i=1,2,⋯,n.


#### 3.1.3. Computational Hard Problems

The security of the Fog-CPS scheme is based on the computational problems described below.(1) q-Generalized Diffie-Hellman (q-GDH) Assumption [13]. Given a1P,a2P,⋯,aqP in G and all the subset products ∏iϵSaiP∈G for any strict subset S⊂1,⋯,q, it is hard to compute a1⋯aqP∈G, where P is a base point in Epa,b;a1,a2,⋯,aq∈Zp∗. Since the number of subset products (elliptic curve scalar point multiplications) is exponential in q, access to all these subset products is provided through an oracle. For a vector a=a1,⋯,aq∈Zpq, define Op,a to be an oracle that for any strict subset S⊂1,⋯,q responds with Op,aS=Πi∈Sai∈G.Definition 1 (q-GDH assumption).
Thet,q,∈−GDH assumption is satisfied in G, if for all t-time algorithms A, the advantage AdvA,qGDH=PrAOP,a=a1⋯aqP<ϵ, where a=a1,⋯,aq∈Zpq and for any sufficiently small ϵ>0.(2) q-Diffie-Hellman Inversion (q-DHI) Problem [13]. Given a q+1-tuple P,xP,x2P,⋯,xqP∈Gq+1, the problem is to compute 1/xP∈G where x∈Zp∗.Definition 2 (q-DHI assumption).
G satisfies the t,q,ϵ-DHI assumption, if for all t-time algorithms A, the advantage becomes AdvA,qGDH=PrAP,xP,x2P,⋯,xqP=1/xP<ϵ for any sufficiently small ϵ>0, where the probability is over the random choice of x in Zp∗ and the random bits of A.It can be shown by a reduction that our computational problem is at least as hard as the discrete logarithm problem (DLP).


### 3.2. Assumptions

The following assumptions are made regarding the Fog-CPS entities.(1)
It is assumed that CPS devices, such as smart meter and home appliances, can be compromised and leak sensitive information(2)
The FA, fog nodes, and cloud provider are honest but curious and might try to gather as much information (from CPS devices, users, social media, and external resources) as possible that can later be used to generate the profile of CPS devices/users. Such information can be used for targeted advertisement and spamming(3)
All Fog-CPS entities will register with the FA using their secret attribute set and it would generate their partial key pair(4)
The CPS entities and fog nodes generate the final public keys of the collaborating devices(5)
Access policies based on shared attributes are shared with CPS devices, FA, fog nodes, and cloud(6)
It is assumed that the elliptic curve group parameters are preshared with entities


### 3.3. Fog-CPS Security Scheme Description

The proposed Fog-CPS security scheme has adopted the encryption and decryption algorithms of [8]. Furthermore, additional changes were made to the key generation algorithms of [8] as specified below:
(1)
The attributes in the Fog-CPS scheme are divided into two sets, i.e., a secretAS and a shared AK. Therefore, the key generation process is also distributed between the FA and Fog-CPS entities. Three algorithms, namely, partial key pair generation, final public KeyGen, and final secret KeyGen, are designed for the complete key generation process(2)
The Fog-CPS security scheme uses two elliptic curve (EC) points for each attribute instead of three as in [8]. The use of two points per attribute reduces the processing and memory overhead and makes the Fog-CPS scheme efficient but also secure.(3)
Efficient key update algorithms with limited additional overhead are introduced


### 3.4. Fog-CPS Security Scheme Construction

The Fog-CPS security scheme consists of eight algorithms out of which seven are presented here. As previously mentioned, the encryption and decryption algorithms are adopted from [8]. However, we made a few changes to the encryption algorithm, so it is also presented, but the description of the decryption algorithm is omitted.


#### 3.4.1. Partial Key Pair Generationλ,AS→PKAS/SKAS

The partial key pair generation algorithm is executed by the FA which registers the Fog-CPS entities based on a secret attribute setAS. Algorithm 1 takes as input the security parameter λ and a set of secret attributes AS. λ consists of a long string of 1 s (chosen finite field) and defines the length of the secret keys and messages. It outputs the partial public/secret key pair PKAS/SKAS. Subsequently, the FA publishes the public key PKAS and sends the secret key SKAS to the CPS device. For initial communication, Fog-CPS entities can use the partial public keys. The partial public keys guarantee that Fog-CPS entities are legitimate and registered with FA.


#### 3.4.2. Final Public KeyGenPKAS,AK→PKAK

The second pair of keys, namely, the final public and secret keys, is generated from the shared attribute set. The final public keys can be generated by any CPS device or fog node that shares a set of attributes with some other entity. Algorithm2 generates the final public key of a CPS device. It takes as input the partial public key PKAS generated over the secret attribute set AS and the shared attribute set AK. It outputs the final public key PKAK.


#### 3.4.3. Final Secret KeyGenSKAS,AK→SKAK

Algorithm3 generates the final secret key of a CPS device. It takes as input the secret key generated over the secret attribute set AS and the shared attribute set AK. It outputs the final secret key SKAK.


#### 3.4.4. EncryptPKAK,M,ℙ→CT

The encryption algorithm takes as input the final public keyPKAK, access policy ℙ, and a message M. It outputs a ciphertext CT. Algorithm 7 presents the encryption procedure in detail.Proposition 3.
From Equations (9) and (18), a new polynomial can be calculated as(12)Fx,SK,SP=fx,SPfx,SK=∏i=1tx+H4iai−bi.
It can easily be verified thatfx,SP/fx,SK is a polynomial function in x, if and only if ℙ⊆AK. The encryption algorithm and the secret key generation algorithms are designed in such a way that fx,SP/fx,SK must be a polynomial for a successful decryption.


#### 3.4.5. DecryptCT,SKAK→M

The decryption algorithm takes as input the final secret keySKAK and ciphertext CT and outputs the plaintext message M. The construction of the decryption algorithm is the same as the one in [8].


#### 3.4.6. Partial Key Pair Updateλ,A´S→PK´AS/SK´AS

If the secret attributes of a CPS entity are changed, then all the keys need to be updated. The key update procedure will start by regenerating the partial public/secretPKAS/SKAS key pair. In the partial key pair update procedure, Algorithm 4 is executed. It takes the updated set of secret attributes AS as input and generates a new PK´AK/SK´AK partial key pair for the CPS device. Subsequently, the final public and secret keys are also regenerated.Algorithm 4: Partial key pair update.
1:Input: Secret AS set.2:Output: New partial key pair PKAS/SKAS.3: Increment the counterc for revoked keys.4: If the attributes are the same, the previous computations overt attributes are considered.5: Else, perform calculations for attributes fromi=t to t±1.6: Mapt±1 attribute in AS to Zp using Equation (1) and compute secret number s´.s´=s´+st±1.137: Next, computes using Equation (3).8: Next, compute public key componentPi for i=t±1 attribute using Equation (4).


#### 3.4.7. Final Key UpdatePK´AS/A´K→PK´AK/SK´AK

If the shared attributes of a CPS device are updated, then the final public and secret keys need to be regenerated. In this case, Algorithms5 and 6 are executed to generate the new final public and secret keys of the Fog-CPS entities. These algorithms take the updated set of shared attributes A´S as input and generate the new final public and secret keys PK´AK/SK´AK of the CPS device.Algorithm 5: Final public key update.
1:Input: Shared AK attribute set.2:Output: New final public key PKAK.3: If the attributes are the same, the previous computations overt attributes are considered.4: Else, perform calculations for attributes fromi=t to t±1.5: Mapt±1 attribute in shared set AK to Zp. Apply hash function H1 and compute ki using Equation (5). Then, compute k:k=k+kt±1.146: Next, compute final public key componentUi, for t±1 attribute using Equation (7).Algorithm 6: Final secret key update.
1:Input: Shared AK attribute set.2:Output: New final secret key SKAK.3: If the attributes are the same, the previous computations overt attributes are considered.4: Else, perform calculations for attributes fromi=t to t±1.5: Compute secret numberα using Equation (8).6: Next, computefα,AK:fα,AK=fα,AK·α+H1t±11−at±1,15where polynomialfα,AK has been computed over t attributes in Equation (9).7: Pick two random numbersru,tu∈ZP and then compute su using Equation (10).8: Next, compute secret key componentu1 using Equation (11).Algorithm 7: Encryption.
1:Input:PKAK, M, andℙ,ℙ⊆AK .2:Output:CT=ℙ,Um,i,C1,Cr,Cm.3: Create a random numberc∈0,1lr and computerm=H1ℙ,M,c,16km=KDFrmP,17whereKDF is a key derivation function which takes the new elliptic curve point rmP and generates a secret key km.4: LetSP=b1b2⋯.bt be the access policy string. Compute the corresponding t−1 degree at most polynomial function fx,SP in Zpx asfx,SP=∏i=1tx+H1i1−bi.18Letci denote the coefficient of xi in the polynomial fx,SP.5: Choose two one-way collision resistance hash functions,H2 and H3, defined as:H2∶0,1∗→0,1lr,H3∶0,1∗→0,1lm,wherelr is the length of a random string, lm is the length of message M, 0,1∗ is a binary string of arbitrary length, and 0,1l is a binary string of length l. The length of the hash value is the same as the length of a random string r, and similarly, the hash value will be the same size as the message M.6: Next, theCT which consists of three components C1, Cr, and Cm is computed. C1 is a point on the elliptic curve which is computed from the polynomial fx,SP and Ui components in PKAK corresponding to attributes in ℙ. C1 is computed as follows:Um,i=rmUi,i=1,2,⋯,t−ℙ,19C1=rm∑i=0tciUi=rmfα,ℙP.20Next,Cr is computed by a XOR operation on km and c computed in Step 3.Cr=H2km⊕c.21Lastly,Cm is computed by a XOR operation on c and message M.Cm=H3c⊕M.22


#### 3.4.8. KeyRevoke

Similar to existing ABE schemes, the keys are revoked by the CA but in our application scenario FA. However, the keys can also be revoked due to the malicious behaviour of CPS devices. Three cases for key revocation have been identified:(1)
Legitimate revoke: in the first case, both key pairs can be revoked due to a system update, expiration date, and scheduled maintenance of the Fog-CPS system.(2)
Malicious activity: in the second case, the key revocation may take place due to the malicious behaviour which might be observed and/or reported by FA, fog nodes, and CPS devices. Two cases of malicious activity are considered below:
(a)
Malicious FA: the compromise of partial key pair would not trigger key revocation.(b)
Malicious CPS devices: the compromise of a CPS device would trigger revocation of the partial key pair. For example, if the secret key is compromised or leaked, then again keys should be revoked and regenerated.(3)
Attribute update: in the third case, the change in the attribute set can trigger a key revocation.In key revocation, FA revokes the existing partial key pair and generates new keys in the first two cases, i.e., legitimate revoke and malicious activity. In the third case, the keys are regenerated as discussed in Sections3.4.6 and 3.4.7. As the generation of final public and secret key is dependent upon the partial key pair generated over secret attributes, so the revocation of partial key pair requires the revocation of final public and secret keys. As a result, Algorithms 4–6 are designed. The proposed key update algorithms are lightweight as each revocation only incurs the overhead of one extra key component. In each subsequent key update, the t attribute counter is incremented by one.


#### 3.4.9. Correctness

The correctness of the Fog-CPS security scheme is based on the following property. For a given pair of final keysPKAK,SKAK and CT generated from EncryptPKAK,M,ℙ, the decryption algorithm DecryptCT,ℙ,SKAK,AK will output the correct M, if ℙ⊆AK; otherwise, the decryption will fail.


### 3.5. Fog-CPS Security Scheme Application Scenario

The proposed scheme can be applied to any Fog-CPS scenario. To demonstrate it, a case in a fog-enabled smart grid power control (Fog-SGC) system is considered wherein a smart home device reports meter dataD to a neighbouring area network (NAN) device. Figure 2 illustrates the communication between smart home device, NAN device, and FA. The interaction between all other entities in a Fog-SGC system would be similar as between smart home and NAN devices. Initially, all entities, namely, smart meters and fog nodes, register with FA based on their secret attribute sets AS. The FA executes Algorithm 1 to generate their partial key pair. Subsequently, the FA publishes the public key PKAS and securely transmits the secret key SKAS to the device.Figure 2
Fog-CPS scheme application.After registration with FA, the smart home device sends a data store request to the NAN device. Upon receiving the request, the NAN device asks for a set of shared attributesAK. Subsequently, the smart home device generates the final public key of the NAN device by executing Algorithm 2. Next, the NAN device executes Algorithm 3 to generate the final secret key SKAK corresponding to the shared attribute set. Then, the smart home device encrypts D using the final public key PKAK of the NAN device and signs the shared attributes AK using its secret key SKAK. Subsequently, the smart home device sends CT and signature σ to the NAN device. Following this, the NAN device verifies the σ and decrypts the CT. Upon successful decryption, it gets an assurance that the smart home device possesses the required attributes and stores D.


## 3.1. Preliminaries

In this section, the attributes, access structures, and the computational hard problems are discussed.


### 3.1.1. Secret and Shared Attribute Sets

All CPS devices and fog nodes possess a set of attributes. LetA=AS∪AK be the attribute set of each CPS device consisting of both secret AS and shared AK attributes. As an example, a few attributes for both sets are listed in Table 2.Table 2
Attributes shared between CPS devices and fog assist node.
(a)Secret attribute set shared between Fog-CPS entities and FAA´1A´2A´3……ASDevice IDIP addressLocationMalicious activities reportedNumber of key updatesTrust(b)Shared attribute set shared between Fog-CPS entitiesA1A2A3……AKEntity IDEntity typeApplication IDApplication typeData identifierTrust


### 3.1.2. Access Structure

The attribute string of a device is presented with ann-bit string a1a2⋯an. To further elaborate the attribute string, the example of shared attribute set AK is considered. The attribute string is defined as follows: ai=1,ifAi∈AK and ai=0,ifAi∉AK. For example, if n=5 and 4 attributes are considered for final key pair generation, then AK=A1,A2,A4,A5; the 5-bit string AK becomes 11011. Likewise, an access policy is defined by ℙ and specified with attributes in the shared attribute set AK. The access policy is also represented with n-bit string b1b2⋯bn where bi=1, for Ai∈ℙ, and bi=0, for Ai∉ℙ. If the access policy is defined on attributes A1,A2,A4, then the policy string is ℙ=11010. Additionally, the proposed scheme is based on the AND-gate access control structure. The attribute set AK fulfills the access policy ℙ, if and only if ℙ⊆A and ai≥bi, for all i=1,2,⋯,n.


### 3.1.3. Computational Hard Problems

The security of the Fog-CPS scheme is based on the computational problems described below.(1) q-Generalized Diffie-Hellman (q-GDH) Assumption [13]. Given a1P,a2P,⋯,aqP in G and all the subset products ∏iϵSaiP∈G for any strict subset S⊂1,⋯,q, it is hard to compute a1⋯aqP∈G, where P is a base point in Epa,b;a1,a2,⋯,aq∈Zp∗. Since the number of subset products (elliptic curve scalar point multiplications) is exponential in q, access to all these subset products is provided through an oracle. For a vector a=a1,⋯,aq∈Zpq, define Op,a to be an oracle that for any strict subset S⊂1,⋯,q responds with Op,aS=Πi∈Sai∈G.Definition 1 (q-GDH assumption).
Thet,q,∈−GDH assumption is satisfied in G, if for all t-time algorithms A, the advantage AdvA,qGDH=PrAOP,a=a1⋯aqP<ϵ, where a=a1,⋯,aq∈Zpq and for any sufficiently small ϵ>0.(2) q-Diffie-Hellman Inversion (q-DHI) Problem [13]. Given a q+1-tuple P,xP,x2P,⋯,xqP∈Gq+1, the problem is to compute 1/xP∈G where x∈Zp∗.Definition 2 (q-DHI assumption).
G satisfies the t,q,ϵ-DHI assumption, if for all t-time algorithms A, the advantage becomes AdvA,qGDH=PrAP,xP,x2P,⋯,xqP=1/xP<ϵ for any sufficiently small ϵ>0, where the probability is over the random choice of x in Zp∗ and the random bits of A.It can be shown by a reduction that our computational problem is at least as hard as the discrete logarithm problem (DLP).


## 3.1.1. Secret and Shared Attribute Sets

All CPS devices and fog nodes possess a set of attributes. LetA=AS∪AK be the attribute set of each CPS device consisting of both secret AS and shared AK attributes. As an example, a few attributes for both sets are listed in Table 2.Table 2
Attributes shared between CPS devices and fog assist node.
(a)Secret attribute set shared between Fog-CPS entities and FAA´1A´2A´3……ASDevice IDIP addressLocationMalicious activities reportedNumber of key updatesTrust(b)Shared attribute set shared between Fog-CPS entitiesA1A2A3……AKEntity IDEntity typeApplication IDApplication typeData identifierTrust


## 3.1.2. Access Structure

The attribute string of a device is presented with ann-bit string a1a2⋯an. To further elaborate the attribute string, the example of shared attribute set AK is considered. The attribute string is defined as follows: ai=1,ifAi∈AK and ai=0,ifAi∉AK. For example, if n=5 and 4 attributes are considered for final key pair generation, then AK=A1,A2,A4,A5; the 5-bit string AK becomes 11011. Likewise, an access policy is defined by ℙ and specified with attributes in the shared attribute set AK. The access policy is also represented with n-bit string b1b2⋯bn where bi=1, for Ai∈ℙ, and bi=0, for Ai∉ℙ. If the access policy is defined on attributes A1,A2,A4, then the policy string is ℙ=11010. Additionally, the proposed scheme is based on the AND-gate access control structure. The attribute set AK fulfills the access policy ℙ, if and only if ℙ⊆A and ai≥bi, for all i=1,2,⋯,n.


## 3.1.3. Computational Hard Problems

The security of the Fog-CPS scheme is based on the computational problems described below.(1) q-Generalized Diffie-Hellman (q-GDH) Assumption [13]. Given a1P,a2P,⋯,aqP in G and all the subset products ∏iϵSaiP∈G for any strict subset S⊂1,⋯,q, it is hard to compute a1⋯aqP∈G, where P is a base point in Epa,b;a1,a2,⋯,aq∈Zp∗. Since the number of subset products (elliptic curve scalar point multiplications) is exponential in q, access to all these subset products is provided through an oracle. For a vector a=a1,⋯,aq∈Zpq, define Op,a to be an oracle that for any strict subset S⊂1,⋯,q responds with Op,aS=Πi∈Sai∈G.Definition 1 (q-GDH assumption).
Thet,q,∈−GDH assumption is satisfied in G, if for all t-time algorithms A, the advantage AdvA,qGDH=PrAOP,a=a1⋯aqP<ϵ, where a=a1,⋯,aq∈Zpq and for any sufficiently small ϵ>0.(2) q-Diffie-Hellman Inversion (q-DHI) Problem [13]. Given a q+1-tuple P,xP,x2P,⋯,xqP∈Gq+1, the problem is to compute 1/xP∈G where x∈Zp∗.Definition 2 (q-DHI assumption).
G satisfies the t,q,ϵ-DHI assumption, if for all t-time algorithms A, the advantage becomes AdvA,qGDH=PrAP,xP,x2P,⋯,xqP=1/xP<ϵ for any sufficiently small ϵ>0, where the probability is over the random choice of x in Zp∗ and the random bits of A.It can be shown by a reduction that our computational problem is at least as hard as the discrete logarithm problem (DLP).


## 3.2. Assumptions

The following assumptions are made regarding the Fog-CPS entities.(1)
It is assumed that CPS devices, such as smart meter and home appliances, can be compromised and leak sensitive information(2)
The FA, fog nodes, and cloud provider are honest but curious and might try to gather as much information (from CPS devices, users, social media, and external resources) as possible that can later be used to generate the profile of CPS devices/users. Such information can be used for targeted advertisement and spamming(3)
All Fog-CPS entities will register with the FA using their secret attribute set and it would generate their partial key pair(4)
The CPS entities and fog nodes generate the final public keys of the collaborating devices(5)
Access policies based on shared attributes are shared with CPS devices, FA, fog nodes, and cloud(6)
It is assumed that the elliptic curve group parameters are preshared with entities


## 3.3. Fog-CPS Security Scheme Description

The proposed Fog-CPS security scheme has adopted the encryption and decryption algorithms of [8]. Furthermore, additional changes were made to the key generation algorithms of [8] as specified below:
(1)
The attributes in the Fog-CPS scheme are divided into two sets, i.e., a secretAS and a shared AK. Therefore, the key generation process is also distributed between the FA and Fog-CPS entities. Three algorithms, namely, partial key pair generation, final public KeyGen, and final secret KeyGen, are designed for the complete key generation process(2)
The Fog-CPS security scheme uses two elliptic curve (EC) points for each attribute instead of three as in [8]. The use of two points per attribute reduces the processing and memory overhead and makes the Fog-CPS scheme efficient but also secure.(3)
Efficient key update algorithms with limited additional overhead are introduced


## 3.4. Fog-CPS Security Scheme Construction

The Fog-CPS security scheme consists of eight algorithms out of which seven are presented here. As previously mentioned, the encryption and decryption algorithms are adopted from [8]. However, we made a few changes to the encryption algorithm, so it is also presented, but the description of the decryption algorithm is omitted.


### 3.4.1. Partial Key Pair Generationλ,AS→PKAS/SKAS

The partial key pair generation algorithm is executed by the FA which registers the Fog-CPS entities based on a secret attribute setAS. Algorithm 1 takes as input the security parameter λ and a set of secret attributes AS. λ consists of a long string of 1 s (chosen finite field) and defines the length of the secret keys and messages. It outputs the partial public/secret key pair PKAS/SKAS. Subsequently, the FA publishes the public key PKAS and sends the secret key SKAS to the CPS device. For initial communication, Fog-CPS entities can use the partial public keys. The partial public keys guarantee that Fog-CPS entities are legitimate and registered with FA.


### 3.4.2. Final Public KeyGenPKAS,AK→PKAK

The second pair of keys, namely, the final public and secret keys, is generated from the shared attribute set. The final public keys can be generated by any CPS device or fog node that shares a set of attributes with some other entity. Algorithm2 generates the final public key of a CPS device. It takes as input the partial public key PKAS generated over the secret attribute set AS and the shared attribute set AK. It outputs the final public key PKAK.


### 3.4.3. Final Secret KeyGenSKAS,AK→SKAK

Algorithm3 generates the final secret key of a CPS device. It takes as input the secret key generated over the secret attribute set AS and the shared attribute set AK. It outputs the final secret key SKAK.


### 3.4.4. EncryptPKAK,M,ℙ→CT

The encryption algorithm takes as input the final public keyPKAK, access policy ℙ, and a message M. It outputs a ciphertext CT. Algorithm 7 presents the encryption procedure in detail.Proposition 3.
From Equations (9) and (18), a new polynomial can be calculated as(12)Fx,SK,SP=fx,SPfx,SK=∏i=1tx+H4iai−bi.
It can easily be verified thatfx,SP/fx,SK is a polynomial function in x, if and only if ℙ⊆AK. The encryption algorithm and the secret key generation algorithms are designed in such a way that fx,SP/fx,SK must be a polynomial for a successful decryption.


### 3.4.5. DecryptCT,SKAK→M

The decryption algorithm takes as input the final secret keySKAK and ciphertext CT and outputs the plaintext message M. The construction of the decryption algorithm is the same as the one in [8].


### 3.4.6. Partial Key Pair Updateλ,A´S→PK´AS/SK´AS

If the secret attributes of a CPS entity are changed, then all the keys need to be updated. The key update procedure will start by regenerating the partial public/secretPKAS/SKAS key pair. In the partial key pair update procedure, Algorithm 4 is executed. It takes the updated set of secret attributes AS as input and generates a new PK´AK/SK´AK partial key pair for the CPS device. Subsequently, the final public and secret keys are also regenerated.Algorithm 4: Partial key pair update.
1:Input: Secret AS set.2:Output: New partial key pair PKAS/SKAS.3: Increment the counterc for revoked keys.4: If the attributes are the same, the previous computations overt attributes are considered.5: Else, perform calculations for attributes fromi=t to t±1.6: Mapt±1 attribute in AS to Zp using Equation (1) and compute secret number s´.s´=s´+st±1.137: Next, computes using Equation (3).8: Next, compute public key componentPi for i=t±1 attribute using Equation (4).


### 3.4.7. Final Key UpdatePK´AS/A´K→PK´AK/SK´AK

If the shared attributes of a CPS device are updated, then the final public and secret keys need to be regenerated. In this case, Algorithms5 and 6 are executed to generate the new final public and secret keys of the Fog-CPS entities. These algorithms take the updated set of shared attributes A´S as input and generate the new final public and secret keys PK´AK/SK´AK of the CPS device.Algorithm 5: Final public key update.
1:Input: Shared AK attribute set.2:Output: New final public key PKAK.3: If the attributes are the same, the previous computations overt attributes are considered.4: Else, perform calculations for attributes fromi=t to t±1.5: Mapt±1 attribute in shared set AK to Zp. Apply hash function H1 and compute ki using Equation (5). Then, compute k:k=k+kt±1.146: Next, compute final public key componentUi, for t±1 attribute using Equation (7).Algorithm 6: Final secret key update.
1:Input: Shared AK attribute set.2:Output: New final secret key SKAK.3: If the attributes are the same, the previous computations overt attributes are considered.4: Else, perform calculations for attributes fromi=t to t±1.5: Compute secret numberα using Equation (8).6: Next, computefα,AK:fα,AK=fα,AK·α+H1t±11−at±1,15where polynomialfα,AK has been computed over t attributes in Equation (9).7: Pick two random numbersru,tu∈ZP and then compute su using Equation (10).8: Next, compute secret key componentu1 using Equation (11).Algorithm 7: Encryption.
1:Input:PKAK, M, andℙ,ℙ⊆AK .2:Output:CT=ℙ,Um,i,C1,Cr,Cm.3: Create a random numberc∈0,1lr and computerm=H1ℙ,M,c,16km=KDFrmP,17whereKDF is a key derivation function which takes the new elliptic curve point rmP and generates a secret key km.4: LetSP=b1b2⋯.bt be the access policy string. Compute the corresponding t−1 degree at most polynomial function fx,SP in Zpx asfx,SP=∏i=1tx+H1i1−bi.18Letci denote the coefficient of xi in the polynomial fx,SP.5: Choose two one-way collision resistance hash functions,H2 and H3, defined as:H2∶0,1∗→0,1lr,H3∶0,1∗→0,1lm,wherelr is the length of a random string, lm is the length of message M, 0,1∗ is a binary string of arbitrary length, and 0,1l is a binary string of length l. The length of the hash value is the same as the length of a random string r, and similarly, the hash value will be the same size as the message M.6: Next, theCT which consists of three components C1, Cr, and Cm is computed. C1 is a point on the elliptic curve which is computed from the polynomial fx,SP and Ui components in PKAK corresponding to attributes in ℙ. C1 is computed as follows:Um,i=rmUi,i=1,2,⋯,t−ℙ,19C1=rm∑i=0tciUi=rmfα,ℙP.20Next,Cr is computed by a XOR operation on km and c computed in Step 3.Cr=H2km⊕c.21Lastly,Cm is computed by a XOR operation on c and message M.Cm=H3c⊕M.22


### 3.4.8. KeyRevoke

Similar to existing ABE schemes, the keys are revoked by the CA but in our application scenario FA. However, the keys can also be revoked due to the malicious behaviour of CPS devices. Three cases for key revocation have been identified:(1)
Legitimate revoke: in the first case, both key pairs can be revoked due to a system update, expiration date, and scheduled maintenance of the Fog-CPS system.(2)
Malicious activity: in the second case, the key revocation may take place due to the malicious behaviour which might be observed and/or reported by FA, fog nodes, and CPS devices. Two cases of malicious activity are considered below:
(a)
Malicious FA: the compromise of partial key pair would not trigger key revocation.(b)
Malicious CPS devices: the compromise of a CPS device would trigger revocation of the partial key pair. For example, if the secret key is compromised or leaked, then again keys should be revoked and regenerated.(3)
Attribute update: in the third case, the change in the attribute set can trigger a key revocation.In key revocation, FA revokes the existing partial key pair and generates new keys in the first two cases, i.e., legitimate revoke and malicious activity. In the third case, the keys are regenerated as discussed in Sections3.4.6 and 3.4.7. As the generation of final public and secret key is dependent upon the partial key pair generated over secret attributes, so the revocation of partial key pair requires the revocation of final public and secret keys. As a result, Algorithms 4–6 are designed. The proposed key update algorithms are lightweight as each revocation only incurs the overhead of one extra key component. In each subsequent key update, the t attribute counter is incremented by one.


### 3.4.9. Correctness

The correctness of the Fog-CPS security scheme is based on the following property. For a given pair of final keysPKAK,SKAK and CT generated from EncryptPKAK,M,ℙ, the decryption algorithm DecryptCT,ℙ,SKAK,AK will output the correct M, if ℙ⊆AK; otherwise, the decryption will fail.


## 3.4.1. Partial Key Pair Generationλ,AS→PKAS/SKAS

The partial key pair generation algorithm is executed by the FA which registers the Fog-CPS entities based on a secret attribute setAS. Algorithm 1 takes as input the security parameter λ and a set of secret attributes AS. λ consists of a long string of 1 s (chosen finite field) and defines the length of the secret keys and messages. It outputs the partial public/secret key pair PKAS/SKAS. Subsequently, the FA publishes the public key PKAS and sends the secret key SKAS to the CPS device. For initial communication, Fog-CPS entities can use the partial public keys. The partial public keys guarantee that Fog-CPS entities are legitimate and registered with FA.


## 3.4.2. Final Public KeyGenPKAS,AK→PKAK

The second pair of keys, namely, the final public and secret keys, is generated from the shared attribute set. The final public keys can be generated by any CPS device or fog node that shares a set of attributes with some other entity. Algorithm2 generates the final public key of a CPS device. It takes as input the partial public key PKAS generated over the secret attribute set AS and the shared attribute set AK. It outputs the final public key PKAK.


## 3.4.3. Final Secret KeyGenSKAS,AK→SKAK

Algorithm3 generates the final secret key of a CPS device. It takes as input the secret key generated over the secret attribute set AS and the shared attribute set AK. It outputs the final secret key SKAK.


## 3.4.4. EncryptPKAK,M,ℙ→CT

The encryption algorithm takes as input the final public keyPKAK, access policy ℙ, and a message M. It outputs a ciphertext CT. Algorithm 7 presents the encryption procedure in detail.Proposition 3.
From Equations (9) and (18), a new polynomial can be calculated as(12)Fx,SK,SP=fx,SPfx,SK=∏i=1tx+H4iai−bi.
It can easily be verified thatfx,SP/fx,SK is a polynomial function in x, if and only if ℙ⊆AK. The encryption algorithm and the secret key generation algorithms are designed in such a way that fx,SP/fx,SK must be a polynomial for a successful decryption.


## 3.4.5. DecryptCT,SKAK→M

The decryption algorithm takes as input the final secret keySKAK and ciphertext CT and outputs the plaintext message M. The construction of the decryption algorithm is the same as the one in [8].


## 3.4.6. Partial Key Pair Updateλ,A´S→PK´AS/SK´AS

If the secret attributes of a CPS entity are changed, then all the keys need to be updated. The key update procedure will start by regenerating the partial public/secretPKAS/SKAS key pair. In the partial key pair update procedure, Algorithm 4 is executed. It takes the updated set of secret attributes AS as input and generates a new PK´AK/SK´AK partial key pair for the CPS device. Subsequently, the final public and secret keys are also regenerated.Algorithm 4: Partial key pair update.
1:Input: Secret AS set.2:Output: New partial key pair PKAS/SKAS.3: Increment the counterc for revoked keys.4: If the attributes are the same, the previous computations overt attributes are considered.5: Else, perform calculations for attributes fromi=t to t±1.6: Mapt±1 attribute in AS to Zp using Equation (1) and compute secret number s´.s´=s´+st±1.137: Next, computes using Equation (3).8: Next, compute public key componentPi for i=t±1 attribute using Equation (4).


## 3.4.7. Final Key UpdatePK´AS/A´K→PK´AK/SK´AK

If the shared attributes of a CPS device are updated, then the final public and secret keys need to be regenerated. In this case, Algorithms5 and 6 are executed to generate the new final public and secret keys of the Fog-CPS entities. These algorithms take the updated set of shared attributes A´S as input and generate the new final public and secret keys PK´AK/SK´AK of the CPS device.Algorithm 5: Final public key update.
1:Input: Shared AK attribute set.2:Output: New final public key PKAK.3: If the attributes are the same, the previous computations overt attributes are considered.4: Else, perform calculations for attributes fromi=t to t±1.5: Mapt±1 attribute in shared set AK to Zp. Apply hash function H1 and compute ki using Equation (5). Then, compute k:k=k+kt±1.146: Next, compute final public key componentUi, for t±1 attribute using Equation (7).Algorithm 6: Final secret key update.
1:Input: Shared AK attribute set.2:Output: New final secret key SKAK.3: If the attributes are the same, the previous computations overt attributes are considered.4: Else, perform calculations for attributes fromi=t to t±1.5: Compute secret numberα using Equation (8).6: Next, computefα,AK:fα,AK=fα,AK·α+H1t±11−at±1,15where polynomialfα,AK has been computed over t attributes in Equation (9).7: Pick two random numbersru,tu∈ZP and then compute su using Equation (10).8: Next, compute secret key componentu1 using Equation (11).Algorithm 7: Encryption.
1:Input:PKAK, M, andℙ,ℙ⊆AK .2:Output:CT=ℙ,Um,i,C1,Cr,Cm.3: Create a random numberc∈0,1lr and computerm=H1ℙ,M,c,16km=KDFrmP,17whereKDF is a key derivation function which takes the new elliptic curve point rmP and generates a secret key km.4: LetSP=b1b2⋯.bt be the access policy string. Compute the corresponding t−1 degree at most polynomial function fx,SP in Zpx asfx,SP=∏i=1tx+H1i1−bi.18Letci denote the coefficient of xi in the polynomial fx,SP.5: Choose two one-way collision resistance hash functions,H2 and H3, defined as:H2∶0,1∗→0,1lr,H3∶0,1∗→0,1lm,wherelr is the length of a random string, lm is the length of message M, 0,1∗ is a binary string of arbitrary length, and 0,1l is a binary string of length l. The length of the hash value is the same as the length of a random string r, and similarly, the hash value will be the same size as the message M.6: Next, theCT which consists of three components C1, Cr, and Cm is computed. C1 is a point on the elliptic curve which is computed from the polynomial fx,SP and Ui components in PKAK corresponding to attributes in ℙ. C1 is computed as follows:Um,i=rmUi,i=1,2,⋯,t−ℙ,19C1=rm∑i=0tciUi=rmfα,ℙP.20Next,Cr is computed by a XOR operation on km and c computed in Step 3.Cr=H2km⊕c.21Lastly,Cm is computed by a XOR operation on c and message M.Cm=H3c⊕M.22


## 3.4.8. KeyRevoke

Similar to existing ABE schemes, the keys are revoked by the CA but in our application scenario FA. However, the keys can also be revoked due to the malicious behaviour of CPS devices. Three cases for key revocation have been identified:(1)
Legitimate revoke: in the first case, both key pairs can be revoked due to a system update, expiration date, and scheduled maintenance of the Fog-CPS system.(2)
Malicious activity: in the second case, the key revocation may take place due to the malicious behaviour which might be observed and/or reported by FA, fog nodes, and CPS devices. Two cases of malicious activity are considered below:
(a)
Malicious FA: the compromise of partial key pair would not trigger key revocation.(b)
Malicious CPS devices: the compromise of a CPS device would trigger revocation of the partial key pair. For example, if the secret key is compromised or leaked, then again keys should be revoked and regenerated.(3)
Attribute update: in the third case, the change in the attribute set can trigger a key revocation.In key revocation, FA revokes the existing partial key pair and generates new keys in the first two cases, i.e., legitimate revoke and malicious activity. In the third case, the keys are regenerated as discussed in Sections3.4.6 and 3.4.7. As the generation of final public and secret key is dependent upon the partial key pair generated over secret attributes, so the revocation of partial key pair requires the revocation of final public and secret keys. As a result, Algorithms 4–6 are designed. The proposed key update algorithms are lightweight as each revocation only incurs the overhead of one extra key component. In each subsequent key update, the t attribute counter is incremented by one.


## 3.4.9. Correctness

The correctness of the Fog-CPS security scheme is based on the following property. For a given pair of final keysPKAK,SKAK and CT generated from EncryptPKAK,M,ℙ, the decryption algorithm DecryptCT,ℙ,SKAK,AK will output the correct M, if ℙ⊆AK; otherwise, the decryption will fail.


## 3.5. Fog-CPS Security Scheme Application Scenario

The proposed scheme can be applied to any Fog-CPS scenario. To demonstrate it, a case in a fog-enabled smart grid power control (Fog-SGC) system is considered wherein a smart home device reports meter dataD to a neighbouring area network (NAN) device. Figure 2 illustrates the communication between smart home device, NAN device, and FA. The interaction between all other entities in a Fog-SGC system would be similar as between smart home and NAN devices. Initially, all entities, namely, smart meters and fog nodes, register with FA based on their secret attribute sets AS. The FA executes Algorithm 1 to generate their partial key pair. Subsequently, the FA publishes the public key PKAS and securely transmits the secret key SKAS to the device.Figure 2
Fog-CPS scheme application.After registration with FA, the smart home device sends a data store request to the NAN device. Upon receiving the request, the NAN device asks for a set of shared attributesAK. Subsequently, the smart home device generates the final public key of the NAN device by executing Algorithm 2. Next, the NAN device executes Algorithm 3 to generate the final secret key SKAK corresponding to the shared attribute set. Then, the smart home device encrypts D using the final public key PKAK of the NAN device and signs the shared attributes AK using its secret key SKAK. Subsequently, the smart home device sends CT and signature σ to the NAN device. Following this, the NAN device verifies the σ and decrypts the CT. Upon successful decryption, it gets an assurance that the smart home device possesses the required attributes and stores D.


## 4. Theoretical Security Analysis and Evaluation

As mentioned in the previous sections, in the proposed Fog-CPS security scheme, each entity possesses two key pairs, namely, partial and secret. So keeping that in view, the security of the proposed scheme is carefully analyzed to ensure security against the following attacks:(i)
Computing the final secret keySKAK from the partial secret key SKAS(ii)
Computing the partial/final secret keys from the partial/final public keys(iii)
Computing the final secret keySKAK from multiple ciphertexts (i.e., chosen ciphertext attack)The Fog-CPS scheme is secure against the abovementioned attacks due to theq-Diffie-Hellman Inversion (q-DHI) problem [13], elliptic curve discrete logarithm problem (ECDLP), and the robustness of the hash functions.Additionally, the robustness of the proposed scheme is based on two fundamental security notions of encryption schemes, namely, indistinguishability of messages and the collision resistance against secret keys. Message indistinguishability is an important security property of many encryption schemes. Given the ciphertext and the encryption key, the adversary cannot tell apart two same-length but different messages encrypted under the scheme, even if he chose the messages himself. With collision resistance, the attackers cannot pool their secret key components corresponding to a set of attributes to generate a new key which otherwise cannot be generated from their own attributes. Before presenting the security analysis against the abovementioned attacks, the notion of collision resistance as presumed in this scheme is discussed.


### 4.1. Collision Resistance against Secret Keys

The proposed scheme does not follow the same conventional attribute sharing as the existing ABE schemes. Attributes are only shared between two CPS devices and the FA node. So, the collision attack as presumed in existing schemes does not apply in this case. In other words, the pooling of attributes and secret key components (i.e., the collision attack) from several adversaries who do not share the attributes would not benefit in generating the secret keys. Precisely, for the security of the proposed scheme, the definition of collision resistance is modified.In this case, it is essential to prevent a device from generating the final secret keySKAK of another device.Theorem 1.
It can be shown by a reduction that the computational problem in the proposed scheme is at least as hard as the discrete logarithm problem (DLP).Proof.
AssumeA is an algorithm that efficiently solves our problem. We can use A to compute the discrete logarithm of an element h to the base g as follows:
(i)
InvokeA on input m=g and m´=h(ii)
A will return will return r,s, and t such that rs≡g and rt≡h modulo p(iii)
Now we can compute a numberx such that x·s≡1modG (this can be done efficiently using the extended Euclidean algorithm because p is prime and therefore s and p are coprime)(iv)
Then,gx.t≡rsx·t≡rx.st≡rt≡hmodG(v)
Hence,x·t is the discrete logarithm of h to the base g(vi)
Note that the discrete logarithm problem is at least as hard as our problem since if you can compute discrete logarithms to some baser, you can s and t for given m and m´ such that rs≡m and rt≡m modulo G. Hence, the two problems are equally hard under the assumption that r is of order p.


### 4.2. Key Generation Analysis

In this section, the difficulty of deriving the partial/final secret keys from their respective public keys and final secret key derivation from multiple ciphertexts and partial secret key is analyzed. Additionally, the computational difficulty of guessing the attributes and subsequently generating the secret keys is also discussed.


#### 4.2.1. Partial/Final Secret Key Guessing

The partial and final secret keys in Algorithms1 and 3 are generated based on the secret and shared attributes which are mapped to Zp. The success probability of guessing an attribute is equivalent to the complexity of hashing algorithm H1, i.e., 2n/2 (birthday paradox). For the partial secret key SKAS, the adversary should guess all attributes in set AS and the secret random number r. The secret numbers si which are used in partial key pair generation cannot be derived by collision attack due to its complexity. To be precise, the computational complexity is of the order of number of attributes for hash function and random guessing. This also applies to final public and secret key generation algorithms whereby the shared attributes are hashed and subsequently used in key generation. Additionally, the assumption that each entity possesses a unique set of secret and shared attributes with no overlap with the attribute set of other entities makes attribute guessing more difficult.


#### 4.2.2. Partial/Final Secret Key Generation

The partial secret keySKAS of a CPS device cannot be guessed due to the difficulty of deriving the secret key components si∈AS and r∈Zp in Algorithm 1. So, in order to generate/guess the final secret key, the adversary needs to know the secret key SKAS, shared attribute set AK, and three secret numbers α,ru,tu. α is computed from the secret components s and k in algorithm 3.4.2 whereas ru,tu are random numbers. The secret component s can only be computed and/or known if both the FA node and the CPS device are compromised. The compromised device can leak the shared attribute set and the final secret key SKAK.Theorem 2.
The proposed scheme is secure against an adversaryA with knowledge of the shared attribute set AK for deriving the final SKAK secret key by collision attack.Proof.
Having the knowledge ofAK is not enough for generating the SKAK=u1, where
(23)u1=su−rutumodp.
From Equation (10) in Algorithm3,
(24)1fα,AK=su−rutumodp,where ru and tu are random numbers. The condition in Equation (24) only holds if su and α are known, and subsequently, the values of rutu can be computed. All these values can then be used to solve Equation (23). Another solution to Equation (23) is to correctly guess the random numbers ru,tu and compute α. The difficulty of computing α is already explained in preceding paragraphs. Hence, generating SKAK without knowing secret components ru,tu, su, and α is computationally infeasible for an adversary.


#### 4.2.3. Computing the Secret Keys from Public Keys

It is underlined that the secret keys, either partial or final, cannot be computed from their respective public keys due to the intractability of the elliptic curve discrete logarithm problem (ECDLP). Given two pointsP,Q∈EFq, the ECDLP problem is to find an integer x, if it exists, such that Q=xP. Following the same notion, the problem is to compute partial/final secret SKAS/SKAK keys from public keys PKAS/PKAK. Like in case of SKAS, given the PKAS=Pi=siP for all attributes in AS, the problem is to compute si from its corresponding public key Pi component. The ECDLP problem has to be solved for all attributes in a given attribute set. The same applies to the final secret key SKAK generation from PKAK. For the SKAK, ECDLP is to compute ki from given Ui and Pi. To be precise, due to the intractability of ECDLP, it is not feasible to compute secret keys from public keys.


#### 4.2.4. Computing the Decryption Key from Ciphertext

Additionally, the proposed scheme is secure against an adversary for deriving the decryption keyrmP from the ciphertext CT=ℙ,Um,i,K1m,Cσm,Cm.Theorem 3.
Given the ciphertextCT=ℙ,Um,i,K1m,C1,Cr,Cm, it is hard to compute decryption key rmP.Proof.
A ciphertextCT corresponding to the access policy ℙ consists of the following parameters:
(25)Um,i=rmPi,i=1,2,⋯,n−ℙ,C1=rm∑i=0nfiUi=rmfα,ℙP,Cr=H2km⊕c,Cm=H3c⊕M.Since∑i=1n−ℙUm,i=rmfα,ℙ−f0P, it is hard to compute rmP using C1 due to the difficulty of solving the elliptic curve discrete logarithm problem. Given Um,i=rmUi=rmkPi, i=1,2,⋯,q=n−ℙ, this problem can be reduced to the q−1‐DHI problem as follows. Let Q=αrmP. The parameters are then rewritten Um,i=rmUi=αirmP as Qi=Um,i=αi−1Q, i=1,2,⋯,q. This implies that if an adversary A has the ability to solve the q−1‐DHI problem, he/she can compute the key rmP=1/αQ1=1/αQ and then successfully decrypt the ciphertext CT. The following theorem proves that solving the q−1‐DHI problem is as hard as the q‐GDH problem.Remark 1.
From the above discussion, the proposed scheme is collision resistant against secret keys. As a result, computing the keykm=rmP from a ciphertext CT corresponding to the access policy ℙ without a valid user secret key SKAK is as hard as the q−GDH problem. This implies that given Um,1,Um,2,⋯,Um,q,C1, where q=n−ℙ,T∈G, the q−GDH problem reduces to the q−1−DHI problem and then decides whether T is equal to rmP or a random element in G. But as the q−GDH problem is hard to solve, so would be q−1−DHI. Hence, an adversary cannot derive rmP from C1.


### 4.3. Network Devices Compromise Analysis

Having discussed the difficulty of generating and/or guessing the secret keys, the impact of the compromise of Fog-CPS entities on the proposed security scheme is discussed.


#### 4.3.1. Compromise of FA

The compromise of FA can have drastic impact on the security of the Fog-CPS system. A compromised FA can reveal the partial secret keysSKAS of Fog-CPS entities. An adversary in possession of a partial secret key SKAS and the shared attribute set AK can generate the corresponding final secret key SKAK. After having generated the final secret key, the adversary can also change the attributes agreed with FA and subsequently further compromise the network. However, if the adversary is not aware of the shared attribute set, then it cannot generate the final secret key. Moreover, the actual encryption and decryption is performed using final public and secret keys PKAK/SKAK meaning that the communication between the CPS devices is still secure.


#### 4.3.2. Compromise of CPS Device and Fog Nodes (Leakage of Final Secret Key)

The compromise of CPS devices and fog nodes will only leak their own secret keys. The compromise of one set of secret keys does not risk the messages encrypted under different shared attributes therefore keys. Henceforth, legitimate CPS devices can still communicate securely.


## 4.1. Collision Resistance against Secret Keys

The proposed scheme does not follow the same conventional attribute sharing as the existing ABE schemes. Attributes are only shared between two CPS devices and the FA node. So, the collision attack as presumed in existing schemes does not apply in this case. In other words, the pooling of attributes and secret key components (i.e., the collision attack) from several adversaries who do not share the attributes would not benefit in generating the secret keys. Precisely, for the security of the proposed scheme, the definition of collision resistance is modified.In this case, it is essential to prevent a device from generating the final secret keySKAK of another device.Theorem 1.
It can be shown by a reduction that the computational problem in the proposed scheme is at least as hard as the discrete logarithm problem (DLP).Proof.
AssumeA is an algorithm that efficiently solves our problem. We can use A to compute the discrete logarithm of an element h to the base g as follows:
(i)
InvokeA on input m=g and m´=h(ii)
A will return will return r,s, and t such that rs≡g and rt≡h modulo p(iii)
Now we can compute a numberx such that x·s≡1modG (this can be done efficiently using the extended Euclidean algorithm because p is prime and therefore s and p are coprime)(iv)
Then,gx.t≡rsx·t≡rx.st≡rt≡hmodG(v)
Hence,x·t is the discrete logarithm of h to the base g(vi)
Note that the discrete logarithm problem is at least as hard as our problem since if you can compute discrete logarithms to some baser, you can s and t for given m and m´ such that rs≡m and rt≡m modulo G. Hence, the two problems are equally hard under the assumption that r is of order p.


## 4.2. Key Generation Analysis

In this section, the difficulty of deriving the partial/final secret keys from their respective public keys and final secret key derivation from multiple ciphertexts and partial secret key is analyzed. Additionally, the computational difficulty of guessing the attributes and subsequently generating the secret keys is also discussed.


### 4.2.1. Partial/Final Secret Key Guessing

The partial and final secret keys in Algorithms1 and 3 are generated based on the secret and shared attributes which are mapped to Zp. The success probability of guessing an attribute is equivalent to the complexity of hashing algorithm H1, i.e., 2n/2 (birthday paradox). For the partial secret key SKAS, the adversary should guess all attributes in set AS and the secret random number r. The secret numbers si which are used in partial key pair generation cannot be derived by collision attack due to its complexity. To be precise, the computational complexity is of the order of number of attributes for hash function and random guessing. This also applies to final public and secret key generation algorithms whereby the shared attributes are hashed and subsequently used in key generation. Additionally, the assumption that each entity possesses a unique set of secret and shared attributes with no overlap with the attribute set of other entities makes attribute guessing more difficult.


### 4.2.2. Partial/Final Secret Key Generation

The partial secret keySKAS of a CPS device cannot be guessed due to the difficulty of deriving the secret key components si∈AS and r∈Zp in Algorithm 1. So, in order to generate/guess the final secret key, the adversary needs to know the secret key SKAS, shared attribute set AK, and three secret numbers α,ru,tu. α is computed from the secret components s and k in algorithm 3.4.2 whereas ru,tu are random numbers. The secret component s can only be computed and/or known if both the FA node and the CPS device are compromised. The compromised device can leak the shared attribute set and the final secret key SKAK.Theorem 2.
The proposed scheme is secure against an adversaryA with knowledge of the shared attribute set AK for deriving the final SKAK secret key by collision attack.Proof.
Having the knowledge ofAK is not enough for generating the SKAK=u1, where
(23)u1=su−rutumodp.
From Equation (10) in Algorithm3,
(24)1fα,AK=su−rutumodp,where ru and tu are random numbers. The condition in Equation (24) only holds if su and α are known, and subsequently, the values of rutu can be computed. All these values can then be used to solve Equation (23). Another solution to Equation (23) is to correctly guess the random numbers ru,tu and compute α. The difficulty of computing α is already explained in preceding paragraphs. Hence, generating SKAK without knowing secret components ru,tu, su, and α is computationally infeasible for an adversary.


### 4.2.3. Computing the Secret Keys from Public Keys

It is underlined that the secret keys, either partial or final, cannot be computed from their respective public keys due to the intractability of the elliptic curve discrete logarithm problem (ECDLP). Given two pointsP,Q∈EFq, the ECDLP problem is to find an integer x, if it exists, such that Q=xP. Following the same notion, the problem is to compute partial/final secret SKAS/SKAK keys from public keys PKAS/PKAK. Like in case of SKAS, given the PKAS=Pi=siP for all attributes in AS, the problem is to compute si from its corresponding public key Pi component. The ECDLP problem has to be solved for all attributes in a given attribute set. The same applies to the final secret key SKAK generation from PKAK. For the SKAK, ECDLP is to compute ki from given Ui and Pi. To be precise, due to the intractability of ECDLP, it is not feasible to compute secret keys from public keys.


### 4.2.4. Computing the Decryption Key from Ciphertext

Additionally, the proposed scheme is secure against an adversary for deriving the decryption keyrmP from the ciphertext CT=ℙ,Um,i,K1m,Cσm,Cm.Theorem 3.
Given the ciphertextCT=ℙ,Um,i,K1m,C1,Cr,Cm, it is hard to compute decryption key rmP.Proof.
A ciphertextCT corresponding to the access policy ℙ consists of the following parameters:
(25)Um,i=rmPi,i=1,2,⋯,n−ℙ,C1=rm∑i=0nfiUi=rmfα,ℙP,Cr=H2km⊕c,Cm=H3c⊕M.Since∑i=1n−ℙUm,i=rmfα,ℙ−f0P, it is hard to compute rmP using C1 due to the difficulty of solving the elliptic curve discrete logarithm problem. Given Um,i=rmUi=rmkPi, i=1,2,⋯,q=n−ℙ, this problem can be reduced to the q−1‐DHI problem as follows. Let Q=αrmP. The parameters are then rewritten Um,i=rmUi=αirmP as Qi=Um,i=αi−1Q, i=1,2,⋯,q. This implies that if an adversary A has the ability to solve the q−1‐DHI problem, he/she can compute the key rmP=1/αQ1=1/αQ and then successfully decrypt the ciphertext CT. The following theorem proves that solving the q−1‐DHI problem is as hard as the q‐GDH problem.Remark 1.
From the above discussion, the proposed scheme is collision resistant against secret keys. As a result, computing the keykm=rmP from a ciphertext CT corresponding to the access policy ℙ without a valid user secret key SKAK is as hard as the q−GDH problem. This implies that given Um,1,Um,2,⋯,Um,q,C1, where q=n−ℙ,T∈G, the q−GDH problem reduces to the q−1−DHI problem and then decides whether T is equal to rmP or a random element in G. But as the q−GDH problem is hard to solve, so would be q−1−DHI. Hence, an adversary cannot derive rmP from C1.


## 4.2.1. Partial/Final Secret Key Guessing

The partial and final secret keys in Algorithms1 and 3 are generated based on the secret and shared attributes which are mapped to Zp. The success probability of guessing an attribute is equivalent to the complexity of hashing algorithm H1, i.e., 2n/2 (birthday paradox). For the partial secret key SKAS, the adversary should guess all attributes in set AS and the secret random number r. The secret numbers si which are used in partial key pair generation cannot be derived by collision attack due to its complexity. To be precise, the computational complexity is of the order of number of attributes for hash function and random guessing. This also applies to final public and secret key generation algorithms whereby the shared attributes are hashed and subsequently used in key generation. Additionally, the assumption that each entity possesses a unique set of secret and shared attributes with no overlap with the attribute set of other entities makes attribute guessing more difficult.


## 4.2.2. Partial/Final Secret Key Generation

The partial secret keySKAS of a CPS device cannot be guessed due to the difficulty of deriving the secret key components si∈AS and r∈Zp in Algorithm 1. So, in order to generate/guess the final secret key, the adversary needs to know the secret key SKAS, shared attribute set AK, and three secret numbers α,ru,tu. α is computed from the secret components s and k in algorithm 3.4.2 whereas ru,tu are random numbers. The secret component s can only be computed and/or known if both the FA node and the CPS device are compromised. The compromised device can leak the shared attribute set and the final secret key SKAK.Theorem 2.
The proposed scheme is secure against an adversaryA with knowledge of the shared attribute set AK for deriving the final SKAK secret key by collision attack.Proof.
Having the knowledge ofAK is not enough for generating the SKAK=u1, where
(23)u1=su−rutumodp.
From Equation (10) in Algorithm3,
(24)1fα,AK=su−rutumodp,where ru and tu are random numbers. The condition in Equation (24) only holds if su and α are known, and subsequently, the values of rutu can be computed. All these values can then be used to solve Equation (23). Another solution to Equation (23) is to correctly guess the random numbers ru,tu and compute α. The difficulty of computing α is already explained in preceding paragraphs. Hence, generating SKAK without knowing secret components ru,tu, su, and α is computationally infeasible for an adversary.


## 4.2.3. Computing the Secret Keys from Public Keys

It is underlined that the secret keys, either partial or final, cannot be computed from their respective public keys due to the intractability of the elliptic curve discrete logarithm problem (ECDLP). Given two pointsP,Q∈EFq, the ECDLP problem is to find an integer x, if it exists, such that Q=xP. Following the same notion, the problem is to compute partial/final secret SKAS/SKAK keys from public keys PKAS/PKAK. Like in case of SKAS, given the PKAS=Pi=siP for all attributes in AS, the problem is to compute si from its corresponding public key Pi component. The ECDLP problem has to be solved for all attributes in a given attribute set. The same applies to the final secret key SKAK generation from PKAK. For the SKAK, ECDLP is to compute ki from given Ui and Pi. To be precise, due to the intractability of ECDLP, it is not feasible to compute secret keys from public keys.


## 4.2.4. Computing the Decryption Key from Ciphertext

Additionally, the proposed scheme is secure against an adversary for deriving the decryption keyrmP from the ciphertext CT=ℙ,Um,i,K1m,Cσm,Cm.Theorem 3.
Given the ciphertextCT=ℙ,Um,i,K1m,C1,Cr,Cm, it is hard to compute decryption key rmP.Proof.
A ciphertextCT corresponding to the access policy ℙ consists of the following parameters:
(25)Um,i=rmPi,i=1,2,⋯,n−ℙ,C1=rm∑i=0nfiUi=rmfα,ℙP,Cr=H2km⊕c,Cm=H3c⊕M.Since∑i=1n−ℙUm,i=rmfα,ℙ−f0P, it is hard to compute rmP using C1 due to the difficulty of solving the elliptic curve discrete logarithm problem. Given Um,i=rmUi=rmkPi, i=1,2,⋯,q=n−ℙ, this problem can be reduced to the q−1‐DHI problem as follows. Let Q=αrmP. The parameters are then rewritten Um,i=rmUi=αirmP as Qi=Um,i=αi−1Q, i=1,2,⋯,q. This implies that if an adversary A has the ability to solve the q−1‐DHI problem, he/she can compute the key rmP=1/αQ1=1/αQ and then successfully decrypt the ciphertext CT. The following theorem proves that solving the q−1‐DHI problem is as hard as the q‐GDH problem.Remark 1.
From the above discussion, the proposed scheme is collision resistant against secret keys. As a result, computing the keykm=rmP from a ciphertext CT corresponding to the access policy ℙ without a valid user secret key SKAK is as hard as the q−GDH problem. This implies that given Um,1,Um,2,⋯,Um,q,C1, where q=n−ℙ,T∈G, the q−GDH problem reduces to the q−1−DHI problem and then decides whether T is equal to rmP or a random element in G. But as the q−GDH problem is hard to solve, so would be q−1−DHI. Hence, an adversary cannot derive rmP from C1.


## 4.3. Network Devices Compromise Analysis

Having discussed the difficulty of generating and/or guessing the secret keys, the impact of the compromise of Fog-CPS entities on the proposed security scheme is discussed.


### 4.3.1. Compromise of FA

The compromise of FA can have drastic impact on the security of the Fog-CPS system. A compromised FA can reveal the partial secret keysSKAS of Fog-CPS entities. An adversary in possession of a partial secret key SKAS and the shared attribute set AK can generate the corresponding final secret key SKAK. After having generated the final secret key, the adversary can also change the attributes agreed with FA and subsequently further compromise the network. However, if the adversary is not aware of the shared attribute set, then it cannot generate the final secret key. Moreover, the actual encryption and decryption is performed using final public and secret keys PKAK/SKAK meaning that the communication between the CPS devices is still secure.


### 4.3.2. Compromise of CPS Device and Fog Nodes (Leakage of Final Secret Key)

The compromise of CPS devices and fog nodes will only leak their own secret keys. The compromise of one set of secret keys does not risk the messages encrypted under different shared attributes therefore keys. Henceforth, legitimate CPS devices can still communicate securely.


## 4.3.1. Compromise of FA

The compromise of FA can have drastic impact on the security of the Fog-CPS system. A compromised FA can reveal the partial secret keysSKAS of Fog-CPS entities. An adversary in possession of a partial secret key SKAS and the shared attribute set AK can generate the corresponding final secret key SKAK. After having generated the final secret key, the adversary can also change the attributes agreed with FA and subsequently further compromise the network. However, if the adversary is not aware of the shared attribute set, then it cannot generate the final secret key. Moreover, the actual encryption and decryption is performed using final public and secret keys PKAK/SKAK meaning that the communication between the CPS devices is still secure.


## 4.3.2. Compromise of CPS Device and Fog Nodes (Leakage of Final Secret Key)

The compromise of CPS devices and fog nodes will only leak their own secret keys. The compromise of one set of secret keys does not risk the messages encrypted under different shared attributes therefore keys. Henceforth, legitimate CPS devices can still communicate securely.


## 5. Experimental Evaluation

To evaluate the performance of the proposed scheme, its algorithmic efficiency in terms of processing time and memory complexity is measured.


### 5.1. System Configurations

For benchmarking the time complexity, two sets of experiments are conducted to demonstrate the effectiveness of the proposed scheme on both resource-limited CPS devices and resourceful fog nodes. In thefirst experiment, the scheme is evaluated on a Raspberry Pi 3B+ model (CPS devices). It has a Quad Core 1.2 GHz, 64-bit CPU, 1 GB of RAM, a wireless LAN and Bluetooth Low Energy (BLE) on board, 100 Base Ethernet, 40-pin extended GPIO, 4 USB ports, HDMI, and micro SD port. In the second experiment, it is executed on a virtual machine running Ubuntu R16.04 with Python 3.6.4. on Intel (R) Core(TM) i5-4310U CPU@2.000 GHz with 8.0 GB RAM (fog nodes).


### 5.2. Implementation and Evaluation

The Fog-CPS scheme is compared with five other ABE schemes in Guo et al. [6], Odelu and Das [8], Cheng et al. [12], Yamada et al. [14], and Zhou et al. [9] using the Charm crypto library [15]. All security schemes, including this, are based on a selective security model. It is noted that the proposed scheme is not based on bilinear elliptic curves and can be implemented on any elliptic curve. However, in order to compare the scheme with existing ABE schemes which are based on bilinear maps, it is implemented on bilinear curves, i.e., MNT159 and SS512. On other curves, namely, prime192v1 and secp224r1, the memory overhead would be less. The proposed scheme and two others in Guo et al. [6] and Odelu and Das [8] are tested on a non-super-singular asymmetric bilinear curve (i.e., MNT159), whilst three of the schemes [9, 12, 14] have been tested on the super-singular SS512 curve. Both SS512 and MNT159 curves provide 80-bit security.


### 5.3. Timing Results

The execution times of all algorithms are benchmarked to compare the efficiency of different schemes. In the existing schemes in Guo et al. [6], Odelu and Das [8], Cheng et al. [12], Yamada et al. [14], and Zhou et al. [9], the Setup and KeyGen algorithms are separate. But, since there is no Setup in the Fog-CPS scheme, the execution time of both these algorithms is added and compared with the timing of the final public and secret key generation. To be precise, the final key pair generation timing of this scheme is the sum of the execution times of Algorithms 2 and 3.ForSetup and KeyGen, three different sizes of attribute universe U and user attribute sets A are considered. To be precise, an attribute universe U of 10, 20, and 30 attributes has been implemented for measuring the timing of the Setup algorithm. Likewise, for the secret key generation, a user attribute set A of 5, 15, and 25 attributes is taken into consideration.Additionally, the encryption and decryption algorithms are also implemented to demonstrate that they are more efficient than the ones in Odelu and Das [8] because this scheme uses lesser elliptic curve group elements. Another reason to implement the encryption and decryption algorithms was to measure their execution timings on the Raspberry Pi, i.e., CPS devices. Henceforth, two types of benchmarks are set for measuring the times for encryption and decryption: (1) 1 kilobyte (1 kB) and (2) 1 megabyte (1 MB). These two low size messages are used because CPS devices and cloud requests are usually transmitted in low size messages. Furthermore, in the encryption algorithm, an access policy ℙ of constant size, i.e., 5 attributes, is considered. For the key update, there are two cases with an increment and decrement of one attribute, i.e., t±1. However, in our experimental evaluation, the execution time for key update is recorded in case of t+1 attributes only.Tables3–5 list the processing times of all algorithms for the first and second experiments for attribute U of 10, 20, and 30, respectively. Additionally, graphs (see Figures 3–10) are also plotted for the results of the first experiment.Table 3
Processing times (sec)U=10.
SchemesSetup+KeyGen (final KeyGen)Encrypt (1 kB)Decrypt (1 kB)Encrypt (1 MB)Decrypt (1 MB)First experimentGuo et al. [6]0.270.150.59175.09696.16Odelu and Das [8]0.180.300.08326.791.9Cheng et al. [12]0.360.180.31212.3367.5Yamada et al. [14]0.631.541.831547.51838.3Zhou et al. [9]0.130.120.94153.21118.5Fog-CPS scheme0.020.200.035252.243.11Second experimentGuo et al. [6]0.0340.020.0524.2162.65Odelu and Das [8]0.030.090.0296.7127.28Cheng et al. [12]0.050.030.0234.8932.58Yamada et al. [14]0.230.560.26564.66288.43Zhou et al. [9]0.050.200.1220.21119.75Fog-CPS scheme0.0080.060.0165.2911.14Table 4
Processing times (sec)U=20.
SchemesSetup+KeyGen (final KeyGen)Encrypt (1 kB)Decrypt (1 kB)Encrypt (1 MB)Decrypt (1 MB)First experimentGuo et al. [6]0.320.150.62184.29740.01Odelu and Das [8]0.360.310.08377.4105.8Cheng et al. [12]0.680.240.37275.4416.5Yamada et al. [14]1.161.551.841595.21822.3Zhou et al. [9]0.190.120.94153.91123.7Fog-CPS scheme0.060.240.04253.243.28Second experimentGuo et al. [6]0.0340.020.0524.4963.09Odelu and Das [8]0.050.090.0299.2127.87Cheng et al. [12]0.090.040.0336.8534.88Yamada et al. [14]0.410.880.38911.76383.99Zhou et al. [9]0.080.020.1120.18119.57Fog-CPS scheme0.0170.060.01165.4711.26Table 5
Processing times (sec)U=30.
SchemesSetup+KeyGen (final KeyGen)Encrypt (1 kB)Decrypt (1 kB)Encrypt (1 MB)Decrypt (1 MB)First experimentGuo et al. [6]0.370.160.68186.78740.01Odelu and Das [8]0.520.320.09375.0105.61Cheng et al. [12]1.00.310.42361.21515.24Yamada et al. [14]1.691.551.841533.41838.8Zhou et al. [9]0.310.151.10154.21128.2Fog-CPS scheme0.100.240.04253.743.28Second experimentGuo et al. [6]0.0450.020.0524.4963.09Odelu and Das [8]0.070.080.0297.6427.97Cheng et al. [12]0.110.040.0339.8436.10Yamada et al. [14]0.621.380.591330.16580.92Zhou et al. [9]0.100.020.1120.18119.57Fog-CPS scheme0.0270.060.0165.7612.92Figure 3
Final key pair generation Fog-CPS scheme (Algorithms2 and 3) and Setup+KeyGen (other schemes).Figure 4
Partial key generation (Algorithm2).Figure 5
Final key update (Algorithms5 and 6).Figure 6
Partial key update (Algorithm4).Figure 7
Processing time (sec) for encryption algorithm (1 kB).Figure 8
Processing time (sec) for encryption algorithm (1 MB).Figure 9
Processing time (sec) for decryption algorithm (1 kB).Figure 10
Processing time (sec) for decryption algorithm (1 MB).


#### 5.3.1. First Experiment

In this experiment, our implementations are carried out on the Raspberry Pi 3B+ model. Timing results are shown in Figures3–10. From Figure 3, it can be observed that the Fog-CPS scheme takes 0.02 sec for the final key pair generation over 10 attributes, 0.06 sec over 20 attributes, and 0.10 sec over 30 attributes. Additionally, Figure 4 shows the partial key pair generation timings and Figures 5 and 6 show the final and partial key pair update timings of the Fog-CPS scheme. It can be observed that key pair update timings of this scheme are negligible due to the lightweight and efficient process. Figures 7 and 8 show the timings of encryption; this scheme takes 0.20 and 252.3 sec to encrypt a message of 1 kB and 1 MB, respectively. Similarly, for decrypting a ciphertext of 1 kB and 1 MB, it takes 0.03 sec and 43.1 sec as shown in Figures 9 and 10, respectively.


#### 5.3.2. Second Experiment

In the second experiment, the implementations are executed on a desktop computer (configurations are mentioned in Section5.1). Tables 3–5 list the timing results of the final key pair generation, encryption, decryption, and key pair updates. Overall, it is observed that benchmarks recorded on the Raspberry Pi 3B+ model are slower than on the desktop computer. Comparing the timings of both experiments in Table 3, it is noted that the proposed scheme is slower on the Raspberry Pi. But it is still the fastest compared to the rest of the schemes as it only takes 0.008, 0.017, and 0.02 seconds for an attribute universe of 10, 20, and 30 attributes, respectively.Analyzing the processing times for encryption of 1 kB and 1 MB messages, it can be observed that the encryption timing of the schemes by Zhou et al. [9] and Yamada et al. [14] is almost equal and they are faster than rest of the schemes, followed by the scheme of Cheng et al. [12].The Fog-CPS scheme is three times slower whereas the scheme by Odelu and Das [8] is four times slower than the schemes by Zhou et al. [9] and Guo et al. [6]. Likewise, the Fog-CPS security scheme is 10 times faster than the scheme by Yamada et al. [14] which is the slowest of all schemes. Comparing the timings of encryption and decryption, it is observed that in the case of encryption, the proposed scheme is a bit slower than three of the other schemes. However, in decryption, this scheme is the fastest of all; it takes only 0.01 seconds for encryption of the 1 kB message. Following the same trend as in encryption, the scheme by Yamada et al. [14] is the slowest of all the other schemes in decryption as well. Furthermore, it can be observed that for decryption of the 1 kB message, the execution time of the scheme by Odelu and Das [8] is almost equal to that by Cheng et al. [12].


### 5.4. Memory Overhead

Table6 shows the calculation of the memory overhead of each scheme. In the MNT159 curve, one group element in G and G1 takes 2×160=320 bits whereas one group element in GT takes 2×512=1024 bits. Likewise, in the SS512 curve, one group element in G1 takes 2×512=1024 bits whereas one group element in GT takes 2×1024=2048 bits.Table 6
Memory overhead.
SchemesSetupKeyGenEncryptDecryptKey updateBytesFog-CPS schemePKAS=n+1GSKAS=1×OPn−ℙ+2GM2×OP+2G1340Odelu and Das [8]PK=3n+1GSK=2×OPnℙ+3G+LMN/A1760Guo et al. [6]PK=2n+1G1+GTMSK=G1SK=2G1n−ℙ+2G1+GTMN/A1636Zhou et al. [9]PK=6n+1G1MSK=2ZpSK=2A+1G12G1+GTMN/A9876Yamada et al. [14]PK=6G1+GTMSK=2ZpSK=4A+2G13ℙ+1G1MN/A6292Cheng et al. [12]PK=2nG1+2GTMSK=2nG1SK=A+1G12G1+GTGTN/A6932Note:G1 and GT: prime order pairing groups (160 bits); exp: exponent operation; p¨: pairing operation; A and ℙ: no. of attributes in secret key and access policy; G: elliptic curve group defined over finite field Zp; OP: order of the base point (160 bits in Zp); L: length of plaintext message M.The columnBytes represents the total number of bytes required in all algorithms (i.e., Setup, KeyGen, Encrypt, Decrypt, and KeyRevoke) for an attribute universe U of 10 and an access policy ℙ of 5 attributes. In the case of the proposed scheme, the memory overhead of one partial and final key pair generation and one key update in both cases is also considered when calculating the number of bytes required by each algorithm.The proposed Fog-CPS scheme is lightweight than the Odelu and Das [8] scheme as it requires fewer elliptic curve group elements. Our scheme requires 2n+1 elements in G for generation of both partial and final public keys whereas the scheme by Odelu and Das [8] requires 3n+1 elements for the public key. Likewise, for partial and final secret keys, our scheme requires only two secret elements in the finite field Zp, whereas the scheme by Odelu and Das [8] requires three. The length of CT in our scheme is n−ℙ+2 group G elements whereas n−ℙ+3 in the scheme by Odelu and Das [8].As can be seen in Table6, the Fog-CPS scheme has the lowest memory overhead, i.e., 1340 bytes followed by the Guo et al. [6] and Odelu and Das [8] schemes which take 1636 and 1760 bytes, respectively. The Zhou et al. [9] scheme incurs the highest overhead of 9876 bytes. It is noted that for the proposed scheme, the memory overhead of one final public and secret key over a shared attribute set Ak=10 has also been considered. Moreover, for the Setup and KeyGen algorithms, i.e., partial key pair generation in this case, the Fog-CPS scheme has the lowest overhead compared to all other schemes. The final secret key in the proposed scheme only requires one element of the order of base point on the elliptic curve G.In the Guo et al. [6] scheme, there are 2n+1 elements in G1 and one in GT for PK, two elements in G1 for SK, and n−ℙ+2 elements in G1 for CT. In the Zhou et al. [9] scheme, there are 6n+1G1 and 2A+1 group elements in PK and SK, respectively, whereas CT has 2 group elements in G1 and one in GT. The PK in the Cheng et al. [12] scheme has 2n elements in G1 and two in GT; the SK has A+1 elements in G1, whereas the CT has 2 elements in G1 and one in GT. In the Yamada et al. [14] scheme, PK contains 6 elements in G1 and one in GT, SK contains 4A+2 elements in G1, and CT contains 3ℙ+1 in G1. The Zhou et al. [9] scheme has the highest memory overhead followed by the Cheng et al. [12] and Yamada et al. [14] schemes. Both the Zhou et al. [9] and Cheng et al. [12] schemes have constant size ciphertexts which only require 2 group elements in G1 and one element in GT. The CT in the Fog-CPS scheme and the Guo et al. [6] scheme have almost the same number of elements. In the key update Algorithms 4–6, this scheme only requires 2 elements in G and 2 elements of the order of base point on the elliptic curve G.


### 5.5. Computational Overhead

The computational overhead of all schemes is summarized in Table7. The column Total operations represents the total number of operations by considering all algorithms, i.e., Setup, KeyGen, Encrypt, and Decrypt. In the proposed scheme, the computational overhead of one partial and final key pair generation and update are also considered. From Table 7, it is observed that the Fog-CPS scheme introduces the lowest computational overhead than all other schemes which are based on bilinear maps and elliptic curves.Table 7
Computational overhead.
SchemesSetupKeyGenEncryptDecryptKeyRevokeTotal operationsFog-CPS schemen+1ecmN/An−ℙ+1ecmn−ℙ+2ecm2ecm37ecmOdelu and Das [8]3n+1ecmN/An−ℙ+2ecmn−ℙ+3ecmN/A48ecmGuo et al. [6]2nexp+p¨2expn−ℙ+3exp+p¨2n−ℙ+4exp+4p¨N/A44exp+6p¨Zhou et al. [9]6n+1exp2A+1exp3exp+p¨2ℙ+1exp+2ℙ+1p¨N/A96exp+12p¨Yamada et al. [14]1exp4A+2exp3ℙ+1exp2ℙexp+2ℙp¨N/A69exp+10p¨Cheng et al. [12]nexp+np¨Aexp3exp2p¨N/A23exp+12p¨Note:exp: exponentiation operation; p¨: pairing operation; ecm: scalar point multiplication in the elliptic curve group G.For partial and final public key generation, the Fog-CPS scheme requires2n+2 scalar multiplications in the elliptic curve group G. Likewise, for Encrypt and Decrypt, n−ℙ+1 and n−ℙ+2 scalar point multiplications are required, respectively. Moreover, in the key update algorithms, i.e., 4, 5, and 6, this scheme only requires two scalar multiplications.For theSetup and KeyGen algorithms, the Guo et al. [6] scheme requires 2n+2 exponentiations and 1 pairing operation, respectively. In addition, the Encrypt algorithm requires n−ℙ+3 exponentiations and a single pairing whereas Decrypt requires 2n−ℙ+4 exponentiations and 4 pairing operations. The Setup and KeyGen algorithms in the Zhou et al. [9] scheme require 6n+1 and 2A+1 exponentiation operations, respectively. Similarly, for Encrypt, it requires 3 exponentiations and 1 pairing, whereas for Decrypt, 2ℙ+1 exponentiation and pairing operations are required. Moreover, for the Setup and KeyGen algorithms, the Cheng et al. [12] scheme requires n+A exponentiation and n pairing operations. On the contrary, it requires 3 exponentiation and 2 pairing operations for the Encrypt and Decrypt algorithms, respectively. In the Yamada et al. [14] scheme, 4A+3 exponentiations are required for both the Setup and KeyGen algorithms. However, the Encrypt algorithm requires 3ℙ+1 exponentiations and Decrypt requires 2ℙ exponentiation and pairing operations.


## 5.1. System Configurations

For benchmarking the time complexity, two sets of experiments are conducted to demonstrate the effectiveness of the proposed scheme on both resource-limited CPS devices and resourceful fog nodes. In thefirst experiment, the scheme is evaluated on a Raspberry Pi 3B+ model (CPS devices). It has a Quad Core 1.2 GHz, 64-bit CPU, 1 GB of RAM, a wireless LAN and Bluetooth Low Energy (BLE) on board, 100 Base Ethernet, 40-pin extended GPIO, 4 USB ports, HDMI, and micro SD port. In the second experiment, it is executed on a virtual machine running Ubuntu R16.04 with Python 3.6.4. on Intel (R) Core(TM) i5-4310U CPU@2.000 GHz with 8.0 GB RAM (fog nodes).


## 5.2. Implementation and Evaluation

The Fog-CPS scheme is compared with five other ABE schemes in Guo et al. [6], Odelu and Das [8], Cheng et al. [12], Yamada et al. [14], and Zhou et al. [9] using the Charm crypto library [15]. All security schemes, including this, are based on a selective security model. It is noted that the proposed scheme is not based on bilinear elliptic curves and can be implemented on any elliptic curve. However, in order to compare the scheme with existing ABE schemes which are based on bilinear maps, it is implemented on bilinear curves, i.e., MNT159 and SS512. On other curves, namely, prime192v1 and secp224r1, the memory overhead would be less. The proposed scheme and two others in Guo et al. [6] and Odelu and Das [8] are tested on a non-super-singular asymmetric bilinear curve (i.e., MNT159), whilst three of the schemes [9, 12, 14] have been tested on the super-singular SS512 curve. Both SS512 and MNT159 curves provide 80-bit security.


## 5.3. Timing Results

The execution times of all algorithms are benchmarked to compare the efficiency of different schemes. In the existing schemes in Guo et al. [6], Odelu and Das [8], Cheng et al. [12], Yamada et al. [14], and Zhou et al. [9], the Setup and KeyGen algorithms are separate. But, since there is no Setup in the Fog-CPS scheme, the execution time of both these algorithms is added and compared with the timing of the final public and secret key generation. To be precise, the final key pair generation timing of this scheme is the sum of the execution times of Algorithms 2 and 3.ForSetup and KeyGen, three different sizes of attribute universe U and user attribute sets A are considered. To be precise, an attribute universe U of 10, 20, and 30 attributes has been implemented for measuring the timing of the Setup algorithm. Likewise, for the secret key generation, a user attribute set A of 5, 15, and 25 attributes is taken into consideration.Additionally, the encryption and decryption algorithms are also implemented to demonstrate that they are more efficient than the ones in Odelu and Das [8] because this scheme uses lesser elliptic curve group elements. Another reason to implement the encryption and decryption algorithms was to measure their execution timings on the Raspberry Pi, i.e., CPS devices. Henceforth, two types of benchmarks are set for measuring the times for encryption and decryption: (1) 1 kilobyte (1 kB) and (2) 1 megabyte (1 MB). These two low size messages are used because CPS devices and cloud requests are usually transmitted in low size messages. Furthermore, in the encryption algorithm, an access policy ℙ of constant size, i.e., 5 attributes, is considered. For the key update, there are two cases with an increment and decrement of one attribute, i.e., t±1. However, in our experimental evaluation, the execution time for key update is recorded in case of t+1 attributes only.Tables3–5 list the processing times of all algorithms for the first and second experiments for attribute U of 10, 20, and 30, respectively. Additionally, graphs (see Figures 3–10) are also plotted for the results of the first experiment.Table 3
Processing times (sec)U=10.
SchemesSetup+KeyGen (final KeyGen)Encrypt (1 kB)Decrypt (1 kB)Encrypt (1 MB)Decrypt (1 MB)First experimentGuo et al. [6]0.270.150.59175.09696.16Odelu and Das [8]0.180.300.08326.791.9Cheng et al. [12]0.360.180.31212.3367.5Yamada et al. [14]0.631.541.831547.51838.3Zhou et al. [9]0.130.120.94153.21118.5Fog-CPS scheme0.020.200.035252.243.11Second experimentGuo et al. [6]0.0340.020.0524.2162.65Odelu and Das [8]0.030.090.0296.7127.28Cheng et al. [12]0.050.030.0234.8932.58Yamada et al. [14]0.230.560.26564.66288.43Zhou et al. [9]0.050.200.1220.21119.75Fog-CPS scheme0.0080.060.0165.2911.14Table 4
Processing times (sec)U=20.
SchemesSetup+KeyGen (final KeyGen)Encrypt (1 kB)Decrypt (1 kB)Encrypt (1 MB)Decrypt (1 MB)First experimentGuo et al. [6]0.320.150.62184.29740.01Odelu and Das [8]0.360.310.08377.4105.8Cheng et al. [12]0.680.240.37275.4416.5Yamada et al. [14]1.161.551.841595.21822.3Zhou et al. [9]0.190.120.94153.91123.7Fog-CPS scheme0.060.240.04253.243.28Second experimentGuo et al. [6]0.0340.020.0524.4963.09Odelu and Das [8]0.050.090.0299.2127.87Cheng et al. [12]0.090.040.0336.8534.88Yamada et al. [14]0.410.880.38911.76383.99Zhou et al. [9]0.080.020.1120.18119.57Fog-CPS scheme0.0170.060.01165.4711.26Table 5
Processing times (sec)U=30.
SchemesSetup+KeyGen (final KeyGen)Encrypt (1 kB)Decrypt (1 kB)Encrypt (1 MB)Decrypt (1 MB)First experimentGuo et al. [6]0.370.160.68186.78740.01Odelu and Das [8]0.520.320.09375.0105.61Cheng et al. [12]1.00.310.42361.21515.24Yamada et al. [14]1.691.551.841533.41838.8Zhou et al. [9]0.310.151.10154.21128.2Fog-CPS scheme0.100.240.04253.743.28Second experimentGuo et al. [6]0.0450.020.0524.4963.09Odelu and Das [8]0.070.080.0297.6427.97Cheng et al. [12]0.110.040.0339.8436.10Yamada et al. [14]0.621.380.591330.16580.92Zhou et al. [9]0.100.020.1120.18119.57Fog-CPS scheme0.0270.060.0165.7612.92Figure 3
Final key pair generation Fog-CPS scheme (Algorithms2 and 3) and Setup+KeyGen (other schemes).Figure 4
Partial key generation (Algorithm2).Figure 5
Final key update (Algorithms5 and 6).Figure 6
Partial key update (Algorithm4).Figure 7
Processing time (sec) for encryption algorithm (1 kB).Figure 8
Processing time (sec) for encryption algorithm (1 MB).Figure 9
Processing time (sec) for decryption algorithm (1 kB).Figure 10
Processing time (sec) for decryption algorithm (1 MB).


### 5.3.1. First Experiment

In this experiment, our implementations are carried out on the Raspberry Pi 3B+ model. Timing results are shown in Figures3–10. From Figure 3, it can be observed that the Fog-CPS scheme takes 0.02 sec for the final key pair generation over 10 attributes, 0.06 sec over 20 attributes, and 0.10 sec over 30 attributes. Additionally, Figure 4 shows the partial key pair generation timings and Figures 5 and 6 show the final and partial key pair update timings of the Fog-CPS scheme. It can be observed that key pair update timings of this scheme are negligible due to the lightweight and efficient process. Figures 7 and 8 show the timings of encryption; this scheme takes 0.20 and 252.3 sec to encrypt a message of 1 kB and 1 MB, respectively. Similarly, for decrypting a ciphertext of 1 kB and 1 MB, it takes 0.03 sec and 43.1 sec as shown in Figures 9 and 10, respectively.


### 5.3.2. Second Experiment

In the second experiment, the implementations are executed on a desktop computer (configurations are mentioned in Section5.1). Tables 3–5 list the timing results of the final key pair generation, encryption, decryption, and key pair updates. Overall, it is observed that benchmarks recorded on the Raspberry Pi 3B+ model are slower than on the desktop computer. Comparing the timings of both experiments in Table 3, it is noted that the proposed scheme is slower on the Raspberry Pi. But it is still the fastest compared to the rest of the schemes as it only takes 0.008, 0.017, and 0.02 seconds for an attribute universe of 10, 20, and 30 attributes, respectively.Analyzing the processing times for encryption of 1 kB and 1 MB messages, it can be observed that the encryption timing of the schemes by Zhou et al. [9] and Yamada et al. [14] is almost equal and they are faster than rest of the schemes, followed by the scheme of Cheng et al. [12].The Fog-CPS scheme is three times slower whereas the scheme by Odelu and Das [8] is four times slower than the schemes by Zhou et al. [9] and Guo et al. [6]. Likewise, the Fog-CPS security scheme is 10 times faster than the scheme by Yamada et al. [14] which is the slowest of all schemes. Comparing the timings of encryption and decryption, it is observed that in the case of encryption, the proposed scheme is a bit slower than three of the other schemes. However, in decryption, this scheme is the fastest of all; it takes only 0.01 seconds for encryption of the 1 kB message. Following the same trend as in encryption, the scheme by Yamada et al. [14] is the slowest of all the other schemes in decryption as well. Furthermore, it can be observed that for decryption of the 1 kB message, the execution time of the scheme by Odelu and Das [8] is almost equal to that by Cheng et al. [12].


## 5.3.1. First Experiment

In this experiment, our implementations are carried out on the Raspberry Pi 3B+ model. Timing results are shown in Figures3–10. From Figure 3, it can be observed that the Fog-CPS scheme takes 0.02 sec for the final key pair generation over 10 attributes, 0.06 sec over 20 attributes, and 0.10 sec over 30 attributes. Additionally, Figure 4 shows the partial key pair generation timings and Figures 5 and 6 show the final and partial key pair update timings of the Fog-CPS scheme. It can be observed that key pair update timings of this scheme are negligible due to the lightweight and efficient process. Figures 7 and 8 show the timings of encryption; this scheme takes 0.20 and 252.3 sec to encrypt a message of 1 kB and 1 MB, respectively. Similarly, for decrypting a ciphertext of 1 kB and 1 MB, it takes 0.03 sec and 43.1 sec as shown in Figures 9 and 10, respectively.


## 5.3.2. Second Experiment

In the second experiment, the implementations are executed on a desktop computer (configurations are mentioned in Section5.1). Tables 3–5 list the timing results of the final key pair generation, encryption, decryption, and key pair updates. Overall, it is observed that benchmarks recorded on the Raspberry Pi 3B+ model are slower than on the desktop computer. Comparing the timings of both experiments in Table 3, it is noted that the proposed scheme is slower on the Raspberry Pi. But it is still the fastest compared to the rest of the schemes as it only takes 0.008, 0.017, and 0.02 seconds for an attribute universe of 10, 20, and 30 attributes, respectively.Analyzing the processing times for encryption of 1 kB and 1 MB messages, it can be observed that the encryption timing of the schemes by Zhou et al. [9] and Yamada et al. [14] is almost equal and they are faster than rest of the schemes, followed by the scheme of Cheng et al. [12].The Fog-CPS scheme is three times slower whereas the scheme by Odelu and Das [8] is four times slower than the schemes by Zhou et al. [9] and Guo et al. [6]. Likewise, the Fog-CPS security scheme is 10 times faster than the scheme by Yamada et al. [14] which is the slowest of all schemes. Comparing the timings of encryption and decryption, it is observed that in the case of encryption, the proposed scheme is a bit slower than three of the other schemes. However, in decryption, this scheme is the fastest of all; it takes only 0.01 seconds for encryption of the 1 kB message. Following the same trend as in encryption, the scheme by Yamada et al. [14] is the slowest of all the other schemes in decryption as well. Furthermore, it can be observed that for decryption of the 1 kB message, the execution time of the scheme by Odelu and Das [8] is almost equal to that by Cheng et al. [12].


## 5.4. Memory Overhead

Table6 shows the calculation of the memory overhead of each scheme. In the MNT159 curve, one group element in G and G1 takes 2×160=320 bits whereas one group element in GT takes 2×512=1024 bits. Likewise, in the SS512 curve, one group element in G1 takes 2×512=1024 bits whereas one group element in GT takes 2×1024=2048 bits.Table 6
Memory overhead.
SchemesSetupKeyGenEncryptDecryptKey updateBytesFog-CPS schemePKAS=n+1GSKAS=1×OPn−ℙ+2GM2×OP+2G1340Odelu and Das [8]PK=3n+1GSK=2×OPnℙ+3G+LMN/A1760Guo et al. [6]PK=2n+1G1+GTMSK=G1SK=2G1n−ℙ+2G1+GTMN/A1636Zhou et al. [9]PK=6n+1G1MSK=2ZpSK=2A+1G12G1+GTMN/A9876Yamada et al. [14]PK=6G1+GTMSK=2ZpSK=4A+2G13ℙ+1G1MN/A6292Cheng et al. [12]PK=2nG1+2GTMSK=2nG1SK=A+1G12G1+GTGTN/A6932Note:G1 and GT: prime order pairing groups (160 bits); exp: exponent operation; p¨: pairing operation; A and ℙ: no. of attributes in secret key and access policy; G: elliptic curve group defined over finite field Zp; OP: order of the base point (160 bits in Zp); L: length of plaintext message M.The columnBytes represents the total number of bytes required in all algorithms (i.e., Setup, KeyGen, Encrypt, Decrypt, and KeyRevoke) for an attribute universe U of 10 and an access policy ℙ of 5 attributes. In the case of the proposed scheme, the memory overhead of one partial and final key pair generation and one key update in both cases is also considered when calculating the number of bytes required by each algorithm.The proposed Fog-CPS scheme is lightweight than the Odelu and Das [8] scheme as it requires fewer elliptic curve group elements. Our scheme requires 2n+1 elements in G for generation of both partial and final public keys whereas the scheme by Odelu and Das [8] requires 3n+1 elements for the public key. Likewise, for partial and final secret keys, our scheme requires only two secret elements in the finite field Zp, whereas the scheme by Odelu and Das [8] requires three. The length of CT in our scheme is n−ℙ+2 group G elements whereas n−ℙ+3 in the scheme by Odelu and Das [8].As can be seen in Table6, the Fog-CPS scheme has the lowest memory overhead, i.e., 1340 bytes followed by the Guo et al. [6] and Odelu and Das [8] schemes which take 1636 and 1760 bytes, respectively. The Zhou et al. [9] scheme incurs the highest overhead of 9876 bytes. It is noted that for the proposed scheme, the memory overhead of one final public and secret key over a shared attribute set Ak=10 has also been considered. Moreover, for the Setup and KeyGen algorithms, i.e., partial key pair generation in this case, the Fog-CPS scheme has the lowest overhead compared to all other schemes. The final secret key in the proposed scheme only requires one element of the order of base point on the elliptic curve G.In the Guo et al. [6] scheme, there are 2n+1 elements in G1 and one in GT for PK, two elements in G1 for SK, and n−ℙ+2 elements in G1 for CT. In the Zhou et al. [9] scheme, there are 6n+1G1 and 2A+1 group elements in PK and SK, respectively, whereas CT has 2 group elements in G1 and one in GT. The PK in the Cheng et al. [12] scheme has 2n elements in G1 and two in GT; the SK has A+1 elements in G1, whereas the CT has 2 elements in G1 and one in GT. In the Yamada et al. [14] scheme, PK contains 6 elements in G1 and one in GT, SK contains 4A+2 elements in G1, and CT contains 3ℙ+1 in G1. The Zhou et al. [9] scheme has the highest memory overhead followed by the Cheng et al. [12] and Yamada et al. [14] schemes. Both the Zhou et al. [9] and Cheng et al. [12] schemes have constant size ciphertexts which only require 2 group elements in G1 and one element in GT. The CT in the Fog-CPS scheme and the Guo et al. [6] scheme have almost the same number of elements. In the key update Algorithms 4–6, this scheme only requires 2 elements in G and 2 elements of the order of base point on the elliptic curve G.


## 5.5. Computational Overhead

The computational overhead of all schemes is summarized in Table7. The column Total operations represents the total number of operations by considering all algorithms, i.e., Setup, KeyGen, Encrypt, and Decrypt. In the proposed scheme, the computational overhead of one partial and final key pair generation and update are also considered. From Table 7, it is observed that the Fog-CPS scheme introduces the lowest computational overhead than all other schemes which are based on bilinear maps and elliptic curves.Table 7
Computational overhead.
SchemesSetupKeyGenEncryptDecryptKeyRevokeTotal operationsFog-CPS schemen+1ecmN/An−ℙ+1ecmn−ℙ+2ecm2ecm37ecmOdelu and Das [8]3n+1ecmN/An−ℙ+2ecmn−ℙ+3ecmN/A48ecmGuo et al. [6]2nexp+p¨2expn−ℙ+3exp+p¨2n−ℙ+4exp+4p¨N/A44exp+6p¨Zhou et al. [9]6n+1exp2A+1exp3exp+p¨2ℙ+1exp+2ℙ+1p¨N/A96exp+12p¨Yamada et al. [14]1exp4A+2exp3ℙ+1exp2ℙexp+2ℙp¨N/A69exp+10p¨Cheng et al. [12]nexp+np¨Aexp3exp2p¨N/A23exp+12p¨Note:exp: exponentiation operation; p¨: pairing operation; ecm: scalar point multiplication in the elliptic curve group G.For partial and final public key generation, the Fog-CPS scheme requires2n+2 scalar multiplications in the elliptic curve group G. Likewise, for Encrypt and Decrypt, n−ℙ+1 and n−ℙ+2 scalar point multiplications are required, respectively. Moreover, in the key update algorithms, i.e., 4, 5, and 6, this scheme only requires two scalar multiplications.For theSetup and KeyGen algorithms, the Guo et al. [6] scheme requires 2n+2 exponentiations and 1 pairing operation, respectively. In addition, the Encrypt algorithm requires n−ℙ+3 exponentiations and a single pairing whereas Decrypt requires 2n−ℙ+4 exponentiations and 4 pairing operations. The Setup and KeyGen algorithms in the Zhou et al. [9] scheme require 6n+1 and 2A+1 exponentiation operations, respectively. Similarly, for Encrypt, it requires 3 exponentiations and 1 pairing, whereas for Decrypt, 2ℙ+1 exponentiation and pairing operations are required. Moreover, for the Setup and KeyGen algorithms, the Cheng et al. [12] scheme requires n+A exponentiation and n pairing operations. On the contrary, it requires 3 exponentiation and 2 pairing operations for the Encrypt and Decrypt algorithms, respectively. In the Yamada et al. [14] scheme, 4A+3 exponentiations are required for both the Setup and KeyGen algorithms. However, the Encrypt algorithm requires 3ℙ+1 exponentiations and Decrypt requires 2ℙ exponentiation and pairing operations.


## 6. Conclusion

The security and privacy challenges posed by Fog-CPS systems can affect both individuals and systems. The heterogeneous nature of CPS devices with varying degrees of computation and storage capacity also make it a challenging task to devise the security solutions. It is therefore essential to find lightweight solutions which eliminate the need for applying different security mechanisms at different layers of Fog-CPS. Moreover, the devised schemes must also enable the users/CPS devices to have control over their data without risking their privacy of information (e.g., identities, location, data, and type of service used) with other entities, such as the fog nodes and/or cloud provider. The existing PKE and ABE schemes are computationally expensive and, therefore, not suitable for resource-constrained devices. Moreover, the sharing of attributes with the FA risks the privacy of CPS devices as it can also decrypt the messages. Considering the limitations of existing schemes, in this paper, a lightweight encryption scheme is proposed. In the Fog-CPS scheme, the CPS devices generate the keys without relying on a FA. In our proposed security scheme, the above problems are addressed by dividing the attribute set into secret and shared attributes. The secret attributes are used for entity registration with FA, whereas the shared attributes are only shared with the collaborating CPS devices and employed to generate the final public and secret keys. The compromise of FA would not endanger the secrecy of messages among CPS devices, as they can still securely communicate. Furthermore, the key update process of the proposed scheme is very lightweight, since the key generation process as found in Algorithms1–3 is not repeated.Another novel aspect of the Fog-CPS scheme is that it is based on elliptic curve cryptography which supports smaller key sizes and is highly suitable for resource-constrained CPS devices. The experimental evaluation shows that the Fog-CPS security scheme outperforms other ABE schemes based on bilinear pairing and elliptic curves. In the future, the authors will investigate how the proposed scheme can be further improved to support more expressive access structures and an adaptive security model.



---

*Source: 2145829-2020-09-21.xml*