# Cloud Storage Data Access Control Scheme Based on Blockchain and Attribute-Based Encryption

Authors: Xiaodong Yang; Aijia Chen; Zhisong Wang; Shudong Li
Journal: Security and Communication Networks
 (2022)

---

## Abstract

Cloud storage is a popular model of the application in various fields, and the security of storage data and access permission have been widely considered. Attribute-based encryption (ABE) provides fine-grained user access control and ensures data confidentiality. However, current ABE access control schemes rely on trusted cloud servers and provide a low level of security. To solve these problems of traditional encryption schemes, we propose a blockchain-based and ABE cloud storage data access control scheme. In this article, blockchain and smart contract technology are the core elements to ensure data integrity and build a decentralized verification method for outsourcing results. This application can minimize the reliance on servers in the cloud environment. Based on the ciphertext-policy ABE algorithm, the proposed scheme supports a hidden access policy to avoid the risk of privacy leakage. In addition, we adopt outsourcing technology and predetected decryption algorithms to reduce the computational overhead of local and outsourced servers. Security analysis and performance evaluation show that our proposed scheme has high computational efficiency and satisfies the condition of indistinguishability under the chosen-ciphertext attacks.


---

## Body

## 1. Introduction

Cloud storage technology uses the storage space of cloud servers to provide powerful data storage capability [1]. Data owners can overcome the obstacle of restricted storage resources at user terminals by storing data in the cloud. Therefore, cloud storage has become more popular in various specific industries in recent years, such as the Internet of Things (IoT) [2, 3], the Industrial Internet of Things environment [4], and electronic health records [5, 6]. However, the data collected by cloud servers and IoT devices face many attacks [7] during data transmission and storage. Meanwhile, sensitive data are vulnerable to tampering or forgery attacks during the transmission via public channels, which exposes users’ private information to the risk of being leaked. Therefore, it is critical to consider privacy protection and data confidentiality in the network. In the most typical schemes, encryption technology is adopted to achieve data confidentiality and privacy. To provide more detailed privacy protection, some researchers introduce the most recent privacy protection technologies in their schemes. For instance, a location privacy protection scheme [8] anonymizes the source location, which contains significant information about the target being observed and tracked. Moreover, a homomorphic encryption scheme with higher performance [9] is proposed to achieve privacy protection of data stored in the central server.Although the encryption mechanism can guarantee the confidentiality and privacy of the data, it does not ensure that the data are legally obtained. In cloud storage applications, the data stored in the cloud server cannot be fully controlled by the data owner. To prevent malicious users and cloud server providers from accessing data, a trusted access control mechanism is also essential.The CP-ABE [10] not only provides data confidentiality but also allows fine-grained and flexible access control to improve the security of the data. However, the traditional CP-ABE scheme [10, 11] has some drawbacks in practical applications. For example, the access control policy in the CP-ABE is constructed by attribute information-related users, which may contain private information about the user’s identity. Second, attribute-based encryption algorithms frequently use a large number of bilinear pair computations, significantly increasing the encryption and decryption computational overhead. To reduce computational costs, on the one hand, an increasing number of schemes outsource decryption operations to third-party servers. However, few of these systems consider the correctness of calculation results from cloud servers. On the other hand, most access control schemes on cloud platforms are established using prime-order bilinearity to reduce the computational burden. This design’s reduced computational burden comes at the expense of lower security, so it can only satisfy indistinguishability under chosen-plaintext attack (IND-CPA). Although there are already some schemes that can partially solve the above problems, we still need to consider some detailed and in-depth issues. The existing cloud storage access control scheme is designed based on the traditional cloud server, which increases the trusted dependence on the cloud server. Unfortunately, semitrusted cloud servers are curious about the processed data while executing user commands. If the cloud server fails unpredictably or is maliciously attacked and outputs incorrect results, it may cause users to obtain incorrect data.Blockchain technology [12] is a widely emerging technology based on distributed ledgers that has the advantages of decentralization. However, at the same time, due to the openness of blockchain, data security and supervision are also faced with challenges [13, 14]. Therefore, the combination of blockchain technology and traditional access control is a promising structure. Blockchain technology can enhance the reliability of traditional schemes, and the encryption mechanism of the scheme can protect the data security of the blockchain. In this article, we are committed to establishing a reliable access control mechanism in an untrusted cloud environment. We propose a cloud storage access control scheme based on blockchain and attribute-based encryption, which realizes data verification and ensures the verifiability of the outsourced decryption results and the integrity of the cloud storage data in a decentralized way.The main contributions of our proposed program are as follows:(i)
The support of hidden access control policies reduces the risk of user privacy information disclosure in traditional CP-ABE.(ii)
The use of smart contracts deployed on the consortium blockchain can achieve a decentralized verifiable outsourcing scheme while ensuring the integrity of data in the cloud.(iii)
The dependence on fully trusted cloud servers in traditional cloud server-based schemes is removed by introducing blockchain technology.(iv)
Our scheme is proven to meet CCA security under the random oracle model, which has stronger security than similar schemes. Performance analysis shows that the new scheme has comparable computational overhead.The rest of the article is organized as follows. Section2 introduces the related work. Preliminary knowledge related to our scheme is described in Section 3. In Section 4, we present the system model, security model, scheme framework, and detailed construction of the proposed scheme. The correctness analysis is given in Section 5. In Section 6, we provide security analysis and security proof of the new scheme. In Section 7, we discuss the performance analysis and computational efficiency of our scheme. The work of this scheme is concluded, and the outlook is presented in Section 8.


## 2. Related Work

To overcome the problem of multiperson sharing of encrypted data, an attribute-based encryption system (ABE) [15] was proposed as a one-to-many encryption mechanism. More specifically, ciphertext-policy attribute-based encryption (CP-ABE) [10] allows the data owner to refine the user authority of the data visitor to the attribute level by setting a policy. In other words, CP-ABE can achieve effective fine-grained access control under the condition of ensuring data security.However, the traditional CP-ABE Schemes [16, 17] usually publish the access policy in the form of plaintext. Anyone who obtains the ciphertext (including cloud servers) can infer part of the secret information included in the ciphertext, endangering the user’s identity privacy. In addition, sensitive data must also be protected as private data in specific fields.To address the above issues, Kapadia et al. [18] proposed a policy-hiding CP-ABE scheme. However, an online semitrusted server was introduced in [18] to reencrypt the ciphertext for each user, thus making the server a bottleneck in the entire system. Nishide et al. [19] developed two CP-ABE schemes to hide the policy, which express the access control policy through AND logic with wildcards. Based on the decisional assumption of subgroups, Lai et al. [20] suggested an adaptively secure policy hiding the CP-ABE technique over a bilinear group of combinatorial orders. Although the scheme in [20] improves security, the computational cost grows with the increase of the attributes. Hur [21] constructed a scheme that supports arbitrary expressions with monotonicity and blinds the access policy within the ciphertext. However, this scheme is proven to be secure using the generic group model, which is normally considered heuristically rather than provably secure. Afterwards, Helil Rahman [22] constructed a CP-ABE access control scheme based on the scheme in [21]. We introduce an additional entity (the SDS monitor) in [22] to handle the problem of sensitive dataset constraints, but the policy is disclosed for all entities. Song et al. [23] made improvements to the access tree on the basis of the scheme in [24] to realize policy hiding based on the access tree. Through the application of secret sharing in “and,” “or” and “threshold,” attribute values with permission are hidden in all attribute values of the system. However, as the expression ability of the access structure grows, the communication overhead also increases.To reduce the overhead of a large number of bilinear pairings required for the CP-ABE decryption calculation, Green et al. [25] proposed a scheme with outsourced decryption. In their article, the outsourcing server uses a transformation key for decryption, which is generated by the data user. However, their scheme lacks a verification mechanism for the calculation results of the outsourcing server. Then, on the basis of the scheme in [25], Lai et al. [26] verified the result returned by the outsourcing server by adding a ciphertext component. However, at the same time, this method doubles the ciphertext length of the ABE-type and El Gamal-type encryption systems. In recent years, with the development of fog computing, fog nodes have been widely used in cloud environments. Li et al. [27] presented a verifiable outsourced multiauthorization access control method that delegated most encryption and decryption work to fog nodes. This scheme can lighten the user’s processing load and verify the reliability of outsourced computing outputs. In fog-enhanced IoT systems, an access control scheme with hidden access structures and outsourcing computation was presented by [28], which uses fog nodes to conduct outsourcing decryption and verification procedures. Lin et al. [29] invented a new attribute-based scheme combined with symmetric encryption technology to achieve efficient verifiability. In addition, they presented a verifiable unified model for the OD-ABE. However, all of the abovementioned verifiable outsourcing schemes meet the CPA security requirements. A verifiable hidden policy CP-ABE with a decryption testing scheme (VHPDT) was proposed by Zhao et al. [30], which is CCA-secure. Meanwhile, the VHPDT scheme introduces a predetection algorithm to increase the efficiency of the decryption. However, this scheme does not consider the integrity verification of the data and needs to rely on trusted cloud servers. However, cloud servers cannot be completely trusted, and dangers such as user data leakage and tampering will persist.Blockchain technology [12] is an emerging technology based on distributed ledgers that has the advantages of decentralization. Many systems [31–34] introduce blockchain into the traditional cloud server-based structure to better realize decentralized security schemes. Rahulamathavan et al. [32] proposed combining blockchain technology with ABE to realize data confidentiality and privacy protection. However, the large amount of computing overhead generated by ABE is not suitable for the resource-constrained IoT environment. Zhang et al. [33] introduced blockchain-based smart contract technology and designed a BaDS scheme in the IoT, which not only reduces the cost of decryption but also improves the flexibility of traditional CP-ABE for access control. A blockchain-based outsourcing verifiable CP-ABE scheme was offered by Zhang [34], which uses smart contracts to achieve verifiability of the outsourcing results. However, decrypting and obtaining plaintext by smart contracts will reduce the security of the system.


## 3. Preliminary Knowledge

### 3.1. Composite-Order Bilinear Group

Assuming thatφ is a group generation algorithm, the input λ is a security parameter, and the output N=p1p2p3,G,GT,e^ is a tuple, where N is the product of three prime numbers p1,p2, and p3; G and GT are cyclic groups with order N; e^:G×G⟶GT is a bilinear map satisfying the following conditions:(1)
Bilinearity: for anyg0,g1∈G, c,d∈ZN, we have eg0c,g1d=eg0,g1cd.(2)
Nondegeneracy: ifx∈G, then ex,x has the order N in GT.(3)
Computability: ife^:G×G⟶GT, then operations in G and GT are effectively computable in polynomial time, and G and GT are bilinear groups.(4)
Orthogonality:Gp1,Gp2, and Gp3 are three subgroups of G0, with the order of p1,p2, and p3, respectively. The orthogonality of the subgroups can be known as follows:(a)
For anyhp1∈Gp1 and hp2∈Gp2, then ehp1,hp2=1.(b)
For anyhp1∈Gp1 and hp2∈Gp2, where a,b,c,d∈ZN, equation ehp1ahp2b,hp1chp2d=ehp1,hp2ab=ehp1,hp2cd holds.


### 3.2. Discrete Logarithm (DL) Problem

LetG0 be a multiplicative cyclic group of order p1 and g1 be the generator of G0. Given a tuple g1,Δ=g1x, where Δ∈G0, the DL problem has difficulty calculating x∈ZN.


### 3.3. Blockchain and Smart Contracts

The essential function of blockchain technology is a distributed ledger that cannot be tampered with and counterfeited [12]. Blockchain technology joins data blocks in chronological order to form a chain data structure and uses cryptography to assure the chain’s immutability and security. Moreover, blockchain encourages network nodes to participate in and jointly maintain chain data by setting up incentive mechanisms to provide a reward. The consensus mechanism is adopted to ensure the fairness of transactions, which is based on multiparty consensus and will not be undermined by the complicity of a few malicious nodes. Therefore, blockchain can be used as a low-cost and highly reliable infrastructure. Blockchain is deployed in the forms of public blockchain, private blockchain, and consortium blockchain. The public blockchain is a mode in which any node is open to anyone. This mode allows everyone to participate in the calculation of this block, and anyone can download and obtain the full blockchain data. The private blockchain is a private chain in which only licensed nodes can be involved and view all data. Consortium blockchain means that the permissions of each node participating are completely equal. Without total mutual trust, each node can realize the trustworthy exchange of data, but each node often has an associated entity organization that may only join or leave the network after being authorized. Compared with the public blockchain, the consortium blockchain maintains the characteristics of decentralization and enhances the control of the participating members.A smart contract is an automatic piece of code deployed on the blockchain with a unique address [35]. The initializer can establish a smart contract and save it as a transaction on the blockchain platform. When a transaction in the contract is triggered, the contract will automatically execute predefined content according to the script, such as executing relevant calculations. Finally, the output and status information of the transaction are recorded in the blockchain as transactions. In our structure, we employ smart contracts to create interfaces for the blockchain application layer and verify operations through the interaction of cloud servers with smart contracts instead of using semitrusted servers.


## 3.1. Composite-Order Bilinear Group

Assuming thatφ is a group generation algorithm, the input λ is a security parameter, and the output N=p1p2p3,G,GT,e^ is a tuple, where N is the product of three prime numbers p1,p2, and p3; G and GT are cyclic groups with order N; e^:G×G⟶GT is a bilinear map satisfying the following conditions:(1)
Bilinearity: for anyg0,g1∈G, c,d∈ZN, we have eg0c,g1d=eg0,g1cd.(2)
Nondegeneracy: ifx∈G, then ex,x has the order N in GT.(3)
Computability: ife^:G×G⟶GT, then operations in G and GT are effectively computable in polynomial time, and G and GT are bilinear groups.(4)
Orthogonality:Gp1,Gp2, and Gp3 are three subgroups of G0, with the order of p1,p2, and p3, respectively. The orthogonality of the subgroups can be known as follows:(a)
For anyhp1∈Gp1 and hp2∈Gp2, then ehp1,hp2=1.(b)
For anyhp1∈Gp1 and hp2∈Gp2, where a,b,c,d∈ZN, equation ehp1ahp2b,hp1chp2d=ehp1,hp2ab=ehp1,hp2cd holds.


## 3.2. Discrete Logarithm (DL) Problem

LetG0 be a multiplicative cyclic group of order p1 and g1 be the generator of G0. Given a tuple g1,Δ=g1x, where Δ∈G0, the DL problem has difficulty calculating x∈ZN.


## 3.3. Blockchain and Smart Contracts

The essential function of blockchain technology is a distributed ledger that cannot be tampered with and counterfeited [12]. Blockchain technology joins data blocks in chronological order to form a chain data structure and uses cryptography to assure the chain’s immutability and security. Moreover, blockchain encourages network nodes to participate in and jointly maintain chain data by setting up incentive mechanisms to provide a reward. The consensus mechanism is adopted to ensure the fairness of transactions, which is based on multiparty consensus and will not be undermined by the complicity of a few malicious nodes. Therefore, blockchain can be used as a low-cost and highly reliable infrastructure. Blockchain is deployed in the forms of public blockchain, private blockchain, and consortium blockchain. The public blockchain is a mode in which any node is open to anyone. This mode allows everyone to participate in the calculation of this block, and anyone can download and obtain the full blockchain data. The private blockchain is a private chain in which only licensed nodes can be involved and view all data. Consortium blockchain means that the permissions of each node participating are completely equal. Without total mutual trust, each node can realize the trustworthy exchange of data, but each node often has an associated entity organization that may only join or leave the network after being authorized. Compared with the public blockchain, the consortium blockchain maintains the characteristics of decentralization and enhances the control of the participating members.A smart contract is an automatic piece of code deployed on the blockchain with a unique address [35]. The initializer can establish a smart contract and save it as a transaction on the blockchain platform. When a transaction in the contract is triggered, the contract will automatically execute predefined content according to the script, such as executing relevant calculations. Finally, the output and status information of the transaction are recorded in the blockchain as transactions. In our structure, we employ smart contracts to create interfaces for the blockchain application layer and verify operations through the interaction of cloud servers with smart contracts instead of using semitrusted servers.


## 4. Our Cloud Storage Data Access Control Scheme Based on Blockchain and Attribute-Based Encryption

### 4.1. System Model

Figure1 depicts the framework of our data access control system, which includes six entities: Attribute Authority, Data Owner, Cloud Server, Data Accessing Users, Blockchain, and Outsource Server. The functions of various entities are described as follows:(i)
TheAttribute Authority (AA) is responsible for setting up the system and generating the users’ private keys.(ii)
TheData Owner (DO) calculates the hash of the initial data and parameters used for authentication and uploads these components to the blockchain platform. Then, the DO generates the ciphertext by encrypting the plaintext according to the access policy and sends it to the cloud server for storage.(iii)
TheCloud Server (CS) is a semitrusted entity that stores data ciphertext.(iv)
TheData Accessing User (DAU) is initially involved in generating a key that is used by the outsourcing sever for decryption. After receiving the storage address returned by the cloud server, the DAU is responsible for computing parameters and decrypting. After obtaining the plaintext, the DAU verifies the integrity of the data through the computation.(v)
Blockchain. We use a consortium blockchain with smart contracts deployed. The blockchain platform is responsible for storing verification components and smart contracts, ensuring the correctness of the outsourcing decryption result.(vi)
TheOutsource Server (OS) is responsible for detecting the attributes of the accessing user and obtaining the semiciphertext through decryption.Figure 1
System model.


### 4.2. Security Model

To fulfil the confidentiality and verifiability of the proposed scheme, we define the security model of our scheme by the following two security games.Game 1 (confidentiality): for our scheme, we define an indistinguishable game under the chosen-ciphertext attack (IND-CCA) that includes an adversary AlgorithmA and a challenge Algorithm B.Initialization phase:B runs Setup1λ to produce the system public key pk and the system master private key msk. Then, B sends pk to A and retains msk.Inquiry phase 1:A adaptively asks B for the private key of the attribute set Λ, and the private key can be requested repeatedly. B runs KeyGenpk,msk,Λ and returns skΛ to A.Challenge phase: A sends equal-length messagesM0 and M1 as well as access structures W0 and W1 to B. B selects ξ∈0,1 and runs Encryptpk,m,W to generate challenge ciphertext C∗. Finally, B sends C∗ to A.Inquiry phase 2: this is similar to inquiry phase 1, but A cannot ask for the messagesM0 and M1.Guess: A outputs the guess ξ′∈0,1 of the challenge ciphertext C∗. If ξ=ξ′, then B outputs 1, which means that A wins Game 1 with a probability of Adv=Prξ=ξ′−1/2.Theorem 1.
If there is no polynomial-time adversary to attack the above security model with a nonnegligible probability advantage, then our proposed scheme is IND-CCA.Game 2 (verifiable): We use the interactive game between adversaryF and challenger C to prove the verifiability of our scheme supporting the hidden strategy. The process is as follows:Initialization phase:C runs the Setup algorithm to produce the master key msk and the system public key pk, while pk is sent to F.Challenge phase:F asks for the decryption key by specifying an arbitrary set of attributes Λ to be sent to C for inquiry. Then, C performs a key generation algorithm based on the attribute set Λ to generate a decryption key sk. Finally, sk is returned to adversary F.Output phase: F outputs an access structureW that satisfies the attribute set Λ and a tuple CT′,tk,Ck1,Ck2,Δ. C executes the preauthentication algorithm to obtain the session key nk1,nk2. If nk1≠nk2, then we claim that F wins the game. We define Pr [F wins] to denote the advantage of F winning the game.Theorem 2.
If there is a polynomial adversaryF who can win the above interactive game with the advantage Pr [F wins], then our attribute-based encryption scheme with the hidden strategy can be considered to be verifiable.


### 4.3. Scheme Framework

The operational flow of the cloud storage data access control scheme based on blockchain and attribute-based encryption is shown in Figure2, and the specific implementation details of this scheme are as follows.Figure 2
Framework of the proposed system.


### 4.4. Scheme Construction

#### 4.4.1. System Setup

The credible attribute authorization centre (AA) executes the system setup algorithm. is a group generation algorithm that outputs tupleN=p1p2p3,G,GT,e^. AA first selects a security parameter λ and runs the algorithm φλ to obtain the system parameters N=p1p2p3,G0,GT,e^, where G0 and GT are two cyclic groups of order N, and p1, p2, and p3 are three different prime numbers. Gp1,Gp2, and Gp3 are three subgroups from G0, whose generators are g1,g2, and g3, respectively. We suppose that U=att1,att2,…,attn is a system attribute set and Si=vi,1,vi,2,…,vi,j is the value set of the attribute atti. For any attribute atti in the system, AA generates a public key pk and a master key msk according to the following steps:(1)
AA chooses two hash functions in cryptographyH:0,1∗⟶ZN and H0:G0⟶ZN∗, which are anticollision.(2)
For any attributeatti in the system, AA randomly selects xi,j∈ZN∗ and Qi,j∈Gp3 and calculates Ai,j=g11/xi,jQi,j, where i∈1,2,…n,j∈1,2,…ni.(3)
AA randomly selectsβ0,β∈ZN∗ and Q0∈Gp3 aφnd then calculates Y0=eg1,g1β0 and Y=eg1,g1β.(4)
AA defines a key distribution functionKF that maps the session key to a stream of bits of length κ and two parameters ω and ν that belong to. Gp3.(5)
AA publishes the public keypk=A0,g3,Ai,j1≤i≤n,1≤j≤ni,Y0,Y,KF,ω,ν,κ,H,H0 and keeps the master private key msk=g1,xi,j1≤i≤n,1≤j≤ni,β0,β secretly.


#### 4.4.2. Key Generation

According to the attribute listΛ of DAU, AA randomly selects λi∈ZN∗ for any attribute i1≤i≤k and calculates K0=g1β−0∑i=1kλi, K=g1β−∑i=1kλi and Ki=g1λixi,j. Then, AA sends the generated private key skΛ=K0,K,Ki1≤i≤k to DAU.


#### 4.4.3. Verification Component Generation

The data owner (DO) performs the following operations to generate and upload verification components.(1)
The DO randomly selectss∈ZN and a session key nk=Y0s=eg1,g1β0s and uses the key distribution function KFnk,κ=vk‖γ defined by AA, where γ is a random value and vk is the verification key. Then, the DO calculates C^=ωHvkνHγ, which is used to verify the outsourcing decryption result.(2)
The DO computesC˜=vH0m and uploads to the blockchain platform. The stored addresses Addm and v,H0 are sent to the smart contract as verification components.


#### 4.4.4. Data Encryption

We adopt the access structure used in Zhao et al. scheme [30]. The DO performs the following operations with the access policy W to encrypt plaintext M.(1)
The DO selects a random elementQ0′∈Gp3 and then calculates C0=A0sQ0′ and C1=mYs.(2)
The DO sets the secret values as the root node’s value of the access tree. Then, the status of leaf nodes is set to read. Apart from leaf nodes, the status of all child nodes is set to unread. Later, the DO performs a recursive operation for each node with an unread state:(a)
If the nonleaf node represents a logic “AND,” then DO setssi for the u−1 previous nodes of its children. Then, the value of the last leaf node is calculated by su=s−∑i=1u−1si.(b)
If the nonleaf node delegates a logic “OR,” then DO setss as the value of all child nodes, while the state of these nodes is set to read.(c)
If the nonleaf node expresses the “threshold” with a threshold valueh, then the DO randomly generates a polynomial f of degree h−1. Meanwhile, the polynomial satisfies f0=s and assigns the value of fi to the i th child node.(3)
The DO enforces operations to hide the policy. For simplicity, the parent node of any leaf node is named PNode. Suppose a PNodeα exists, which is assigned the secret value sα. Γα represents a subtree in which α is the root node, and all leaf nodes are indicated by a set SΓα. For each attribute atti, DO calculates Ci,j according to different conditions. When an attribute atti∈Γα and the value vi,j∉SΓα, the DO randomly selects si,j∈ZN∗ and Qi,j′∈Gp3 and calculates Ci,j=Ai,jsi,jQi,j′. Otherwise, DO calculates Ci,j=Ai,jsαQi,j′.(4)
The DO randomly selectsQα∈Gp3, calculates C¯α=A0sαQα and Iα=Ysα for each PNode α, and obtains the component of the ciphertext Cα=C¯α,Iα,Ci,j1≤i≤n,1≤j≤ni.(5)
The DO obtains the entire ciphertextCT=C0,C1,Cα∀α and sends it to the CS for storage.


#### 4.4.5. Transformation Key Generation

DAU randomly chooses a factory∈ZN and calculates Ti∗=Ti1/y, T∗=T1/y, T0∗=T01/y, and Iα∗=Iα1/y. Later, DAU sends the transformation key tk=Ti∗,T∗,T0∗,Iα∗ and semidecrypted ciphertext CT′ to the outsourcing server OS.


#### 4.4.6. Outsourcing Decryption

Execution by the outsourcing server OS. The algorithm is divided into an attribute detection phase and a decryption phase. The attribute detection phase is to preeliminate the attribute values in the private key that are unable to meet the access policy. This design can avoid bottom-up recursive decryption to reduce computational overhead. Only after passing the attribute checking can the algorithm proceed to the decryption phase.(1)
The OS runs different functions according to different nodes in the access structure to detect the value. If a node is PNodeα, the OS runs PreDec Nodeα=∏i=1keCi,j,Ti∗. Likewise, if a node is a normal node β, according to the structure of “OR”, “AND” and “Threshold” in the access structure, then the OS runs Pre Dec Nodeβ.(1)PreDecNodeβ=∏i=1uPreDecNodechildβ,i,structureβ=AND,PreDecNodechildβ,i,structureβ=OR,∏i=1hPreDecNodechildβ,iΔi,β0,structureβ=Threshold.Finally, OS calculatesωχ=Iα∗/eC,αT∗PreDecNodeα.(2)
Only whenωχ=1, does the OS further calculate N=eC0,T0∗PreDecNoderootW in the decryption phrase. Then, the OS sends the semidecrypted ciphertext CT′=N to the DAU.The preauthentication DAU obtains the semidecrypted ciphertextCT′ and generates the computed values Hvk and Hγ to complete the preauthentication work.(1)
DAU uses the blinding factory and computes the session key nk=Ν−y=eg1,g1sβ0.(2)
DAU executesKFnk,κ=vk‖γ mapping the session key to a stream of bits of length κ. Finally, the DAU calculates Hvk and Hγ sends it to the smart contract.


#### 4.4.7. Outsourcing Verification

Receiving the elementsHvk and Hγ from the DAU, the smart contract computes ωHvkνHγ. If equation ωHvkνHγ=C^ holds, then the smart contract outputs bool=1. Otherwise, the algorithm is terminated.


#### 4.4.8. Decryption and Integrity Verification

If DAU receivesbool=1, then the semidecrypted ciphertext CT′ computed by the OS is not fake. Then, the steps of decryption and verification by the DAU are as follows:(1)
DAU utilizesy to compute plaintext m=C˜⋅Νy.(2)
DAU computesC˜′=vH0m and determines whether the computed C˜′ equals C˜. If equation C˜′=C˜ holds, then the ciphertext stored on the cloud is proved completely.


## 4.1. System Model

Figure1 depicts the framework of our data access control system, which includes six entities: Attribute Authority, Data Owner, Cloud Server, Data Accessing Users, Blockchain, and Outsource Server. The functions of various entities are described as follows:(i)
TheAttribute Authority (AA) is responsible for setting up the system and generating the users’ private keys.(ii)
TheData Owner (DO) calculates the hash of the initial data and parameters used for authentication and uploads these components to the blockchain platform. Then, the DO generates the ciphertext by encrypting the plaintext according to the access policy and sends it to the cloud server for storage.(iii)
TheCloud Server (CS) is a semitrusted entity that stores data ciphertext.(iv)
TheData Accessing User (DAU) is initially involved in generating a key that is used by the outsourcing sever for decryption. After receiving the storage address returned by the cloud server, the DAU is responsible for computing parameters and decrypting. After obtaining the plaintext, the DAU verifies the integrity of the data through the computation.(v)
Blockchain. We use a consortium blockchain with smart contracts deployed. The blockchain platform is responsible for storing verification components and smart contracts, ensuring the correctness of the outsourcing decryption result.(vi)
TheOutsource Server (OS) is responsible for detecting the attributes of the accessing user and obtaining the semiciphertext through decryption.Figure 1
System model.


## 4.2. Security Model

To fulfil the confidentiality and verifiability of the proposed scheme, we define the security model of our scheme by the following two security games.Game 1 (confidentiality): for our scheme, we define an indistinguishable game under the chosen-ciphertext attack (IND-CCA) that includes an adversary AlgorithmA and a challenge Algorithm B.Initialization phase:B runs Setup1λ to produce the system public key pk and the system master private key msk. Then, B sends pk to A and retains msk.Inquiry phase 1:A adaptively asks B for the private key of the attribute set Λ, and the private key can be requested repeatedly. B runs KeyGenpk,msk,Λ and returns skΛ to A.Challenge phase: A sends equal-length messagesM0 and M1 as well as access structures W0 and W1 to B. B selects ξ∈0,1 and runs Encryptpk,m,W to generate challenge ciphertext C∗. Finally, B sends C∗ to A.Inquiry phase 2: this is similar to inquiry phase 1, but A cannot ask for the messagesM0 and M1.Guess: A outputs the guess ξ′∈0,1 of the challenge ciphertext C∗. If ξ=ξ′, then B outputs 1, which means that A wins Game 1 with a probability of Adv=Prξ=ξ′−1/2.Theorem 1.
If there is no polynomial-time adversary to attack the above security model with a nonnegligible probability advantage, then our proposed scheme is IND-CCA.Game 2 (verifiable): We use the interactive game between adversaryF and challenger C to prove the verifiability of our scheme supporting the hidden strategy. The process is as follows:Initialization phase:C runs the Setup algorithm to produce the master key msk and the system public key pk, while pk is sent to F.Challenge phase:F asks for the decryption key by specifying an arbitrary set of attributes Λ to be sent to C for inquiry. Then, C performs a key generation algorithm based on the attribute set Λ to generate a decryption key sk. Finally, sk is returned to adversary F.Output phase: F outputs an access structureW that satisfies the attribute set Λ and a tuple CT′,tk,Ck1,Ck2,Δ. C executes the preauthentication algorithm to obtain the session key nk1,nk2. If nk1≠nk2, then we claim that F wins the game. We define Pr [F wins] to denote the advantage of F winning the game.Theorem 2.
If there is a polynomial adversaryF who can win the above interactive game with the advantage Pr [F wins], then our attribute-based encryption scheme with the hidden strategy can be considered to be verifiable.


## 4.3. Scheme Framework

The operational flow of the cloud storage data access control scheme based on blockchain and attribute-based encryption is shown in Figure2, and the specific implementation details of this scheme are as follows.Figure 2
Framework of the proposed system.


## 4.4. Scheme Construction

### 4.4.1. System Setup

The credible attribute authorization centre (AA) executes the system setup algorithm. is a group generation algorithm that outputs tupleN=p1p2p3,G,GT,e^. AA first selects a security parameter λ and runs the algorithm φλ to obtain the system parameters N=p1p2p3,G0,GT,e^, where G0 and GT are two cyclic groups of order N, and p1, p2, and p3 are three different prime numbers. Gp1,Gp2, and Gp3 are three subgroups from G0, whose generators are g1,g2, and g3, respectively. We suppose that U=att1,att2,…,attn is a system attribute set and Si=vi,1,vi,2,…,vi,j is the value set of the attribute atti. For any attribute atti in the system, AA generates a public key pk and a master key msk according to the following steps:(1)
AA chooses two hash functions in cryptographyH:0,1∗⟶ZN and H0:G0⟶ZN∗, which are anticollision.(2)
For any attributeatti in the system, AA randomly selects xi,j∈ZN∗ and Qi,j∈Gp3 and calculates Ai,j=g11/xi,jQi,j, where i∈1,2,…n,j∈1,2,…ni.(3)
AA randomly selectsβ0,β∈ZN∗ and Q0∈Gp3 aφnd then calculates Y0=eg1,g1β0 and Y=eg1,g1β.(4)
AA defines a key distribution functionKF that maps the session key to a stream of bits of length κ and two parameters ω and ν that belong to. Gp3.(5)
AA publishes the public keypk=A0,g3,Ai,j1≤i≤n,1≤j≤ni,Y0,Y,KF,ω,ν,κ,H,H0 and keeps the master private key msk=g1,xi,j1≤i≤n,1≤j≤ni,β0,β secretly.


### 4.4.2. Key Generation

According to the attribute listΛ of DAU, AA randomly selects λi∈ZN∗ for any attribute i1≤i≤k and calculates K0=g1β−0∑i=1kλi, K=g1β−∑i=1kλi and Ki=g1λixi,j. Then, AA sends the generated private key skΛ=K0,K,Ki1≤i≤k to DAU.


### 4.4.3. Verification Component Generation

The data owner (DO) performs the following operations to generate and upload verification components.(1)
The DO randomly selectss∈ZN and a session key nk=Y0s=eg1,g1β0s and uses the key distribution function KFnk,κ=vk‖γ defined by AA, where γ is a random value and vk is the verification key. Then, the DO calculates C^=ωHvkνHγ, which is used to verify the outsourcing decryption result.(2)
The DO computesC˜=vH0m and uploads to the blockchain platform. The stored addresses Addm and v,H0 are sent to the smart contract as verification components.


### 4.4.4. Data Encryption

We adopt the access structure used in Zhao et al. scheme [30]. The DO performs the following operations with the access policy W to encrypt plaintext M.(1)
The DO selects a random elementQ0′∈Gp3 and then calculates C0=A0sQ0′ and C1=mYs.(2)
The DO sets the secret values as the root node’s value of the access tree. Then, the status of leaf nodes is set to read. Apart from leaf nodes, the status of all child nodes is set to unread. Later, the DO performs a recursive operation for each node with an unread state:(a)
If the nonleaf node represents a logic “AND,” then DO setssi for the u−1 previous nodes of its children. Then, the value of the last leaf node is calculated by su=s−∑i=1u−1si.(b)
If the nonleaf node delegates a logic “OR,” then DO setss as the value of all child nodes, while the state of these nodes is set to read.(c)
If the nonleaf node expresses the “threshold” with a threshold valueh, then the DO randomly generates a polynomial f of degree h−1. Meanwhile, the polynomial satisfies f0=s and assigns the value of fi to the i th child node.(3)
The DO enforces operations to hide the policy. For simplicity, the parent node of any leaf node is named PNode. Suppose a PNodeα exists, which is assigned the secret value sα. Γα represents a subtree in which α is the root node, and all leaf nodes are indicated by a set SΓα. For each attribute atti, DO calculates Ci,j according to different conditions. When an attribute atti∈Γα and the value vi,j∉SΓα, the DO randomly selects si,j∈ZN∗ and Qi,j′∈Gp3 and calculates Ci,j=Ai,jsi,jQi,j′. Otherwise, DO calculates Ci,j=Ai,jsαQi,j′.(4)
The DO randomly selectsQα∈Gp3, calculates C¯α=A0sαQα and Iα=Ysα for each PNode α, and obtains the component of the ciphertext Cα=C¯α,Iα,Ci,j1≤i≤n,1≤j≤ni.(5)
The DO obtains the entire ciphertextCT=C0,C1,Cα∀α and sends it to the CS for storage.


### 4.4.5. Transformation Key Generation

DAU randomly chooses a factory∈ZN and calculates Ti∗=Ti1/y, T∗=T1/y, T0∗=T01/y, and Iα∗=Iα1/y. Later, DAU sends the transformation key tk=Ti∗,T∗,T0∗,Iα∗ and semidecrypted ciphertext CT′ to the outsourcing server OS.


### 4.4.6. Outsourcing Decryption

Execution by the outsourcing server OS. The algorithm is divided into an attribute detection phase and a decryption phase. The attribute detection phase is to preeliminate the attribute values in the private key that are unable to meet the access policy. This design can avoid bottom-up recursive decryption to reduce computational overhead. Only after passing the attribute checking can the algorithm proceed to the decryption phase.(1)
The OS runs different functions according to different nodes in the access structure to detect the value. If a node is PNodeα, the OS runs PreDec Nodeα=∏i=1keCi,j,Ti∗. Likewise, if a node is a normal node β, according to the structure of “OR”, “AND” and “Threshold” in the access structure, then the OS runs Pre Dec Nodeβ.(1)PreDecNodeβ=∏i=1uPreDecNodechildβ,i,structureβ=AND,PreDecNodechildβ,i,structureβ=OR,∏i=1hPreDecNodechildβ,iΔi,β0,structureβ=Threshold.Finally, OS calculatesωχ=Iα∗/eC,αT∗PreDecNodeα.(2)
Only whenωχ=1, does the OS further calculate N=eC0,T0∗PreDecNoderootW in the decryption phrase. Then, the OS sends the semidecrypted ciphertext CT′=N to the DAU.The preauthentication DAU obtains the semidecrypted ciphertextCT′ and generates the computed values Hvk and Hγ to complete the preauthentication work.(1)
DAU uses the blinding factory and computes the session key nk=Ν−y=eg1,g1sβ0.(2)
DAU executesKFnk,κ=vk‖γ mapping the session key to a stream of bits of length κ. Finally, the DAU calculates Hvk and Hγ sends it to the smart contract.


### 4.4.7. Outsourcing Verification

Receiving the elementsHvk and Hγ from the DAU, the smart contract computes ωHvkνHγ. If equation ωHvkνHγ=C^ holds, then the smart contract outputs bool=1. Otherwise, the algorithm is terminated.


### 4.4.8. Decryption and Integrity Verification

If DAU receivesbool=1, then the semidecrypted ciphertext CT′ computed by the OS is not fake. Then, the steps of decryption and verification by the DAU are as follows:(1)
DAU utilizesy to compute plaintext m=C˜⋅Νy.(2)
DAU computesC˜′=vH0m and determines whether the computed C˜′ equals C˜. If equation C˜′=C˜ holds, then the ciphertext stored on the cloud is proved completely.


## 4.4.1. System Setup

The credible attribute authorization centre (AA) executes the system setup algorithm. is a group generation algorithm that outputs tupleN=p1p2p3,G,GT,e^. AA first selects a security parameter λ and runs the algorithm φλ to obtain the system parameters N=p1p2p3,G0,GT,e^, where G0 and GT are two cyclic groups of order N, and p1, p2, and p3 are three different prime numbers. Gp1,Gp2, and Gp3 are three subgroups from G0, whose generators are g1,g2, and g3, respectively. We suppose that U=att1,att2,…,attn is a system attribute set and Si=vi,1,vi,2,…,vi,j is the value set of the attribute atti. For any attribute atti in the system, AA generates a public key pk and a master key msk according to the following steps:(1)
AA chooses two hash functions in cryptographyH:0,1∗⟶ZN and H0:G0⟶ZN∗, which are anticollision.(2)
For any attributeatti in the system, AA randomly selects xi,j∈ZN∗ and Qi,j∈Gp3 and calculates Ai,j=g11/xi,jQi,j, where i∈1,2,…n,j∈1,2,…ni.(3)
AA randomly selectsβ0,β∈ZN∗ and Q0∈Gp3 aφnd then calculates Y0=eg1,g1β0 and Y=eg1,g1β.(4)
AA defines a key distribution functionKF that maps the session key to a stream of bits of length κ and two parameters ω and ν that belong to. Gp3.(5)
AA publishes the public keypk=A0,g3,Ai,j1≤i≤n,1≤j≤ni,Y0,Y,KF,ω,ν,κ,H,H0 and keeps the master private key msk=g1,xi,j1≤i≤n,1≤j≤ni,β0,β secretly.


## 4.4.2. Key Generation

According to the attribute listΛ of DAU, AA randomly selects λi∈ZN∗ for any attribute i1≤i≤k and calculates K0=g1β−0∑i=1kλi, K=g1β−∑i=1kλi and Ki=g1λixi,j. Then, AA sends the generated private key skΛ=K0,K,Ki1≤i≤k to DAU.


## 4.4.3. Verification Component Generation

The data owner (DO) performs the following operations to generate and upload verification components.(1)
The DO randomly selectss∈ZN and a session key nk=Y0s=eg1,g1β0s and uses the key distribution function KFnk,κ=vk‖γ defined by AA, where γ is a random value and vk is the verification key. Then, the DO calculates C^=ωHvkνHγ, which is used to verify the outsourcing decryption result.(2)
The DO computesC˜=vH0m and uploads to the blockchain platform. The stored addresses Addm and v,H0 are sent to the smart contract as verification components.


## 4.4.4. Data Encryption

We adopt the access structure used in Zhao et al. scheme [30]. The DO performs the following operations with the access policy W to encrypt plaintext M.(1)
The DO selects a random elementQ0′∈Gp3 and then calculates C0=A0sQ0′ and C1=mYs.(2)
The DO sets the secret values as the root node’s value of the access tree. Then, the status of leaf nodes is set to read. Apart from leaf nodes, the status of all child nodes is set to unread. Later, the DO performs a recursive operation for each node with an unread state:(a)
If the nonleaf node represents a logic “AND,” then DO setssi for the u−1 previous nodes of its children. Then, the value of the last leaf node is calculated by su=s−∑i=1u−1si.(b)
If the nonleaf node delegates a logic “OR,” then DO setss as the value of all child nodes, while the state of these nodes is set to read.(c)
If the nonleaf node expresses the “threshold” with a threshold valueh, then the DO randomly generates a polynomial f of degree h−1. Meanwhile, the polynomial satisfies f0=s and assigns the value of fi to the i th child node.(3)
The DO enforces operations to hide the policy. For simplicity, the parent node of any leaf node is named PNode. Suppose a PNodeα exists, which is assigned the secret value sα. Γα represents a subtree in which α is the root node, and all leaf nodes are indicated by a set SΓα. For each attribute atti, DO calculates Ci,j according to different conditions. When an attribute atti∈Γα and the value vi,j∉SΓα, the DO randomly selects si,j∈ZN∗ and Qi,j′∈Gp3 and calculates Ci,j=Ai,jsi,jQi,j′. Otherwise, DO calculates Ci,j=Ai,jsαQi,j′.(4)
The DO randomly selectsQα∈Gp3, calculates C¯α=A0sαQα and Iα=Ysα for each PNode α, and obtains the component of the ciphertext Cα=C¯α,Iα,Ci,j1≤i≤n,1≤j≤ni.(5)
The DO obtains the entire ciphertextCT=C0,C1,Cα∀α and sends it to the CS for storage.


## 4.4.5. Transformation Key Generation

DAU randomly chooses a factory∈ZN and calculates Ti∗=Ti1/y, T∗=T1/y, T0∗=T01/y, and Iα∗=Iα1/y. Later, DAU sends the transformation key tk=Ti∗,T∗,T0∗,Iα∗ and semidecrypted ciphertext CT′ to the outsourcing server OS.


## 4.4.6. Outsourcing Decryption

Execution by the outsourcing server OS. The algorithm is divided into an attribute detection phase and a decryption phase. The attribute detection phase is to preeliminate the attribute values in the private key that are unable to meet the access policy. This design can avoid bottom-up recursive decryption to reduce computational overhead. Only after passing the attribute checking can the algorithm proceed to the decryption phase.(1)
The OS runs different functions according to different nodes in the access structure to detect the value. If a node is PNodeα, the OS runs PreDec Nodeα=∏i=1keCi,j,Ti∗. Likewise, if a node is a normal node β, according to the structure of “OR”, “AND” and “Threshold” in the access structure, then the OS runs Pre Dec Nodeβ.(1)PreDecNodeβ=∏i=1uPreDecNodechildβ,i,structureβ=AND,PreDecNodechildβ,i,structureβ=OR,∏i=1hPreDecNodechildβ,iΔi,β0,structureβ=Threshold.Finally, OS calculatesωχ=Iα∗/eC,αT∗PreDecNodeα.(2)
Only whenωχ=1, does the OS further calculate N=eC0,T0∗PreDecNoderootW in the decryption phrase. Then, the OS sends the semidecrypted ciphertext CT′=N to the DAU.The preauthentication DAU obtains the semidecrypted ciphertextCT′ and generates the computed values Hvk and Hγ to complete the preauthentication work.(1)
DAU uses the blinding factory and computes the session key nk=Ν−y=eg1,g1sβ0.(2)
DAU executesKFnk,κ=vk‖γ mapping the session key to a stream of bits of length κ. Finally, the DAU calculates Hvk and Hγ sends it to the smart contract.


## 4.4.7. Outsourcing Verification

Receiving the elementsHvk and Hγ from the DAU, the smart contract computes ωHvkνHγ. If equation ωHvkνHγ=C^ holds, then the smart contract outputs bool=1. Otherwise, the algorithm is terminated.


## 4.4.8. Decryption and Integrity Verification

If DAU receivesbool=1, then the semidecrypted ciphertext CT′ computed by the OS is not fake. Then, the steps of decryption and verification by the DAU are as follows:(1)
DAU utilizesy to compute plaintext m=C˜⋅Νy.(2)
DAU computesC˜′=vH0m and determines whether the computed C˜′ equals C˜. If equation C˜′=C˜ holds, then the ciphertext stored on the cloud is proved completely.


## 5. Correctness Analysis

### 5.1. Correctness of Data Decryption

Here, we verify the correctness of the outsourcing decryption algorithm (executed by OS) and decryption algorithm (by DAU).Receivingtk=Ti∗,T∗,T0∗,Iα∗ sent from the user, the OS executes attribute detection. The OS judges whether the user access structure satisfies all sα values through the ωχ result value calculated in the attribute detection phrase. The calculation equation is as follows:(2)ωχ=Iα∗eC,αT∗PreDecNodeα=Ysα/yeA0sαQα,g1β−λ/yeg1,g1λsα/y,=eg1,g1βsα/yeA0sαQα,g1β−λ/yeg1,g1λsα/y=eg1,g1βsα/yeg1,g1sαβ−λ/yeg1,g1λsα/y=1.Only when the user’s attributes pass the detection, can the OS obtainωχ=1; otherwise, ωχ is a random value. After receiving ωχ=1, the OS uses tk to calculate CT′, and the calculation equation is as follows:(3)N=eC,0T0∗Pre Dec NoderootW=eA0sQ0′,T01/yPre Dec NoderootW=eg0sQ0sQ0′,g1β0−λ/yeg1,g1λs/y=eg1,g1sβ0−λ/yeg1,g1λs/y=eg1,g1sβ0/y.DAU receives theCT′ sent from the OS and then calculates nk=Ν−y=eg1,g1sβ0 and KFnk,κ=vk‖γ. The smart contract verifies whether semidecrypted ciphertext CT′ is valid. If equation ωHvkνHγ=C^ holds, then the decryption result from the OS is correct. Then, DAU using Ν, C˜ and y recover the plaintext by the following:(4)C˜⋅Νy=mYseg1,g1sβ0=meg1,g1sβ0eg1,g1sβ0=m.


### 5.2. Integrity of Cloud Data

After the DAU obtains the plaintext, he or she calculatesC˜′=vH0m and verifies that C˜′ is equal to the C˜ stored on the blockchain. If C˜′≠C˜, then the tampering of the ciphertext by the cloud server is demonstrated.


## 5.1. Correctness of Data Decryption

Here, we verify the correctness of the outsourcing decryption algorithm (executed by OS) and decryption algorithm (by DAU).Receivingtk=Ti∗,T∗,T0∗,Iα∗ sent from the user, the OS executes attribute detection. The OS judges whether the user access structure satisfies all sα values through the ωχ result value calculated in the attribute detection phrase. The calculation equation is as follows:(2)ωχ=Iα∗eC,αT∗PreDecNodeα=Ysα/yeA0sαQα,g1β−λ/yeg1,g1λsα/y,=eg1,g1βsα/yeA0sαQα,g1β−λ/yeg1,g1λsα/y=eg1,g1βsα/yeg1,g1sαβ−λ/yeg1,g1λsα/y=1.Only when the user’s attributes pass the detection, can the OS obtainωχ=1; otherwise, ωχ is a random value. After receiving ωχ=1, the OS uses tk to calculate CT′, and the calculation equation is as follows:(3)N=eC,0T0∗Pre Dec NoderootW=eA0sQ0′,T01/yPre Dec NoderootW=eg0sQ0sQ0′,g1β0−λ/yeg1,g1λs/y=eg1,g1sβ0−λ/yeg1,g1λs/y=eg1,g1sβ0/y.DAU receives theCT′ sent from the OS and then calculates nk=Ν−y=eg1,g1sβ0 and KFnk,κ=vk‖γ. The smart contract verifies whether semidecrypted ciphertext CT′ is valid. If equation ωHvkνHγ=C^ holds, then the decryption result from the OS is correct. Then, DAU using Ν, C˜ and y recover the plaintext by the following:(4)C˜⋅Νy=mYseg1,g1sβ0=meg1,g1sβ0eg1,g1sβ0=m.


## 5.2. Integrity of Cloud Data

After the DAU obtains the plaintext, he or she calculatesC˜′=vH0m and verifies that C˜′ is equal to the C˜ stored on the blockchain. If C˜′≠C˜, then the tampering of the ciphertext by the cloud server is demonstrated.


## 6. Security Analysis

### 6.1. Confidentiality

Data confidentiality of our scheme relies on the security of the attribute encryption system. This section proves Theorem1 based on the security model in Section 4.2.Theorem 3.
If there is no polynomial-time adversary that can attack the scheme of [30] with a nonnegligible advantage, then no polynomial adversary A can break the scheme of this article with a nonnegligible advantage.Proof.
Based on the proof method in Scheme [30], we prove that the confidentiality of our scheme satisfies security under a chosen-ciphertext attack.
The following simulation game is played between adversaryA and challenger B.Initialization phase:B runs Setup1λ to produce the system public key pk=A0,g3,Ai,j1≤i≤n,1≤j≤ni,Y0,Y,KF,ω,ν,κ,H,H0≠ and the system master private key msk=g1,xi,j1≤i≤n,1≤j≤ni,β0,β. Then, B sends pk to A and generates an initially empty list L and an empty set ℝ.Inquiry phase 1:A can initiate the following two types of inquiries to B.(1)
Private key inquiry:A adaptively asks B for the private key of the attribute set Λ, B runs Key Genpk,msk,Λ and returns skΛ=K0,K,Ki1≤i≤k to A. B calculates Λ∩ℝ and assigns Λ∩ℝ to ℝ.(2)
Transformation key inquiry: receiving the request of token inquiry fromA, B first searches for Λ,skΛ,tkΛ in list L. If Λ,skΛ,tkΛ exists, then B returns tkΛ to A; otherwise, B chooses a random number y∈ZN and calculates tkΛ=Ti∗,T∗,T0∗,Iα∗. Then, B adds Λ and tkΛ to list L and returns list L to A.Challenge phase:A sends equal-length messages M0,M1 and access structure W0,W1 to B. B selects γ∈0,1 and runs Encryptpk,m,W to generate challenge ciphertext CT=C0=A0sQ0′,C1=mYs,Cα∀α. Finally, B sends CT to A.Inquiry phase 2: similar to inquiry phase 1, butA cannot ask for messages M0 and M1.Guess:A outputs the guess γ′∈0,1. If γ′=γ, then the attack is declared successful. Based on the proof of Definition 5 in Scheme [30], it is difficult for A to guess γ′ and γ selected randomly during the ciphertext generation phase. We prove that the confidentiality of our scheme satisfies security under a chosen-ciphertext attack.


### 6.2. Privacy Policy

The DO uploads the ciphertext componentsC0=A0sQ0′, C1=mYs and Cα=C¯α,Iα,Ci,j1≤i≤n,1≤j≤ni to the CS, where Ci,j=Ai,jsαQi,j′ or Ci,j=Ai,jsi,jQi,j′. Note that the attribute information sα is hidden in the ciphertext component Cα. When an attribute value of the accessing user satisfies the value under node α, then the ciphertext component can be obtained by Ci,j=Ai,jsαQi,j′, where sα is the attribute information. When a data user does not meet the access control, the DO uses a random value si,j to replace sα and obtains the ciphertext component Ci,j=Ai,jsi,jQi,j′, even if the data user who does not meet the access control obtains the ciphertext and calculates(5)ωχ=Iα∗eC,αT∗Pre Dec Nodeα=Ysα/yeA0sαQα,g1β−λ/yeAi,jsi,jQi,j′,Ki1/yλ,=eg1,g1βsα/yeg1,g1sαβ−λ/yeg1,g1λsi,j/y.There are random valuessi,j in the above equation; therefore, users who do not satisfy the access control do not obtain the attribute values of node α. Thus, the whole access structure cannot be inferred from the access policy. Therefore, the scheme in this article satisfies policy privacy.


### 6.3. Verifiability

Theorem 4.
For a composite-order bilinear group, if the discrete logarithm problem holds in the system, then the proposed scheme satisfies verifiability.Proof.
If within the PPT time, the verifiability of the system can be attacked by attackerA with a nonnegligible advantage, then algorithm S can be simulated to solve the discrete logarithm problem in a composite-order bilinear group system. The bilinear system N,p1,G0,GT,e^,g1,Δ=g1xI is input into the simulation algorithm S. The algorithm S needs to calculate x=loggΔ. The game process between the simulation algorithm S and attacker A is as follows:Initialization phrase: the simulation algorithmS randomly generates the parameters y∈ZN, picks two anticollision hash functions, H:0,1∗⟶ZN and H0:G0⟶ZN∗, and defines a key distribution function KF. Later, S generates system public parameters pk=A0,g3,Ai,j1≤i≤n,1≤j≤ni,Y0,Y,KF,ω,ν,κ,H,H0 according to the scheme initialization process and sends the public key to attacker A.Challenge phrase: AttackerA sends the attribute set Λ to the simulation algorithm S, performs the key generation process Key Genpk,msk,Λ to generate the private key skΛ=K0,K,Ki1≤i≤k corresponding to the attribute set Λ and sends it to attacker A.Output phrase: AttackerA outputs a tuple CT′,tk,Ck1,Ck2,Δ and an encrypted access structure W that satisfies the attribute set Λ. The simulation algorithm S calculates KFnk1,κ=vk1‖ε1 and KFnk2,κ=vk2‖ε2, where nk1=w1,2Δ and nk2=w2,2Δ. If nk1≠nk2, that is, attacker A wins the game, and the simulation algorithm S calculates(6)g1x⋅Hvk1+y⋅Hε1=ωHvk1νHε1=w1=g1x⋅Hvk2+y⋅Hε2=ωHvk2νHε2.
Because the selected hash functionH has collision resistance, vk1≠vk2 and Hvk1≠Hvk2, the algorithm S is able to compute x=yHε1−Hε2/Hvk1−Hvk2 as a solution to the discrete logarithm problem, which proves that the proposed scheme is verifiable.


### 6.4. Data Integrity

Data integrity is guaranteed by two processes. First, the smart contract is used to realize the decryption correctness of the outsourcing server. Subsequently, the original data hash on the blockchain is saved to verify the data integrity. After receiving the semidecrypted ciphertextCT′=Ν sent by the outsourcing server, the data access user uses the blinding factor y to calculate the session key nk=Ν−y=eg1,g1sβ0 and replaces the key allocation function KFnk,κ=vk‖γ. A smart contract verifies equation ωHvkνHγ=C^ and outputs bool=1 when this equation is established. Then, the data access user continues to decrypt semidecrypted ciphertext. Otherwise, the smart contract outputs bool=0 and ends the decryption.After the DAU performs decryption to obtain plaintextm, C˜′=vH0m is calculated and the validity of C˜′=C˜ is verified. If the equation does not hold, then it cannot be verified by data integrity.


## 6.1. Confidentiality

Data confidentiality of our scheme relies on the security of the attribute encryption system. This section proves Theorem1 based on the security model in Section 4.2.Theorem 3.
If there is no polynomial-time adversary that can attack the scheme of [30] with a nonnegligible advantage, then no polynomial adversary A can break the scheme of this article with a nonnegligible advantage.Proof.
Based on the proof method in Scheme [30], we prove that the confidentiality of our scheme satisfies security under a chosen-ciphertext attack.
The following simulation game is played between adversaryA and challenger B.Initialization phase:B runs Setup1λ to produce the system public key pk=A0,g3,Ai,j1≤i≤n,1≤j≤ni,Y0,Y,KF,ω,ν,κ,H,H0≠ and the system master private key msk=g1,xi,j1≤i≤n,1≤j≤ni,β0,β. Then, B sends pk to A and generates an initially empty list L and an empty set ℝ.Inquiry phase 1:A can initiate the following two types of inquiries to B.(1)
Private key inquiry:A adaptively asks B for the private key of the attribute set Λ, B runs Key Genpk,msk,Λ and returns skΛ=K0,K,Ki1≤i≤k to A. B calculates Λ∩ℝ and assigns Λ∩ℝ to ℝ.(2)
Transformation key inquiry: receiving the request of token inquiry fromA, B first searches for Λ,skΛ,tkΛ in list L. If Λ,skΛ,tkΛ exists, then B returns tkΛ to A; otherwise, B chooses a random number y∈ZN and calculates tkΛ=Ti∗,T∗,T0∗,Iα∗. Then, B adds Λ and tkΛ to list L and returns list L to A.Challenge phase:A sends equal-length messages M0,M1 and access structure W0,W1 to B. B selects γ∈0,1 and runs Encryptpk,m,W to generate challenge ciphertext CT=C0=A0sQ0′,C1=mYs,Cα∀α. Finally, B sends CT to A.Inquiry phase 2: similar to inquiry phase 1, butA cannot ask for messages M0 and M1.Guess:A outputs the guess γ′∈0,1. If γ′=γ, then the attack is declared successful. Based on the proof of Definition 5 in Scheme [30], it is difficult for A to guess γ′ and γ selected randomly during the ciphertext generation phase. We prove that the confidentiality of our scheme satisfies security under a chosen-ciphertext attack.


## 6.2. Privacy Policy

The DO uploads the ciphertext componentsC0=A0sQ0′, C1=mYs and Cα=C¯α,Iα,Ci,j1≤i≤n,1≤j≤ni to the CS, where Ci,j=Ai,jsαQi,j′ or Ci,j=Ai,jsi,jQi,j′. Note that the attribute information sα is hidden in the ciphertext component Cα. When an attribute value of the accessing user satisfies the value under node α, then the ciphertext component can be obtained by Ci,j=Ai,jsαQi,j′, where sα is the attribute information. When a data user does not meet the access control, the DO uses a random value si,j to replace sα and obtains the ciphertext component Ci,j=Ai,jsi,jQi,j′, even if the data user who does not meet the access control obtains the ciphertext and calculates(5)ωχ=Iα∗eC,αT∗Pre Dec Nodeα=Ysα/yeA0sαQα,g1β−λ/yeAi,jsi,jQi,j′,Ki1/yλ,=eg1,g1βsα/yeg1,g1sαβ−λ/yeg1,g1λsi,j/y.There are random valuessi,j in the above equation; therefore, users who do not satisfy the access control do not obtain the attribute values of node α. Thus, the whole access structure cannot be inferred from the access policy. Therefore, the scheme in this article satisfies policy privacy.


## 6.3. Verifiability

Theorem 4.
For a composite-order bilinear group, if the discrete logarithm problem holds in the system, then the proposed scheme satisfies verifiability.Proof.
If within the PPT time, the verifiability of the system can be attacked by attackerA with a nonnegligible advantage, then algorithm S can be simulated to solve the discrete logarithm problem in a composite-order bilinear group system. The bilinear system N,p1,G0,GT,e^,g1,Δ=g1xI is input into the simulation algorithm S. The algorithm S needs to calculate x=loggΔ. The game process between the simulation algorithm S and attacker A is as follows:Initialization phrase: the simulation algorithmS randomly generates the parameters y∈ZN, picks two anticollision hash functions, H:0,1∗⟶ZN and H0:G0⟶ZN∗, and defines a key distribution function KF. Later, S generates system public parameters pk=A0,g3,Ai,j1≤i≤n,1≤j≤ni,Y0,Y,KF,ω,ν,κ,H,H0 according to the scheme initialization process and sends the public key to attacker A.Challenge phrase: AttackerA sends the attribute set Λ to the simulation algorithm S, performs the key generation process Key Genpk,msk,Λ to generate the private key skΛ=K0,K,Ki1≤i≤k corresponding to the attribute set Λ and sends it to attacker A.Output phrase: AttackerA outputs a tuple CT′,tk,Ck1,Ck2,Δ and an encrypted access structure W that satisfies the attribute set Λ. The simulation algorithm S calculates KFnk1,κ=vk1‖ε1 and KFnk2,κ=vk2‖ε2, where nk1=w1,2Δ and nk2=w2,2Δ. If nk1≠nk2, that is, attacker A wins the game, and the simulation algorithm S calculates(6)g1x⋅Hvk1+y⋅Hε1=ωHvk1νHε1=w1=g1x⋅Hvk2+y⋅Hε2=ωHvk2νHε2.
Because the selected hash functionH has collision resistance, vk1≠vk2 and Hvk1≠Hvk2, the algorithm S is able to compute x=yHε1−Hε2/Hvk1−Hvk2 as a solution to the discrete logarithm problem, which proves that the proposed scheme is verifiable.


## 6.4. Data Integrity

Data integrity is guaranteed by two processes. First, the smart contract is used to realize the decryption correctness of the outsourcing server. Subsequently, the original data hash on the blockchain is saved to verify the data integrity. After receiving the semidecrypted ciphertextCT′=Ν sent by the outsourcing server, the data access user uses the blinding factor y to calculate the session key nk=Ν−y=eg1,g1sβ0 and replaces the key allocation function KFnk,κ=vk‖γ. A smart contract verifies equation ωHvkνHγ=C^ and outputs bool=1 when this equation is established. Then, the data access user continues to decrypt semidecrypted ciphertext. Otherwise, the smart contract outputs bool=0 and ends the decryption.After the DAU performs decryption to obtain plaintextm, C˜′=vH0m is calculated and the validity of C˜′=C˜ is verified. If the equation does not hold, then it cannot be verified by data integrity.


## 7. Performance Analysis

### 7.1. Property Analysis

In this section, the functionality of our system is compared with schemes in [29, 30, 34, 36], and the comparison outcomes are shown in Table 1. We can note from Table 1 that our scheme is the only one that meets the requirements of policy hiding, verifiable outsourcing, and data integrity under CCA. Schemes in [29, 34, 36] use outsourcing for decryption operations, but their decryption operations are not very efficient. Moreover, the scheme in [36] does not support the validation of outsourcing decryption results. In addition, schemes in [29, 30, 36] achieve data integrity verification by relying on a trusted cloud server. As a result, the proposed new scheme is able to provide both higher security and fuller functionality than existing similar schemes.Table 1
Functional comparison.
SystemAccess structureHidden policyPredetected decryptionVerifiable outsourcingIntegrityConfidentialityBlockchain technology[36]LSSS√×××CPA×[30]Access tree√√√×CPA×[34]LSSS√×√√—√[29]LSSS√×√×CPA×OursAccess tree√√√√CCA√


### 7.2. Performance Evaluation

We compare our scheme with Systems [30, 34, 36], which also use bilinear groups of composite order. The computational cost of these schemes is analysed through three stages: encryption, decryption, and outsourcing decryption, and the comparison results are shown in Table 2. Our scheme mainly considers pair operations and exponential operations in groups G and GT. We use G and GT to denote the time to perform an exponential operation on the corresponding group and Tp to denote the time to perform a logarithmic operation. Furthermore, the number of authorized attributes in the system is denoted by nω, the number of leaf node parents by na, the number of attributes in the key by nk, and the number of user attributes by nl.Table 2
Computational overhead comparison.
SystemEncryptionOutsourcing decryptionUser decryption (s)DecryptionPredetected[30]1+na+nanG+1+nGTnn+nTp+GTTp+GT2GT=0.42[34]Tp+3+3nlG+GT2+nlTp+1+2nlG0[36]nlTp+4+3nlG+GTnkTp+nk+1GG = 0.72Oursna+nanG+nGTnn+nTp+GTTp+GTGT = 0.21To evaluate the specific computational performance of our scheme, we conducted experiments. Our experimental environment is an Intel(R) Core (TM) i5-8250U CPU 1.80 GHz processor with 8 GB memory and the Win10 operating system (Pairing-Based Cryptography, PBC) library in the VC6.0 environment. Through the above environment, the new scheme was simulated and compared with schemes in [30, 36], and the experimental data were averaged over 20 runs. In the composite-order bilinear group, the times of G, GT, and Tp are 0.21 s, 0.72 ms, and 1.64 s, respectively. Our scheme and Zhao et al. proposed a scheme in [30] that adopts a special access number structure, and the encryption time is related to the number of parent nodes of leaf nodes na. As a result, to better reflect the two systems’ performance, we set na=1. In addition, we suppose the user has 5 attributes. The number of attributes connected with ciphertext is half the number of systems, and the system contains between 5 and 50 attributes.In Table2, we compare these schemes in terms of computational overhead, mainly considering the cost of encryption, outsourcing decryption, and user decryption. For encryption, our scheme improves the efficiency of the ciphertext generation stage. Unlike the scheme in [30], the new scheme uses blockchain technology and minimizes the number of ciphertext components that must be uploaded to the cloud server. Consequently, two exponential operations originally performed by the data owner in the encryption process are reduced. Additionally, in the correctness verification process, the new scheme leaves the verification of the outsourcing results to be performed by smart contracts, reducing the verification overhead for local users. In the decryption phase, all four experiments presented in Table 2 use an outsourced server for predecryption so the decryption overhead for the user is kept at a constant level. The calculation times of the three schemes are G, 2 G, and GT. Compared with the scheme in [34] without local overhead, and although the new scheme has some decryption overhead, its security is better than the scheme in [34]. On the one hand, when the scheme in [34] uses smart contracts to verify the results of outsourcing, it needs to know the blinding factor that is private for the user. On the other hand, the smart contract decrypts and obtains the plaintext instead of the user, which makes the plaintext information available to the smart contract and increases the risk of data leakage.Figure3 shows the time taken to perform the operation of the data owner and user side. We experiment with different attribute values and show the encryption time changes of the new scheme, the scheme in [30], and the scheme in [34], in Figure 3(a). The computational overhead of the new scheme and the scheme in [30] is smaller than that of the scheme in [34], as shown in Figure 3(a), and the advantage grows as the number of characteristics grows. Due to the additional pair operations and exponential operations in group G that must be computed while hiding the access control policy, the scheme in [34] takes longer. Moreover, based on the scheme in [30], our scheme introduces blockchain technology to encrypt the ciphertext components that need to be encrypted with a data owner in advance in their scheme. This design reduces the encryption time of two exponential operations in the ciphertext generation process.Figure 3
Time cost of encryption and decryption with different numbers of attributes. (a) Encryption time of data owner. (b) Decryption time of the user side.
(a)(b)From Figure3(b), we can clearly see that the attributes are irrelevant to the time taken for the three schemes to perform decryption (user side) operations, but the time expenditure advantage of our scheme is always higher than those of Schemes [30, 36].


## 7.1. Property Analysis

In this section, the functionality of our system is compared with schemes in [29, 30, 34, 36], and the comparison outcomes are shown in Table 1. We can note from Table 1 that our scheme is the only one that meets the requirements of policy hiding, verifiable outsourcing, and data integrity under CCA. Schemes in [29, 34, 36] use outsourcing for decryption operations, but their decryption operations are not very efficient. Moreover, the scheme in [36] does not support the validation of outsourcing decryption results. In addition, schemes in [29, 30, 36] achieve data integrity verification by relying on a trusted cloud server. As a result, the proposed new scheme is able to provide both higher security and fuller functionality than existing similar schemes.Table 1
Functional comparison.
SystemAccess structureHidden policyPredetected decryptionVerifiable outsourcingIntegrityConfidentialityBlockchain technology[36]LSSS√×××CPA×[30]Access tree√√√×CPA×[34]LSSS√×√√—√[29]LSSS√×√×CPA×OursAccess tree√√√√CCA√


## 7.2. Performance Evaluation

We compare our scheme with Systems [30, 34, 36], which also use bilinear groups of composite order. The computational cost of these schemes is analysed through three stages: encryption, decryption, and outsourcing decryption, and the comparison results are shown in Table 2. Our scheme mainly considers pair operations and exponential operations in groups G and GT. We use G and GT to denote the time to perform an exponential operation on the corresponding group and Tp to denote the time to perform a logarithmic operation. Furthermore, the number of authorized attributes in the system is denoted by nω, the number of leaf node parents by na, the number of attributes in the key by nk, and the number of user attributes by nl.Table 2
Computational overhead comparison.
SystemEncryptionOutsourcing decryptionUser decryption (s)DecryptionPredetected[30]1+na+nanG+1+nGTnn+nTp+GTTp+GT2GT=0.42[34]Tp+3+3nlG+GT2+nlTp+1+2nlG0[36]nlTp+4+3nlG+GTnkTp+nk+1GG = 0.72Oursna+nanG+nGTnn+nTp+GTTp+GTGT = 0.21To evaluate the specific computational performance of our scheme, we conducted experiments. Our experimental environment is an Intel(R) Core (TM) i5-8250U CPU 1.80 GHz processor with 8 GB memory and the Win10 operating system (Pairing-Based Cryptography, PBC) library in the VC6.0 environment. Through the above environment, the new scheme was simulated and compared with schemes in [30, 36], and the experimental data were averaged over 20 runs. In the composite-order bilinear group, the times of G, GT, and Tp are 0.21 s, 0.72 ms, and 1.64 s, respectively. Our scheme and Zhao et al. proposed a scheme in [30] that adopts a special access number structure, and the encryption time is related to the number of parent nodes of leaf nodes na. As a result, to better reflect the two systems’ performance, we set na=1. In addition, we suppose the user has 5 attributes. The number of attributes connected with ciphertext is half the number of systems, and the system contains between 5 and 50 attributes.In Table2, we compare these schemes in terms of computational overhead, mainly considering the cost of encryption, outsourcing decryption, and user decryption. For encryption, our scheme improves the efficiency of the ciphertext generation stage. Unlike the scheme in [30], the new scheme uses blockchain technology and minimizes the number of ciphertext components that must be uploaded to the cloud server. Consequently, two exponential operations originally performed by the data owner in the encryption process are reduced. Additionally, in the correctness verification process, the new scheme leaves the verification of the outsourcing results to be performed by smart contracts, reducing the verification overhead for local users. In the decryption phase, all four experiments presented in Table 2 use an outsourced server for predecryption so the decryption overhead for the user is kept at a constant level. The calculation times of the three schemes are G, 2 G, and GT. Compared with the scheme in [34] without local overhead, and although the new scheme has some decryption overhead, its security is better than the scheme in [34]. On the one hand, when the scheme in [34] uses smart contracts to verify the results of outsourcing, it needs to know the blinding factor that is private for the user. On the other hand, the smart contract decrypts and obtains the plaintext instead of the user, which makes the plaintext information available to the smart contract and increases the risk of data leakage.Figure3 shows the time taken to perform the operation of the data owner and user side. We experiment with different attribute values and show the encryption time changes of the new scheme, the scheme in [30], and the scheme in [34], in Figure 3(a). The computational overhead of the new scheme and the scheme in [30] is smaller than that of the scheme in [34], as shown in Figure 3(a), and the advantage grows as the number of characteristics grows. Due to the additional pair operations and exponential operations in group G that must be computed while hiding the access control policy, the scheme in [34] takes longer. Moreover, based on the scheme in [30], our scheme introduces blockchain technology to encrypt the ciphertext components that need to be encrypted with a data owner in advance in their scheme. This design reduces the encryption time of two exponential operations in the ciphertext generation process.Figure 3
Time cost of encryption and decryption with different numbers of attributes. (a) Encryption time of data owner. (b) Decryption time of the user side.
(a)(b)From Figure3(b), we can clearly see that the attributes are irrelevant to the time taken for the three schemes to perform decryption (user side) operations, but the time expenditure advantage of our scheme is always higher than those of Schemes [30, 36].


## 8. Conclusion

We propose a verifiable access control model for outsourced cloud storage that supports policy hiding as well as secure and efficient decryption. Our system is based on the CP-ABE, avoiding privacy leakage by hiding access policies. The idea of outsourcing and a more efficient decryption algorithm reduce the computational cost of local users and outsourcing decryption servers in the decryption process, respectively. To validate the integrity of outsourced decryption results, we use smart contracts implemented on the blockchain, which implements a decentralized ciphertext result verification approach. At the same time, through the hash of the original data retained on the blockchain platform, the integrity of the decrypted data is verified, which solves the dependence of the traditional scheme on fully trusted cloud servers. The analysis results show that the new scheme not only improves computing performance and meets CCA security but also verifies data integrity in the cloud storage environment. In future work, we will attempt to improve the cloud storage data access control scheme for multiauthorization centres.



---

*Source: 2204832-2022-05-11.xml*